Most package managers I know support Turing complete install hooks. How would a package manager detect what parts of those require/are safe to run with root?