If we assume the worst of the maintainer/packager, of course it's no better. I'm assuming some adherence to these guidelines, otherwise they should be removed

If we assume the worst of the maintainer/packager, of course it's no better. I'm assuming some adherence to these guidelines, otherwise they should be removed from the service: https://docs.fedoraproject.org/en-US/packaging-guidelines/#_no_files_or_directories_under_srv_usrlocal_or_homeuser https://docs.fedoraproject.org/en-US/packaging-guidelines/#_... A package adhering to this guideline modifying system files, as designed, is not a problem. They are explicitly prohibited from modifying user data. My point with managers vs scripts is that managers provide some sanity. Not perfection. I trust: - a versioned package - built to the linked standards - from upstream sources in an offline environment Far more than I do curl | bash. There is far less ambiguity and I can actually reproduce this exact environment at some point.