How to find source for a package that differs from the upstream tool?

For example, the tool-vnproch55x package.
The github link is for the upstream tool, not whatever is in the pio package.

The binary packaged by pio and the upstream tool are incompatible and different.
The pio version works, while upstream doesn’t like my bootloader.
Also, the platformio usage vnproch55x [-f] binary, while upstream is vnproch55x binary and -f results in a usage error.
-h causes a segfault in the pio version, and a missing file error in upstream.

Pio version:

~/.platformio/packages/tool-vnproch55x/vnproch55x -f blink.bin 
------------------------------------------------------------------
CH55x Programmer by VNPro
------------------------------------------------------------------
DeviceVersion of CH55x: 2.40 
MCU ID: 59 11
Found Device CH559
Bootloader: 2.4.0
ID: E5 4E 5D BC
XOR Mask: 4C 4C 4C 4C 4C 4C 4C A5 
Write 280 bytes from bin file.
..................................................
Write complete!!!
Verify chip
..................................................
Verify complete!!!
------------------------------------------------------------------

Upstream version:

./vnproch55x blink.bin
------------------------------------------------------------------                                                                                                               
CH55x Programmer by VNPro
------------------------------------------------------------------
Found Device CH559
Bootloader: 2.4.0
ID: E5 4E 5D BC
Not support

So someone has done a fair amount of modification before packaging it for pio, how do I see what they changed?

Can you open an issue in platform-intelmcs51?

Is there version info (--version) or the date of the package / the executable that could help you determine what commit of vnproch55x was used?

This question isn’t really about the bugs in vnproch55x, but more how platformio tools are packaged.
(vnproch55x doesn’t implement --version or even --help)

Reading about how to publish a package, it looks like you just upload a random tarball that may contain binaries with pio pkg publish, and there is no requirement to have any kind of traceability to what is in those binaries?

Kinda related, where should I ask about getting a package made for GitHub - atc1441/chflasher ?
I found that chflasher.py works way better than vnproch55x

Any user can freely create packages and submit them to the PlatformIO trusted registry. In the last month I had 3 or so registered. You just need to create a package.json that describes the metainformation for your tool and use the PlatformIO CLI’s pio pkg pack/publish commands.

https://docs.platformio.org/en/latest/platforms/creating_platform.html#packages