diff -Nru dh-cargo-28/cargo.pm dh-cargo-28ubuntu1/cargo.pm
--- dh-cargo-28/cargo.pm	2021-11-07 13:54:52.000000000 +0100
+++ dh-cargo-28ubuntu1/cargo.pm	2022-08-24 13:18:46.000000000 +0200
@@ -142,8 +142,13 @@
     my $this=shift;
     doit("cp", "debian/cargo-checksum.json",
          ".cargo-checksum.json");
-    rm_files("Cargo.lock");
-    doit("/usr/share/cargo/bin/cargo", "prepare-debian", "debian/cargo_registry", "--link-from-system");
+    if (defined $ENV{'CARGO_VENDOR_DIR'}) {
+        doit("/usr/share/cargo/bin/cargo", "prepare-debian", $ENV{'CARGO_VENDOR_DIR'});
+        doit("/usr/share/cargo/bin/dh-cargo-vendored-sources.pl");
+    } else {
+        rm_files("Cargo.lock");
+        doit("/usr/share/cargo/bin/cargo", "prepare-debian", "debian/cargo_registry", "--link-from-system");
+    }
 }
 
 sub test {
@@ -189,6 +194,15 @@
         my $destdir = $ENV{'DESTDIR'} || tmpdir($this->{binpkg});
         doit("env", "DESTDIR=$destdir",
              "/usr/share/cargo/bin/cargo", "install", @_);
+        if (defined $ENV{'CARGO_VENDOR_DIR'}) {
+            if (-e "Cargo.lock") {
+                my $lockfile_dir=tmpdir($this->{binpkg}) . "/usr/share/doc/" . $this->{binpkg};
+                install_dir($lockfile_dir);
+                install_file("Cargo.lock", $lockfile_dir . "/Cargo.lock");
+            } else {
+                warning("Cargo.lock file not found!");
+            }
+        }
         # generate Built-Using fields
         doit("env", "/usr/share/cargo/bin/dh-cargo-built-using", $this->{binpkg});
     }
diff -Nru dh-cargo-28/debian/changelog dh-cargo-28ubuntu1/debian/changelog
--- dh-cargo-28/debian/changelog	2021-11-07 13:59:57.000000000 +0100
+++ dh-cargo-28ubuntu1/debian/changelog	2022-08-24 13:20:03.000000000 +0200
@@ -1,3 +1,11 @@
+dh-cargo (28ubuntu1) kinetic; urgency=medium
+
+  * Add support for using vendored sources, including checking the validity of
+    XS-Vendored-Sources-Rust field via the new dh-cargo-vendored-sources.pl
+    script, and shipping the Cargo.lock file. (LP: #1987515)
+
+ -- Simon Chopin <schopin@ubuntu.com>  Wed, 24 Aug 2022 13:20:03 +0200
+
 dh-cargo (28) unstable; urgency=medium
 
   * Support packages with ruzt-* prefix to help with debcargo testing.
