{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:BROU7J4NFEYDAHHHGERXI2XY4S","short_pith_number":"pith:BROU7J4N","canonical_record":{"source":{"id":"2403.09537","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2024-03-14T16:26:40Z","cross_cats_sorted":[],"title_canon_sha256":"2caa80ccb27821d33353fc0e156cf18a3bb498b28f7a8896ef12042e05926d25","abstract_canon_sha256":"a8b976425e2b1dc0aee5c6783594ca26e6b1ca58c959b29aa136af4aa06c297d"},"schema_version":"1.0"},"canonical_sha256":"0c5d4fa78d2930301ce73123746af8e490d68f43acbb0edd16a78febcf1508b2","source":{"kind":"arxiv","id":"2403.09537","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2403.09537","created_at":"2026-07-05T07:56:11Z"},{"alias_kind":"arxiv_version","alias_value":"2403.09537v1","created_at":"2026-07-05T07:56:11Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2403.09537","created_at":"2026-07-05T07:56:11Z"},{"alias_kind":"pith_short_12","alias_value":"BROU7J4NFEYD","created_at":"2026-07-05T07:56:11Z"},{"alias_kind":"pith_short_16","alias_value":"BROU7J4NFEYDAHHH","created_at":"2026-07-05T07:56:11Z"},{"alias_kind":"pith_short_8","alias_value":"BROU7J4N","created_at":"2026-07-05T07:56:11Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:BROU7J4NFEYDAHHHGERXI2XY4S","target":"record","payload":{"canonical_record":{"source":{"id":"2403.09537","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2024-03-14T16:26:40Z","cross_cats_sorted":[],"title_canon_sha256":"2caa80ccb27821d33353fc0e156cf18a3bb498b28f7a8896ef12042e05926d25","abstract_canon_sha256":"a8b976425e2b1dc0aee5c6783594ca26e6b1ca58c959b29aa136af4aa06c297d"},"schema_version":"1.0"},"canonical_sha256":"0c5d4fa78d2930301ce73123746af8e490d68f43acbb0edd16a78febcf1508b2","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T07:56:11.092057Z","signature_b64":"loJJI5na0CZjkuTzK5u46M7A6nmkVarKzcDbrwDNSLKmx6jA4YnEkR0HjdiGhVW/lRQbtr8YKzDfvIykxa8yDw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"0c5d4fa78d2930301ce73123746af8e490d68f43acbb0edd16a78febcf1508b2","last_reissued_at":"2026-07-05T07:56:11.091561Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T07:56:11.091561Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2403.09537","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T07:56:11Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Z7eT4v3zEQNCT0UyVA2VNGAX0ynmaX1t8e1T1OZKEUGB60ZIa1oS5WeRvwuHGIFWTNU+hjP7SZcv59CP8ruNDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T22:50:05.781061Z"},"content_sha256":"ba1d2573090e56474e6dbaf63b7285e272a16cd32dad78cd8be8a39cbab80d03","schema_version":"1.0","event_id":"sha256:ba1d2573090e56474e6dbaf63b7285e272a16cd32dad78cd8be8a39cbab80d03"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:BROU7J4NFEYDAHHHGERXI2XY4S","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Analyzing and Mitigating (with LLMs) the Security Misconfigurations of Helm Charts from Artifact Hub","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.SE","authors_text":"Fabio Massacci, Francesco Minna, Katja Tuma","submitted_at":"2024-03-14T16:26:40Z","abstract_excerpt":"Background: Helm is a package manager that allows defining, installing, and upgrading applications with Kubernetes (K8s), a popular container orchestration platform. A Helm chart is a collection of files describing all dependencies, resources, and parameters required for deploying an application within a K8s cluster. Objective: The goal of this study is to mine and empirically evaluate the security of Helm charts, comparing the performance of existing tools in terms of misconfigurations reported by policies available by default, and measure to what extent LLMs could be used for removing miscon"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2403.09537","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2403.09537/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T07:56:11Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"nsN0m3HsSRSbabTNxVeMVnYni5ZkLJJ8p8b2V8B30EiuLahp+n6F0UUmMDu82wRHfhiBrHyQCTWpIv3NKo1jCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T22:50:05.781572Z"},"content_sha256":"e1fdb2dc431b124566c08c6aefded47e70e33801be8deb8da2366dca11d61bbe","schema_version":"1.0","event_id":"sha256:e1fdb2dc431b124566c08c6aefded47e70e33801be8deb8da2366dca11d61bbe"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/BROU7J4NFEYDAHHHGERXI2XY4S/bundle.json","state_url":"https://pith.science