{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:4CHTUTHMTFMYCE67MFQC4EISEZ","short_pith_number":"pith:4CHTUTHM","canonical_record":{"source":{"id":"2505.10538","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-15T17:48:14Z","cross_cats_sorted":[],"title_canon_sha256":"3c69e3c14878de7e7c873485503859d0c6ab57d343db48a9b84ca34877f99c68","abstract_canon_sha256":"6850de5ca53fb8cefe7d2a4f03fb3cce09d9b5b5a3c84916dc2f2be32fa65b4e"},"schema_version":"1.0"},"canonical_sha256":"e08f3a4cec99598113df61602e1112264d2d3158f4c10fc918f34a567d5d0e91","source":{"kind":"arxiv","id":"2505.10538","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2505.10538","created_at":"2026-07-05T11:03:39Z"},{"alias_kind":"arxiv_version","alias_value":"2505.10538v1","created_at":"2026-07-05T11:03:39Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2505.10538","created_at":"2026-07-05T11:03:39Z"},{"alias_kind":"pith_short_12","alias_value":"4CHTUTHMTFMY","created_at":"2026-07-05T11:03:39Z"},{"alias_kind":"pith_short_16","alias_value":"4CHTUTHMTFMYCE67","created_at":"2026-07-05T11:03:39Z"},{"alias_kind":"pith_short_8","alias_value":"4CHTUTHM","created_at":"2026-07-05T11:03:39Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:4CHTUTHMTFMYCE67MFQC4EISEZ","target":"record","payload":{"canonical_record":{"source":{"id":"2505.10538","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-15T17:48:14Z","cross_cats_sorted":[],"title_canon_sha256":"3c69e3c14878de7e7c873485503859d0c6ab57d343db48a9b84ca34877f99c68","abstract_canon_sha256":"6850de5ca53fb8cefe7d2a4f03fb3cce09d9b5b5a3c84916dc2f2be32fa65b4e"},"schema_version":"1.0"},"canonical_sha256":"e08f3a4cec99598113df61602e1112264d2d3158f4c10fc918f34a567d5d0e91","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:03:39.564977Z","signature_b64":"R1RVHr7/6OViIVMnSkiogqfMX1R+9ZXgQ0vIxhOI+HMV6o9a1B8oG5/vuOylPpaLI7R4pwq1H+K+F+dn0qi/Dg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"e08f3a4cec99598113df61602e1112264d2d3158f4c10fc918f34a567d5d0e91","last_reissued_at":"2026-07-05T11:03:39.564500Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:03:39.564500Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2505.10538","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:03:39Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"LUgs6yRIUvfEhtGaIoQjONUgFOd7qreDEaBVoPjqWCBk04VE8e+d1rV2bqUGIOme0nQUqcLGGY1SBnM1BbwwCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-09T05:54:36.154074Z"},"content_sha256":"dffd33d8a56207fc76d49e06407d53ccf9e0758f1740d8b6e224ed9c8afee74d","schema_version":"1.0","event_id":"sha256:dffd33d8a56207fc76d49e06407d53ccf9e0758f1740d8b6e224ed9c8afee74d"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:4CHTUTHMTFMYCE67MFQC4EISEZ","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"S3C2 Summit 2024-09: Industry Secure Software Supply Chain Summit","license":"http://creativecommons.org/licenses/by-sa/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Alexandros Kapravelos, Christian Kastner, Dominik Wermke, Imranur Rahman, Laurie Williams, Michel Cukier, William Enck, Yasemin Acar","submitted_at":"2025-05-15T17:48:14Z","abstract_excerpt":"While providing economic and software development value, software supply chains are only as strong as their weakest link. Over the past several years, there has been an exponential increase in cyberattacks, specifically targeting vulnerable links in critical software supply chains. These attacks disrupt the day-to-day functioning and threaten the security of nearly everyone on the internet, from billion-dollar companies and government agencies to hobbyist open-source developers. The ever-evolving threat of software supply chain attacks has garnered interest from the software industry and the U"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2505.10538","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2505.10538/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:03:39Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"zErmifUvuACh8COODjbmQVgluo7+SPf4unf63/cZEFVbW1QVeYkIkyKdLM6sqSzQiTevybTemwlzMYkZGMvWBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-09T05:54:36.154727Z"},"content_sha256":"472a807e1ff8a5f80fd3aa390fd97810985dedc83dab01bc64fd02a74445aa74","schema_version":"1.0","event_id":"sha256:472a807e1ff8a5f80fd3aa390fd97810985dedc83dab01bc64fd02a74445aa74"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/4CHTUTHMTFMYCE67MFQC4EISEZ/bundle.json","state_url":"