review multiple pip installs and metadata location

[jku]

Currently metadata goes into ~/.local/share/pip/tuf -- review if there can be negative side-effects from using multiple pip installs (in virtualenvs etc)

[jku]

Multiple pip installs should work fine: Each install has a bootstrap metadata for pypi.org (the root.json version might not be same but refreshing that metadata will converge to the same up-to-date metadata). The first version to run will bootstrap the metadata into .local/share/ and that will be used by all versions from that point on.

There is a security aspect: If an attacker can create or modify the bootstrapped metadata location .local/share/, the pip installs have no way of verifying if the current metadata is 'compatible' with their bootstrap metadata: they will just run with whatever metadata is already installed.

This is not ideal but should lead to DOS at worst?

[jku]

This is looked at upstream in theupdateframework/python-tuf#1168