/pith/BROU7J4NFEYDAHHHGERXI2XY4S/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/BROU7J4NFEYDAHHHGERXI2XY4S/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-08T22:50:05Z","links":{"resolver":"https://pith.science/pith/BROU7J4NFEYDAHHHGERXI2XY4S","bundle":"https://pith.science/pith/BROU7J4NFEYDAHHHGERXI2XY4S/bundle.json","state":"https://pith.science/pith/BROU7J4NFEYDAHHHGERXI2XY4S/state.json","well_known_bundle":"https://pith.science/.well-known/pith/BROU7J4NFEYDAHHHGERXI2XY4S/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:BROU7J4NFEYDAHHHGERXI2XY4S","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"a8b976425e2b1dc0aee5c6783594ca26e6b1ca58c959b29aa136af4aa06c297d","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2024-03-14T16:26:40Z","title_canon_sha256":"2caa80ccb27821d33353fc0e156cf18a3bb498b28f7a8896ef12042e05926d25"},"schema_version":"1.0","source":{"id":"2403.09537","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2403.09537","created_at":"2026-07-05T07:56:11Z"},{"alias_kind":"arxiv_version","alias_value":"2403.09537v1","created_at":"2026-07-05T07:56:11Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2403.09537","created_at":"2026-07-05T07:56:11Z"},{"alias_kind":"pith_short_12","alias_value":"BROU7J4NFEYD","created_at":"2026-07-05T07:56:11Z"},{"alias_kind":"pith_short_16","alias_value":"BROU7J4NFEYDAHHH","created_at":"2026-07-05T07:56:11Z"},{"alias_kind":"pith_short_8","alias_value":"BROU7J4N","created_at":"2026-07-05T07:56:11Z"}],"graph_snapshots":[{"event_id":"sha256:e1fdb2dc431b124566c08c6aefded47e70e33801be8deb8da2366dca11d61bbe","target":"graph","created_at":"2026-07-05T07:56:11Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2403.09537/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Background: Helm is a package manager that allows defining, installing, and upgrading applications with Kubernetes (K8s), a popular container orchestration platform. A Helm chart is a collection of files describing all dependencies, resources, and parameters required for deploying an application within a K8s cluster. Objective: The goal of this study is to mine and empirically evaluate the security of Helm charts, comparing the performance of existing tools in terms of misconfigurations reported by policies available by default, and measure to what extent LLMs could be used for removing miscon","authors_text":"Fabio Massacci, Francesco Minna, Katja Tuma","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2024-03-14T16:26:40Z","title":"Analyzing and Mitigating (with LLMs) the Security Misconfigurations of Helm Charts from Artifact Hub"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2403.09537","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:ba1d2573090e56474e6dbaf63b7285e272a16cd32dad78cd8be8a39cbab80d03","target":"record","created_at":"2026-07-05T07:56:11Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"a8b976425e2b1dc0aee5c6783594ca26e6b1ca58c959b29aa136af4aa06c297d","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2024-03-14T16:26:40Z","title_canon_sha256":"2caa80ccb27821d33353fc0e156cf18a3bb498b28f7a8896ef12042e05926d25"},"schema_version":"1.0","source":{"id":"2403.09537","kind":"arxiv","version":1}},"canonical_sha256":"0c5d4fa78d2930301ce73123746af8e490d68f43acbb0edd16a78febcf1508b2","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"0c5d4fa78d2930301ce73123746af8e490d68f43acbb0edd16a78febcf1508b2","first_computed_at":"2026-07-05T07:56:11.091561Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T07:56:11.091561Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"loJJI5na0CZjkuTzK5u46M7A6nmkVarKzcDbrwDNSLKmx6jA4YnEkR0HjdiGhVW/lRQbtr8YKzDfvIykxa8yDw==","signature_status":"signed_v1","signed_at":"2026-07-05T07:56:11.092057Z","signed_message":"canonical_sha256_bytes"},"source_id":"2403.09537","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:ba1d2573090e56474e6dbaf63b7285e272a16cd32dad78cd8be8a39cbab80d03","sha256:e1fdb2dc431b124566c08c6aefded47e70e33801be8deb8da2366dca11d61bbe"],"state_sha256":"2e465cc613ea40150e71fa25a10b9fa8bcb1ba2a038ff01848f73af759c526a2"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"CYHxTzhETHpAg89hf2mu3NACGrOwTSnpmu8ut+BWC9Vkm5DGha2gDz50JH/v/e26i4eIMYXwO0SHEAb35AxCDQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-08T22:50:05.786191Z","bundle_sha256":"0250ce09467aa961e7dfc3cd9349418dd38cc2688be83cf781946111f085b15f"}}