{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:CQFHDHBUJAYXYS3THIJHKBPYS2","short_pith_number":"pith:CQFHDHBU","canonical_record":{"source":{"id":"2606.21487","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-06-19T14:37:59Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"67b488e68762860131e10eba1f2f0f41109aa006f32f3a67297258623b23fead","abstract_canon_sha256":"faa0851eeaadd98b8bbf729e629f92205ecc9b34199f14b95b5d5c6bca69e412"},"schema_version":"1.0"},"canonical_sha256":"140a719c3448317c4b733a127505f896b604ea6c378e4043698999b804c26798","source":{"kind":"arxiv","id":"2606.21487","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.21487","created_at":"2026-06-23T01:13:11Z"},{"alias_kind":"arxiv_version","alias_value":"2606.21487v1","created_at":"2026-06-23T01:13:11Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.21487","created_at":"2026-06-23T01:13:11Z"},{"alias_kind":"pith_short_12","alias_value":"CQFHDHBUJAYX","created_at":"2026-06-23T01:13:11Z"},{"alias_kind":"pith_short_16","alias_value":"CQFHDHBUJAYXYS3T","created_at":"2026-06-23T01:13:11Z"},{"alias_kind":"pith_short_8","alias_value":"CQFHDHBU","created_at":"2026-06-23T01:13:11Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:CQFHDHBUJAYXYS3THIJHKBPYS2","target":"record","payload":{"canonical_record":{"source":{"id":"2606.21487","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-06-19T14:37:59Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"67b488e68762860131e10eba1f2f0f41109aa006f32f3a67297258623b23fead","abstract_canon_sha256":"faa0851eeaadd98b8bbf729e629f92205ecc9b34199f14b95b5d5c6bca69e412"},"schema_version":"1.0"},"canonical_sha256":"140a719c3448317c4b733a127505f896b604ea6c378e4043698999b804c26798","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-06-23T01:13:11.984472Z","signature_b64":"iwpm+o7TA1UsOE94cn4vVZQK+T1XCOgn8dtGEaPLfo9MLmvAthy/7ZGghJN25Tj+f44O+6wwoRndmyVkyTKqDA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"140a719c3448317c4b733a127505f896b604ea6c378e4043698999b804c26798","last_reissued_at":"2026-06-23T01:13:11.983962Z","signature_status":"signed_v1","first_computed_at":"2026-06-23T01:13:11.983962Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2606.21487","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-23T01:13:11Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"NZh5H1UvDCuI6B/IAn6kldkYWBInRy1sZl3YmckjC4pN27JrvYNvGoykeQw5xkzs78ukyhjfYoaSXWh85b94Dg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-23T22:35:21.227910Z"},"content_sha256":"64109bcce403aa1c99921e979be0e84890ea35e6d4505bda1c87145673cc31b8","schema_version":"1.0","event_id":"sha256:64109bcce403aa1c99921e979be0e84890ea35e6d4505bda1c87145673cc31b8"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:CQFHDHBUJAYXYS3THIJHKBPYS2","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"A Longitudinal Study of Android Apps Signing Key Protection","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Chunyang Chen, Mark Huasong Meng, Qing Zhang, Weirao Lu","submitted_at":"2026-06-19T14:37:59Z","abstract_excerpt":"Android app signing relies on developer-managed credentials, making secure key protection essential for the integrity of the software supply chain. A recent platform key leakage incident involving two major OEM manufacturers demonstrates that even robustly designed signing mechanisms can be compromised due to developers' oversight. In this work, we conduct a longitudinal ecosystem study to characterize this threat by mining public repositories for Android signing credentials, recovering compromised keys via exposed passwords, and matching them against signatures from over 4,000 apps collected "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.21487","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2606.21487/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-23T01:13:11Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"xV7+dpdi7B7HaM/p9McCqTd9+vq0hjmyzG37kZN8M25djNXRDELPWpqcqMb0ZdsBKUohQyIZytgB8lRcOvHRCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-23T22:35:21.228400Z"},"content_sha256":"3ff993bffbf72709fb510f0b4a41bc4bc77819d830728eb206ab3581aaf4756a","schema_version":"1.0","event_id":"sha256:3ff993bffbf72709fb510f0b4a41bc4bc77819d830728eb206ab3581aaf4756a"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/CQFHDHBUJAYXYS3THIJHKBPYS2/bundle.json","state_url":"https://pith.science/pith/CQFHDHBUJAYXYS