Spurious network error 503 on updating crates.io index behind proxy since 1.89.0

[michaelvlach]

Problem

Since cargo 1.89.0 including current version (1.91.0) cargo is unable to download the registry manifest or crates. We are seeing spurious network warning when cargo tries to update from crates.io behind an authenticated proxy due to 503 being returned (likely from the proxy?):

warning: spurious network error (3 tries remaining): failed to get successful HTTP response from `https://index.crates.io/config.json` (18.239.236.15), got 503

Version 1.88.0 works fine and we are pinned to it.

OS: RHEL8 (8.9), RHEL9 (9.6)
(behaves the same in both versions of redhat)

Log is attached that shows the log output.

cargo_update.log

No combination of exposed settings makes any difference. Using --config registries.creates-io.protocol=\'git\' allows downloading the index but later fails in the same way when downloading the crates themselves. Using net.git-fetch-cli-with-cli=true makes no difference (likely because it is only used to download crates, not fetching the index).

The most likely cause is some interaction with the proxy. However running plain curl

curl https://index.crates.io/config.json

works just fine. Setting no proxy yields connection refused. Setting proxy without auth yields 407. Setting proxy with auth yields the above problem.

Looking at the relevant cargo code I do not see any outstanding setting that could lead to a difference in behaviour but I am not too familiar with the codebase.

Steps

export CARGO_LOG=debug
export CARGO_HTTP_DEBUG=true
cargo update

Possible Solution(s)

None (pin to cargo 1.88)

Notes

No response

Version

cargo 1.91.1 (ea2d97820 2025-10-10)
release: 1.91.1
commit-hash: ea2d97820c16195b0ca3fadb4319fe512c199a43
commit-date: 2025-10-10
host: x86_64-unknown-linux-gnu
libgit2: 1.9.1 (sys:0.20.2 vendored)
libcurl: 8.15.0-DEV (sys:0.4.83+curl-8.15.0 vendored ssl:OpenSSL/3.5.2)
ssl: OpenSSL 3.5.2 5 Aug 2025
os: Red Hat Enterprise Linux 9.6.0 [64-bit]

[epage]

   0.023339647s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * Uses proxy env variable NO_PROXY == 'localhost,127.0.0.1,.barcapint.com,.barclays.com,barclays.intranet,docker:2376,.vpce.amazonaws.com'
   0.034540459s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * Host index.crates.io:443 was resolved.
   0.034614676s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * IPv6: (none)
   0.034618809s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * IPv4: 18.239.236.15, 18.239.236.113, 18.239.236.19, 18.239.236.107
   0.034642446s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *   Trying 18.239.236.15:443...
   0.044048091s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *  CAfile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
   0.044109242s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *  CApath: /etc/pki/tls/certs
   0.044150166s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * ALPN: curl offers h2,http/1.1
   0.044358266s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * TLSv1.3 (OUT), TLS handshake, Client hello (1):
   0.239365032s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * TLSv1.3 (IN), TLS handshake, Server hello (2):
   0.239809742s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
   0.239837244s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
   0.239856654s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * TLSv1.3 (IN), TLS handshake, Certificate (11):
   0.240257910s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * TLSv1.3 (IN), TLS handshake, CERT verify (15):
   0.240322976s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * TLSv1.3 (IN), TLS handshake, Finished (20):
   0.240350450s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
   0.240366441s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * TLSv1.3 (OUT), TLS handshake, Finished (20):
   0.240417405s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / x25519 / RSASSA-PSS
   0.240434515s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * ALPN: server accepted http/1.1
   0.240440002s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * Server certificate:
   0.240444938s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *  subject: CN=crates.io
   0.240448842s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *  start date: Oct 26 00:00:00 2025 GMT
   0.240451893s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *  expire date: Nov 24 23:59:59 2026 GMT
   0.240458308s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *  subjectAltName: host "index.crates.io" matched cert's "index.crates.io"
   0.240465869s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *  issuer: C=GB; ST=London; L=London; O=BarclaysPLC; OU=GIS; CN=SSLInterceptionIssuingG2CA6
   0.240469128s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *  SSL certificate verify ok.
   0.240473992s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
   0.240476979s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *   Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
   0.240499530s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * Connected to index.crates.io (18.239.236.15) port 443
   0.240502141s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * using HTTP/1.x
   0.240541083s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: > GET /config.json HTTP/1.1
   0.240544797s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: > Host: index.crates.io
   0.240547387s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: > User-Agent: cargo/1.91.1 (ea2d97820 2025-10-10)
   0.240549917s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: > Accept-Encoding: deflate, gzip
   0.240552075s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: > cargo-protocol: version=1
   0.240553644s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: > accept: text/plain
   0.240555200s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: > 
   0.240564914s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * Request completely sent off
   0.279191746s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
   0.279291804s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < HTTP/1.1 503 Service Unavailable
   0.279305252s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < Cache-Control: no-cache
   0.279315438s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < X-XSS-Protection: 1
   0.279330642s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < Connection: close
   0.279349215s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < Content-Type: text/html; charset=utf-8
   0.279355661s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < Content-Length: 10248
   0.279362907s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < Pragma: no-cache
   0.279367276s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < 
   0.279744876s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * shutting down connection #0
warning: spurious network error (3 tries remaining): failed to get successful HTTP response from `https://index.crates.io/config.json` (18.239.236.15), got 503
body:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<style>
body {
background: #CED1D4;
}
#logo {
    background-color:#FFF;
    color:#FFF;
    text-align:left;
    width:1000px;
	 padding: 5px 10px 15px;
	 margin-left: auto;
    margin-right: auto;
}
#spacer {
    background-color:#CED1D4;
    width:1000px;
	 padding: 10px;
	 margin-left: auto;
    margin-right: auto;
}
#section {
    background-color:#FFF;
 …

