Beware that it's possible to have a tarball with cargo.toml that will be readable as Cargo.toml on a case-insensitive file system, but will not match path == "Cargo.toml" check in Rust.
Due to case-insensitivity confusion, cargo package can behave differently on macOS and Windows where it may end up with both README.md and Readme.md or an extra cargo.lock: rust-lang/cargo#13722
Unfortunately there's a bunch of old crates affected by this.
rust-lang/crates.io#8410