Policy-gated Cargo registry

A registry you can vouch for.

Crate Haven enforces your supply-chain policy at the registry, so a bad version is stopped before any build can reach it. It gates both what you publish and which upstream versions your builds consume. Namespaces can be private for proprietary code or public for an open source community.

Start freePricing

Self-serve and hosted in the EU, with private or public namespaces. Setting up your first gated publish takes about five minutes.

# .cargo/config.toml
[registries.acme]
index = "sparse+https://haven.rs/ns/acme/index/"

$ cargo publish --registry acme
    Packaging acme-billing v1.4.0
   Uploading acme-billing v1.4.0
    Uploaded acme-billing v1.4.0 to registry `acme`
warning: held from the index: SBOM required but not attached
warning: held from the index: requires 2 attestations from distinct identities, has 0

For what you publish and what you depend on

You publish

Crates you publish

Your namespace is the gate your own releases have to clear. A publish is accepted and then held until it's promoted, so consumers only resolve versions that passed your policy.

  • Promotion thresholds: m keyless CI attestations from distinct identities, owner approvals
  • An SBOM on the version and clean VCS provenance before it promotes
  • Per-client read grants with semver ranges, enforced in the index
# .cargo/config.toml
[registries.acme]
index = "sparse+https://haven.rs/ns/acme/index/"

You depend

Crates you depend on

A mirror namespace puts crates.io behind the same gate. New upstream versions are held until they pass your policy. Mirror the full catalog or only an allowlist imported from your Cargo.lock.

  • Cooldown on fresh releases, expiring on a schedule you set
  • RUSTSEC advisories hold versions at the severity levels you choose
  • License allowlist, and a hold when an unfamiliar publisher appears upstream
# .cargo/config.toml
[registries.acme-mirror]
index = "sparse+https://haven.rs/ns/acme-mirror/index/"

[source.crates-io]
replace-with = "acme-mirror"

What the gate enforces

  • Enforcement at the registry

    Policy gates run the moment a crate is published. A version that fails your rules is held before any consumer can build against it.

  • Namespaces and grants

    Each namespace is private or public, and crates live under acme::name. Per-client read grants with semver ranges decide exactly who resolves what, enforced in the index itself.

  • Your dependencies, through the same gate

    Mirror crates.io through Haven and new upstream versions are held until they pass your rules: advisories, cooldown, license or maintainer changes. Full catalog or a vetted allowlist, one policy for every repo, no per-repo bot config.

  • Keyless CI attestations

    CI publishes with its OIDC identity, so there are no long-lived keys to steal. Beyond trusted publishing, each release carries auditable attestations, and promotion can require m distinct ones.

  • SBOMs on every version

    CycloneDX SBOMs, uploaded or generated, served next to the crate. License reports roll up per dependency tree.

  • Coordinated disclosure built in

    A CVD channel with timestamped, audit-logged reports, so the 24h/72h/14d reporting cadence has somewhere to run.

  • Tamper-evident audit log

    Every mutation lands in a hash-chained event log, verified on every read. An out-of-band edit shows up as an alert.

Three steps to a gated registry

  1. 1

    Create your org and namespaces

    Sign in, name your org, claim namespaces: one to publish into, one mirroring crates.io. Each is a policy boundary.

  2. 2

    Point cargo at them

    One .cargo/config.toml snippet and a minted token. A single source replacement swaps crates.io for your mirror. Nothing else changes for your team.

  3. 3

    Publish and depend through the gate

    Every publish and every new upstream version is policy-checked, held during its cooldown, and promoted once it meets your policy.

Pricing

  • Free

    €0

    Three public namespaces and one private, with unlimited crates and members and the predefined policy gates.

    Start free

  • Team

    €49/mo

    Unlimited namespaces, 250 GB of storage, 1 TB of monthly transfer. Everything your org publishes and pulls goes through the gate.

    Start free

  • Compliance

    €199/mo

    Custom policies on the full engine, attestations, audit log export, and coordinated disclosure. Priced for your CRA obligation rather than your storage.

    Talk to us

  • Enterprise

    Custom

    SCIM, physical isolation, self-hosted or on-premise, air-gap distribution, SLA.

    Talk to us

Every tier includes rustdoc builds, crate site hosting, SBOMs, OIDC SSO, and quarantine. Annual billing gets two months free. Running a large open source project? Talk to us. See the full plan comparison.

No registry can make attacks impossible. Build-time checks don't catch malice that only triggers at runtime, and a patient attacker can still defeat provenance over time. What Haven does is make attacks more expensive and easier to trace, and the docs are explicit about where that limit sits.