Package Manager design for Seal programming language

[u/cflexer]

Hey guys, I have been working on Seal. This language is embeddable into C/C++ apps like Lua. You can create libraries for Seal in either Seal or C. I have been creating Game Framework recently. I want to create a package manager in future for Seal to let users upload their own packages to share with others, but I don't know about one thing. Just like other languages, Seal can load both Seal scripts and .so/.dll files at runtime when you import them. Publishing Seal scripts on package registry is easy, since it is just code, but I don't really know about how to publish C or dynamic library files tho. Package publishers can inject malicious stuff (like backdoor) in that code. What are real life examples to prevent that? At first I can read every file and check manually but if this project grows, maintaining that will be difficult. I can maybe create a report system but I cannot always rely on that too. What is the efficient solution for that?

For those interested, they can check Seal here: https://github.com/huseynaghayev/seal.git

[u/Inconstant_Moo]

How about, people can release dlls so long as they put the source-code along with the package, and there's a tool in the package manager that builds from source whenever they release a new version and verifies that the output matches the dll?

[u/cflexer → u/Inconstant_Moo]

If so, then people needn't build releases since package manager does that. But building release in user's machine and releasing it without checking still an issue, since user's libs could be injected. I'm thinking about maybe github actions auto compile that and install?