Cargo

NORA implements the Cargo Sparse Index protocol for hosting and proxying Rust crates. Publish private crates and cache public ones from crates.io.

Client Configuration

Add NORA as an alternative registry in ~/.cargo/config.toml:

[registries.nora]
index = "sparse+http://nora.example.com:4000/cargo/index/"

Use the registry:

# Publish
cargo publish --registry nora

# Install
cargo install my-crate --registry nora

To use NORA as the default source for crates.io packages, add:

[source.crates-io]
replace-with = "nora"

[source.nora]
registry = "sparse+http://nora.example.com:4000/cargo/index/"

Upstream Proxy

NORA proxies index lookups and crate downloads from the upstream registry when a crate is not found locally.

config.toml:

[cargo]
enabled = true
proxy = "https://crates.io"
proxy_timeout = 30

Environment variables:

Variable	Description	Default
NORA_CARGO_ENABLED	Enable Cargo registry	true
NORA_CARGO_PROXY	Upstream registry URL	https://crates.io
NORA_CARGO_PROXY_AUTH	Upstream auth (user:pass)	—
NORA_CARGO_PROXY_TIMEOUT	Upstream timeout in seconds	30

Published Crates and the Upstream

A crate published to NORA is served from its own entries only, from 1.4.0:

• its sparse index and downloads never ask the upstream; a download of a version it does not have is 404, and nothing is fetched or stored;
• - and _ name one crate, as on crates.io: another spelling of a published crate is 404 on the index and on downloads, naming the published spelling, and publishing it is 409;
• publishing a name the upstream also has goes through and never imports the upstream’s versions.

NORA records each crate’s spelling under cargo/_names/ after its first publish; for crates published before 1.4.0 the first start writes the records before it accepts requests.

Features

Feature	Status	Notes
config.json	Full	dl and api fields
Sparse index lookup	Full	Prefix rules (1/2/3/ab/cd)
Crate download	Full	.crate files by version
cargo publish	Full	Length-prefixed JSON + .crate
Dependency metadata	Full	req, package transforms
SHA256 verification	Full	On publish
Cache-Control headers	Full	immutable for downloads, max-age=300 for index
Yank/unyank	—	Not implemented
Owner management	—	Not implemented
Categories/keywords	Partial	Stored but not searchable

Known Limitations

• Yank and unyank are not supported — published versions cannot be marked as yanked.
• Owner management is not implemented.
• Categories and keywords are stored in metadata but are not searchable.
• Copies of unknown versions that a release before 1.4.0 fetched and stored beside a published crate stay until you delete them; they are listed in the UI and counted by keep_last (#1163).