The answer for "what's the source of this version of this crate?" is always "what was published to crates.io?", the content of the git repository should be irre

The answer for "what's the source of this version of this crate?" is always "what was published to crates.io?", the content of the git repository should be irrelevant. All serious code review efforts should always operate on the code that's actually going to be used instead of the upstream git repository, for reasons outlined by the blog post. This is how cargo-crev already works: https://github.com/crev-dev/cargo-crev https://github.com/crev-dev/cargo-crev