How to separate crates index from files

help
1

I'm using Kellnr proxy-cache server, that hosted on the remote machine in the local (Yggdrasil) network:

#~/.cargo/config.toml
[registries.kellnr]
index = "sparse+http://[202:68d0:f0d5:b88d:1d1a:555e:2f6b:3148]:8180/api/v1/cratesio/"

[source.crates-io]
replace-with = "kellnr"

[http]
timeout = 180

My problem in that I don't trust to provider to validate hash-sums from it, but ready to download the dependencies by using my self-hosted index version.

Is this possible? I know about the --locked option but this file is not always provided in source repos. Just security goals, to not download malformed packages when I'm using unofficial storage.

1 Like
2

The registry contains a config.json file whose dl field points to where files are downloaded. I guess you could use a local clone of GitHub - rust-lang/crates.io-index: Registry index for crates.io with the config.json file pointing to the remote proxy-cache server as registry. Just be aware that this repo gets squashed every once in a while to keep the repo size under control.