`cargo package` includes multiple README files when the case is not all upper-case

[ehuss]

Problem

If a package has a Readme.md file (and no readme field in Cargo.toml), it will end up with two readme files in the package.

This regressed in rust-lang/rust#96031 (rust 1.62.0). I'm not sure which of those is responsible.

Steps

1. cargo new foo
2. cd foo
3. touch Readme.md
4. cargo package --list --allow-dirty

Possible Solution(s)

No response

Notes

No response

Version

cargo 1.77.1 (e52e36006 2024-03-26)
release: 1.77.1
commit-hash: e52e360061cacbbeac79f7f1215a7a90b6f08442
commit-date: 2024-03-26
host: x86_64-apple-darwin
libgit2: 1.7.2 (sys:0.18.2 vendored)
libcurl: 8.6.0 (sys:0.4.70+curl-8.5.0 system ssl:(SecureTransport) LibreSSL/3.3.6)
ssl: OpenSSL 1.1.1w  11 Sep 2023
os: Mac OS 14.5.0 [64-bit]

[epage]

This is a subset of #13722.

I'm assuming the root cause is #10548 which mirrored existing license logic over for readme's.

[Turbo87]

has there been any work done on this yet? would it be viable to revert #10548 if that is indeed the root cause of this bug?

[epage]

@Turbo87 this has been in since 1.62 and was just reported just over a month ago. What is bad enough about this that a partial revert of #10548 should be considered?

[Turbo87]

What is bad enough about this that a partial revert of #10548 should be considered?

we would like to turn the server-side validation for duplicate files back on to prevent potential security issues. that is admittedly unlikely to be relevant for the readme, but might be an issue for code modules depending on the system. e.g. it would be bad if for example docs.rs showed different sources than what is actually getting compiled in because of casing conflicts.

[epage]

@Turbo87 so your concern is more about #13722 than this issue?

[Turbo87]

to some degree yes, though this one here is apparently what is commonly happening in production from what I've seen so far

[jian-lin]

If a package has a Readme.md file (and no readme field in Cargo.toml), it will end up with two readme files in the package.

This bug also happens if there is readme = "README.md" in cargo.toml.

---

I cannot reproduce this on linux but I can reproduce this on darwin.