You will need python3 and curl.
build.py which will output a new version of
src/lib.rs. You can now
compare and audit. The code is generated in deterministic order so changes
to the source should only result from upstream changes.
build.py also verifies the signature published alongside the list.