Inspect the command and hash the files which are being run. We could then potentially trust them even if the package version changes,

[ashward]