Phylum Cargo Registry

The Phylum Cargo registry is based on Cargo's sparse Registry Index API.

Configuration

All configuration options will require a Phylum API key, since Phylum requires authentication. You can find out how to generate one in our API Keys documentation.

In the following examples, all API keys will be represented as <PHYLUM_API_KEY>, so make sure to replace them with your generated key.

Additionally, if the default policy is not sufficient, a group can be passed to evaluate all packages against the group's policy. To do this, just replace <PHYLUM_GROUP> with the desired group name. The supplied API key must have access to this group.

If Phylum's default policy is sufficient, you can remove all instances of <PHYLUM_GROUP>.

cargo

To use the Phylum Cargo registry, it first needs to be added to a .cargo/config.toml file. On UNIX you can use ~/.cargo/config.toml to make the registry available to all projects.

[registries]
phylum = { index = "sparse+https://cargo.phylum.io/" }

This makes the Phylum registry available to all Cargo projects, however by default Cargo will still use the official registry. To ensure all requests go through Phylum, you'll have to override the crates.io registry in the .cargo/config.toml file. This can be a project's Cargo config if you do not wish to globally run every install through Phylum.

The easiest way to enable Phylum is by replacing the crates.io source with Phylum's registry. This has the advantage of creating Cargo.toml and Cargo.lock files that are identical to the ones created for the official registry.

[source.crates-io]
replace-with = "phylum"

Since replacing the Cargo source prevents you from using the official registry, this is unsuitable if certain packages should still be installable without going through Phylum. In this case you can just set Phylum to be the default registry instead:

[registry]
default = "phylum"

Since Phylum's registry requires authentication, you'll also need to configure a credential provider in your .cargo/config.toml file:

[registry]
global-credential-providers = ["cargo:token"]

Once the file-based cargo:token credential provider is configured, you can add your authentication details to the .cargo/credentials.toml file.

The Phylum group and API key first need to be converted to Base64:

printf "<PHYLUM_GROUP>:<PHYLUM_API_KEY>" | base64

⚠️ WARNING ⚠️

Do not accidentally save your token into your shell history.

Once converted to Base64, you can add it as a basic authentication token to your credentials:

[registries.phylum]
token = "Basic <BASE64_OUTPUT>"

A blocked package will show up in cargo output as missing:

    Updating `phylum` index
error: no matching package named `libc` found
location searched: registry `phylum`
required by package `testing v0.1.0 (/tmp/testing)`

Alternatively, if a specific version constraint matches the blocked version:

    Updating `phylum` index
error: failed to select a version for the requirement `libc = "=0.2.155"`
candidate versions found which didn't match: 0.2.158, 0.2.157, 0.2.156, ...
location searched: `phylum` index
required by package `testing v0.1.0 (/tmp/testing)`

If a version range is accepted by the manifest, the package manager will automatically attempt to use a version that passes Phylum's policy.