Tooling for verifying wasm was compiled from the public source

Hello

Maybe this is just a paranoia on my side. However, currently if I want to do an audit of my dependencies, I can download and extract the crate source downloaded from crates.io and read it. There are even tools promoting such approach, like cargo-crev.

But if the crate contains the binary wasm code, reading it and understanding what it does gets much harder. I understand that the compiled code can't do arbitrary stuff to the system itself, but it could still produce malicious code into its output, or simply be buggy and produce wrong code.

So I wonder, would it be possible to somehow make it possible (by some tooling) to automatically bundle both the original source code and the wasm and have a way to opt into the longer compile time, but making sure it is indeed from the given sources?