Module crates_io 

Read another release from the registry that published it.

This is the one network read in the tool, and it produces bytes a later apply may write into a repository, so every step is bounded and every byte is verified. The registry’s own protocol decides the URLs: the sparse index serves config.json and one line per version, and the dl template in that configuration says where an archive lives. None of it is a hard-coded download layout.

The archive is untrusted input. It is verified against the index checksum before it is parsed, expanded under caps on compressed bytes, expanded bytes, entry count, and per-file bytes, and admitted only for regular files under a declared payload root. A path that is absolute, that climbs out, that is a link of either kind, or that repeats is refused rather than skipped, because an archive that carries one is not the archive the registry says it is.

Nothing is executed. A bundle is data the planner reads.

Structs

CrateReleaseBundle

A release read from its published crate.

CratesIoResolver

Resolve a selector against crates.io, or against the cache alone.

Constants

CRATE_NAME

The crate this tool distributes itself as.

INDEX_ROOT

The sparse index this tool reads.

Functions

admit

Read an archive into the payload files it is allowed to carry.

expand_download

Fill the registry’s download template, or fall back to the default form.