This is a hard problem to solve. It seems to me the best way to mitigate most of the issues is to disallow developers to upload the built artifacts and instead have the repositories build them. That way, at least you can guarantee the source corresponds to the hosted artifacts. On the other hand, this now puts a huge burden on the package hosters to provide the infrastructure to compile everything. And forget about any oddball packages that require esoteric or picky tools