Cryptographic signature verification of build dependencies

Would be interested to compare this approach to other similar systems (e.g. Ruby Gems, CPAN, NuGet). At first blush it seems like none of these provide any mechanism to check the authenticity of artifacts.