{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:EH2YRE55SPJ5NCYBIB4RRS733Z","short_pith_number":"pith:EH2YRE55","canonical_record":{"source":{"id":"2605.29140","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-27T22:09:55Z","cross_cats_sorted":[],"title_canon_sha256":"6b69d801afb9ca1558a1b833c76e9e228b905ef3cd40fb922c58d78582282acb","abstract_canon_sha256":"3efee302699d1dcff3476c8d1f8eb5e2eadfdf756562d05cc03bdaad9be6200d"},"schema_version":"1.0"},"canonical_sha256":"21f58893bd93d3d68b01407918cbfbde4f7bd8256ac55cb9c4b48ffd6f058204","source":{"kind":"arxiv","id":"2605.29140","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.29140","created_at":"2026-05-29T01:05:20Z"},{"alias_kind":"arxiv_version","alias_value":"2605.29140v1","created_at":"2026-05-29T01:05:20Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.29140","created_at":"2026-05-29T01:05:20Z"},{"alias_kind":"pith_short_12","alias_value":"EH2YRE55SPJ5","created_at":"2026-05-29T01:05:20Z"},{"alias_kind":"pith_short_16","alias_value":"EH2YRE55SPJ5NCYB","created_at":"2026-05-29T01:05:20Z"},{"alias_kind":"pith_short_8","alias_value":"EH2YRE55","created_at":"2026-05-29T01:05:20Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:EH2YRE55SPJ5NCYBIB4RRS733Z","target":"record","payload":{"canonical_record":{"source":{"id":"2605.29140","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-27T22:09:55Z","cross_cats_sorted":[],"title_canon_sha256":"6b69d801afb9ca1558a1b833c76e9e228b905ef3cd40fb922c58d78582282acb","abstract_canon_sha256":"3efee302699d1dcff3476c8d1f8eb5e2eadfdf756562d05cc03bdaad9be6200d"},"schema_version":"1.0"},"canonical_sha256":"21f58893bd93d3d68b01407918cbfbde4f7bd8256ac55cb9c4b48ffd6f058204","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-29T01:05:20.362842Z","signature_b64":"pAbYlJcGyef55Qw0eLkcwVoiX//Z+w4MzXXiycQKyIwfpBklNkNRouznnTJOVUb+7q7PJ4fCThkmJc0hseNDBA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"21f58893bd93d3d68b01407918cbfbde4f7bd8256ac55cb9c4b48ffd6f058204","last_reissued_at":"2026-05-29T01:05:20.362019Z","signature_status":"signed_v1","first_computed_at":"2026-05-29T01:05:20.362019Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2605.29140","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-29T01:05:20Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"QA5ZDNj1w083ozBKagZW12OxHaL/I4K8XfURZYkXp4SypaFFo82Y3LcEM4xs0z6QHjKQtPB9dMJu2JlPZ7GbCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-08T02:02:07.356421Z"},"content_sha256":"5d67b79e047a641d4fe552b09d2e0cb0c31edf20c1b188ad4361f848b2c59bc2","schema_version":"1.0","event_id":"sha256:5d67b79e047a641d4fe552b09d2e0cb0c31edf20c1b188ad4361f848b2c59bc2"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:EH2YRE55SPJ5NCYBIB4RRS733Z","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"S3C2 Summit 2025-07: Government Secure Supply Chain Summit","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Alexandros Kapravelos, Christian K\\\"astner, Dominik Wermke, Laurie Williams, Michel Cukier, Pat Morrison, Sivana Hamer, William Enck, Yasemin Acar","submitted_at":"2026-05-27T22:09:55Z","abstract_excerpt":"Software supply chains, while providing immense economic and software development value, are only as strong as their weakest link. Over the past several years, there has been an exponential increase in cyberattacks specifically targeting vulnerable links in critical software supply chains. The attacks disrupt day-to-day functioning and threaten the security of nearly everyone on the internet, from billion-dollar companies and government agencies to hobbyist open-source developers. The evolving threat of software supply chain attacks has garnered interest from both the software industry and gov"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.29140","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2605.29140/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-29T01:05:20Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"kYemBBcn87fFsnDfq9gs99xkeY+7Zywie9iqyDfH5CpcK8TS0UwBsbEHtBktK8OSysribUeIsVUQXaumla25Ag==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-08T02:02:07.357145Z"},"content_sha256":"3f5bf8aeccac7613fc42cc732db836ce54f20544464da09e838d53cc67cf8522","schema_version":"1.0","event_id":"sha256:3f5bf8aeccac7613fc42cc732db836ce54f20544464da09e838d53cc67cf8522"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/EH2YRE55SPJ5NCYBIB4RRS733Z/bundle.json","state_url":"https://pith