python-tuf/docs/papers/attacks-on-package-managers-ccs2008.pdf