Package managers usually verify checksums during install, but this fails against upstream supply chain attacks or post-install mods. There needs to be a more widely adopted mechanism or standard for continuous verification of installed tooling against a source of truth. This applies to scripts and compiled binaries, with the latter being more challenging when built locally from variable inputs.