{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2024:DRLSQG73IIFCVL6CMM7W6YDLHS","short_pith_number":"pith:DRLSQG73","schema_version":"1.0","canonical_sha256":"1c57281bfb420a2aafc2633f6f606b3c879ad486723cb359770ca50c43dd3314","source":{"kind":"arxiv","id":"2409.01214","version":1},"attestation_state":"computed","paper":{"title":"SBOM Generation Tools in the Python Ecosystem: an In-Detail Analysis","license":"http://creativecommons.org/licenses/by-sa/4.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Giacomo Benedetti, Matteo Dell'Amico, Serena Cofano","submitted_at":"2024-09-02T12:48:10Z","abstract_excerpt":"Software Bills of Material (SBOMs), which improve transparency by listing the components constituting software, are a key countermeasure to the mounting problem of Software Supply Chain attacks. SBOM generation tools take project source files and provide an SBOM as output, interacting with the software ecosystem. While SBOMs are a substantial improvement for security practitioners, providing a complete and correct SBOM is still an open problem. This paper investigates the causes of the issues affecting SBOM completeness and correctness, focusing on the PyPI ecosystem. We analyze four popular S"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2409.01214","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2024-09-02T12:48:10Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"28aa19b761875043a613147e1c97dae19b7716031911ba29b8982c6e0d05281f","abstract_canon_sha256":"8ba22f40513aca46a1ce72ed973c50db781c423f0920e86f81435028d46dc0b4"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T09:02:00.854099Z","signature_b64":"EmF3W0ogg+lzOuv0+Jm4Z6bxgZLNOiDmAR5UmK01YBxQvSyRGJsJcjl7tMN+g/bDt6YQuoTi4nSb15vdW0AlDA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"1c57281bfb420a2aafc2633f6f606b3c879ad486723cb359770ca50c43dd3314","last_reissued_at":"2026-07-05T09:02:00.853550Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T09:02:00.853550Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"SBOM Generation Tools in the Python Ecosystem: an In-Detail Analysis","license":"http://creativecommons.org/licenses/by-sa/4.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Giacomo Benedetti, Matteo Dell'Amico, Serena Cofano","submitted_at":"2024-09-02T12:48:10Z","abstract_excerpt":"Software Bills of Material (SBOMs), which improve transparency by listing the components constituting software, are a key countermeasure to the mounting problem of Software Supply Chain attacks. SBOM generation tools take project source files and provide an SBOM as output, interacting with the software ecosystem. While SBOMs are a substantial improvement for security practitioners, providing a complete and correct SBOM is still an open problem. This paper investigates the causes of the issues affecting SBOM completeness and correctness, focusing on the PyPI ecosystem. We analyze four popular S"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2409.01214","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2409.01214/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2409.01214","created_at":"2026-07-05T09:02:00.853609+00:00"},{"alias_kind":"arxiv_version","alias_value":"2409.01214v1","created_at":"2026-07-05T09:02:00.853609+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2409.01214","created_at":"2026-07-05T09:02:00.853609+00:00"},{"alias_kind":"pith_short_12","alias_value":"DRLSQG73IIFC","created_at":"2026-07-05T09:02:00.853609+00:00"},{"alias_kind":"pith_short_16","alias_value":"DRLSQG73IIFCVL6C","created_at":"2026-07-05T09:02:00.853609+00:00"},{"alias_kind":"pith_short_8","alias_value":"DRLSQG73","created_at":"2026-07-05T09:02:00.853609+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":1,"internal_anchor_count":1,"sample":[{"citing_arxiv_id":"2602.18602","citing_title":"Package Managers \\`a la Carte: A Formal Model of Dependency Resolution","ref_index":21,"is_internal_anchor":true}]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/DRLSQG73IIFCVL6CMM7W6YDLHS","json":"https://pith.science/pith/DRLSQG73IIFCVL6CMM7W6YDLHS.json","graph_json":"https://pith.science/api/pith-number/DRLSQG73IIFCVL6CMM7W6YDLHS/graph.json","events_json":"https://pith.science/api/pith-number/DRLSQG73IIFCVL6CMM7W6YDLHS/events.json","paper":"https://pith.science/paper/DRLSQG73"},"agent_actions":{"view_html":"https://pith.science/pith/DRLSQG73IIFCVL6CMM7W6YDLHS","download_json":"https://pith.science/pith/DRLSQG73IIFCVL6CMM7W6YDLHS.json","view_paper":"https://pith.science/paper/DRLSQG73","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2409.01214&json=true","fetch_graph":"https://pith.science/api/pith-number/DRLSQG73IIFCVL6CMM7W6YDLHS/graph.json","fetch_events":"https://pith.science/api/pith-number/DRLSQG73IIFCVL6CMM7W6YDLHS/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/DRLSQG73IIFCVL6CMM7W6YDLHS/action/timestamp_anchor","attest_storage":"https://pith.science/pith/DRLSQG73IIFCVL6CMM7W6YDLHS/action/storage_attestation","attest_author":"https://pith.science/pith/DRLSQG73IIFCVL6CMM7W6YDLHS/action/author_attestation","sign_citation":"https://pith.science/pith/DRLSQG73IIFCVL6CMM7W6YDLHS/action/citation_signature","submit_replication":"https://pith.science/pith/DRLSQG73IIFCVL6CMM7W6YDLHS/action/replication_record"}},"created_at":"2026-07-05T09:02:00.853609+00:00","updated_at":"2026-07-05T09:02:00.853609+00:00"}