diff --git a/build/ci.go b/build/ci.go
index c4530b2f4..4ecb993f5 100644
--- a/build/ci.go
+++ b/build/ci.go
@@ -24,9 +24,14 @@ Usage: go run build/ci.go <command> <command flags/arguments>
 
 Available commands are:
 
-	install    [ -arch architecture ] [ -cc compiler ] [ packages... ]                          -- builds packages and executables
-	test       [ -coverage ] [ packages... ]                                                    -- runs the tests
-	lint                                                                                        -- runs certain pre-selected linters
+	lint           -- runs certain pre-selected linters
+	check_tidy     -- verifies that everything is 'go mod tidy'-ed
+	check_generate -- verifies that everything is 'go generate'-ed
+	check_baddeps  -- verifies that certain dependencies are avoided
+
+	install    [ -arch architecture ] [ -cc compiler ] [ packages... ] -- builds packages and executables
+	test       [ -coverage ] [ packages... ]                           -- runs the tests
+
 	archive    [ -arch architecture ] [ -type zip|tar ] [ -signer key-envvar ] [ -signify key-envvar ] [ -upload dest ] -- archives build artifacts
 	importkeys                                                                                  -- imports signing keys from env
 	debsrc     [ -signer key-id ] [ -upload dest ]                                              -- creates a debian source package
@@ -371,7 +376,6 @@ func doLint(cmdline []string) {
 	linter := downloadLinter(*cachedir)
 	lflags := []string{"run", "--config", ".golangci.yml"}
 	build.MustRunCommandWithOutput(linter, append(lflags, packages...)...)
-
 	doGoModTidy()
 	fmt.Println("You have achieved perfection.")
 }
diff --git a/internal/build/file.go b/internal/build/file.go
index c159b5189..2d8c993f3 100644
--- a/internal/build/file.go
+++ b/internal/build/file.go
@@ -16,7 +16,14 @@
 
 package build
 
-import "os"
+import (
+	"crypto/sha256"
+	"io"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+)
 
 // FileExist checks if a file exists at path.
 func FileExist(path string) bool {
@@ -26,3 +33,70 @@ func FileExist(path string) bool {
 	}
 	return true
 }
+
+// HashFiles iterates the provided set of files, computing the hash of each.
+func HashFiles(files []string) (map[string][32]byte, error) {
+	res := make(map[string][32]byte)
+	for _, filePath := range files {
+		f, err := os.OpenFile(filePath, os.O_RDONLY, 0666)
+		if err != nil {
+			return nil, err
+		}
+		hasher := sha256.New()
+		if _, err := io.Copy(hasher, f); err != nil {
+			return nil, err
+		}
+		res[filePath] = [32]byte(hasher.Sum(nil))
+	}
+	return res, nil
+}
+
+// HashFolder iterates all files under the given directory, computing the hash
+// of each.
+func HashFolder(folder string, exlude []string) (map[string][32]byte, error) {
+	res := make(map[string][32]byte)
+	err := filepath.WalkDir(folder, func(path string, d os.DirEntry, _ error) error {
+		// Skip anything that's exluded or not a regular file
+		for _, skip := range exlude {
+			if strings.HasPrefix(path, filepath.FromSlash(skip)) {
+				return filepath.SkipDir
+			}
+		}
+		if !d.Type().IsRegular() {
+			return nil
+		}
+		// Regular file found, hash it
+		f, err := os.OpenFile(path, os.O_RDONLY, 0666)
+		if err != nil {
+			return err
+		}
+		hasher := sha256.New()
+		if _, err := io.Copy(hasher, f); err != nil {
+			return err
+		}
+		res[path] = [32]byte(hasher.Sum(nil))
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return res, nil
+}
+
+// DiffHashes compares two maps of file hashes and returns the changed files.
+func DiffHashes(a map[string][32]byte, b map[string][32]byte) []string {
+	var updates []string
+
+	for file := range a {
+		if _, ok := b[file]; !ok || a[file] != b[file] {
+			updates = append(updates, file)
+		}
+	}
+	for file := range b {
+		if _, ok := a[file]; !ok {
+			updates = append(updates, file)
+		}
+	}
+	sort.Strings(updates)
+	return updates
+}