Hi, this seems like a duplicate of #57260, which timed out due to lack of information. Can you provide evidence that you are the owner of the package? (e.g. by temporarily recreating the package with a message that references this issue?) Thanks.

Hello, yes this is my boss at 2LINFO.
Unfortunately, we can't put it online due to the fact that this is a private package intern to Adrien's company.
If you still have access to the git repository (cached on pkg.go.dev for example), you can see that almost all commits are signed with my GPG key C7D19B2BA2890526 (the subkeys are 4137B6C1D91817FC and 4FF8DF9CBCECFE97).
This package has been added to pkg.go.dev because during a software release, we temporarily open this repository to the public to debug an issue that we encored with doing a go get on our production server. At the time we didn't know that this repository will be cached on pkg.go.dev and as Adrien says in the issue #57260 the repo does not mean to be public.
Whatever happens, the link to the repo will always lead to a 404 error because it won't be publicly available and we won't open our Git server to the internet for confidentiality reason.
Thanks

Though I can confirm that https://api.github.com/users/dragonis41/gpg_keys contains those GPG keys, unfortunately (or perhaps fortunately) I don't have access to the git history of the delete repo. (The Go module proxy stores only versioned .zip files.)

But in this case I will assume good faith and activate the process to block this module in pkgsite.

Thank you Alan, I appreciate !

We will do everything we can to ensure that this does not happen again in the future.

Looks like this is done, as https://pkg.go.dev/cloud.2linfo.fr/gitea/2linfo/golibarr is serving a 404.

Marking as closed. Please let me know if I missed something.