{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2021:3C47NEI4RCVINXRZV6LLDZI6EG","short_pith_number":"pith:3C47NEI4","canonical_record":{"source":{"id":"2108.06262","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2021-08-13T14:19:33Z","cross_cats_sorted":[],"title_canon_sha256":"4c3eda5c8ac0a781d345580d6724f96e66fca75e279399b22f7a6d1d0fd6d9d9","abstract_canon_sha256":"38b043c56d78610798e78651569e7457e00947add4d1591db43401d8906105af"},"schema_version":"1.0"},"canonical_sha256":"d8b9f6911c88aa86de39af96b1e51e21a0214df296548c791a5a1979b041aff6","source":{"kind":"arxiv","id":"2108.06262","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2108.06262","created_at":"2026-07-05T03:05:39Z"},{"alias_kind":"arxiv_version","alias_value":"2108.06262v1","created_at":"2026-07-05T03:05:39Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2108.06262","created_at":"2026-07-05T03:05:39Z"},{"alias_kind":"pith_short_12","alias_value":"3C47NEI4RCVI","created_at":"2026-07-05T03:05:39Z"},{"alias_kind":"pith_short_16","alias_value":"3C47NEI4RCVINXRZ","created_at":"2026-07-05T03:05:39Z"},{"alias_kind":"pith_short_8","alias_value":"3C47NEI4","created_at":"2026-07-05T03:05:39Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2021:3C47NEI4RCVINXRZV6LLDZI6EG","target":"record","payload":{"canonical_record":{"source":{"id":"2108.06262","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2021-08-13T14:19:33Z","cross_cats_sorted":[],"title_canon_sha256":"4c3eda5c8ac0a781d345580d6724f96e66fca75e279399b22f7a6d1d0fd6d9d9","abstract_canon_sha256":"38b043c56d78610798e78651569e7457e00947add4d1591db43401d8906105af"},"schema_version":"1.0"},"canonical_sha256":"d8b9f6911c88aa86de39af96b1e51e21a0214df296548c791a5a1979b041aff6","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T03:05:39.091673Z","signature_b64":"Vv4XOJw9gHfLkdOUgACpRjbQfcJTFQImu/J5RNxeqrxL+LPo7ha4Uw2tC0y/UTOWJNcbnRB2t46kLDmLfAqcBw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"d8b9f6911c88aa86de39af96b1e51e21a0214df296548c791a5a1979b041aff6","last_reissued_at":"2026-07-05T03:05:39.091258Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T03:05:39.091258Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2108.06262","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T03:05:39Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"D7b4VR/JimiUdpSEM16/FCE/YCWmauXD4L/wrirvxfEilkAK0jTe30PTyGf/rM7fKUyGJDiIp/ggL07ET4MCCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T03:55:38.176968Z"},"content_sha256":"cbcd85e3d8870c20226044b089cab42062cd5b197632c9811824deeede126e64","schema_version":"1.0","event_id":"sha256:cbcd85e3d8870c20226044b089cab42062cd5b197632c9811824deeede126e64"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2021:3C47NEI4RCVINXRZV6LLDZI6EG","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Contrasting Third-Party Package Management User Experience","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.SE","authors_text":"Bodin Chinthanet, Christoph Treude, Kenichi Matsumoto, Raula Gaikovina Kula, Syful Islam, Takashi Ishio","submitted_at":"2021-08-13T14:19:33Z","abstract_excerpt":"The management of third-party package dependencies is crucial to most technology stacks, with package managers acting as brokers to ensure that a verified package is correctly installed, configured, or removed from an application. Diversity in technology stacks has led to dozens of package ecosystems with their own management features. While recent studies have shown that developers struggle to migrate their dependencies, the common assumption is that package ecosystems are used without any issue. In this study, we explore 13 package ecosystems to understand whether their features correlate wi"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2108.06262","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2108.06262/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T03:05:39Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"STMSicoMaPH/O9fCY6/BIj7MmmIP6AQ9DEfZZimRUA/kw3ZicO/TIWUClVJxl0PVyy6NBxVpAMwp27hJfwHBAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T03:55:38.177351Z"},"content_sha256":"286ab3288ea77f76341f76ce0b91514e2fc23597fb1a5c2299e93f3b1fcb8957","schema_version":"1.0","event_id":"sha256:286ab3288ea77f76341f76ce0b91514e2fc23597fb1a5c2299e93f3b1fcb8957"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/3C47NEI4RCVINXRZV6LLDZI6EG/bundle.json","state_url":"https://pith.science