https://pith.science/pith/4CHTUTHMTFMYCE67MFQC4EISEZ/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/4CHTUTHMTFMYCE67MFQC4EISEZ/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-09T05:54:36Z","links":{"resolver":"https://pith.science/pith/4CHTUTHMTFMYCE67MFQC4EISEZ","bundle":"https://pith.science/pith/4CHTUTHMTFMYCE67MFQC4EISEZ/bundle.json","state":"https://pith.science/pith/4CHTUTHMTFMYCE67MFQC4EISEZ/state.json","well_known_bundle":"https://pith.science/.well-known/pith/4CHTUTHMTFMYCE67MFQC4EISEZ/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:4CHTUTHMTFMYCE67MFQC4EISEZ","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"6850de5ca53fb8cefe7d2a4f03fb3cce09d9b5b5a3c84916dc2f2be32fa65b4e","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-15T17:48:14Z","title_canon_sha256":"3c69e3c14878de7e7c873485503859d0c6ab57d343db48a9b84ca34877f99c68"},"schema_version":"1.0","source":{"id":"2505.10538","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2505.10538","created_at":"2026-07-05T11:03:39Z"},{"alias_kind":"arxiv_version","alias_value":"2505.10538v1","created_at":"2026-07-05T11:03:39Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2505.10538","created_at":"2026-07-05T11:03:39Z"},{"alias_kind":"pith_short_12","alias_value":"4CHTUTHMTFMY","created_at":"2026-07-05T11:03:39Z"},{"alias_kind":"pith_short_16","alias_value":"4CHTUTHMTFMYCE67","created_at":"2026-07-05T11:03:39Z"},{"alias_kind":"pith_short_8","alias_value":"4CHTUTHM","created_at":"2026-07-05T11:03:39Z"}],"graph_snapshots":[{"event_id":"sha256:472a807e1ff8a5f80fd3aa390fd97810985dedc83dab01bc64fd02a74445aa74","target":"graph","created_at":"2026-07-05T11:03:39Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2505.10538/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"While providing economic and software development value, software supply chains are only as strong as their weakest link. Over the past several years, there has been an exponential increase in cyberattacks, specifically targeting vulnerable links in critical software supply chains. These attacks disrupt the day-to-day functioning and threaten the security of nearly everyone on the internet, from billion-dollar companies and government agencies to hobbyist open-source developers. The ever-evolving threat of software supply chain attacks has garnered interest from the software industry and the U","authors_text":"Alexandros Kapravelos, Christian Kastner, Dominik Wermke, Imranur Rahman, Laurie Williams, Michel Cukier, William Enck, Yasemin Acar","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-15T17:48:14Z","title":"S3C2 Summit 2024-09: Industry Secure Software Supply Chain Summit"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2505.10538","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:dffd33d8a56207fc76d49e06407d53ccf9e0758f1740d8b6e224ed9c8afee74d","target":"record","created_at":"2026-07-05T11:03:39Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"6850de5ca53fb8cefe7d2a4f03fb3cce09d9b5b5a3c84916dc2f2be32fa65b4e","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-15T17:48:14Z","title_canon_sha256":"3c69e3c14878de7e7c873485503859d0c6ab57d343db48a9b84ca34877f99c68"},"schema_version":"1.0","source":{"id":"2505.10538","kind":"arxiv","version":1}},"canonical_sha256":"e08f3a4cec99598113df61602e1112264d2d3158f4c10fc918f34a567d5d0e91","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"e08f3a4cec99598113df61602e1112264d2d3158f4c10fc918f34a567d5d0e91","first_computed_at":"2026-07-05T11:03:39.564500Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:03:39.564500Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"R1RVHr7/6OViIVMnSkiogqfMX1R+9ZXgQ0vIxhOI+HMV6o9a1B8oG5/vuOylPpaLI7R4pwq1H+K+F+dn0qi/Dg==","signature_status":"signed_v1","signed_at":"2026-07-05T11:03:39.564977Z","signed_message":"canonical_sha256_bytes"},"source_id":"2505.10538","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:dffd33d8a56207fc76d49e06407d53ccf9e0758f1740d8b6e224ed9c8afee74d","sha256:472a807e1ff8a5f80fd3aa390fd97810985dedc83dab01bc64fd02a74445aa74"],"state_sha256":"6d21b622cf6f8a30c9bcc19f1944eeedfd7a9a7fe7d146af4701ff11951b97e3"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ODdaC/WctuEMm60Oj/lGURGt1c7/tFSVuYPalXI+Ltudji+JUX7Zpw3uZedZ8xUvv1gb+L4SdhQKPcRL6G5bAQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-09T05:54:36.158431Z","bundle_sha256":"87b178d7d3bc504d9dbf536f3e8972a5678147b1b8918e376f34f4dd44f19d75"}}