def diff(vault_client, opt):
    """Derive a comparison between what is represented in the Secretfile
    and what is actually live on a Vault instance"""
    if opt.thaw_from:
        opt.secrets = tempfile.mkdtemp('aomi-thaw')
        auto_thaw(vault_client, opt)

    ctx = Context.load(get_secretfile(opt), opt) \
                 .fetch(vault_client)

    for backend in ctx.mounts():
        diff_a_thing(backend, opt)

    for resource in ctx.resources():
        diff_a_thing(resource, opt)

    if opt.thaw_from:
        rmtree(opt.secrets)
Derive a comparison between what is represented in the Secretfile
    and what is actually live on a Vault instance