#Cargo (Rust) configuration

OSA Proxy supports Cargo sparse registries: it checks versions in the index and downloaded .crate archives. Supported upstreams include crates.io and compatible private sparse registries, including Artifactory and Nexus Cargo endpoints. Git indexes, Git/path dependencies, publishing, and the yank API are not supported.

#OSA Proxy configuration

cargo:
  enabled: true
  repository:
    - name: crates
      registry: https://index.crates.io
      scan-manifest: true
      scan-package: true
      remove-blocked-versions: true
      work-mode: strict_wait
      additional-packages-registries:
        static.crates.io: https://static.crates.io

Set registry to the HTTP(S) sparse index root without the sparse+ prefix. Archive download hosts other than the index registry must be allowed through additional-packages-registries.

scan-manifest enables checks of versions in the sparse index. Blocked versions are removed by default; with remove-blocked-versions: false, they remain marked yanked: true. scan-package checks an archive before download, including versions already pinned in Cargo.lock.

#Connecting Cargo

To replace crates.io, add the following to .cargo/config.toml:

[source.crates-io]
replace-with = "osa-proxy"

[source.osa-proxy]
registry = "sparse+https://osa-proxy.example.com/crates/"

The client URL requires the sparse+ prefix and trailing /. Use a new CARGO_HOME to test in a clean environment: Cargo may otherwise use an archive from its local cache without contacting the proxy.

#Archive downloads

If Nexus sits in front of OSA Proxy (its Cargo proxy points at OSA Proxy), codescoring.osa-proxy-url must be reachable by Nexus because it takes the download host from dl.