[epage]

Looking at changes in 1.88

In Cargo.toml

-flate2 = { version = "1.0.35", default-features = false, features = ["zlib"] }
+flate2 = { version = "1.1.1", default-features = false, features = ["zlib-rs"] }
-openssl = "0.10.57"
+openssl = "0.10.72"

In Cargo.lock

name = "flate2"
-version = "1.1.0"
+version = "1.1.1"
name = "openssl"
-version = "0.10.71"
+version = "0.10.72"
name = "openssl-sys"
-version = "0.9.106"
+version = "0.9.107"

Did not see anything else that may be relevant.

[weihanglo]

Behind what kind of proxy, and how did you setup the proxy?

The most likely cause is some interaction with the proxy. However running plain curl

curl https://index.crates.io/config.json

Did this plain curl also run behind proxy? You might want to share the verbose output via curl --verbose (and also the version of curl CLI you used).

[michaelvlach]

It is the same corporate proxy not set by us on the same system and the same shell. Here are some more details.

First curl log that works. You will notice differnet CAfile but it is just a copy of the same one at different location. Also when I set --config http.cainfo to it there is no difference and log of cargo shows the same location/certs used. However, curl managed to upgrade connection to HTTP/2 and you will see below cargo 1.88 manages to do the same. But cargo 1.89+ including 1.91 does not manage that, uses HTTP/1 and produces the error above:

Curl version:

curl 7.76.1 (x86_64-redhat-linux-gnu) libcurl/7.76.1 OpenSSL/3.2.2 zlib/1.2.11 nghttp2/1.43.0
Release-Date: 2021-04-14
Protocols: file ftp ftps http https
Features: alt-svc AsynchDNS GSS-API HTTP2 HTTPS-proxy IPv6 Kerberos Largefile libz NTLM SPNEGO SSL UnixSockets

Curl outpout:

 $/: curl -v https://index.crates.io/config.json
* Uses proxy env variable NO_PROXY == 'localhost,127.0.0.1,.barcapint.com,.barclays.com,barclays.intranet,docker:2376,.vpce.amazonaws.com'
*   Trying 18.239.236.107:443...
* Connected to index.crates.io (18.239.236.107) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: /etc/pki/tls/certs/ca-bundle.crt
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Unknown (23):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.2 (IN), TLS header, Unknown (23):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS header, Unknown (23):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.2 (IN), TLS header, Unknown (23):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Unknown (23):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
* ALPN, server accepted to use h2
* Server certificate:
*  subject: CN=crates.io
*  start date: Oct 26 00:00:00 2025 GMT
*  expire date: Nov 24 23:59:59 2026 GMT
*  subjectAltName: host "index.crates.io" matched cert's "index.crates.io"
*  issuer: C=US; O=Amazon; CN=Amazon RSA 2048 M04
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* TLSv1.2 (OUT), TLS header, Unknown (23):
* TLSv1.2 (OUT), TLS header, Unknown (23):
* TLSv1.2 (OUT), TLS header, Unknown (23):
* Using Stream ID: 1 (easy handle 0x55a80b3f0b80)
* TLSv1.2 (OUT), TLS header, Unknown (23):
> GET /config.json HTTP/2
> Host: index.crates.io
> user-agent: curl/7.76.1
> accept: */*
> 
* TLSv1.2 (IN), TLS header, Unknown (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.2 (IN), TLS header, Unknown (23):
* Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
* TLSv1.2 (OUT), TLS header, Unknown (23):
* TLSv1.2 (IN), TLS header, Unknown (23):
< HTTP/2 200 
< content-type: application/octet-stream
< content-length: 76
< date: Tue, 02 Dec 2025 08:48:36 GMT
< last-modified: Tue, 12 Mar 2024 07:31:15 GMT
< etag: "652b69f181634dbf60fc8c3ec9f776e5"
< x-amz-server-side-encryption: AES256
< x-amz-version-id: oJr.VPzoI2MIgYxW8Lam7ayZJlnQq_9z
< accept-ranges: bytes
< server: AmazonS3
< x-cache: Hit from cloudfront
< via: 1.1 1696a1e7f7602d80638fb508ba2b83d2.cloudfront.net (CloudFront)
< x-amz-cf-pop: LHR5-P6
< x-amz-cf-id: rIvT4ye_laOyluRrpHKul4XscVWOf_x_XLhZbw_l0C2vKsbkO7oVjg==
< age: 1535
< 
{
  "dl": "https://static.crates.io/crates",
  "api": "https://crates.io"
}
* TLSv1.2 (IN), TLS header, Unknown (23):
* Connection #0 to host index.crates.io left intact

