Comment 0 for bug 2009512

dh-cargo version: 28ubuntu1

In order to use vendored dependencies in Rust, you need to replace the source of the crate (commonly crates.io) by a local path which points to your vendored dependencies.
dh-cargo auto generates the file config.toml, which is used to override said sources, with the following template:
"
[source.crates-io]
replace-with = "dh-cargo-registry"

[source.dh-cargo-registry]
directory = "{0}"
", where 0 corresponds to the path of the local dependencies.

If the package has dependencies from sources other than crates.io, dh-cargo won't replace those sources by the vendored path and instead you need to manually patch the mentioned config file to replace your other sources, e.g.:
"
[source.other-than-crates-io]
replace-with = "dh-cargo-registry"
"

An example of this fix can be found at https://github.com/ubuntu/aad-auth/commit/e8583303402a79a72acaf97beb4c38ac80f858bb.

All the dependencies of the project are listed in the Cargo.lock file. dh-cargo should consult this file in order to get the dependencies sources and then override them in the config.toml file to ensure that each source is replaced by its vendored counterpart.