.science/pith/EH2YRE55SPJ5NCYBIB4RRS733Z/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/EH2YRE55SPJ5NCYBIB4RRS733Z/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-08T02:02:07Z","links":{"resolver":"https://pith.science/pith/EH2YRE55SPJ5NCYBIB4RRS733Z","bundle":"https://pith.science/pith/EH2YRE55SPJ5NCYBIB4RRS733Z/bundle.json","state":"https://pith.science/pith/EH2YRE55SPJ5NCYBIB4RRS733Z/state.json","well_known_bundle":"https://pith.science/.well-known/pith/EH2YRE55SPJ5NCYBIB4RRS733Z/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:EH2YRE55SPJ5NCYBIB4RRS733Z","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"3efee302699d1dcff3476c8d1f8eb5e2eadfdf756562d05cc03bdaad9be6200d","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-27T22:09:55Z","title_canon_sha256":"6b69d801afb9ca1558a1b833c76e9e228b905ef3cd40fb922c58d78582282acb"},"schema_version":"1.0","source":{"id":"2605.29140","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.29140","created_at":"2026-05-29T01:05:20Z"},{"alias_kind":"arxiv_version","alias_value":"2605.29140v1","created_at":"2026-05-29T01:05:20Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.29140","created_at":"2026-05-29T01:05:20Z"},{"alias_kind":"pith_short_12","alias_value":"EH2YRE55SPJ5","created_at":"2026-05-29T01:05:20Z"},{"alias_kind":"pith_short_16","alias_value":"EH2YRE55SPJ5NCYB","created_at":"2026-05-29T01:05:20Z"},{"alias_kind":"pith_short_8","alias_value":"EH2YRE55","created_at":"2026-05-29T01:05:20Z"}],"graph_snapshots":[{"event_id":"sha256:3f5bf8aeccac7613fc42cc732db836ce54f20544464da09e838d53cc67cf8522","target":"graph","created_at":"2026-05-29T01:05:20Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2605.29140/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Software supply chains, while providing immense economic and software development value, are only as strong as their weakest link. Over the past several years, there has been an exponential increase in cyberattacks specifically targeting vulnerable links in critical software supply chains. The attacks disrupt day-to-day functioning and threaten the security of nearly everyone on the internet, from billion-dollar companies and government agencies to hobbyist open-source developers. The evolving threat of software supply chain attacks has garnered interest from both the software industry and gov","authors_text":"Alexandros Kapravelos, Christian K\\\"astner, Dominik Wermke, Laurie Williams, Michel Cukier, Pat Morrison, Sivana Hamer, William Enck, Yasemin Acar","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-27T22:09:55Z","title":"S3C2 Summit 2025-07: Government Secure Supply Chain Summit"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.29140","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:5d67b79e047a641d4fe552b09d2e0cb0c31edf20c1b188ad4361f848b2c59bc2","target":"record","created_at":"2026-05-29T01:05:20Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"3efee302699d1dcff3476c8d1f8eb5e2eadfdf756562d05cc03bdaad9be6200d","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-27T22:09:55Z","title_canon_sha256":"6b69d801afb9ca1558a1b833c76e9e228b905ef3cd40fb922c58d78582282acb"},"schema_version":"1.0","source":{"id":"2605.29140","kind":"arxiv","version":1}},"canonical_sha256":"21f58893bd93d3d68b01407918cbfbde4f7bd8256ac55cb9c4b48ffd6f058204","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"21f58893bd93d3d68b01407918cbfbde4f7bd8256ac55cb9c4b48ffd6f058204","first_computed_at":"2026-05-29T01:05:20.362019Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-29T01:05:20.362019Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"pAbYlJcGyef55Qw0eLkcwVoiX//Z+w4MzXXiycQKyIwfpBklNkNRouznnTJOVUb+7q7PJ4fCThkmJc0hseNDBA==","signature_status":"signed_v1","signed_at":"2026-05-29T01:05:20.362842Z","signed_message":"canonical_sha256_bytes"},"source_id":"2605.29140","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:5d67b79e047a641d4fe552b09d2e0cb0c31edf20c1b188ad4361f848b2c59bc2","sha256:3f5bf8aeccac7613fc42cc732db836ce54f20544464da09e838d53cc67cf8522"],"state_sha256":"52571032490fa172113c2d2c10411a1668ed310fc282331e2d3ac1c5fd30e05f"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"gRdP35oOQ79SQAXEz1StmcFT2YZ2izmXA+1MpDM5PQJko86XtZaA1NeAezecMJpx6s7bbfcyD5kKFdUqRJQyDA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-08T02:02:07.360572Z","bundle_sha256":"c4c978616ef57a5569a8f4c5fa579ccdd6f73c86fd2351901617b746d5c8dd7e"}}