{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2021:BRDW4MK3GIKY47OPI3RBGAFPST","short_pith_number":"pith:BRDW4MK3","canonical_record":{"source":{"id":"2112.12597","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-12-21T07:41:02Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"f9208a178212d29db931983b25c9be1c076fec3617ede54d1317685f97b8e1dd","abstract_canon_sha256":"5c1b2c642233d7f9894173bf38e54cc9a9f3f02003236c34037d3d84786a86e7"},"schema_version":"1.0"},"canonical_sha256":"0c476e315b32158e7dcf46e21300af94e5a5b4c3cdc2f0f5d3b2cf70b6814b8c","source":{"kind":"arxiv","id":"2112.12597","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2112.12597","created_at":"2026-07-05T03:43:29Z"},{"alias_kind":"arxiv_version","alias_value":"2112.12597v1","created_at":"2026-07-05T03:43:29Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2112.12597","created_at":"2026-07-05T03:43:29Z"},{"alias_kind":"pith_short_12","alias_value":"BRDW4MK3GIKY","created_at":"2026-07-05T03:43:29Z"},{"alias_kind":"pith_short_16","alias_value":"BRDW4MK3GIKY47OP","created_at":"2026-07-05T03:43:29Z"},{"alias_kind":"pith_short_8","alias_value":"BRDW4MK3","created_at":"2026-07-05T03:43:29Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2021:BRDW4MK3GIKY47OPI3RBGAFPST","target":"record","payload":{"canonical_record":{"source":{"id":"2112.12597","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-12-21T07:41:02Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"f9208a178212d29db931983b25c9be1c076fec3617ede54d1317685f97b8e1dd","abstract_canon_sha256":"5c1b2c642233d7f9894173bf38e54cc9a9f3f02003236c34037d3d84786a86e7"},"schema_version":"1.0"},"canonical_sha256":"0c476e315b32158e7dcf46e21300af94e5a5b4c3cdc2f0f5d3b2cf70b6814b8c","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T03:43:29.189920Z","signature_b64":"exsXUTXL3/61aQolxXzs7RbO+9K3/oZoZoPHjoDc9uhuWxnppCz50+/NmuG7jTyoHo6B9IQNkIsENk9o4UhoBw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"0c476e315b32158e7dcf46e21300af94e5a5b4c3cdc2f0f5d3b2cf70b6814b8c","last_reissued_at":"2026-07-05T03:43:29.189529Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T03:43:29.189529Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2112.12597","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T03:43:29Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ZRZQVclflpK64UgIYsmO8rhk+Dn4AtNKSUccnqiqvbWXNcyQ4Fy6qfouW+Lq1i4IoV/8OpTfp3OxZ+wZ2Zc9CA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-21T12:40:46.173470Z"},"content_sha256":"cb2cf27991f1e810674c9c4dca7982621fbac8757af200776316b217f6e08b2f","schema_version":"1.0","event_id":"sha256:cb2cf27991f1e810674c9c4dca7982621fbac8757af200776316b217f6e08b2f"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2021:BRDW4MK3GIKY47OPI3RBGAFPST","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Well Begun is Half Done: An Empirical Study of Exploitability & Impact of Base-Image Vulnerabilities","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"M. Ali Babar, Mubin Ul Haque","submitted_at":"2021-12-21T07:41:02Z","abstract_excerpt":"Container technology, (e.g., Docker) is being widely adopted for deploying software infrastructures or applications in the form of container images. Security vulnerabilities in the container images are a primary concern for developing containerized software. Exploitation of the vulnerabilities could result in disastrous impact, such as loss of confidentiality, integrity, and availability of containerized software. Understanding the exploitability and impact characteristics of vulnerabilities can help in securing the configuration of containerized software. However, there is a lack of research "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2112.12597","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2112.12597/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T03:43:29Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"cf6vHdxX6l2SJt6v5GC6+fpLUXu0d8gDhZyLu+hlwZpsB3Cqdx60Mh+/v0CctKwzb5UYl3JjjDGz0mmEdXGTDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-21T12:40:46.173830Z"},"content_sha256":"5c8db426880d6adedc937d3c863c905c129f204deb20e4eb66aeda2fdce1fad7","schema_version":"1.0","event_id":"sha256:5c8db426880d6adedc937d3c863c905c129f204deb20e4eb66aeda2fdce1fad7"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/BRDW4MK3GIKY47OPI3RBGAFPST/bundle.json","state_url":"https://pith.science/pith/BRDW4MK3GIKY47OPI3RBGAFPST/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/BRDW4MK3GIKY47OPI3RBGAFPST/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-21T12:40:46Z","links":{"resolver":"https://pith.science/pith/BRDW4MK3GIKY47OPI3RBGAFPST","bundle":"https://pith.science/pith/BRDW4MK3GIKY47OPI3RBGAFPST/bundle.json","state":"https://pith.science/pith/BRDW4MK3GIKY47OPI3RBGAFPST/state.json","well_known_bundle":"https://pith.science/.well-known/pith/BRDW4MK3GIKY47OPI3RBGAFPST/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2021:BRDW4MK3GIKY47OPI3RBGAFPST","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"5c1b2c642233d7f9894173bf38e54cc9a9f3f02003236c34037d3d84786a86e7","cross_cats_sorted":["cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-12-21T07:41:02Z","title_canon_sha256":"f9208a178212d29db931983b25c9be1c076fec3617ede54d1317685f97b8e1dd"},"schema_version":"1.0","source":{"id":"2112.12597","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2112.12597","created_at":"2026-07-05T03:43:29Z"},{"alias_kind":"arxiv_version","alias_value":"2112.12597v1","created_at":"2026-07-05T03:43:29Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2112.12597","created_at":"2026-07-05T03:43:29Z"},{"alias_kind":"pith_short_12","alias_value":"BRDW4MK3GIKY","created_at":"2026-07-05T03:43:29Z"},{"alias_kind":"pith_short_16","alias_value":"BRDW4MK3GIKY47OP","created_at":"2026-07-05T03:43:29Z"},{"alias_kind":"pith_short_8","alias_value":"BRDW4MK3","created_at":"2026-07-05T03:43:29Z"}],"graph_snapshots":[{"event_id":"sha256:5c8db426880d6adedc937d3c863c905c129f204deb20e4eb66aeda2fdce1fad7","target":"graph","created_at":"2026-07-05T03:43:29Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2112.12597/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Container technology, (e.g., Docker) is being widely adopted for deploying software infrastructures or applications in the form of container images. Security vulnerabilities in the container images are a primary concern for developing containerized software. Exploitation of the vulnerabilities could result in disastrous impact, such as loss of confidentiality, integrity, and availability of containerized software. Understanding the exploitability and impact characteristics of vulnerabilities can help in securing the configuration of containerized software. However, there is a lack of research ","authors_text":"M. Ali Babar, Mubin Ul Haque","cross_cats":["cs.SE"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-12-21T07:41:02Z","title":"Well Begun is Half Done: An Empirical Study of Exploitability & Impact of Base-Image Vulnerabilities"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2112.12597","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:cb2cf27991f1e810674c9c4dca7982621fbac8757af200776316b217f6e08b2f","target":"record","created_at":"2026-07-05T03:43:29Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"5c1b2c642233d7f9894173bf38e54cc9a9f3f02003236c34037d3d84786a86e7","cross_cats_sorted":["cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-12-21T07:41:02Z","title_canon_sha256":"f9208a178212d29db931983b25c9be1c076fec3617ede54d1317685f97b8e1dd"},"schema_version":"1.0","source":{"id":"2112.12597","kind":"arxiv","version":1}},"canonical_sha256":"0c476e315b32158e7dcf46e21300af94e5a5b4c3cdc2f0f5d3b2cf70b6814b8c","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"0c476e315b32158e7dcf46e21300af94e5a5b4c3cdc2f0f5d3b2cf70b6814b8c","first_computed_at":"2026-07-05T03:43:29.189529Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T03:43:29.189529Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"exsXUTXL3/61aQolxXzs7RbO+9K3/oZoZoPHjoDc9uhuWxnppCz50+/NmuG7jTyoHo6B9IQNkIsENk9o4UhoBw==","signature_status":"signed_v1","signed_at":"2026-07-05T03:43:29.189920Z","signed_message":"canonical_sha256_bytes"},"source_id":"2112.12597","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:cb2cf27991f1e810674c9c4dca7982621fbac8757af200776316b217f6e08b2f","sha256:5c8db426880d6adedc937d3c863c905c129f204deb20e4eb66aeda2fdce1fad7"],"state_sha256":"b3705ad957fa0f0f5fe6d49b45a6636032d4da73b5502e20372c9a9c51d30be0"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"jjD10H6jZOM0n2jgE+kBXGxvQFUimhjouQxb3eSw84hJ98fJih50+jLwVKcOamh7UTSiC37jFcUHNu7ECvI7Dw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-21T12:40:46.176836Z","bundle_sha256":"a562582947d6dda0612ef7310521ad695b110f1e2352492b60657957e546435c"}}