A sparse registry that stable Cargo speaks natively. crates.io crates come through a pull-through cache that verifies every checksum; your own crates publish with a token; the policy gate decides what reaches a build.
One block in config.toml names the registry and holds no secret; cargo login stores the token in its own credential store.
The placeholders are your base URL and a token from the web UI. The guide covers the same steps for a single project, plain HTTP, verifying the change, and reverting it.
# ~/.cargo/config.toml — holds no secret
[registries.dependably]
index = "sparse+https://repo.example.com/cargo/"
# then: cargo login --registry dependably
[dependencies]
my-internal-crate = { version = "1.0", registry = "dependably" }The client sees a registry. Behind it, Dependably Packages stages each upstream artefact and refuses the ones that fail a check you configured.
The Cargo guide continues with a verification step, publishing your own packages, and reverting the configuration if you need to.