Limitation
Unlike other package managers, Cargo packages contain the URL of the registry where they have been uploaded to. The Cargo client does not support a global URL replacement method, so the client can't modify dynamic URLs. Artifactory cannot change the URLs in each Cargo package because this would change the package checksum and the package would be considered compromised by the client.
This limitation makes it difficult for Artifactory to enable Virtual repositories and Federation unless the following workaround solution is performed.
Cargo Rewrite Workaround Solution
Cargo recommends using Source Replacement on each developer machine to cope with the URL validation from different sources.
For each instance in the federation, configure .cargo/config.toml to identify all the other federation members. Use the replace-with option for each federation source with the target URL. To use FED1, add a source for FED2, and use FED2 replace-with FED1. In this case, all the crates that have FED2 dependencies will be resolved from FED1 as expected.
For information about source replacement, JFrog strongly recommends reading the official Cargo documentation.
Cargo Rewrite Code Example
[registry] default = "artifactory-local" global-credential-providers = ["cargo:token"][registries.artifactory-local] index = "sparse+http://my-awesome.jfrog.io/artifactory/api/cargo/cargo-local/index/" [source.artifactory-fed1] registry = "sparse+http://my-awesome.jfrog.io/artifactory/api/cargo/cargo-fed1/index/"replace-with = "artifactory-fed2" [source.artifactory-fed2] registry = "sparse+http://my-awesome.jfrog.io/artifactory/api/cargo/cargo-fed2/index/"replace-with = "artifactory-fed1" #artifactory-remote points to the github registry [source.artifactory-remote] registry = "sparse+http://my-awesome.jfrog.io/artifactory/api/cargo/cargo-remote/index/" [source.crates-io] replace-with = "artifactory-remote"