{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:6PUUIPINKHUR67K7MYKLK2DXTC","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"d3683556676c41e60c8b679ac68ea7717e7bea575c509e409192c94c89ffe253","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-09-11T10:12:56Z","title_canon_sha256":"cf0c3a29b114dbf6e00b8b2304f74147260a605115f83c7fc661d34c6046210b"},"schema_version":"1.0","source":{"id":"2509.09322","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2509.09322","created_at":"2026-07-05T12:09:33Z"},{"alias_kind":"arxiv_version","alias_value":"2509.09322v1","created_at":"2026-07-05T12:09:33Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2509.09322","created_at":"2026-07-05T12:09:33Z"},{"alias_kind":"pith_short_12","alias_value":"6PUUIPINKHUR","created_at":"2026-07-05T12:09:33Z"},{"alias_kind":"pith_short_16","alias_value":"6PUUIPINKHUR67K7","created_at":"2026-07-05T12:09:33Z"},{"alias_kind":"pith_short_8","alias_value":"6PUUIPIN","created_at":"2026-07-05T12:09:33Z"}],"graph_snapshots":[{"event_id":"sha256:ec5cc013664935da9e70fa8d5b6409c57344b5564ed0174cf0f2c4f82e7bb5a9","target":"graph","created_at":"2026-07-05T12:09:33Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2509.09322/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Modern software development increasingly depends on open-source libraries and third-party components, which are often encapsulated into containerized environments. While improving the development and deployment of applications, this approach introduces security risks, particularly when outdated or vulnerable components are inadvertently included in production environments. Software Composition Analysis (SCA) is a critical process that helps identify and manage packages and dependencies inside a container. However, unintentional modifications to the container filesystem can lead to incomplete c","authors_text":"Agathe Blaise, Jacopo Bufalino, Stefano Secci","cross_cats":["cs.CR"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-09-11T10:12:56Z","title":"ORCA: Unveiling Obscure Containers In The Wild"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2509.09322","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:dce3b840bcae232f24f9dabaf7b0241b7d4bc63f6211867e69eb476e6593be7b","target":"record","created_at":"2026-07-05T12:09:33Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"d3683556676c41e60c8b679ac68ea7717e7bea575c509e409192c94c89ffe253","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-09-11T10:12:56Z","title_canon_sha256":"cf0c3a29b114dbf6e00b8b2304f74147260a605115f83c7fc661d34c6046210b"},"schema_version":"1.0","source":{"id":"2509.09322","kind":"arxiv","version":1}},"canonical_sha256":"f3e9443d0d51e91f7d5f6614b5687798801af1aec5110bb15914bf853846c76c","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"f3e9443d0d51e91f7d5f6614b5687798801af1aec5110bb15914bf853846c76c","first_computed_at":"2026-07-05T12:09:33.927897Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T12:09:33.927897Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"Z5XCwQLzAQCigWmjfUL1xPjYcszUDuwHEuZHoa6oiE8LE0uzAn97D2HIIt/xrF8rFw7ZxHiy5fRCMiOAUkR6CA==","signature_status":"signed_v1","signed_at":"2026-07-05T12:09:33.928423Z","signed_message":"canonical_sha256_bytes"},"source_id":"2509.09322","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:dce3b840bcae232f24f9dabaf7b0241b7d4bc63f6211867e69eb476e6593be7b","sha256:ec5cc013664935da9e70fa8d5b6409c57344b5564ed0174cf0f2c4f82e7bb5a9"],"state_sha256":"ca6b485949c0ae83095cf5bd68c817b217494a88ff9282f4c8efda6507e046c6"}