Comment 7 for bug 1882098

Thanks for triaging and investigating this, Julian!

A fix for at least the aptcc backend would be highly appreciated -- I'd hope the other backends will fix this on their own if they care about it.

The point of packagekit+policykit is to enable people to do (at least somewhat limited) stuff without explicit root access -- otherwise you'd just give them sudo rights and be done with it. In the current situation, granting a user the right to install ("trusted") packages actually grants them rights to place arbitrary files in the filesystem and execute arbitrary code (package scripts) as root, which is at the very very least highly misleading.

I took a cursory look at the earlier apt backend written in python (which is now deleted from the packagekit tree) and it at least looked like it had some logic to decide whether a package can be trusted or not so it didn't seem like checking where the package is coming from would be unprecedented.