Cargo (Rust) Package Registry Beta Program: Feedback & Graduation Criteria

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

Overview

We are promoting the Cargo (Rust) Package Registry from Experiment to Beta in an upcoming GitLab milestone. This issue serves as the central hub for the Beta program: collecting customer feedback, tracking known limitations, and defining the signal we need before graduating to GA.

For the full history and context, see #33060 - Cargo (Rust) Package Manager MVC.

What is the Cargo Package Registry?

The GitLab Cargo Package Registry allows you to publish and manage Rust crates directly within your GitLab projects. Key capabilities include:

  • Publish crates via cargo publish using personal access tokens, deploy tokens, or CI/CD job tokens
  • Download crates via cargo install or as dependencies in Cargo.toml
  • CI/CD integration with native CI_JOB_TOKEN support for automated publishing
  • Sparse index support for efficient dependency resolution (RFC 2789)
  • Metadata extraction for published crates (version, dependencies, features, etc.)
  • Crate size limit of up to 3 GB

How to sign up for the Beta

No formal sign-up is required. To start using the Cargo Package Registry Beta:

  1. Ensure the feature is enabled: The Cargo registry is behind the cargo_packages feature flag. On GitLab.com, this will be enabled for Beta participants. For Self-Managed instances, an administrator must enable the flag.
  2. Authenticate using one of the supported methods:
    • Personal access token (scope: api)
    • Deploy token (scope: read_package_registry and/or write_package_registry)
    • CI/CD job token
  3. Configure your credentials in ~/.cargo/config.toml: 
    [registries.gitlab]
index = "sparse+https://gitlab.example.com/api/v4/projects/<project_id>/packages/cargo/metadata/"
token = "Bearer <token>"
  4. Publish a crate: 
    cargo publish --registry gitlab
  5. Add a dependency from the registry in Cargo.toml: 
    [dependencies]
my_crate = { version = "0.1.0", registry = "gitlab" }

How to provide feedback

We want to hear from you! Please comment directly on this issue with:

  1. Your use case: What are you using the Cargo registry for? (internal crates, CI/CD publishing, shared libraries, mirroring, etc.)
  2. Environment details: GitLab.com or Self-Managed? Approximate number of crates and total size?
  3. What's working well: Features or workflows that meet your expectations
  4. Issues or bugs: Anything broken or behaving unexpectedly (please also file a separate issue with the ~"Category:Package Registry" label)
  5. Performance observations: Upload/download speeds, latency, any timeouts or failures at scale
  6. Missing functionality: Features you need before you can adopt this in production
  7. Scale testing results: If you've tested with a large number of crates or large crate sizes, share your findings

For bugs or feature requests, please create a dedicated issue and link it here.

Known limitations (Beta)

The following are known limitations during the Beta period:

  • Feature flag gated: The feature is behind the cargo_packages feature flag and must be explicitly enabled
  • Sparse index only: The registry uses the sparse index protocol (RFC 2789); the legacy git-based index is not supported
  • No cargo yank support: Yanking crate versions is not yet supported
  • No dependency resolution validation: The registry does not validate that declared dependencies exist or are resolvable
  • Duplicate crate names/versions: Pushing a crate with the same name and version as an existing one may create a duplicate rather than rejecting or replacing it

Graduation criteria: Beta to GA

We will consider the Cargo Package Registry ready for GA when the following criteria are met:

Functionality

  • All blocking issues related to the Cargo MVC are resolved
  • cargo publish and cargo install / dependency resolution are fully supported
  • Feature flag is removed and the feature is enabled by default
  • Documentation is complete and reflects the production-ready state
  • cargo yank support is implemented or a clear workaround is documented

Performance & Scale

  • Verified performance at scale: publishing and downloading crates performs within acceptable latency thresholds under load
  • No known P1/P2 performance-related bugs
  • Tested with repositories containing 100+ crates of varying sizes

Quality & Reliability

  • No open S1/S2 bugs related to the Cargo registry
  • Error rates on GitLab.com are within acceptable thresholds (aligned with Package Registry SLOs)
  • No data integrity issues (metadata, crate files, dependencies)

Customer Signal

  • At least 5 distinct customers/users have provided positive feedback on this issue confirming production-readiness
  • No unresolved blocking feedback from Beta participants
  • Usage metrics show sustained adoption (month-over-month growth in unique users publishing/downloading crates)

Related resources

Timeline

Milestone Target
Beta launch TBD
Feedback collection period 2-3 milestones post-Beta
GA decision Based on graduation criteria above
Edited by 🤖 GitLab Bot 🤖