{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:7JP5HY2LY3SY3NKNIHZGMQI7RY","short_pith_number":"pith:7JP5HY2L","canonical_record":{"source":{"id":"2505.21642","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-27T18:14:36Z","cross_cats_sorted":[],"title_canon_sha256":"5fc4244dbc9adf0e4551588f0a7abfda550b6cbf7b9007eea8f5f8f9cb717643","abstract_canon_sha256":"cf2c3b31f3678dfc58958eab15b0a6060680e014af9af4004bf291b5bf5581bd"},"schema_version":"1.0"},"canonical_sha256":"fa5fd3e34bc6e58db54d41f266411f8e143a58beed31420be12354e8123ad23d","source":{"kind":"arxiv","id":"2505.21642","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2505.21642","created_at":"2026-07-05T11:11:01Z"},{"alias_kind":"arxiv_version","alias_value":"2505.21642v1","created_at":"2026-07-05T11:11:01Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2505.21642","created_at":"2026-07-05T11:11:01Z"},{"alias_kind":"pith_short_12","alias_value":"7JP5HY2LY3SY","created_at":"2026-07-05T11:11:01Z"},{"alias_kind":"pith_short_16","alias_value":"7JP5HY2LY3SY3NKN","created_at":"2026-07-05T11:11:01Z"},{"alias_kind":"pith_short_8","alias_value":"7JP5HY2L","created_at":"2026-07-05T11:11:01Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:7JP5HY2LY3SY3NKNIHZGMQI7RY","target":"record","payload":{"canonical_record":{"source":{"id":"2505.21642","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-27T18:14:36Z","cross_cats_sorted":[],"title_canon_sha256":"5fc4244dbc9adf0e4551588f0a7abfda550b6cbf7b9007eea8f5f8f9cb717643","abstract_canon_sha256":"cf2c3b31f3678dfc58958eab15b0a6060680e014af9af4004bf291b5bf5581bd"},"schema_version":"1.0"},"canonical_sha256":"fa5fd3e34bc6e58db54d41f266411f8e143a58beed31420be12354e8123ad23d","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:11:01.354825Z","signature_b64":"1zPIdstuSYpTBuak8zHOW1hsX3tN4+FKKsy+WNfHKMStEEAoebrVLp8uLs07jRnyzhGD1uuq3Y1Gzu3vkRc/CA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"fa5fd3e34bc6e58db54d41f266411f8e143a58beed31420be12354e8123ad23d","last_reissued_at":"2026-07-05T11:11:01.354351Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:11:01.354351Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2505.21642","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:11:01Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"/pZZ7nnxdgRxapOFGfzSggSv5yHkaoeKSrlbe7xEI1DD9JtXg3s8hTtPD8ArgCKjG/PRecrN+wLhgHVnQVZ9DQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-21T14:22:40.513691Z"},"content_sha256":"5a329078494c3c8563dc70cb6833e139c82497580a936f6917b01824b6ac26ac","schema_version":"1.0","event_id":"sha256:5a329078494c3c8563dc70cb6833e139c82497580a936f6917b01824b6ac26ac"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:7JP5HY2LY3SY3NKNIHZGMQI7RY","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Reproducible Builds and Insights from an Independent Verifier for Arch Linux","license":"http://creativecommons.org/licenses/by-sa/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Esther H\\\"anggi, Iy\\'an M\\'endez Veiga, Joshua Drexel","submitted_at":"2025-05-27T18:14:36Z","abstract_excerpt":"Supply chain attacks have emerged as a prominent cybersecurity threat in recent years. Reproducible and bootstrappable builds have the potential to reduce such attacks significantly. In combination with independent, exhaustive and periodic source code audits, these measures can effectively eradicate compromises in the building process. In this paper we introduce both concepts, we analyze the achievements over the last ten years and explain the remaining challenges. We contribute to the reproducible builds effort by setting up a rebuilder and verifier instance to test the reproducibility of Arc"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2505.21642","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2505.21642/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:11:01Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ePbNjUNBygtBQRFtpli54mOLsIIJ1KH+gfkg0cErkGyP61rzLC3Z+5STi6rKuV0noHK2wf603TmmemaCkzXlCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-21T14:22:40.514216Z"},"content_sha256":"e4b8f3f5df762269f2ffa052d0f22613b1d90a89c5cae2698e3a8fd1c8e39876","schema_version":"1.0","event_id":"sha256:e4b8f3f5df762269f2ffa052d0f22613b1d90a89c5cae2698e3a8fd1c8e39876"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/7JP5HY2LY3SY3NKNIHZGMQI7RY/bundle.json","state_url":"https