3THIJHKBPYS2/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/CQFHDHBUJAYXYS3THIJHKBPYS2/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-23T22:35:21Z","links":{"resolver":"https://pith.science/pith/CQFHDHBUJAYXYS3THIJHKBPYS2","bundle":"https://pith.science/pith/CQFHDHBUJAYXYS3THIJHKBPYS2/bundle.json","state":"https://pith.science/pith/CQFHDHBUJAYXYS3THIJHKBPYS2/state.json","well_known_bundle":"https://pith.science/.well-known/pith/CQFHDHBUJAYXYS3THIJHKBPYS2/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:CQFHDHBUJAYXYS3THIJHKBPYS2","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"faa0851eeaadd98b8bbf729e629f92205ecc9b34199f14b95b5d5c6bca69e412","cross_cats_sorted":["cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-06-19T14:37:59Z","title_canon_sha256":"67b488e68762860131e10eba1f2f0f41109aa006f32f3a67297258623b23fead"},"schema_version":"1.0","source":{"id":"2606.21487","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.21487","created_at":"2026-06-23T01:13:11Z"},{"alias_kind":"arxiv_version","alias_value":"2606.21487v1","created_at":"2026-06-23T01:13:11Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.21487","created_at":"2026-06-23T01:13:11Z"},{"alias_kind":"pith_short_12","alias_value":"CQFHDHBUJAYX","created_at":"2026-06-23T01:13:11Z"},{"alias_kind":"pith_short_16","alias_value":"CQFHDHBUJAYXYS3T","created_at":"2026-06-23T01:13:11Z"},{"alias_kind":"pith_short_8","alias_value":"CQFHDHBU","created_at":"2026-06-23T01:13:11Z"}],"graph_snapshots":[{"event_id":"sha256:3ff993bffbf72709fb510f0b4a41bc4bc77819d830728eb206ab3581aaf4756a","target":"graph","created_at":"2026-06-23T01:13:11Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2606.21487/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Android app signing relies on developer-managed credentials, making secure key protection essential for the integrity of the software supply chain. A recent platform key leakage incident involving two major OEM manufacturers demonstrates that even robustly designed signing mechanisms can be compromised due to developers' oversight. In this work, we conduct a longitudinal ecosystem study to characterize this threat by mining public repositories for Android signing credentials, recovering compromised keys via exposed passwords, and matching them against signatures from over 4,000 apps collected ","authors_text":"Chunyang Chen, Mark Huasong Meng, Qing Zhang, Weirao Lu","cross_cats":["cs.SE"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-06-19T14:37:59Z","title":"A Longitudinal Study of Android Apps Signing Key Protection"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.21487","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:64109bcce403aa1c99921e979be0e84890ea35e6d4505bda1c87145673cc31b8","target":"record","created_at":"2026-06-23T01:13:11Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"faa0851eeaadd98b8bbf729e629f92205ecc9b34199f14b95b5d5c6bca69e412","cross_cats_sorted":["cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-06-19T14:37:59Z","title_canon_sha256":"67b488e68762860131e10eba1f2f0f41109aa006f32f3a67297258623b23fead"},"schema_version":"1.0","source":{"id":"2606.21487","kind":"arxiv","version":1}},"canonical_sha256":"140a719c3448317c4b733a127505f896b604ea6c378e4043698999b804c26798","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"140a719c3448317c4b733a127505f896b604ea6c378e4043698999b804c26798","first_computed_at":"2026-06-23T01:13:11.983962Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-06-23T01:13:11.983962Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"iwpm+o7TA1UsOE94cn4vVZQK+T1XCOgn8dtGEaPLfo9MLmvAthy/7ZGghJN25Tj+f44O+6wwoRndmyVkyTKqDA==","signature_status":"signed_v1","signed_at":"2026-06-23T01:13:11.984472Z","signed_message":"canonical_sha256_bytes"},"source_id":"2606.21487","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:64109bcce403aa1c99921e979be0e84890ea35e6d4505bda1c87145673cc31b8","sha256:3ff993bffbf72709fb510f0b4a41bc4bc77819d830728eb206ab3581aaf4756a"],"state_sha256":"afbda7d11ac51b5592d809d00a3145c4190c1782a37caa78cc9ce222403fcd34"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"/lzIXbiQi6BMkeokp6rg1Vk0EK7kq+IujfqVC65svguRROomXi/ytdmKP+ygPPQpPJA7ZaW8xeuR+RHZrJ1xAw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-23T22:35:21.232965Z","bundle_sha256":"c920e1b2d99d185181ba21c656dfd5c92b001cb8d8cc6a0c947924ce7f02c6b2"}}