Module crateexport 

Cargo local-registry export (REQ-CRATE-001).

A crate-kind entry carries a .crate tarball. export-cargo materialises a Cargo LOCAL REGISTRY from the verified store — the .crate files plus a registry index — and emits a .cargo/config.toml source-replacement, so a consumer builds fully offline against crates whose bytes varve signed.

The trust chain needs nothing new: a .crate is signed like any blob (its digest is in the DSSE-signed layer manifest), and that digest IS the sha256 Cargo records as the index cksum. Cargo re-checks the .crate against the cksum, so the consumer verifies a second time on its own terms.

Structs

CrateEntry

One crate to place in the registry: its identity, the Cargo cksum (bare sha256 hex of the .crate), and the tarball bytes.

CrateMeta

Everything an index line needs beyond identity and cksum, read from the Cargo.toml inside the signed .crate (REQ-CRATEIDX-001 clause 1).

IndexDep

One dependency exactly as a Cargo registry index expresses it (REQ-CRATEIDX-001 clause 1). Field names and order mirror crates.io’s index so a line varve writes and a line crates.io writes are the same shape.

Enums

CrateExportError

Constants

REGISTRY_SUBDIR

The subdirectory export-cargo puts the local registry in, relative to the export root. A constant, not a caller’s path, so the generated config is a function of the layer alone (REQ-REPRO-001 clause 1).

VENDOR_SUBDIR

The subdirectory export-crates-vendor puts the vendored trees in.

Functions

cargo_checksum_json

The .cargo-checksum.json for a vendored crate. package is the sha256 of the .crate tarball — the SAME digest varve signs, so the upstream integrity anchor is preserved into the vendored tree, not discarded (REQ-BRIDGE-001). files empty is valid for a registry-sourced crate (matches real cargo vendor output for registry crates).

cargo_config_toml

The .cargo/config.toml that redirects crates.io to the local registry, so an unmodified Cargo.toml resolves against varve’s verified bytes.

export_distdir

Materialise a Bazel distdir of the verified .crate tarballs (REQ-VENDOR-002, air-gap rules_rust). Bazel’s --distdir resolves an http_archive from a local file whose sha256 matches — with NO network and NO URL rewrite. Because varve’s signed .crate digest IS the crate_universe pin (== the crates.io checksum), a consumer that pre-generates its crate_universe output once and then builds with bazel build --distdir=<this dir> (network off) resolves every crate from varve’s verified bytes. varve emits the bytes; the consumer commits the generated crate_universe output (so no repin/index lookup at build time). Returns the number of tarballs written.

export_local_registry

Materialise a Cargo local registry at registry_dir: write each .crate file and its index entry. Returns the number of crates written.

export_vendor_dir

Materialise a cargo vendor-shaped directory from verified crate entries: each .crate UNPACKED into <vendor>/<name>-<version>/ with its .cargo-checksum.json. Proven offline-consumable by bare Cargo and Corrosion. (rules_rust needs BUILD files over this tree — REQ-VENDOR-002.) Returns the crate count.

index_line

One index line for a crate version, carrying the crate’s REAL deps and features read from the Cargo.toml inside its signed .crate (REQ-CRATEIDX-001). Cargo resolves the dependency graph from this line, so an empty deps/features is not a conservative default — it is a lie that resolves, builds, and exits 0 with the crate compiled featureless.

index_line_from_meta

The line for an entry whose metadata is already in hand. Split out so the transcription can be unit-tested without a tarball, and so both halves are exercised by the same serialisation.

index_path

The registry-index sub-path for a crate name, per Cargo’s layout: 1/2/3 char names get special prefixes, 4+ use first-two/next-two. Lowercased.

read_crate_meta

Read the deps and features of a crate from the Cargo.toml inside its signed .crate tarball (REQ-CRATEIDX-001 clause 1).

validate_crate_name

Refuse a crate name Cargo’s registry index cannot express, or that would corrupt the index line’s JSON. Cargo’s rule: ASCII alphanumeric, -, _, non-empty. Failing closed here keeps index_path/index_line honest — the alternative is a panic or a silently malformed registry (REQ-CRATENAME-001).

validate_crate_version

Refuse a version string that would corrupt the index line’s JSON. Semver’s own alphabet (alphanumerics, ., -, +) admits no quote or backslash.

vendored_config_toml

The consumer config pairing with a vendored directory: redirects crates.io to the on-disk unpacked trees. Consumed natively by bare Cargo and by Corrosion (both proven offline). rules_rust needs generated BUILD files on top of this tree — its crate.from_cargo splice wants a registry index and rejects a bare directory source (v0.16.0 spike); see REQ-VENDOR-002.