DoShelf
Every app comes with its source code, a plain list of permissions and a checksum for each file.