CARGO_HOME with `..` + git dependency issue `warning: skipping duplicate package`

[kaspar030]

Problem

I have a CARGO_HOME like /home/kaspar/tmp/subfolder/../cargo. With any git dependency, this leads to the following warnings:

❯ CARGO_HOME=/home/kaspar/tmp/subfolder/../cargo cargo build
    Updating git repository `https://github.com/serde-rs/serde`
warning: skipping duplicate package `serde v1.0.225 (https://github.com/serde-rs/serde#ee3c2372)`:
  /home/kaspar/tmp/cargo/git/checkouts/serde-1b10f8d7b61b7b51/ee3c237/serde/Cargo.toml
in favor of /home/kaspar/tmp/subfolder/../cargo/git/checkouts/serde-1b10f8d7b61b7b51/ee3c237/serde/Cargo.toml

warning: skipping duplicate package `serde_core v1.0.225 (https://github.com/serde-rs/serde#ee3c2372)`:
  /home/kaspar/tmp/subfolder/../cargo/git/checkouts/serde-1b10f8d7b61b7b51/ee3c237/serde_core/Cargo.toml
in favor of /home/kaspar/tmp/cargo/git/checkouts/serde-1b10f8d7b61b7b51/ee3c237/serde_core/Cargo.toml

warning: skipping duplicate package `serde_derive v1.0.225 (https://github.com/serde-rs/serde#ee3c2372)`:
  /home/kaspar/tmp/subfolder/../cargo/git/checkouts/serde-1b10f8d7b61b7b51/ee3c237/serde_derive/Cargo.toml
in favor of /home/kaspar/tmp/cargo/git/checkouts/serde-1b10f8d7b61b7b51/ee3c237/serde_derive/Cargo.toml

    Updating crates.io index
   Compiling serde_core v1.0.225 (https://github.com/serde-rs/serde#ee3c2372)
   Compiling serde v1.0.225 (https://github.com/serde-rs/serde#ee3c2372)
   Compiling build-dir-test v0.1.0 (/home/kaspar/tmp/build-dir-test)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 2.26s

Note that these paths point to the same directory:

/home/kaspar/tmp/subfolder/../cargo/git/checkouts/serde-1b10f8d7b61b7b51/ee3c237/serde_core/Cargo.toml
/home/kaspar/tmp/cargo/git/checkouts/serde-1b10f8d7b61b7b51/ee3c237/serde_core/Cargo.toml

Steps

1. cargo new tester; cd tester
2. cargo add serde --git "https://github.com/serde-rs/serde"
3. CARGO_HOME=${HOME}/tmp/subfolder/../cargo cargo build

Possible Solution(s)

canonicalize() the crate path?

Notes

No response

Version

I see this both on 1.89 and current nightly:


❯ cargo version --verbose
cargo 1.89.0 (c24e10642 2025-06-23)
release: 1.89.0
commit-hash: c24e1064277fe51ab72011e2612e556ac56addf7
commit-date: 2025-06-23
host: x86_64-unknown-linux-gnu
libgit2: 1.9.0 (sys:0.20.2 vendored)
libcurl: 8.12.1-DEV (sys:0.4.80+curl-8.12.1 vendored ssl:OpenSSL/3.5.0)
ssl: OpenSSL 3.5.0 8 Apr 2025
os: Arch Linux Rolling Release [64-bit]
tester on  main took 75ms 
❯ cargo +nightly version --verbose
cargo 1.92.0-nightly (24bb93c38 2025-09-10)
release: 1.92.0-nightly
commit-hash: 24bb93c388fb8c211a37986539f24a819dc669d3
commit-date: 2025-09-10
host: x86_64-unknown-linux-gnu
libgit2: 1.9.1 (sys:0.20.2 vendored)
libcurl: 8.15.0-DEV (sys:0.4.83+curl-8.15.0 vendored ssl:OpenSSL/3.5.2)
ssl: OpenSSL 3.5.2 5 Aug 2025
os: Arch Linux Rolling Release [64-bit]