{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2023:DAZPVTMJ5JFLF56JIE4HQUXM2U","short_pith_number":"pith:DAZPVTMJ","schema_version":"1.0","canonical_sha256":"1832facd89ea4ab2f7c941387852ecd5040b7bf24c7de1d6bd8b53201a9c23a9","source":{"kind":"arxiv","id":"2308.05942","version":1},"attestation_state":"computed","paper":{"title":"Understanding and Remediating Open-Source License Incompatibilities in the PyPI Ecosystem","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.SE","authors_text":"Hao He, Kai Gao, Minghui Zhou, Weiwei Xu","submitted_at":"2023-08-11T04:57:54Z","abstract_excerpt":"The reuse and distribution of open-source software must be in compliance with its accompanying open-source license. In modern packaging ecosystems, maintaining such compliance is challenging because a package may have a complex multi-layered dependency graph with many packages, any of which may have an incompatible license. Although prior research finds that license incompatibilities are prevalent, empirical evidence is still scarce in some modern packaging ecosystems (e.g., PyPI). It also remains unclear how developers remediate the license incompatibilities in the dependency graphs of their "},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2308.05942","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.SE","submitted_at":"2023-08-11T04:57:54Z","cross_cats_sorted":[],"title_canon_sha256":"a22309c4efd411eb7d360968981dd5ef7f83908c667d5bab5338f6c643cadf33","abstract_canon_sha256":"d182eec2d2fa746120707686a5074c89e18256fd32ddeba51609f0f64abf080f"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T06:40:20.963547Z","signature_b64":"uBar00aFNf/q3LmJd21MZgVbPox+S3YbyQWk0Ny2Fafxa06z75kFfS0R6yd1R5aKJKq8ZjZDIXQ59qkpPV0mBA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"1832facd89ea4ab2f7c941387852ecd5040b7bf24c7de1d6bd8b53201a9c23a9","last_reissued_at":"2026-07-05T06:40:20.963150Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T06:40:20.963150Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Understanding and Remediating Open-Source License Incompatibilities in the PyPI Ecosystem","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.SE","authors_text":"Hao He, Kai Gao, Minghui Zhou, Weiwei Xu","submitted_at":"2023-08-11T04:57:54Z","abstract_excerpt":"The reuse and distribution of open-source software must be in compliance with its accompanying open-source license. In modern packaging ecosystems, maintaining such compliance is challenging because a package may have a complex multi-layered dependency graph with many packages, any of which may have an incompatible license. Although prior research finds that license incompatibilities are prevalent, empirical evidence is still scarce in some modern packaging ecosystems (e.g., PyPI). It also remains unclear how developers remediate the license incompatibilities in the dependency graphs of their "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2308.05942","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2308.05942/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2308.05942","created_at":"2026-07-05T06:40:20.963208+00:00"},{"alias_kind":"arxiv_version","alias_value":"2308.05942v1","created_at":"2026-07-05T06:40:20.963208+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2308.05942","created_at":"2026-07-05T06:40:20.963208+00:00"},{"alias_kind":"pith_short_12","alias_value":"DAZPVTMJ5JFL","created_at":"2026-07-05T06:40:20.963208+00:00"},{"alias_kind":"pith_short_16","alias_value":"DAZPVTMJ5JFLF56J","created_at":"2026-07-05T06:40:20.963208+00:00"},{"alias_kind":"pith_short_8","alias_value":"DAZPVTMJ","created_at":"2026-07-05T06:40:20.963208+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":1,"internal_anchor_count":1,"sample":[{"citing_arxiv_id":"2412.05259","citing_title":"A Machine Learning-Based Approach For Detecting Malicious PyPI Packages","ref_index":65,"is_internal_anchor":true}]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/DAZPVTMJ5JFLF56JIE4HQUXM2U","json":"https://pith.science/pith/DAZPVTMJ5JFLF56JIE4HQUXM2U.json","graph_json":"https://pith.science/api/pith-number/DAZPVTMJ5JFLF56JIE4HQUXM2U/graph.json","events_json":"https://pith.science/api/pith-number/DAZPVTMJ5JFLF56JIE4HQUXM2U/events.json","paper":"https://pith.science/paper/DAZPVTMJ"},"agent_actions":{"view_html":"https://pith.science/pith/DAZPVTMJ5JFLF56JIE4HQUXM2U","download_json":"https://pith.science/pith/DAZPVTMJ5JFLF56JIE4HQUXM2U.json","view_paper":"https://pith.science/paper/DAZPVTMJ","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2308.05942&json=true","fetch_graph":"https://pith.science/api/pith-number/DAZPVTMJ5JFLF56JIE4HQUXM2U/graph.json","fetch_events":"https://pith.science/api/pith-number/DAZPVTMJ5JFLF56JIE4HQUXM2U/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/DAZPVTMJ5JFLF56JIE4HQUXM2U/action/timestamp_anchor","attest_storage":"https://pith.science/pith/DAZPVTMJ5JFLF56JIE4HQUXM2U/action/storage_attestation","attest_author":"https://pith.science/pith/DAZPVTMJ5JFLF56JIE4HQUXM2U/action/author_attestation","sign_citation":"https://pith.science/pith/DAZPVTMJ5JFLF56JIE4HQUXM2U/action/citation_signature","submit_replication":"https://pith.science/pith/DAZPVTMJ5JFLF56JIE4HQUXM2U/action/replication_record"}},"created_at":"2026-07-05T06:40:20.963208+00:00","updated_at":"2026-07-05T06:40:20.963208+00:00"}