pkg_group and pkg_user are internal only
Privatise lots of functions to limit the public API