

- rpm: signed payload and manifest with signatures in bill of materials that integrates and coordinates with system db and allows enterprise content review and validation at every step and/or easy back-out.
- flatpack/app image - none of these.
Anyone interested in build, security, deployment, should have issue with that. But look at its corp champions and discover their motive.
A LOT of plugins in many projects are a huge concern. I say this as someone who ran security for an OS for a while. It’s just people making bad decisions for everyone and then hand-waving the risks when questioned.