Allow anonymous Cargo installs for public BSR SDKs

[alec-flowers]

Public BSR modules are documented as readable without credentials, and generated SDKs for ecosystems like Python install anonymously. However, the Cargo registry sets "auth-required": true, requiring a Buf account and token even for public SDKs.

Could public Cargo SDKs support anonymous installation as well, perhaps through a separate public registry endpoint?

[alec-flowers]

@emcfarlane @pkwarren
Is one of you the BSR generated-SDK/Cargo registry owner?

The mandatory authentication for public crates appears inconsistent with the other public SDK registries. It also requires every consuming repository to provision and manage a BSR token as a CI secret, including rotation and distribution, even though the dependency itself is public. This adds significant operational friction for adopting these crates across multiple repositories.

[emcfarlane]

Hey @alec-flowers yep, looking into it now.

[alec-flowers]

Awesome, thanks!

[alec-flowers]

Another issue we ran into is crates.io does not permit publishing a crate with non-development dependencies sourced from another Cargo registry. https://doc.rust-lang.org/cargo/reference/registries.html#using-an-alternate-registry

Cargo rejects such packages before upload. Therefore, even if Buf allows anonymous access, any crate depending on a Buf-hosted crate still cannot itself be published to crates.io.

We had initially wanted to use buf to manage our pypi and crates.io publishing but ran into the above and this blocker.

[alec-flowers]

Is there something we can contribute? I notice you added the feature label.

Is it possible to have buf publish to crates.io?

[emcfarlane]

Hey @alec-flowers, currently looking at creating a separate public registry endpoint. Publishing to crates.io would be needed to solve your other issue.

[alec-flowers]

I think publishing to crates.io would potentially solve both issues?