Cargo

Point Cargo (Rust) at your Dependably instance. Dependably exposes a sparse registry index, so it works with stable Cargo (1.70 and newer) with no extra protocol configuration.

You will need your instance's base URL and a token — create a token in the web UI (see Getting started). The examples below use repo.example.com; substitute your own. Your Cargo registry index is:

sparse+https://repo.example.com/cargo/

The sparse+ prefix tells Cargo to use the sparse-index protocol. Keep the trailing slash. Cargo reads https://repo.example.com/cargo/config.json to discover the download and publish endpoints automatically.

Configure

Cargo has no command to define a registry, so add this one block to your global ~/.cargo/config.toml (on Windows, %USERPROFILE%\.cargo\config.toml). It holds no secret:

[registries.dependably]
index = "sparse+https://repo.example.com/cargo/"

Then log in. Cargo prompts for the token and stores it in its own credential store — no environment variable, no secret in a file:

cargo login --registry dependably
# paste <your token> when prompted

To pull a dependency from Dependably, reference the registry by name in your Cargo.toml:

[dependencies]
my-internal-crate = { version = "1.0", registry = "dependably" }

A project can commit its own .cargo/config.toml with the same [registries.dependably] block so everyone who clones the repo resolves it the same way.

Verify

cargo search --registry dependably serde   # search the registry
cargo build                                 # resolve and fetch dependencies

cargo build resolves your [dependencies] against the sparse index and downloads any registry = "dependably" crates. Your first download records an entry on the Activity page in the web UI.

Publishing

Publish a crate to your instance:

cargo publish --registry dependably

Publishing requires a token with a push scope (push only or push & pull) — see Access tokens. The published version appears in the sparse index immediately; re-publishing an existing version is rejected. Removing a bad version is an Admin or Owner action done in the web UI (open the package's version list and select Delete); cargo yank needs removal permission that the pre-defined token scopes do not include.

Access is managed centrally. Who can publish is governed by your Dependably roles and tokens, so there are no per-crate owner lists to maintain — change access once, in one place, instead of crate by crate. cargo owner --list reports your members. (Because access lives in Dependably rather than on the crate, Cargo's cargo owner --add / --remove return 501 Not Implemented.)

Revert

Stop publishing or resolving against Dependably:

cargo logout --registry dependably

Then remove the [registries.dependably] block from ~/.cargo/config.toml, and drop the registry = "dependably" keys from each Cargo.toml.