I am working on a project that uses the current master of lightning as a dependency.
The crate has a musig2 dependency that is listed under [target.'cfg(taproot)'.dependencies], i.e. according to my understanding should only be included when building the library with RUSTFLAGS=--cfg=taproot. I was able to confirm this behavior when directly building thelightning library.
However, when I add the library as a git dependency to another crate (cargo add --git https://github.com/lightningdevkit/rust-lightning.git lightning), musig2 ends up as a transitive dependency, which I don't understand. Why does cargo end up using this custom cfg flag?
By "ends up as a transitive dependency," do you just mean that musig2 is listed in the Cargo.lock? That's normal; Cargo.lock files have to list all dependencies regardless of cfg conditions so that two different people building your project with --cfg=taproot will get the same version of musig2.
This is the same reason as why adding a crate to Cargo.toml that has Windows-specific dependencies will result in those dependencies always being listed in Cargo.lock, even if you're on Linux.