Designing a new conceptual package manager– tell me what's wrong (github.com)

A new cross-platform package manager named Leash has been announced, emphasizing user-controlled permissions for security. Unlike traditional package managers, where security policies are dictated by the packager, Leash starts applications with zero permissions. A local large language model (LLM) reviews the application's code and provides understandable explanations, allowing users to grant or deny permissions based on specific conditions. This innovative approach addresses critical vulnerabilities in existing systems, such as Flatpak, where a significant percentage of apps have overly broad permissions that compromise their sandboxes. The significance of Leash lies in its potential to enhance security and user autonomy in software installations. With a focus on conditional permission grants and a robust auditing system, it promises a safer environment for running applications. The design documentation is thorough, outlining the architectural framework, threat model, and roadmap, and the team is actively seeking a technical co-lead skilled in Rust or C++ to advance the project. By utilizing known technologies like seccomp and eBPF without creating separate forks, Leash aspires to streamline package management while reinforcing security through user empowerment.