://pith.science/pith/7JP5HY2LY3SY3NKNIHZGMQI7RY/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/7JP5HY2LY3SY3NKNIHZGMQI7RY/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-21T14:22:40Z","links":{"resolver":"https://pith.science/pith/7JP5HY2LY3SY3NKNIHZGMQI7RY","bundle":"https://pith.science/pith/7JP5HY2LY3SY3NKNIHZGMQI7RY/bundle.json","state":"https://pith.science/pith/7JP5HY2LY3SY3NKNIHZGMQI7RY/state.json","well_known_bundle":"https://pith.science/.well-known/pith/7JP5HY2LY3SY3NKNIHZGMQI7RY/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:7JP5HY2LY3SY3NKNIHZGMQI7RY","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"cf2c3b31f3678dfc58958eab15b0a6060680e014af9af4004bf291b5bf5581bd","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-27T18:14:36Z","title_canon_sha256":"5fc4244dbc9adf0e4551588f0a7abfda550b6cbf7b9007eea8f5f8f9cb717643"},"schema_version":"1.0","source":{"id":"2505.21642","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2505.21642","created_at":"2026-07-05T11:11:01Z"},{"alias_kind":"arxiv_version","alias_value":"2505.21642v1","created_at":"2026-07-05T11:11:01Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2505.21642","created_at":"2026-07-05T11:11:01Z"},{"alias_kind":"pith_short_12","alias_value":"7JP5HY2LY3SY","created_at":"2026-07-05T11:11:01Z"},{"alias_kind":"pith_short_16","alias_value":"7JP5HY2LY3SY3NKN","created_at":"2026-07-05T11:11:01Z"},{"alias_kind":"pith_short_8","alias_value":"7JP5HY2L","created_at":"2026-07-05T11:11:01Z"}],"graph_snapshots":[{"event_id":"sha256:e4b8f3f5df762269f2ffa052d0f22613b1d90a89c5cae2698e3a8fd1c8e39876","target":"graph","created_at":"2026-07-05T11:11:01Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2505.21642/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Supply chain attacks have emerged as a prominent cybersecurity threat in recent years. Reproducible and bootstrappable builds have the potential to reduce such attacks significantly. In combination with independent, exhaustive and periodic source code audits, these measures can effectively eradicate compromises in the building process. In this paper we introduce both concepts, we analyze the achievements over the last ten years and explain the remaining challenges. We contribute to the reproducible builds effort by setting up a rebuilder and verifier instance to test the reproducibility of Arc","authors_text":"Esther H\\\"anggi, Iy\\'an M\\'endez Veiga, Joshua Drexel","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-27T18:14:36Z","title":"Reproducible Builds and Insights from an Independent Verifier for Arch Linux"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2505.21642","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:5a329078494c3c8563dc70cb6833e139c82497580a936f6917b01824b6ac26ac","target":"record","created_at":"2026-07-05T11:11:01Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"cf2c3b31f3678dfc58958eab15b0a6060680e014af9af4004bf291b5bf5581bd","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-27T18:14:36Z","title_canon_sha256":"5fc4244dbc9adf0e4551588f0a7abfda550b6cbf7b9007eea8f5f8f9cb717643"},"schema_version":"1.0","source":{"id":"2505.21642","kind":"arxiv","version":1}},"canonical_sha256":"fa5fd3e34bc6e58db54d41f266411f8e143a58beed31420be12354e8123ad23d","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"fa5fd3e34bc6e58db54d41f266411f8e143a58beed31420be12354e8123ad23d","first_computed_at":"2026-07-05T11:11:01.354351Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:11:01.354351Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"1zPIdstuSYpTBuak8zHOW1hsX3tN4+FKKsy+WNfHKMStEEAoebrVLp8uLs07jRnyzhGD1uuq3Y1Gzu3vkRc/CA==","signature_status":"signed_v1","signed_at":"2026-07-05T11:11:01.354825Z","signed_message":"canonical_sha256_bytes"},"source_id":"2505.21642","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:5a329078494c3c8563dc70cb6833e139c82497580a936f6917b01824b6ac26ac","sha256:e4b8f3f5df762269f2ffa052d0f22613b1d90a89c5cae2698e3a8fd1c8e39876"],"state_sha256":"bf1a2b6fa4bb525ef0a9f9b4709eeb5e9791565994a7d279284e6dcda1ff0374"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"G7CaEaYDqdXU/i0+EEDw6/T/y86mSUHuZZwEGqq/WUdlyjcNquWRgV8eZ999FhpWxyCTWOhzzq8ZXT2HPFqgAQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-21T14:22:40.519453Z","bundle_sha256":"0e27261c313d77251ab714a538407cc751463d72a211791c7c9e36deebfed780"}}