search

M4SS-Code / cargo-goggles

Verify that registry crates in your Cargo.lock are reproducible from the git repository
https://crates.io/crates/cargo-goggles
Apache License 2.0
36 stars 2 forks source link

Duplicate tarball files and case-insensitive file systems complicate path checks #30

Open kornelski opened 6 months ago

kornelski commented 6 months ago

Beware that it's possible to have a tarball with cargo.toml that will be readable as Cargo.toml on a case-insensitive file system, but will not match path == "Cargo.toml" check in Rust.

Due to case-insensitivity confusion, cargo package can behave differently on macOS and Windows where it may end up with both README.md and Readme.md or an extra cargo.lock: https://github.com/rust-lang/cargo/issues/13722

Unfortunately there's a bunch of old crates affected by this.

https://github.com/rust-lang/crates.io/issues/8410