I am interested in adding a hook point into cargo that would permit me to customize the process by which cargo picks packages from a registry. A simple way could be to just register an executable that uses some stdin/stdout based RPC mechanism. In the ideal world one could register hooks to be used via the global cargo config and require some hooks to be enabled in the Cargo.toml. Some usecases are blacklisting licenses, only use audited versions of packages, backlisting versions of packages that show up in rustsec's advisory db etc.

I'm not entirely sure yet where the best hook point would be but in the ideal situation such a hook would be invoked with the parsed package spec as well as the resolved packages, and can return a new list of packages either filtered down by removing them or by still retaining the package but leaving a marker that marks it as ineligible with a note as of why:

{"name": "libc", "version": "0.2", "matches": [...]}

[{
    "name": "libc",
    "version": "0.2.0",
    "id": "libc 0.2.0",
    "status": {
        "can_use": false,
        "icon": "X",
        "note": "This package has not been audited"
    }
}]

(No thought went into the above JSON payload, so let's not think too much about this yet)

I was looking at hacking something together but I could not find a good way to hook into the current resolution algorithm yet which is why I'm effectively asking for guidance from experienced cargo developers to figure out where such a system would go if it were to be added.

The motivation for adding this has been my blog post about scaling dependencies: http://lucumr.pocoo.org/2019/7/29/dependency-scaling/