Since the headline here is Debian 9, it is worth nothing that changes in Debian 9 address a small part of this overall problem. One can nowadays at least not g

Since the headline here is Debian 9, it is worth nothing that changes in Debian 9 address a small part of this overall problem. One can nowadays at least not give one repository owner the power to sign impostors of every repository that one has configured, by associating a public key directly with an individual repository rather than placing it into a global keyring. * http://jdebp.eu./Softwares/package-repositories.html#Debian http://jdebp.eu./Softwares/package-repositories.html#Debian The rest of the problem still exists, though. Only one package manager that I know of even tries to address it, by having pre/post-install/upgrade/remove actions use a specialist declarative language for things like making directories and dedicated user accounts. But even that has a loophole that allows arbitrary scripts to be executed from within that language. * https://freebsd.org/cgi/man.cgi?query=pkg-create#PLIST_FORMAT https://freebsd.org/cgi/man.cgi?query=pkg-create#PLIST_FORMA... * http://man.openbsd.org/pkg_create#PACKING-LIST_DETAILS http://man.openbsd.org/pkg_create#PACKING-LIST_DETAILS The loophole exists because the provided language simply isn't sufficient for everyday needs. It's quite hard to come up with one that is, whilst not being as worrysome as general-purpose shell script, too.