{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:3QPJ3NMHJ2WRBRSKIC77YT3YGS","short_pith_number":"pith:3QPJ3NMH","canonical_record":{"source":{"id":"2507.05270","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-07-03T14:02:15Z","cross_cats_sorted":[],"title_canon_sha256":"66a04af9ce142db375dad8dd0a549be9b5abce33845e8a9cfc4860df6775be02","abstract_canon_sha256":"b64c44bad68f2a82ea41a94b0d85fd42bc7ef8b11ea0a5615c7a1807ce0152ee"},"schema_version":"1.0"},"canonical_sha256":"dc1e9db5874ead10c64a40bffc4f7834bbd3b03ea7846f144a153b74bbc9e7cb","source":{"kind":"arxiv","id":"2507.05270","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2507.05270","created_at":"2026-07-05T11:34:53Z"},{"alias_kind":"arxiv_version","alias_value":"2507.05270v2","created_at":"2026-07-05T11:34:53Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2507.05270","created_at":"2026-07-05T11:34:53Z"},{"alias_kind":"pith_short_12","alias_value":"3QPJ3NMHJ2WR","created_at":"2026-07-05T11:34:53Z"},{"alias_kind":"pith_short_16","alias_value":"3QPJ3NMHJ2WRBRSK","created_at":"2026-07-05T11:34:53Z"},{"alias_kind":"pith_short_8","alias_value":"3QPJ3NMH","created_at":"2026-07-05T11:34:53Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:3QPJ3NMHJ2WRBRSKIC77YT3YGS","target":"record","payload":{"canonical_record":{"source":{"id":"2507.05270","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-07-03T14:02:15Z","cross_cats_sorted":[],"title_canon_sha256":"66a04af9ce142db375dad8dd0a549be9b5abce33845e8a9cfc4860df6775be02","abstract_canon_sha256":"b64c44bad68f2a82ea41a94b0d85fd42bc7ef8b11ea0a5615c7a1807ce0152ee"},"schema_version":"1.0"},"canonical_sha256":"dc1e9db5874ead10c64a40bffc4f7834bbd3b03ea7846f144a153b74bbc9e7cb","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:34:53.648370Z","signature_b64":"tc33HpIXHNkPaPRJViw+5PFA6xJxQ1+oaaJT9/mMCjOK6mw7Lha4NQdhJ5mChheVLDoD7CrM6l5vjpAd/oSUDg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"dc1e9db5874ead10c64a40bffc4f7834bbd3b03ea7846f144a153b74bbc9e7cb","last_reissued_at":"2026-07-05T11:34:53.647842Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:34:53.647842Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2507.05270","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:34:53Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"GaLjGkbSu++lmjJ+ZKNUhDi4GEJzqwORZV+qr4sNEqy5+KSqx9SVxFj5opesvD2E2RhBfHIctsrd1M6isq1hDw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T22:58:14.588718Z"},"content_sha256":"1e9f7245e9a67e286e8c719570f715362ac610b9b7e8506d60ed75d7d36c5186","schema_version":"1.0","event_id":"sha256:1e9f7245e9a67e286e8c719570f715362ac610b9b7e8506d60ed75d7d36c5186"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:3QPJ3NMHJ2WRBRSKIC77YT3YGS","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Open Source, Hidden Costs: A Systematic Literature Review on OSS License Management","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.SE","authors_text":"BoYuan Li, Chengwei Liu, Lingling Fan, Sen Chen, Zheli Liu, Zhenlin Zhang","submitted_at":"2025-07-03T14:02:15Z","abstract_excerpt":"Integrating third-party software components is a common practice in modern software development, offering significant advantages in terms of efficiency and innovation. However, this practice is fraught with risks related to software licensing. A lack of understanding may lead to disputes, which can pose serious legal and operational challenges. To these ends, both academia and industry have conducted various investigations and proposed solutions and tools to deal with these challenges. However, significant limitations still remain. Moreover, the rapid evolution of open-source software (OSS) li"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2507.05270","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2507.05270/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:34:53Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"kH6yA6F3tiS5hn+g82pSzOfrtetnENix2KkCRKGaReFOkg9rwY2STLHDh4qtYVSF6aA8QONHtjvEpXSyGpadAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T22:58:14.589290Z"},"content_sha256":"5d3f9a480e889b0a0d9bc94ac3a66edad4944e3211c6d6e77b0cb5a6a546cb2f","schema_version":"1.0","event_id":"sha256:5d3f9a480e889b0a0d9bc94ac3a66edad4944e3211c6d6e77b0cb5a6a546cb2f"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/3QPJ3NMHJ2WRBRSKIC77YT3YGS/bundle.json","state_url":"https://pith.science