{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:72SOT5J6UOQTLIDNEEWYWB7PMC","short_pith_number":"pith:72SOT5J6","canonical_record":{"source":{"id":"2506.11051","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-05-22T06:34:48Z","cross_cats_sorted":[],"title_canon_sha256":"6ab89820fa4bce52535f2b86fbcbb2a24f1cbfe04f5b001b940a5a478cbc6b9d","abstract_canon_sha256":"0f58c8ef4335d98480ea4ec2e245c3a609edceec6401019835d9c1d7fe88e9e7"},"schema_version":"1.0"},"canonical_sha256":"fea4e9f53ea3a135a06d212d8b07ef6094eec1412f1195a65b8dcd9cd6f12d5a","source":{"kind":"arxiv","id":"2506.11051","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.11051","created_at":"2026-07-05T11:20:58Z"},{"alias_kind":"arxiv_version","alias_value":"2506.11051v1","created_at":"2026-07-05T11:20:58Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.11051","created_at":"2026-07-05T11:20:58Z"},{"alias_kind":"pith_short_12","alias_value":"72SOT5J6UOQT","created_at":"2026-07-05T11:20:58Z"},{"alias_kind":"pith_short_16","alias_value":"72SOT5J6UOQTLIDN","created_at":"2026-07-05T11:20:58Z"},{"alias_kind":"pith_short_8","alias_value":"72SOT5J6","created_at":"2026-07-05T11:20:58Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:72SOT5J6UOQTLIDNEEWYWB7PMC","target":"record","payload":{"canonical_record":{"source":{"id":"2506.11051","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-05-22T06:34:48Z","cross_cats_sorted":[],"title_canon_sha256":"6ab89820fa4bce52535f2b86fbcbb2a24f1cbfe04f5b001b940a5a478cbc6b9d","abstract_canon_sha256":"0f58c8ef4335d98480ea4ec2e245c3a609edceec6401019835d9c1d7fe88e9e7"},"schema_version":"1.0"},"canonical_sha256":"fea4e9f53ea3a135a06d212d8b07ef6094eec1412f1195a65b8dcd9cd6f12d5a","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:20:58.550495Z","signature_b64":"nGdJG2sm4RTM2oMJNiz1xza9cnguO2lq/kasw2IoNhp1ep/hi8s3JaQg4CQp3uo81P3KCqNT4qE2ZWVBn3vIBw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"fea4e9f53ea3a135a06d212d8b07ef6094eec1412f1195a65b8dcd9cd6f12d5a","last_reissued_at":"2026-07-05T11:20:58.549955Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:20:58.549955Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2506.11051","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:20:58Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"f2qnDclnv4nyBErPig/5cCp+r3L/Ib9+vaWoLetxkaf1tIcDQnHhOM36OvLJr8C0eaQXo9louEhfQbzgxkkPAg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T04:15:20.167297Z"},"content_sha256":"60de99d15493b302690a9d4f930c72d7eb5dc7f01b0f24913c71ed46bda7efa8","schema_version":"1.0","event_id":"sha256:60de99d15493b302690a9d4f930c72d7eb5dc7f01b0f24913c71ed46bda7efa8"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:72SOT5J6UOQTLIDNEEWYWB7PMC","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Software Security Mapping Framework: Operationalization of Security Requirements","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.SE","authors_text":"Liming Dong, Muhammad Ejaz Ahmed, Stefan Avgoustakis, Sung Une Lee, Zhenchang Xing","submitted_at":"2025-05-22T06:34:48Z","abstract_excerpt":"The escalating complexity of modern software development environments has heightened concerns around supply chain security. However, existing frameworks often fall short in translating abstract security principles into concrete, actionable practices. This paper introduces the Software Security Mapping Framework, a structured solution designed to operationalize security requirements across hierarchical levels -- from high-level regulatory standards (e.g., ISM, Australia cybersecurity standard published by the Australian Signals Directorate), through mid-level frameworks (e.g., NIST SSDF, the U."},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.11051","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2506.11051/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:20:58Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"jjjRmWGzwPdpTUuocKy9W1Uu4yf5WR1qc7c0zemKRqfNFt2lVyG85tPhJjgDglhfl8YE49qoN8dSguoLsaiQBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T04:15:20.167689Z"},"content_sha256":"bdb68495e0b4b8b40c3451e3a2def27418c9d6db32899436319ef04f8a13af88","schema_version":"1.0","event_id":"sha256:bdb68495e0b4b8b40c3451e3a2def27418c9d6db32899436319ef04f8a13af88"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/72SOT5J6UOQTLIDNEEWYWB7PMC/bundle.json","state_url":"https://pith.science