Module config 

.cargo/config.toml discovery and [registries.*]/[source.*] resolution.

Resolves a Cargo registry = "<alias>" dependency’s alias into a concrete, fetchable sparse index URL by reading the same .cargo/config.toml hierarchy (and $CARGO_HOME/config.toml) Cargo itself consults, plus the CARGO_REGISTRIES_<NAME>_INDEX/_TOKEN environment variable overrides Cargo documents. Also resolves a [source.crates-io] replace-with chain into a mirror index for plain (Registry-sourced) dependencies (spec FR-005/006/007).

Security model (read before touching this module)

A workspace’s own Cargo.toml/.cargo/config.toml is attacker-controlled the moment a hostile repository is cloned and opened — this LSP parses on file open, before any build ever runs. Two, related, threats this module closes:

• Credential exfiltration. AuthToken must never be attachable to a request whose destination URL provenance traces to a workspace file. This is enforced structurally, not by a runtime check:
  • parse_workspace_registries_raw has no return type capable of expressing a token — its value type is a bare String, with no token field anywhere. There is no token field lookup anywhere in that function’s body.
  • Only parse_cargo_home_registries_raw (fed $CARGO_HOME/config.toml’s content) and the environment-variable lookup in resolve ever construct Some(AuthToken).
  • Provenance exists purely for logging/diagnostics. Nothing in this crate branches on it to decide whether to attach a credential — grepping for Provenance outside this module should find no such branch (verified in this PR’s security review).
• Internal-network reachability (SSRF-adjacent, #443). RegistryIndex::new requires an IndexTrust and a deps_core::net_policy::RegistryAccessPolicy: a WorkspaceDeclared URL is checked against the live policy before it can ever become a fetchable index, while a Trusted ($CARGO_HOME-provenance) URL is never policy-checked at all — it is the user’s own configuration, not something a cloned repository controls. See .local/specs/023-cargo-custom-registries/plan-1b.md §1-§2.

See spec .local/specs/023-cargo-custom-registries/spec.md FR-008/FR-009 and the design review handoffs cited there for the two rounds of critique the credential boundary survived.

Structs

AuthToken

A registry bearer-token credential, redacted everywhere except the one call site that formats it into an Authorization header.

CargoConfig

The merged, resolved view of a workspace’s .cargo/config.toml hierarchy plus $CARGO_HOME/config.toml, for the aliases a manifest actually referenced.

ConfigFileCache

Per-config-file memoization for .cargo/config.toml/$CARGO_HOME/config.toml parsing (spec NFR-005, plan-1b §1.5).

RegistryIndex

A validated, sparse+-prefix-stripped sparse-index URL: https scheme, no userinfo, and (for a WorkspaceDeclared candidate) a host the live deps_core::net_policy::RegistryAccessPolicy allows.

ResolvedRegistryEntry

One resolved [registries.<name>] entry.

Enums

IndexTrust

Whose input a candidate registry index URL is, for RegistryIndex::new’s deps_core::net_policy::RegistryAccessPolicy gate.

Provenance

Where a ResolvedRegistryEntry came from.

RegistryIndexError

Why a candidate index URL failed RegistryIndex::new’s validation.

SourceReplacement

Where a [source.crates-io] replace-with chain resolved to, for plain (Registry-sourced) dependencies (spec FR-005/FR-006/FR-007).

Functions

cargo_home_config_path

$CARGO_HOME/config.toml’s path, or None if $CARGO_HOME is not set.

referenced_aliases

Every distinct alias dependencies declares via registry = "<alias>".

resolve

Resolves referenced_aliases against the .cargo/config.toml hierarchy and $CARGO_HOME/config.toml.