crates-io-trusted-publishing-token

• Provider documentation rust-lang/crates.io crates/crates_io_trustpub/src/access_token.rs (f937ab0, 2026-06-24): PREFIX = "cio_tp_", RAW_LENGTH = 31 alphanumerics, then one check character from A-Za-z0-9 (XOR of the raw bytes, modulo 62); the parser requires exactly 32 characters after the prefix; re-checked 2026-09-29 · observed 2026-09-29 · cio_tp_ + exactly 32 [A-Za-z0-9] (31 + 1 check character), 39 in all
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9
• Reference 10

Arrival evidence (#528, product redact-secret#1031; #1014 handoff crates-io.md, READY). A trusted-publishing token is minted from a CI OIDC exchange and can publish for its short lifetime. T1 for every fact under R1. POLICY, not T1: the check character is corroboration only; a shape-valid token whose last character is not the check character is still claimed (ruling Q1 open; security-first standing decision), so positives carry a matching and a mismatching check character and nothing asserts silence on a check failure. No pinned peer (and no scanner the handoff found) covers cio_tp_.