Tooling for verifying wasm was compiled from the public source

Hello

Maybe this is just a paranoia on my side. However, currently if I want to do an audit of my dependencies, I can download and extract the crate source downloaded from crates.io and read it. There are even tools promoting such approach, like [cargo-crev](https://crates.io/crates/cargo-crev).

But if the crate contains the binary wasm code, reading it and understanding what it does gets much harder. I understand that the compiled code can't do arbitrary stuff to the system itself, but it could still produce malicious code into its output, or simply be buggy and produce wrong code.

So I wonder, would it be possible to somehow make it possible (by some tooling) to automatically bundle both the original source code and the wasm and have a way to opt into the longer compile time, but making sure it is indeed from the given sources?

The issue names no files, tests, or entry points. Start by reviewing the repository's current WebAssembly build and packaging workflow, then determine how source bundling and reproducible verification could fit it; done would mean a documented, opt-in way to verify that distributed wasm matches the public source.

Written by the indexing model from the issue text.