Those are also all just as bad but you can at least run those fully in containers or vms and never let them touch your host system. Brew however is a system le

Those are also all just as bad but you can at least run those fully in containers or vms and never let them touch your host system. Brew however is a system level package manager so it is expected to install your top level tools with substantial privilege, so for using it on a production capable system you would want maintainer signed commits, maintainer signed reviews, and 2+ maintainer signed reproducible builds, all with well known long lived keys controlled by smartcards of each maintainer on high trust systems. I am not just talking out of my ass here. We do all of the above in stagex because it is the bare minimum.