Policy-gated package registry

A registry you can vouch for.

Haven enforces supply-chain policies at the registry, new versions aren't even available for a build until they pass your rules. The policies can also be applied to your package publishes with verifiable guarantees for your dependents. Registries can be private with precise access control or public.

Rust crates and static files today, with shared features for policies, access control and audit. npm, Python and more coming.

Start freePricing

Hosted in the European Union. Self-serve, with private or public registries. Setting up your first gated publish or mirror takes about five minutes.

# .cargo/config.toml
[registries.acme]
index = "sparse+https://haven.rs/r/acme/index/"

$ cargo publish --registry acme
    Packaging acme-billing v1.4.0
   Uploading acme-billing v1.4.0
    Uploaded acme-billing v1.4.0 to registry `acme`
warning: held from the index: SBOM required but not attached
warning: held from the index: requires 2 attestations from distinct identities, has 0

For your dependencies and your releases

You depend

What you depend on

A mirror registry puts upstream (crates.io, ...) behind your policy gate. New versions are held until they pass. Mirror everything or only an allowlist imported from your lockfile.

  • Cooldown on fresh releases, quarantine on your policy
  • Advisories hold versions at the severity alert levels you choose
  • License allowlist, and a hold on unexpected package metadata changes
  • One policy for your org instead of configuring a dependency management bot on each repo
# .cargo/config.toml
[registries.acme-mirror]
index = "sparse+https://haven.rs/r/acme-mirror/index/"

[source.crates-io]
replace-with = "acme-mirror"

You publish

What you publish

Your registry stops being publish-and-wait for client feedback. Give them guarantees and control who sees what.

  • Multiple attestations from distinct identities and owner approvals make sure a publish is intended
  • An SBOM and clean VCS provenance are required before it promotes and give guarantees to your clients
  • Per-client read grants with version-aware ranges, enforced in the index
  • Don't be the one pushing an attack: a publish not matching your usual methods is rejected
# Rust crates: .cargo/config.toml
[registries.acme]
index = "sparse+https://haven.rs/r/acme/index/"

What the registry does beyond hosting

  • Trusted publishing from CI

    Your pipeline exchanges its OIDC identity for a temporary publish token, no long-lived secret to steal. The registry can reject publishes from a manual token. Each release carries auditable attestations, and promotion can require m distinct ones.

  • Common facts or your own

    Haven extracts facts from the package, or you declare facts the built-in rules cannot see: an internal scanner verdict, your code review result, ... Record them from your CI, and define rules over any fact to hold a version until it passes.

  • SBOMs on every version

    CycloneDX SBOMs, uploaded or generated, served next to the version. License reports roll up per dependency tree.

  • Docs built and hosted

    You publish, Haven builds and hosts the documentation, even for private registries, behind the same access control as the package.

  • Coordinated disclosure built in

    A CVD channel with timestamped, audit-logged reports, with the 24h/72h/14d reporting cadence running. An advisory raised on a published version holds it for every consumer, and no approval waives it.

  • Tamper-evident audit log

    Every mutation lands in a hash-chained event log, verified on every read. An out-of-band edit shows up as an alert.

Three steps to a gated registry

  1. 1

    Create your org and registries

    Sign in, name your org, create your registries: one for what you publish, one mirroring your dependencies, one to hold your artifacts. Each for a purpose, each with a policy boundary.

  2. 2

    Point your tools at them

    One .cargo/config.toml snippet and a minted token for Rust crates, or a plain curl upload for static files.

  3. 3

    Depend and publish through the gate

    Every new upstream version and every publish is policy-checked, held during its cooldown, and promoted once it passes.

Pricing

  • Free

    €0

    Three public registries and one private, with unlimited packages and members and the predefined policy gates.

    Start free

  • Team

    €49/mo

    Unlimited registries, 250 GB of storage, 1 TB of monthly transfer. Everything your org publishes and pulls goes through the gate.

    Start free

  • Compliance

    €199/mo

    Custom policies on the full engine, attestations, audit log export, and coordinated disclosure. Priced for your CRA obligation rather than your storage.

    Get started

  • Enterprise

    Custom

    SCIM, physical isolation, self-hosted or on-premise, air-gap distribution, SLA.

    Talk to us

Every tier includes docs builds, package site hosting, SBOMs, OIDC SSO, cooldown, and quarantine. Annual billing gets two months free. See the full plan comparison.
Running a large open source project? Talk to us.

Haven makes attacks harder and registry actions auditable, but nothing will make an attack impossible. Patience can defeat trust, and detection is a cat and mouse game. Haven gives you a place to put your policies, and the time to run your controls.