No warning when Git dependency repository contains multiple packages with the same name

[toriningen]

Problem

I have this minimal example project, which depends on foobar package from this repository, which in turn has multiple places defining package foobar.

Now there is no warning or error when cargo selects one arbitrary instance of foobar to use. After a bit of experimenting I also couldn't find any logic in what particular instance is selected — it's seemingly stable across compilations, but there's no obvious connection to lexical sorting of paths or their depth.

Steps

1. git clone https://github.com/toriningen/cargo-project-with-ambiguous-dependency
2. cd cargo-project-with-ambiguous-dependency
3. cargo build. It builds without complaining.
4. cargo run. It shows any of three paths where foobar is defined in https://github.com/toriningen/ambiguous-cargo-git-dependency.

Possible Solution(s)

It would have been nice if cargo could bail out stating that foobar is defined in multiple places, or at least warn (indicating particular selected path) about this condition.

Notes

Real world case might be when somebody has lots of similar self-registering components under some common directory, and copies their Cargo.toml files, forgetting to rename the package, which could go unnoticed for some time.

Version

cargo 1.62.0-nightly (edffc4a 2022-04-19)
release: 1.62.0-nightly
commit-hash: edffc4ada3d77799e5a04eeafd9b2f843d29fc23
commit-date: 2022-04-19
host: x86_64-unknown-linux-gnu
libgit2: 1.4.2 (sys:0.14.2 vendored)
libcurl: 7.80.0-DEV (sys:0.4.51+curl-7.80.0 vendored ssl:OpenSSL/1.1.1m)
os: Ubuntu 21.04 (hirsute) [64-bit]

[weihanglo]

Thanks for the report! It should be improved for sure.

Some notes from my understanding: A GitSource is in fact a kind of recursive PathSource which tries its best to find all nested packages. It is unfortunate that it only emits logs for duplicates at this moment. I wonder we could turn info! into config.shell.warn() or else to inform users of the situation.

cargo/src/cargo/ops/cargo_read_manifest.rs

Lines 185 to 191 in 11d4599

	Entry::Occupied(_) => {
	info!(
	"skipping nested package `{}` found at `{}`",
	pkg.name(),
	path.to_string_lossy()
	);
	}

The message needs to polish as well, something similar to

"skipping duplicate package `{pkgid}` found at `{path}`".

[danilhendrasr]

@rustbot claim