Not entirely sure I understand @gyst. Are you suggesting something like distributions could be another way to solve this? ie someone selects, tests and curates all the possible plugins someone could need and the standard installer has them all included already? Isn't the problem there that someone has to choose, and test and curate? and its good to have competition in an ecosystem so there is innovation.
I think other two options you have somehow combined but they are different suggestions
- restricted python addons (from @vangheem)
- mode to allow fs package install via sitesetup
- distribution(s)
Whats interesting is none solve all the use cases.
- The only one that makes security patching easier is sitesetup fs packages.
- The only one that allows easily trying out new stuff securely is restricted python addons.
- Distributions is the only really secure way to give the full use of tools you need to build many kinds of sites (esp given most restrictedpython regularly needs whitelisting of many python libraries which can only be done with a fs package)
So I'm not sure we can dismiss any of these options yet.