[Bug 1987640] [NEW] cargo: track vendored dependencies in source control file

[Simon Chopin]

Public bug reported:

We need to be able to know exactly which versions of the dependencies
are shipped with a given cargo package. Since we're vendoring them, we
cannot use the Built-Using field, and we should instead use a dedicated
field, i.e. XS-Vendored-Sources-Rust as proposed there:

https://github.com/cpaelzer/ubuntu-mir/pull/3

For completeness, we could in addition ship the Cargo.lock in
/usr/share/doc/cargo

** Affects: cargo (Ubuntu)
     Importance: Undecided
     Assignee: Simon Chopin (schopin)
         Status: In Progress

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to cargo in Ubuntu.
https://bugs.launchpad.net/bugs/1987640

Title:
  cargo: track vendored dependencies in source control file

Status in cargo package in Ubuntu:
  In Progress

Bug description:
  We need to be able to know exactly which versions of the dependencies
  are shipped with a given cargo package. Since we're vendoring them, we
  cannot use the Built-Using field, and we should instead use a
  dedicated field, i.e. XS-Vendored-Sources-Rust as proposed there:

  https://github.com/cpaelzer/ubuntu-mir/pull/3

  For completeness, we could in addition ship the Cargo.lock in
  /usr/share/doc/cargo

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cargo/+bug/1987640/+subscriptions