This is a clone of the same issue reported against the cargo plugin for bst-1: https://gitlab.com/BuildStream/bst-external/-/issues/48
Some Cargo.lock files can specify dependencies through git repositories, but the cargo plugin is unable to handle this case.