Checksums of source tarballs is a feature in practically all distributions. I'm familiar specifically with Arch Linux (example PKGBUILD https://git.archlinux.o

Checksums of source tarballs is a feature in practically all distributions. I'm familiar specifically with Arch Linux (example PKGBUILD https://git.archlinux.org/svntogit/packages.git/tree/trunk/PKGBUILD?h=packages/wpa_supplicant https://git.archlinux.org/svntogit/packages.git/tree/trunk/P...), Homebrew (example Formula https://github.com/Homebrew/homebrew-core/blob/master/Formula/gawk.rb https://github.com/Homebrew/homebrew-core/blob/master/Formul...), Slackware (example https://slackbuilds.org/slackbuilds/14.2/development/avr-gcc/avr-gcc.info https://slackbuilds.org/slackbuilds/14.2/development/avr-gcc...)