You can find the source here: https://www.sqlite.org/cgi/src/file?name=tool/src-verify.c&ci=trunk https://www.sqlite.org/cgi/src/file?name=tool/src-verify.c&c..

You can find the source here: https://www.sqlite.org/cgi/src/file?name=tool/src-verify.c&ci=trunk https://www.sqlite.org/cgi/src/file?name=tool/src-verify.c&c... It seems to use a manifest with hashes for every file generated by their VCS.