Comment 6 for bug 1434545

As Grant mentions, I can confirm that the packages exist as a field in the datastore_versions table, and this can be set only by the Trove Administrator when he is registering a new datastore version with trove (using the trove-manage utility). This is not a user facing field, and cannot be set through an API. Given this mitigation, I agree with opening the report up, and fixing this as part of security hardening. At this point it's likely that this will be tackled sometime during the Liberty time frame in Trove.