/pith/3C47NEI4RCVINXRZV6LLDZI6EG/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/3C47NEI4RCVINXRZV6LLDZI6EG/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-07T03:55:38Z","links":{"resolver":"https://pith.science/pith/3C47NEI4RCVINXRZV6LLDZI6EG","bundle":"https://pith.science/pith/3C47NEI4RCVINXRZV6LLDZI6EG/bundle.json","state":"https://pith.science/pith/3C47NEI4RCVINXRZV6LLDZI6EG/state.json","well_known_bundle":"https://pith.science/.well-known/pith/3C47NEI4RCVINXRZV6LLDZI6EG/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2021:3C47NEI4RCVINXRZV6LLDZI6EG","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"38b043c56d78610798e78651569e7457e00947add4d1591db43401d8906105af","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2021-08-13T14:19:33Z","title_canon_sha256":"4c3eda5c8ac0a781d345580d6724f96e66fca75e279399b22f7a6d1d0fd6d9d9"},"schema_version":"1.0","source":{"id":"2108.06262","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2108.06262","created_at":"2026-07-05T03:05:39Z"},{"alias_kind":"arxiv_version","alias_value":"2108.06262v1","created_at":"2026-07-05T03:05:39Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2108.06262","created_at":"2026-07-05T03:05:39Z"},{"alias_kind":"pith_short_12","alias_value":"3C47NEI4RCVI","created_at":"2026-07-05T03:05:39Z"},{"alias_kind":"pith_short_16","alias_value":"3C47NEI4RCVINXRZ","created_at":"2026-07-05T03:05:39Z"},{"alias_kind":"pith_short_8","alias_value":"3C47NEI4","created_at":"2026-07-05T03:05:39Z"}],"graph_snapshots":[{"event_id":"sha256:286ab3288ea77f76341f76ce0b91514e2fc23597fb1a5c2299e93f3b1fcb8957","target":"graph","created_at":"2026-07-05T03:05:39Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2108.06262/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The management of third-party package dependencies is crucial to most technology stacks, with package managers acting as brokers to ensure that a verified package is correctly installed, configured, or removed from an application. Diversity in technology stacks has led to dozens of package ecosystems with their own management features. While recent studies have shown that developers struggle to migrate their dependencies, the common assumption is that package ecosystems are used without any issue. In this study, we explore 13 package ecosystems to understand whether their features correlate wi","authors_text":"Bodin Chinthanet, Christoph Treude, Kenichi Matsumoto, Raula Gaikovina Kula, Syful Islam, Takashi Ishio","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2021-08-13T14:19:33Z","title":"Contrasting Third-Party Package Management User Experience"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2108.06262","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:cbcd85e3d8870c20226044b089cab42062cd5b197632c9811824deeede126e64","target":"record","created_at":"2026-07-05T03:05:39Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"38b043c56d78610798e78651569e7457e00947add4d1591db43401d8906105af","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2021-08-13T14:19:33Z","title_canon_sha256":"4c3eda5c8ac0a781d345580d6724f96e66fca75e279399b22f7a6d1d0fd6d9d9"},"schema_version":"1.0","source":{"id":"2108.06262","kind":"arxiv","version":1}},"canonical_sha256":"d8b9f6911c88aa86de39af96b1e51e21a0214df296548c791a5a1979b041aff6","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"d8b9f6911c88aa86de39af96b1e51e21a0214df296548c791a5a1979b041aff6","first_computed_at":"2026-07-05T03:05:39.091258Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T03:05:39.091258Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"Vv4XOJw9gHfLkdOUgACpRjbQfcJTFQImu/J5RNxeqrxL+LPo7ha4Uw2tC0y/UTOWJNcbnRB2t46kLDmLfAqcBw==","signature_status":"signed_v1","signed_at":"2026-07-05T03:05:39.091673Z","signed_message":"canonical_sha256_bytes"},"source_id":"2108.06262","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:cbcd85e3d8870c20226044b089cab42062cd5b197632c9811824deeede126e64","sha256:286ab3288ea77f76341f76ce0b91514e2fc23597fb1a5c2299e93f3b1fcb8957"],"state_sha256":"16b76e973db204a51483bd57f4e22839bcab7c6e52505cfa765e1f07a9de45d6"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"8JpYkXdoQ1VV3A701UQsMpZ+Q9QWozNNjOTXda2u3+bLOZcAzu25RGtGphQXZpoE1SdCcW5tuhUGAxdSPWFoDw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-07T03:55:38.179242Z","bundle_sha256":"68ea1611668626fa04cd697599973df4fed03614df620be3121185a8e82a89ea"}}