/pith/3QPJ3NMHJ2WRBRSKIC77YT3YGS/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/3QPJ3NMHJ2WRBRSKIC77YT3YGS/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-08T22:58:14Z","links":{"resolver":"https://pith.science/pith/3QPJ3NMHJ2WRBRSKIC77YT3YGS","bundle":"https://pith.science/pith/3QPJ3NMHJ2WRBRSKIC77YT3YGS/bundle.json","state":"https://pith.science/pith/3QPJ3NMHJ2WRBRSKIC77YT3YGS/state.json","well_known_bundle":"https://pith.science/.well-known/pith/3QPJ3NMHJ2WRBRSKIC77YT3YGS/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:3QPJ3NMHJ2WRBRSKIC77YT3YGS","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"b64c44bad68f2a82ea41a94b0d85fd42bc7ef8b11ea0a5615c7a1807ce0152ee","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-07-03T14:02:15Z","title_canon_sha256":"66a04af9ce142db375dad8dd0a549be9b5abce33845e8a9cfc4860df6775be02"},"schema_version":"1.0","source":{"id":"2507.05270","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2507.05270","created_at":"2026-07-05T11:34:53Z"},{"alias_kind":"arxiv_version","alias_value":"2507.05270v2","created_at":"2026-07-05T11:34:53Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2507.05270","created_at":"2026-07-05T11:34:53Z"},{"alias_kind":"pith_short_12","alias_value":"3QPJ3NMHJ2WR","created_at":"2026-07-05T11:34:53Z"},{"alias_kind":"pith_short_16","alias_value":"3QPJ3NMHJ2WRBRSK","created_at":"2026-07-05T11:34:53Z"},{"alias_kind":"pith_short_8","alias_value":"3QPJ3NMH","created_at":"2026-07-05T11:34:53Z"}],"graph_snapshots":[{"event_id":"sha256:5d3f9a480e889b0a0d9bc94ac3a66edad4944e3211c6d6e77b0cb5a6a546cb2f","target":"graph","created_at":"2026-07-05T11:34:53Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2507.05270/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Integrating third-party software components is a common practice in modern software development, offering significant advantages in terms of efficiency and innovation. However, this practice is fraught with risks related to software licensing. A lack of understanding may lead to disputes, which can pose serious legal and operational challenges. To these ends, both academia and industry have conducted various investigations and proposed solutions and tools to deal with these challenges. However, significant limitations still remain. Moreover, the rapid evolution of open-source software (OSS) li","authors_text":"BoYuan Li, Chengwei Liu, Lingling Fan, Sen Chen, Zheli Liu, Zhenlin Zhang","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-07-03T14:02:15Z","title":"Open Source, Hidden Costs: A Systematic Literature Review on OSS License Management"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2507.05270","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:1e9f7245e9a67e286e8c719570f715362ac610b9b7e8506d60ed75d7d36c5186","target":"record","created_at":"2026-07-05T11:34:53Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"b64c44bad68f2a82ea41a94b0d85fd42bc7ef8b11ea0a5615c7a1807ce0152ee","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-07-03T14:02:15Z","title_canon_sha256":"66a04af9ce142db375dad8dd0a549be9b5abce33845e8a9cfc4860df6775be02"},"schema_version":"1.0","source":{"id":"2507.05270","kind":"arxiv","version":2}},"canonical_sha256":"dc1e9db5874ead10c64a40bffc4f7834bbd3b03ea7846f144a153b74bbc9e7cb","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"dc1e9db5874ead10c64a40bffc4f7834bbd3b03ea7846f144a153b74bbc9e7cb","first_computed_at":"2026-07-05T11:34:53.647842Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:34:53.647842Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"tc33HpIXHNkPaPRJViw+5PFA6xJxQ1+oaaJT9/mMCjOK6mw7Lha4NQdhJ5mChheVLDoD7CrM6l5vjpAd/oSUDg==","signature_status":"signed_v1","signed_at":"2026-07-05T11:34:53.648370Z","signed_message":"canonical_sha256_bytes"},"source_id":"2507.05270","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:1e9f7245e9a67e286e8c719570f715362ac610b9b7e8506d60ed75d7d36c5186","sha256:5d3f9a480e889b0a0d9bc94ac3a66edad4944e3211c6d6e77b0cb5a6a546cb2f"],"state_sha256":"774c59c498f1ae1c7d4396d912923a8846341325bc154931f2e0b29421675604"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"cjobetQCWn01UoT+iMDVYwN7GlZfKxx16zDVQl7vVyLORdyXlYvw95pR+AZZOsyP/Ipzx6Mszy9rJ7oXr5qQAQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-08T22:58:14.593772Z","bundle_sha256":"f07d7d71567150a8c20b2a30a5ed9b95a182922b72e416796f095d9188356e10"}}