Jeremy C. Reed wrote:
> 
> Would one of our pkgsrc developers would put in a malicious @exec/@unexec
> line?

No, but I can see accidentally putting in an @exec/@unexec line that has
unfortunate consequences.  We (pkgsrc developers) are definitely far 
from perfect.

Regarding the issue of whether the user should be notified, I think 
INSTALL/DEINSTALL scripts should also tell the user when they are doing 
something that permanently affects the state of the system, e.g. adding 
new users, "rm -rf" directories, etc.  Currently, I've written the 
template INSTALL/DEINSTALL scripts to output these notifications for 
exactly these cases.  We should sweep pkgsrc for package-specific 
INSTALL/DEINSTALL script extras that may also do these types of actions 
and cause them to notify the user of what they are doing, and add a note 
to the pkgsrc guide as well.

> Maybe we can have a compromise and have different @tags for some things to
> be ran? Because I don't want to be told things like this:
> 
> @unexec /bin/rmdir %D/share/emacs/site-lisp 2>/dev/null || true

I'm working on changes to bsd.pkg.install.mk that will remove the need 
to list directories that should be removed when a package is deleted. 
When that is done, we should be able to remove all of these "rmdir" and 
"@dirrm" lines from PLISTs, and leave the PLISTs containing only files. 
  It is unfortunate that the majority of the @exec/@unexec lines in 
pkgsrc are of the form you note above, as it does make it hard to 
separate the signal, e.g. "@unexec /bin/rm -rf /var/db/pkg" from the 
noise.  As I said, this will hopefully change very soon.

	Cheers,

	-- Johnny Lam <jlam@NetBSD.org>