So, never blindly pipe the web into your bash, kids.
But an unsigned software repository that calls post install scripts seems just as absolutely easy to modify, and we see those regularly.
My software is most easily installed with a piped bash script. In the script contents, I try to explain what's going on. I also at the top indicate that you shouldn't just trust what I am telling you. And then in the documentation, where you are told how to run the script, I tell you to be cautious there as well. (The script just installs the repository, and from there it's all signed and delivered over https).
I could never get over how easy it would be to whitewash a bash script with an rpm just to get some psychological credibility.
If it's not signed and/or delivered over https, it's completely hackable.
That first step of trust, how?
Of course you have to make sure the original install is trustworthy; all you can really do for that is compare the .iso checksum on several different machines. If all those machines are compromised (or there's a hardware-level compromise of your machine) then you're doomed, but that at least makes attacking a lot more costly than it would otherwise be.