tracking the trustworthiness and security status of packages and their versions