Troubleshooting

cargo publish “timed out waiting for the crate to appear”

This should not happen anymore, held or not: the publishing token keeps seeing its own publish for a short window, so cargo’s post-publish index poll succeeds even when the policy holds the new version. If you do see the timeout, the usual cause is polling with a different token than the one that published (or resuming the poll more than half an hour later). Either way, the publish succeeded if Haven’s warnings said “held”: the version is stored and sits in the Held tab; the crate page shows which rules hold it and what clears them. Nothing needs to be re-published.

A version is held and can never pass

Some holds are frozen into the tarball, most notably vcs (a dirty or missing VCS state at package time). Version numbers are immutable, so you cannot re-publish the same version cleanly. Either have owners waive the rule for that version through promotion approvals, or publish the next version with the issue fixed.

cargo owners does not work

Correct: the cargo owner command is not supported. Haven does have per-crate owner lists — package owners — but they are managed through the Haven API and UI (the package’s Settings tab), alongside registry-level owners and per-crate grants.

401 or 403 from cargo

• Reads always need a token, even for public registries (a personal public-read token covers those).
• Check the credential is attached to the right registry name: cargo login --registry <name>, or the CARGO_REGISTRIES_<NAME>_TOKEN environment variable with the registry name uppercased and dashes as underscores.
• Registry read tokens expire after a year; mint a fresh one.
• If you are reading another organization’s private crate, entitlement comes from a grant; the token alone is not enough.

A dependency version exists upstream but not in the mirror

In order of likelihood:

• The registry policy holds it (quarantine still running, advisory at a blocking level, unvouched new publisher). See the Held tab.
• The mirror is in subset mode and the crate is not on the allowlist.
• The catalog listing lags the upstream: check the dump’s “as of” time on the registry page and refresh if needed. Resolution through cargo does not depend on the dump, so this affects browsing more than building.

Search or theme toggle does nothing in hosted rustdoc

Expected: hosted rustdoc is served with script execution blocked for security. See Rustdoc hosting.

I lost a token

Tokens are shown once and stored hashed; nobody can recover the value. Revoke the lost token and mint a new one. Both actions are audited.