Hi edo1
... Ok, which format of source package could be used? ...
If you downloaded a source tarball, you could submit that.
If you used git to fetch the source in a build script, theoretically, the script could be sufficient.
My scripts tar up the build directory and include that in the email being submitted.
... Indeed I'm very disappointed with TCL extension system. I sent the binary package and it was approved soon after. So any user can install this package using tce-load.
It is so easy to upload a package with a backdoor, and there is almost no way to check / prevent this.
IMO every package should have sources (or building scripts) published. And the binary package should be built in a trusted environment (or reproducible build used). All distributions I know do this way.
Source code can contain mischievous code, so that means individuals well versed in understanding code that have the
time to review it. The same holds true for build scripts. This is a small distro with finite resources. As a result, we also
rely on volunteers to submit extensions.