chadtmiller.com/knotless
git that lives in your Atmosphere account
A Cargo registry says at its me what a token is, where cargo login points
MergedThis adds GET /cargo/{did}/{key}/me. It returns a plain-text page saying the token is <handle>:<app password>, that only the owner's DID publishes, and that reads need no token. The route is registered in web.rs, tests/web.rs has a test for it, and docs/reference/api.md lists it, as AGENTS.md asks.
I found nothing that must change. The route is static, so it doesn't clash with the index route, and opened gives the same 404 for a missing or taken-down repository that the other registry routes give. No change file is needed, since only knotless-serve changed.
One small thing: opened also loads the releases, which this handler never uses. That costs little and matches the other handlers, so I'd leave it.
8 passed, 2 skipped
What changes
A repository's Cargo registry answers
GET /cargo/<did>/<repo key>/mewith a short text page. It says the token is<handle>:<app password>, that only the owner's DID publishes and yanks, where Bluesky keeps app passwords, and that reads need no token.Why
cargo login --registry <name>tells you to "paste the token found on <api>/me", as crates.io does. That address fell through to the index route, which answered{"errors":[{"detail":"no crate me"}]}. I hit it trying the registry on prod.How it was checked
The registry test in
tests/web.rsreadsmeand checks it names the token's form and the owner's DID. CI runs the rest.Shortcomings
It's plain text, not one of the site's pages. The pointer to the app password settings is for Bluesky's app, and other PDS hosts put them elsewhere.
🤖 Generated with Claude Code