I'm using Kellnr proxy-cache server, that hosted on the remote machine in the local (Yggdrasil) network:

#~/.cargo/config.toml
[registries.kellnr]
index = "sparse+http://[202:68d0:f0d5:b88d:1d1a:555e:2f6b:3148]:8180/api/v1/cratesio/"

[source.crates-io]
replace-with = "kellnr"

[http]
timeout = 180

My problem in that I don't trust to provider to validate hash-sums from it, but ready to download the dependencies by using my self-hosted index version.

Is this possible? I know about the --locked option but this file is not always provided in source repos. Just security goals, to not download malformed packages when I'm using unofficial storage.

1 post - 1 participant

Read full topic