/pith/72SOT5J6UOQTLIDNEEWYWB7PMC/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/72SOT5J6UOQTLIDNEEWYWB7PMC/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-07T04:15:20Z","links":{"resolver":"https://pith.science/pith/72SOT5J6UOQTLIDNEEWYWB7PMC","bundle":"https://pith.science/pith/72SOT5J6UOQTLIDNEEWYWB7PMC/bundle.json","state":"https://pith.science/pith/72SOT5J6UOQTLIDNEEWYWB7PMC/state.json","well_known_bundle":"https://pith.science/.well-known/pith/72SOT5J6UOQTLIDNEEWYWB7PMC/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:72SOT5J6UOQTLIDNEEWYWB7PMC","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"0f58c8ef4335d98480ea4ec2e245c3a609edceec6401019835d9c1d7fe88e9e7","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-05-22T06:34:48Z","title_canon_sha256":"6ab89820fa4bce52535f2b86fbcbb2a24f1cbfe04f5b001b940a5a478cbc6b9d"},"schema_version":"1.0","source":{"id":"2506.11051","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.11051","created_at":"2026-07-05T11:20:58Z"},{"alias_kind":"arxiv_version","alias_value":"2506.11051v1","created_at":"2026-07-05T11:20:58Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.11051","created_at":"2026-07-05T11:20:58Z"},{"alias_kind":"pith_short_12","alias_value":"72SOT5J6UOQT","created_at":"2026-07-05T11:20:58Z"},{"alias_kind":"pith_short_16","alias_value":"72SOT5J6UOQTLIDN","created_at":"2026-07-05T11:20:58Z"},{"alias_kind":"pith_short_8","alias_value":"72SOT5J6","created_at":"2026-07-05T11:20:58Z"}],"graph_snapshots":[{"event_id":"sha256:bdb68495e0b4b8b40c3451e3a2def27418c9d6db32899436319ef04f8a13af88","target":"graph","created_at":"2026-07-05T11:20:58Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2506.11051/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The escalating complexity of modern software development environments has heightened concerns around supply chain security. However, existing frameworks often fall short in translating abstract security principles into concrete, actionable practices. This paper introduces the Software Security Mapping Framework, a structured solution designed to operationalize security requirements across hierarchical levels -- from high-level regulatory standards (e.g., ISM, Australia cybersecurity standard published by the Australian Signals Directorate), through mid-level frameworks (e.g., NIST SSDF, the U.","authors_text":"Liming Dong, Muhammad Ejaz Ahmed, Stefan Avgoustakis, Sung Une Lee, Zhenchang Xing","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-05-22T06:34:48Z","title":"Software Security Mapping Framework: Operationalization of Security Requirements"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.11051","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:60de99d15493b302690a9d4f930c72d7eb5dc7f01b0f24913c71ed46bda7efa8","target":"record","created_at":"2026-07-05T11:20:58Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"0f58c8ef4335d98480ea4ec2e245c3a609edceec6401019835d9c1d7fe88e9e7","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-05-22T06:34:48Z","title_canon_sha256":"6ab89820fa4bce52535f2b86fbcbb2a24f1cbfe04f5b001b940a5a478cbc6b9d"},"schema_version":"1.0","source":{"id":"2506.11051","kind":"arxiv","version":1}},"canonical_sha256":"fea4e9f53ea3a135a06d212d8b07ef6094eec1412f1195a65b8dcd9cd6f12d5a","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"fea4e9f53ea3a135a06d212d8b07ef6094eec1412f1195a65b8dcd9cd6f12d5a","first_computed_at":"2026-07-05T11:20:58.549955Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:20:58.549955Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"nGdJG2sm4RTM2oMJNiz1xza9cnguO2lq/kasw2IoNhp1ep/hi8s3JaQg4CQp3uo81P3KCqNT4qE2ZWVBn3vIBw==","signature_status":"signed_v1","signed_at":"2026-07-05T11:20:58.550495Z","signed_message":"canonical_sha256_bytes"},"source_id":"2506.11051","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:60de99d15493b302690a9d4f930c72d7eb5dc7f01b0f24913c71ed46bda7efa8","sha256:bdb68495e0b4b8b40c3451e3a2def27418c9d6db32899436319ef04f8a13af88"],"state_sha256":"907e1be4a9959b8b90872dd7cb3e4d056d74378e0a8838b9c885f7f49de08fc2"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"QT/yvbBBK3K3/ZNx75tDpzTyhta5xqQHVsK1Q5IRNv+QTHH+ow3XUJdF4TK+9J2qpcscWoQA5iLZr/yoPTm0CA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-07T04:15:20.169748Z","bundle_sha256":"5b3bfb3a83ca43c870eecb1620391739ceeca4426532d5a26ebbe15cd9175c70"}}