Not distributed but for windows users, https://chocolatey.org/. According to https://chocolatey.org/security it verifies package checksums.

Of course chocolatey itself could be compromised.