Now here is the cargo 1.88 output on the same system with the same settings and everything:

cargo 1.88.0 (873a06493 2025-05-10)
release: 1.88.0
commit-hash: 873a0649350c486caf67be772828a4f36bb4734c
commit-date: 2025-05-10
host: x86_64-unknown-linux-gnu
libgit2: 1.9.0 (sys:0.20.0 vendored)
libcurl: 8.12.1-DEV (sys:0.4.80+curl-8.12.1 vendored ssl:OpenSSL/3.4.1)
ssl: OpenSSL 3.4.1 11 Feb 2025
os: Red Hat Enterprise Linux 9.6.0 [64-bit]

And the output:

Updating crates.io index
   0.017173439s DEBUG main:exec:resolve_with_previous:resolve: network: Version {
    version: "8.12.1-DEV",
    rust_crate_version: "0.4.47",
    rust_sys_crate_version: "0.4.80+curl-8.12.1",
    vendored: true,
    host: "unknown",
    feature_ipv6: true,
    feature_ssl: true,
    feature_libz: true,
    feature_ntlm: false,
    feature_gss_negotiate: false,
    feature_debug: false,
    feature_spnego: false,
    feature_largefile: false,
    feature_idn: false,
    feature_sspi: false,
    feature_async_dns: true,
    feature_conv: false,
    feature_tlsauth_srp: false,
    feature_ntlm_wb: false,
    feature_unix_domain_socket: true,
    feature_https_proxy: true,
    feature_altsvc: true,
    feature_zstd: false,
    feature_unicode: false,
    feature_http3: false,
    feature_http2: true,
    feature_gsasl: false,
    feature_brotli: false,
    ssl_version: "OpenSSL/3.4.1",
    libz_version: "1.3.1",
    iconv_version_num: "0",
    brotli_version_num: "0",
    nghttp2_version_num: "14000",
    nghttp2_version: "1.64.0",
    zstd_ver_num: "0",
    protocols: [
        "file",
        "http",
        "https",
        "mqtt",
        "ws",
        "wss",
    ],
}
   0.017190700s DEBUG main:exec:resolve_with_previous:resolve: network: fetch https://index.crates.io/config.json
   0.017193657s DEBUG main:exec:resolve_with_previous:resolve: network: downloading config.json as 0
   0.017236888s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * Uses proxy env variable NO_PROXY == 'localhost,127.0.0.1,.barcapint.com,.barclays.com,barclays.intranet,docker:2376,.vpce.amazonaws.com'
   0.198878526s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * Host index.crates.io:443 was resolved.
   0.198928737s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * IPv6: (none)
   0.198933198s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * IPv4: 18.239.236.15, 18.239.236.107, 18.239.236.19, 18.239.236.113
   0.198961464s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *   Trying 18.239.236.15:443...
   0.207992369s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *  CAfile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
   0.208026168s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *  CApath: /etc/pki/tls/certs
   0.208060346s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * ALPN: curl offers h2,http/1.1
   0.208161839s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * TLSv1.3 (OUT), TLS handshake, Client hello (1):
   0.555914235s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * TLSv1.3 (IN), TLS handshake, Server hello (2):
   0.556227941s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
   0.556243921s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
   0.556261568s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * TLSv1.3 (IN), TLS handshake, Certificate (11):
   0.556825579s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * TLSv1.3 (IN), TLS handshake, CERT verify (15):
   0.556901788s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * TLSv1.3 (IN), TLS handshake, Finished (20):
   0.556938069s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
   0.556961222s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * TLSv1.3 (OUT), TLS handshake, Finished (20):
   0.557064965s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / x25519 / RSASSA-PSS
   0.557074469s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * ALPN: server accepted h2
   0.557080204s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * Server certificate:
   0.557087396s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *  subject: CN=crates.io
   0.557092869s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *  start date: Oct 26 00:00:00 2025 GMT
   0.557097005s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *  expire date: Nov 24 23:59:59 2026 GMT
   0.557104913s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *  subjectAltName: host "index.crates.io" matched cert's "index.crates.io"
   0.557112907s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *  issuer: C=US; O=Amazon; CN=Amazon RSA 2048 M04
   0.557116511s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *  SSL certificate verify ok.
   0.557122839s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
   0.557126715s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *   Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
