How to transfer crates to a private registry

help
1

So I'm operating in an airgapped environment. To still have access to crates I set up a private registry (kellnr in this case)
Now i want to download crates on a non airgapped system, bring them through the airgap and upload them to kellnr. how can I achieve this without downloading each dependency manually?

I tried downloading with cargo collect but i get this

❯ cargo collect --crate-name actix-web -o test
2024-11-14T07:49:53.196906Z  INFO cargo_collect: Collect dependencies recursively...
Error: Crate not found
2

I don't know anything about private registries, but I would look at cargo vendor.

3

Thats an idea I had too but how do i upload the vendored crates to the registry without uploading every single one manually

4

Private registry is a wrong tool for this job. It will cause you an endless misery, because crates can't be simply copied, they need to be republished with their metadata rewritten for the registry URL, and will always be considered as different crates that are incompatible with crates.io.

For airgapped environments Cargo has support for crates.io mirrors, which it calls source replacement.

https://doc.rust-lang.org/cargo/reference/source-replacement.html

2 Likes
5

I'm sorry I should have been more clear. I'm already doing exactly that with kellnr
But let's assume I sit behind a firewall that doesn't allow kellnr to proxy crates.io. (I don't know yet if that's the case, the security team still has to take a look at it) is there ANY way to download crates on one machine and on another machine upload them to kellnr or another mirror without doing it one by one

6

Source replacement is not only for proxies. Cargo supports air-gapped builds and even has two source replacement formats for it: a local directory with a registry copy with a full index, downloaded with cargo-local-registry, or local directory with project specific copy, downloaded using cargo vendor— see the docs.

1 Like
7

But those are local to the current machine, right? The idea is to have one repository for source replacement that all machines can access

8

I did not expect airgapped machines to be networked. For this you can use source replacement with a URL and mirror/serve crates using this mirroring tool:

9

They're airgapped inside the company network. I can reach other machines in the network but I can't reach the internet/crates.io