slash-package manager

On http://cr.yp.to/slashpackage/sharability.html Dan mentions a package
manager:

   [...] the
   package manager can automatically set up appropriate symlinks, using some
   system-specific configuration and a small amount of sharing information
   included in the package: [...]
        /package/admin/daemontools-0.76/package
                  -> /shared/dist/admin/daemontools-0.76/package
 [...]  But the only program that cares about this is the package manager. The files
   are accessed without regard to sharability.

How can a package manager set up a symlink for
/package/admin/daemontools-0.76/package if it is not already installed
and therefore /package/admin/daemontools-0.76/package/sharing is not
available?

1. Peek into daemontools-0.76.tar.gz look at the first
   non-sticky directory, then extract its subfile package/sharing.
   This will be much fun from a shell...

2. Create a descriptor file daemontools-0.76.dsc (like Debian) which
   contains the sharing information.
   Doubling information and using two files is anoying.

3. Change tar-ball style. E.g.: Drop the category prefix, then
   extracting package/sharing can be easily done to stdout.
   If package/category contains the category it is easy to create
   sticky parent directories on the fly, e.g.:
          cat=` gzip -d -c pkg.tar.gz | tar xOf - package/category `
          mkdir -p "${repository:-}/package/$cat"
          while :
          do
            case "$cat"x in .x|/x|x) break ;; esac
            chmod +t "${repository:-}/package/$cat"
            cat=`dirname "$cat"`
          done
   Note:
     (a) Extracting '*/package/sharing' need not work for all packages.
     (b) A trojan package cannot poke a file into another package anymore.
     (c) The package need not be unpacked by root, the package manager
         can change the uid before calling anything of the package.
         This may prevent unintended mistakes.
     (d) For backward compatibility the slash-package manager must know
         ca. 54 packages with few versions which use the old style,
         until they are updated.

From the notes you may guess it already - I vote for 3.

PS: Should there be a voting procedure for slash-package or must
    Dan decide every policy and convention?

-- 
Stefan Karrmann