Check that repo & package privacy match