Policy-gated package registry

A registry you can vouch for.

Haven enforces your supply-chain policy at the registry, so a bad version is stopped before any build can reach it. It gates both which upstream versions your builds consume and what you publish. Registries can be private for proprietary code or public for an open source community.

Rust crates and static files today, behind the same gate, the same tokens, and the same audit log. More formats coming.

Start freePricing

Hosted in the European Union. Self-serve, with private or public registries. Setting up your first gated publish takes about five minutes.

# .cargo/config.toml
[registries.acme]
index = "sparse+https://haven.rs/r/acme/index/"

$ cargo publish --registry acme
    Packaging acme-billing v1.4.0
   Uploading acme-billing v1.4.0
    Uploaded acme-billing v1.4.0 to registry `acme`
warning: held from the index: SBOM required but not attached
warning: held from the index: requires 2 attestations from distinct identities, has 0

For what you depend on and what you publish

You depend

What you depend on

A mirror registry puts crates.io behind the same gate. New upstream versions are held until they pass your policy. Mirror the full catalog or only an allowlist imported from your Cargo.lock.

  • Cooldown on fresh releases, expiring on a schedule you set
  • RUSTSEC advisories hold versions at the severity levels you choose
  • License allowlist, and a hold when an unfamiliar publisher appears upstream
  • One policy for every repo in your org, with no per-repo bot config
# .cargo/config.toml
[registries.acme-mirror]
index = "sparse+https://haven.rs/r/acme-mirror/index/"

[source.crates-io]
replace-with = "acme-mirror"

You publish

What you publish

Your registry is the gate your own releases have to clear. A publish is accepted and then held until it's promoted, so consumers only resolve versions that passed your policy.

  • Promotion thresholds: m keyless CI attestations from distinct identities, owner approvals
  • An SBOM on the version and clean VCS provenance before it promotes
  • Per-client read grants with semver ranges, enforced in the index
  • Static files clear the same gate: resolved by semver, downloaded a file at a time or as one premade archive
# Rust crates: .cargo/config.toml
[registries.acme]
index = "sparse+https://haven.rs/r/acme/index/"

What the registry does beyond hosting

  • Trusted publishing from CI

    Your pipeline exchanges its OIDC identity for a publish token that lives 30 minutes, so there is no long-lived secret to steal. Each release carries auditable attestations, and promotion can require m distinct ones.

  • Your own facts, the same engine

    Declare facts the built-in rules cannot see: coverage, unsafe counts, an internal scanner verdict. Record them from CI, or bind an extractor and Haven reads the value out of the tarball itself. Rules over your facts hold a version exactly like the built-in ones do.

  • SBOMs on every version

    CycloneDX SBOMs, uploaded or generated, served next to the version. License reports roll up per dependency tree.

  • Docs built and hosted

    Publishing is enough: rustdoc builds in a sandbox and serves from a hostname of its own, under the same read rules as the crate. Private crates get the docs.rs experience without leaving your registry.

  • Coordinated disclosure built in

    A CVD channel with timestamped, audit-logged reports, so the 24h/72h/14d reporting cadence has somewhere to run. An advisory raised on a published version holds it for every consumer, and no approval waives it.

  • Tamper-evident audit log

    Every mutation lands in a hash-chained event log, verified on every read. An out-of-band edit shows up as an alert.

Three steps to a gated registry

  1. 1

    Create your org and registries

    Sign in, name your org, claim registries: one for what you publish, one mirroring crates.io, one for static files if you ship more than crates. Each is a policy boundary.

  2. 2

    Point your tools at them

    One .cargo/config.toml snippet and a minted token for crates, or a plain curl upload for static files. A single source replacement swaps crates.io for your mirror. Nothing else changes for your team.

  3. 3

    Depend and publish through the gate

    Every new upstream version and every publish is policy-checked, held during its cooldown, and promoted once it meets your policy.

Pricing

  • Free

    €0

    Three public registries and one private, with unlimited packages and members and the predefined policy gates.

    Start free

  • Team

    €49/mo

    Unlimited registries, 250 GB of storage, 1 TB of monthly transfer. Everything your org publishes and pulls goes through the gate.

    Start free

  • Compliance

    €199/mo

    Custom policies on the full engine, attestations, audit log export, and coordinated disclosure. Priced for your CRA obligation rather than your storage.

    Get started

  • Enterprise

    Custom

    SCIM, physical isolation, self-hosted or on-premise, air-gap distribution, SLA.

    Talk to us

Every tier includes rustdoc builds, crate site hosting, SBOMs, OIDC SSO, and quarantine. Annual billing gets two months free. See the full plan comparison.
Running a large open source project? Talk to us.

No registry can make attacks impossible. Build-time checks don't catch malice that only triggers at runtime, and a patient attacker can still defeat provenance over time. What Haven does is make attacks more expensive and easier to trace, and the docs are explicit about where that limit sits.