Mutual TLS support for authentication with registry

Cargo.toml

@@ -81,6 +81,7 @@ proptest = "1.9.0"
 pulldown-cmark = { version = "0.13.0", default-features = false, features = ["html"] }
 rand = "0.9.2"
 regex = "1.12.2"
+rpassword = "7.4.0"
 rusqlite = { version = "0.37.0", features = ["bundled"] }
 rustc-hash = "2.1.1"
 rustc-stable-hash = "0.1.2"
@@ -221,6 +222,7 @@ unicode-ident.workspace = true
 url.workspace = true
 walkdir.workspace = true
 winnow.workspace = true
+rpassword.workspace = true
 
 [target.'cfg(target_has_atomic = "64")'.dependencies]
 tracing-chrome.workspace = true

src/cargo/util/context/schema.rs

@@ -51,6 +51,9 @@ pub struct CargoHttpConfig {
     pub debug: Option<bool>,
     pub multiplexing: Option<bool>,
     pub ssl_version: Option<SslVersionConfig>,
+    pub client_ssl_cert: Option<ConfigRelativePath>,
+    pub client_ssl_key: Option<ConfigRelativePath>,
+    pub client_ssl_key_protected: Option<bool>,
 }
 
 /// The `[future-incompat-report]` stable

src/cargo/util/network/http.rs

@@ -69,6 +69,22 @@ pub fn configure_http_handle(gctx: &GlobalContext, handle: &mut Easy) -> CargoRe
     if let Some(check) = http.check_revoke {
         handle.ssl_options(SslOpt::new().no_revoke(!check))?;
     }
+    if let Some(client_ssl_cert) = &http.client_ssl_cert {
+        let client_ssl_cert = client_ssl_cert.resolve_path(gctx);
+        handle.ssl_cert(&client_ssl_cert)?;
+    }
+    if let Some(client_ssl_key) = &http.client_ssl_key {
+        let client_ssl_key = client_ssl_key.resolve_path(gctx);
+        handle.ssl_key(&client_ssl_key)?;
+
+        if http.client_ssl_key_protected.unwrap_or_default() {
+            let key_password = rpassword::prompt_password(format!(
+                "Password for certificate key file {}:",
+                client_ssl_key.display()
+            ))?;
+            handle.key_password(&key_password)?;
+        }
+    }
 
     if let Some(user_agent) = &http.user_agent {
         handle.useragent(user_agent)?;