GNU/Linux distributions such as Trisquel usually have their own package
repository, and the package manager is configured to use that.
So yes, there's usually a "gatekeeper" in a sense because there are usually
going to be people involved in the decisions of what does (or doesn't) make
it into that particular distro's repository. If the distro is based on
another (such as Trisquel is) they've got several choices: They can admit
packages from their "upstream" repository without modification, or they can
first modify the package in some way and then add their modified version into
their repository, or they could blacklist the package entirely and not have
it at all. They can also add their own packages, not found in the upstream
distribution.
This is why the distro having their own repositories is essential: It means
complete independence.
That independence also addresses the issue of what happens when a previously
good package "goes bad": Depending on the specifics they can tae action like
I mentioned above: Modify it to make it good again, or blacklist it entirely.
Since the package manager is using the distro's own repository, the distro is
in control.
Other package managers could be used of course. There's nothing a distro can
use to stop people from adding other repos, etc. into their system because in
the case of distros like Trisquel, everything is Free as in freedom so the
user is in control.
