Generic Package download should not require authentication on public projects

My users can't download the generic packages that I uploaded because the URLs that I can deterministically construct from

/projects/some_id/packages/generic/mypackage/myversion/my-file-name.tar

requires authentication at all times! This is really inconvenient. Users can still use the generated link that looks like

/group/project/-/package_files/some_package_id/download

but I can't really anticipate some_package_id when uploading the generic package. Even worse, uploading a generic package only returns a 201 without any useful body!