Policy-gated Cargo registry

A registry you can vouch for.

Crate Haven enforces your supply-chain policy at the registry, so a bad version is stopped before any build can reach it. It gates both which upstream versions your builds consume and what you publish. Registries can be private for proprietary code or public for an open source community.

Start freePricing

Self-serve and hosted in the EU, with private or public registries. Setting up your first gated publish takes about five minutes.

# .cargo/config.toml
[registries.acme]
index = "sparse+https://haven.rs/r/acme/index/"

$ cargo publish --registry acme
    Packaging acme-billing v1.4.0
   Uploading acme-billing v1.4.0
    Uploaded acme-billing v1.4.0 to registry `acme`
warning: held from the index: SBOM required but not attached
warning: held from the index: requires 2 attestations from distinct identities, has 0

For what you depend on and what you publish

You depend

Crates you depend on

A mirror registry puts crates.io behind the same gate. New upstream versions are held until they pass your policy. Mirror the full catalog or only an allowlist imported from your Cargo.lock.

  • Cooldown on fresh releases, expiring on a schedule you set
  • RUSTSEC advisories hold versions at the severity levels you choose
  • License allowlist, and a hold when an unfamiliar publisher appears upstream
# .cargo/config.toml
[registries.acme-mirror]
index = "sparse+https://haven.rs/r/acme-mirror/index/"

[source.crates-io]
replace-with = "acme-mirror"

You publish

Crates you publish

Your registry is the gate your own releases have to clear. A publish is accepted and then held until it's promoted, so consumers only resolve versions that passed your policy.

  • Promotion thresholds: m keyless CI attestations from distinct identities, owner approvals
  • An SBOM on the version and clean VCS provenance before it promotes
  • Per-client read grants with semver ranges, enforced in the index
# .cargo/config.toml
[registries.acme]
index = "sparse+https://haven.rs/r/acme/index/"

What the gate enforces

  • Enforcement at the registry

    Policy gates run the moment a crate is published. A version that fails your rules is held before any consumer can build against it.

  • Your dependencies, through the same gate

    Mirror crates.io through Haven and new upstream versions are held until they pass your rules: advisories, cooldown, license or maintainer changes. Full catalog or a vetted allowlist, one policy for every repo, no per-repo bot config.

  • Registries and grants

    Each registry is private or public, and crates live under acme/name. Per-client read grants with semver ranges decide exactly who resolves what, enforced in the index itself.

  • Trusted publishing from CI

    Your pipeline exchanges its OIDC identity for a publish token that lives 30 minutes, so there is no long-lived secret to steal. Each release carries auditable attestations, and promotion can require m distinct ones.

  • SBOMs on every version

    CycloneDX SBOMs, uploaded or generated, served next to the crate. License reports roll up per dependency tree.

  • Coordinated disclosure built in

    A CVD channel with timestamped, audit-logged reports, so the 24h/72h/14d reporting cadence has somewhere to run.

  • Tamper-evident audit log

    Every mutation lands in a hash-chained event log, verified on every read. An out-of-band edit shows up as an alert.

Three steps to a gated registry

  1. 1

    Create your org and registries

    Sign in, name your org, claim registries: one mirroring crates.io, one to publish into. Each is a policy boundary.

  2. 2

    Point cargo at them

    One .cargo/config.toml snippet and a minted token. A single source replacement swaps crates.io for your mirror. Nothing else changes for your team.

  3. 3

    Depend and publish through the gate

    Every new upstream version and every publish is policy-checked, held during its cooldown, and promoted once it meets your policy.

Pricing

  • Free

    €0

    Three public registries and one private, with unlimited crates and members and the predefined policy gates.

    Start free

  • Team

    €49/mo

    Unlimited registries, 250 GB of storage, 1 TB of monthly transfer. Everything your org publishes and pulls goes through the gate.

    Start free

  • Compliance

    €199/mo

    Custom policies on the full engine, attestations, audit log export, and coordinated disclosure. Priced for your CRA obligation rather than your storage.

    Get started

  • Enterprise

    Custom

    SCIM, physical isolation, self-hosted or on-premise, air-gap distribution, SLA.

    Talk to us

Every tier includes rustdoc builds, crate site hosting, SBOMs, OIDC SSO, and quarantine. Annual billing gets two months free. Running a large open source project? Talk to us. See the full plan comparison.

No registry can make attacks impossible. Build-time checks don't catch malice that only triggers at runtime, and a patient attacker can still defeat provenance over time. What Haven does is make attacks more expensive and easier to trace, and the docs are explicit about where that limit sits.