The following papers provide detailed information on securing software updater systems, TUF's design, attacks on package managers, and package management security:

• Mercury: Bandwidth-Effective Prevention of Rollback Attacks Against Community Repositories

• Diplomat: Using Delegations to Protect Community Repositories

• Survivable Key Compromise in Software Update Systems

• A Look In the Mirror: Attacks on Package Managers

• Package Management Security