Apache-2.0/ISC/MIT
You will need python3 and curl.
Run build.py
which will output a new version of src/lib.rs
. You can now compare and audit. The code is generated in deterministic order so changes to the source should only result from upstream changes.
build.py
also verifies the signature published alongside the list.