Distros don't do this and have communally enforced conventions for package revisions that don't involve updates/changes to the upstream source. Proprietary sof

Distros don't do this and have communally enforced conventions for package revisions that don't involve updates/changes to the upstream source. Proprietary software vendors and in-house corporate repos might pull sloppy crap here, though. It is nice when your package manager reliably alerts you to changes like that, though! Binary package managers can't, really— although this feature could be added— but sourced-based ones often do. Nix and Guix enforce this categorically, including for upstream source tarballs for source builds. Even Homebrew includes hashes for its binaries, and provides options to enforce them (refusing to install packages whose recipes don't include hashes).