diff -Nru dh-cargo-28/debian/control dh-cargo-28ubuntu1/debian/control
--- dh-cargo-28/debian/control	2021-11-01 01:04:27.000000000 +0100
+++ dh-cargo-28ubuntu1/debian/control	2022-08-24 13:20:03.000000000 +0200
@@ -1,7 +1,8 @@
 Source: dh-cargo
 Section: devel
 Priority: optional
-Maintainer: Rust Maintainers <pkg-rust-maintainers@lists.alioth.debian.org>
+Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
+XSBC-Original-Maintainer: Rust Maintainers <pkg-rust-maintainers@lists.alioth.debian.org>
 Uploaders: Josh Triplett <josh@joshtriplett.org>, Ximin Luo <infinity0@debian.org>
 Build-Depends: debhelper-compat (= 13)
 Standards-Version: 4.5.1
diff -Nru dh-cargo-28/debian/dh-cargo.install dh-cargo-28ubuntu1/debian/dh-cargo.install
--- dh-cargo-28/debian/dh-cargo.install	2019-03-18 01:39:47.000000000 +0100
+++ dh-cargo-28ubuntu1/debian/dh-cargo.install	2022-08-24 13:20:03.000000000 +0200
@@ -1,3 +1,4 @@
-cargo.pm             /usr/share/perl5/Debian/Debhelper/Buildsystem/
-dh-cargo-built-using /usr/share/cargo/bin
-cargo-auto-test      /usr/share/cargo/bin
+cargo.pm                        /usr/share/perl5/Debian/Debhelper/Buildsystem/
+dh-cargo-built-using            /usr/share/cargo/bin
+cargo-auto-test                 /usr/share/cargo/bin
+dh-cargo-vendored-sources.pl    /usr/share/cargo/bin
diff -Nru dh-cargo-28/debian/tests/control dh-cargo-28ubuntu1/debian/tests/control
--- dh-cargo-28/debian/tests/control	1970-01-01 01:00:00.000000000 +0100
+++ dh-cargo-28ubuntu1/debian/tests/control	2022-08-24 13:20:03.000000000 +0200
@@ -0,0 +1,3 @@
+Tests: vendor-tests.sh
+Depends: @, build-essential
+Restrictions: allow-stderr
Les fichiers binaires /tmp/AdViz_90jH/dh-cargo-28/debian/tests/dh-cargo-vendor-test_0.0.1-1.debian.tar.xz et /tmp/ik5YuKApPy/dh-cargo-28ubuntu1/debian/tests/dh-cargo-vendor-test_0.0.1-1.debian.tar.xz sont différents
diff -Nru dh-cargo-28/debian/tests/dh-cargo-vendor-test_0.0.1-1.dsc dh-cargo-28ubuntu1/debian/tests/dh-cargo-vendor-test_0.0.1-1.dsc
--- dh-cargo-28/debian/tests/dh-cargo-vendor-test_0.0.1-1.dsc	1970-01-01 01:00:00.000000000 +0100
+++ dh-cargo-28ubuntu1/debian/tests/dh-cargo-vendor-test_0.0.1-1.dsc	2022-08-24 13:20:03.000000000 +0200
@@ -0,0 +1,20 @@
+Format: 3.0 (quilt)
+Source: dh-cargo-vendor-test
+Binary: dh-cargo-vendor-test
+Architecture: any
+Version: 0.0.1-1
+Maintainer: Simon Chopin <schopin@ubuntu.com>
+Standards-Version: 4.5.1
+Build-Depends: debhelper (>= 12), dh-cargo (>= 25), cargo:native, rustc:native
+Package-List:
+ dh-cargo-vendor-test deb utils optional arch=any
+Checksums-Sha1:
+ 53b2aea773e41de00efe54b6b913bf47b57912c5 1116 dh-cargo-vendor-test_0.0.1.orig.tar.xz
+ 5f9ca9c4647424f4aed56257cefad9418efc579c 940 dh-cargo-vendor-test_0.0.1-1.debian.tar.xz
+Checksums-Sha256:
+ b24897219884dd105d0087f9b77c827106dc25cba832a40121cb0902bbb0a90d 1116 dh-cargo-vendor-test_0.0.1.orig.tar.xz
+ 2346e50307d217446a78701c2821bf9a98785788186ee2ec124b3541f1849b5e 940 dh-cargo-vendor-test_0.0.1-1.debian.tar.xz
+Files:
+ b66e07d61eb85e555ffed0da6be153d9 1116 dh-cargo-vendor-test_0.0.1.orig.tar.xz
+ 83612654e319df4f6469a5a446abfa76 940 dh-cargo-vendor-test_0.0.1-1.debian.tar.xz
+Vendored-Sources-Rust: boguscrate2@1.0.3, boguscrate@42.0.3
Les fichiers binaires /tmp/AdViz_90jH/dh-cargo-28/debian/tests/dh-cargo-vendor-test_0.0.1.orig.tar.xz et /tmp/ik5YuKApPy/dh-cargo-28ubuntu1/debian/tests/dh-cargo-vendor-test_0.0.1.orig.tar.xz sont différents
diff -Nru dh-cargo-28/debian/tests/vendor-tests.sh dh-cargo-28ubuntu1/debian/tests/vendor-tests.sh
--- dh-cargo-28/debian/tests/vendor-tests.sh	1970-01-01 01:00:00.000000000 +0100
+++ dh-cargo-28ubuntu1/debian/tests/vendor-tests.sh	2022-08-24 13:20:03.000000000 +0200
@@ -0,0 +1,26 @@
+#!/bin/sh
+
+set -e
+
+cp debian/tests/dh-cargo-vendor-test* $AUTOPKGTEST_TMP
+cd $AUTOPKGTEST_TMP
+dpkg-source --no-check -x dh-cargo-vendor-test_0.0.1-1.dsc
+
+cd dh-cargo-vendor-test-0.0.1
+cp debian/control.valid-field debian/control
+
+dpkg-buildpackage
+
+cp debian/control.no-field debian/control
+if dpkg-buildpackage 2> ../error_logs; then
+    echo "This test should have failed!"
