> While it’s possible to audit the code of a crate on https://docs.rs https://docs.rs on clicking on a [src] button, it turns that I couldn’t find a way to insp

> While it’s possible to audit the code of a crate on https://docs.rs https://docs.rs on clicking on a [src] button, it turns that I couldn’t find a way to inspect build.rs files. Thus, combined with a malicious update, it’s the almost perfect backdoor. Docs.rs has its own source view on /crate that's separate from rustdoc's. For example, you can see the build.rs for boring-sys on `https://docs.rs/crate/boring-sys/1.1.1/source/build.rs https://docs.rs/crate/boring-sys/1.1.1/source/build.rs`.