Troubleshooting

cargo publish “timed out waiting for the crate to appear”

This should not happen anymore, held or not: the publishing token keeps seeing its own publish for a short window, so cargo’s post-publish index poll succeeds even when the policy holds the new version. If you do see the timeout, the usual cause is polling with a different token than the one that published (or resuming the poll more than half an hour later). Either way, the publish succeeded if Haven’s warnings said “held”: the version is stored and sits in the Held tab; the crate page shows which rules hold it and what clears them. Nothing needs to be re-published.

A version is held and can never pass

Some holds are frozen into the tarball, most notably vcs (a dirty or missing VCS state at package time). Version numbers are immutable, so you cannot re-publish the same version cleanly. Either have owners waive the rule for that version through promotion approvals, or publish the next version with the issue fixed.

cargo owners does not work

Correct: Haven does not implement per-crate owner lists. Access is namespace-level (owners) plus per-crate grants.

401 or 403 from cargo

• Reads always need a token, even for public namespaces (a personal public-read token covers those).
• Check the credential is attached to the right registry name: cargo login --registry <name>, or the CARGO_REGISTRIES_<NAME>_TOKEN environment variable with the registry name uppercased and dashes as underscores.
• Namespace read tokens expire after a year; mint a fresh one.
• If you are reading another organization’s private crate, entitlement comes from a grant; the token alone is not enough.

A dependency version exists upstream but not in the mirror

In order of likelihood:

• The namespace policy holds it (quarantine still running, advisory at a blocking level, unvouched new publisher). See the Held tab.
• The mirror is in subset mode and the crate is not on the allowlist.
• The catalog listing lags the upstream: check the dump’s “as of” time on the namespace page and refresh if needed. Resolution through cargo does not depend on the dump, so this affects browsing more than building.

Search or theme toggle does nothing in hosted rustdoc

Expected: hosted rustdoc is served with script execution blocked for security. See Rustdoc hosting.

I lost a token

Tokens are shown once and stored hashed; nobody can recover the value. Revoke the lost token and mint a new one. Both actions are audited.