+    exit 1
+fi
+grep -q "XS-Vendored-Sources-Rust" ../error_logs
+
+cp debian/control.bad-version debian/control
+if dpkg-buildpackage 2> ../error_logs; then
+    echo "This test should have failed!"
+    exit 1
+fi
+grep -q "XS-Vendored-Sources-Rust" ../error_logs
diff -Nru dh-cargo-28/dh-cargo-vendored-sources.pl dh-cargo-28ubuntu1/dh-cargo-vendored-sources.pl
--- dh-cargo-28/dh-cargo-vendored-sources.pl	1970-01-01 01:00:00.000000000 +0100
+++ dh-cargo-28ubuntu1/dh-cargo-vendored-sources.pl	2022-08-24 13:20:03.000000000 +0200
@@ -0,0 +1,55 @@
+#!/usr/bin/perl
+#
+# Checks that the current package's Vendored-Sources-Rust field is up-to-date
+
+use Dpkg::Control::Info;
+use JSON::PP;
+
+unless (defined $ENV{CARGO_VENDOR_DIR}) {
+    print STDERR "CARGO_VENDOR_DIR environment variable not defined, aborting\n";
+    exit 1;
+}
+
+my $vendor_dir = $ENV{CARGO_VENDOR_DIR};
+
+sub cargo_info {
+    my $src = shift;
+    open(F, "cargo metadata --manifest-path $src --no-deps --format-version 1 |");
+    local $/;
+    my $json = JSON::PP->new;
+    my $manifest = $json->decode(<F>);
+    my $crate = %{@{%{$manifest}{'packages'}}[0]}{'name'};
+    my $version = %{@{%{$manifest}{'packages'}}[0]}{'version'};
+    return "$crate\@$version";
+}
+
+my @unsorted_expected = ();
+
+opendir my $dh, $vendor_dir or die "Cannot open directory: $!";
+
+# We operate under the assumption of a flat vendor directory with one crate per subdir,
+# as is generated by `cargo vendor`.
+my @crates = readdir $dh;
+foreach my $crate (@crates) {
+    next if $crate eq ".";
+    next if $crate eq "..";
+    next unless -d "$vendor_dir/$crate";
+    next unless -e "$vendor_dir/$crate/Cargo.toml";
+    push(@unsorted_expected, cargo_info("$vendor_dir/$crate/Cargo.toml"));
+}
+@expected = sort @unsorted_expected;
+
+my $control = Dpkg::Control::Info->new();
+my $source = $control->get_source();
+
+my $actual_raw = $source->get_custom_field('Vendored-Sources-Rust');
+my @actual = sort(split(/,\s*/, $actual_raw));
+
+my $expected_formatted = join(', ', @expected);
+my $actual_formatted = join(', ', @actual);
+
+if ($expected_formatted ne $actual_formatted) {
+    print STDERR "Mismatched XS-Vendored-Sources-Rust field. Expected:\n";
+    print STDERR "XS-Vendored-Sources-Rust: $expected_formatted\n";
+    exit 2;
+}