   0.557130159s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: *   Certificate level 2: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
   0.557161898s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * Connected to index.crates.io (18.239.236.15) port 443
   0.557165956s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * using HTTP/2
   0.557201517s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * [HTTP/2] [1] OPENED stream for https://index.crates.io/config.json
   0.557205984s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * [HTTP/2] [1] [:method: GET]
   0.557209345s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * [HTTP/2] [1] [:scheme: https]
   0.557212521s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * [HTTP/2] [1] [:authority: index.crates.io]
   0.557215628s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * [HTTP/2] [1] [:path: /config.json]
   0.557218875s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * [HTTP/2] [1] [user-agent: cargo/1.88.0 (873a06493 2025-05-10)]
   0.557228894s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * [HTTP/2] [1] [accept-encoding: deflate, gzip]
   0.557232226s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * [HTTP/2] [1] [cargo-protocol: version=1]
   0.557235301s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * [HTTP/2] [1] [accept: text/plain]
   0.557301425s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: > GET /config.json HTTP/2
   0.557309136s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: > Host: index.crates.io
   0.557313538s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: > User-Agent: cargo/1.88.0 (873a06493 2025-05-10)
   0.557317765s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: > Accept-Encoding: deflate, gzip
   0.557321224s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: > cargo-protocol: version=1
   0.557324079s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: > accept: text/plain
   0.557326793s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: > 
   0.557346364s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * Request completely sent off
   0.597612204s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
   0.599178788s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < HTTP/2 200 
   0.599214496s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < content-type: application/octet-stream
   0.599225887s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < content-length: 76
   0.599233145s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < last-modified: Tue, 12 Mar 2024 07:31:15 GMT
   0.599239701s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < x-amz-server-side-encryption: AES256
   0.599245717s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < x-amz-version-id: oJr.VPzoI2MIgYxW8Lam7ayZJlnQq_9z
   0.599251621s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < accept-ranges: bytes
   0.599256444s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < server: AmazonS3
   0.599261654s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < date: Tue, 02 Dec 2025 09:17:04 GMT
   0.599266340s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < etag: "652b69f181634dbf60fc8c3ec9f776e5"
   0.599271114s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < vary: accept-encoding
   0.599275980s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < x-cache: Hit from cloudfront
   0.599281476s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < via: 1.1 02462ba58311d13c5134d2086aba8b32.cloudfront.net (CloudFront)
   0.599286415s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < x-amz-cf-pop: LHR5-P6
   0.599291499s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < x-amz-cf-id: 7z0sXrOuOPVoCGnQuNPbE1XZWPPtoNoR8TLQ0OpZPjGqTCv_V22I1Q==
   0.599296047s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < age: 45
   0.599301498s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: < 
   0.599334052s DEBUG main:exec:resolve_with_previous:resolve:block_until_ready: network: http-debug: * Connection #0 to host index.crates.io left intact

Immediately what jumps out is the fact that cargo 1.88 also manged to upgrade the connection to HTTP/2.

My conclusion therefore is that something broke the ability to upgrade to HTTP/2 between 1.88 and 1.89 in our evnrionment. Is there a way to force it? Does something look indicative of why that could be?

Thanks!

[michaelvlach]

Update on this issue. The failure comes from the proxy servers performing TLS interception and no yet supporting Kyber/ML-KEM. Upgrading the proxies is the ultimate solution but a workaround is also to disable the interception for such requests.

Similarly if curl and therefore cargo could expose some config via environment variable that would disable use of ML-KEM (if possible} then it would help with such issues as well. So far I have not found anything to that effect.

Not sure if the similar issue on FreeBSD #16357 is related to this.