udpate for vendored code

Author: jeroen

README.md

@@ -55,4 +55,6 @@ Personally I think it would be better if CRAN could set a global `CARGO_HOME` on
 
 Generally speaking, the R package description and license files (that are included with every source package) should declare authorship and copyright of __all source code that is contained within this source package__. Hence, if you copied any material authored by other people in a package that you submit to CRAN, you must mention those people and the copyright in the description, because CRAN hosts this material on their servers.
 
-I don't think the package description should name authors of 3rd party things which your package depends on, or links to, or downloads, if that source code is not included with the source package that is on hosted CRAN. This is not a legal statement of any kind, but simply about labeling what is actually in the box.
+I don't think the package description should name authors of 3rd party things which your package depends on, or links to, if that source code is not included with the source package that is on hosted CRAN. This is not a legal statement of any kind, but simply about labeling what is actually in the box.
+
+If you *vendor* the full rust code in your R package, you must name authors of all cargo dependencies. Because there can be many, the best way to do this by creating an `AUTHORS` file in your R package `inst` folder. The hellorust package has a [script](https://github.com/r-rust/hellorust/blob/master/src/myrustlib/vendor-authors.R) that automatically generates the `inst/AUTHORS` file from `cargo metadata` when building the R source package. See also: https://github.com/r-rust/hellorust#vendoring