If I publish accidentally a package with rm -rf / in the post installation script, a number of people will angry at me and frankly, I would understand them.

That being said, aside from distribution packages, always look at the pre/post (un)install scripts for external packages.

rpm -qp --scripts <PACKAGE>.rpm

dpkg is a little less convenient but:

ls control.tar.* # <<< check that no file like that already exists

ar -vx <PACKAGE>.deb

tar -xvf control.tar.*

for i in pre* post;do printf "\n>>> %s\n" "$i";cat $i;done

rm -f conffiles control control.tar. data.tar.* debian-binary md5sums postinst postrm prerm postrm

In most cases if the script is huge, the packaging tends to be horrible and generally, the quality of the software is also not that great.

Another good indicator is the installation path:

dpkg -c <PACKAGE>.deb

rpm -qpl <PACKAGE>.rpm

If there is no effort made by the editor to follow the FHS or at least be nice and put its messy bundle inside /opt/<COMPAGNY>, it's generally a bad sign.

Proprietary software tends to be quite horrible in that regard, I'm still traumatized by the trendmicro serverprotect rpm (AV for linux).

http://downloadcenter.trendmicro.com/index.php?regs=NABU&clk... (if you want to give it a try, don't forget the service pack and the product patch...)