2. rebuild it without the cache
3. hash that
4. compare
Or, trust somebody who has. Inconvenient, but is there any other way to establish trust in the correspondence between code and a binary?