{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:ERF3M2SK5PWNAQSU5JK5O5EYCH","short_pith_number":"pith:ERF3M2SK","canonical_record":{"source":{"id":"2409.10411","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-09-16T15:44:43Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"419f0137340a78f116b2c49d43a24e9af945bc375fb020223eae142fd45230ef","abstract_canon_sha256":"11a5a53e86c5072d4f59145a4a5b9c90149b8147add82bbfe8a6f4f51181e390"},"schema_version":"1.0"},"canonical_sha256":"244bb66a4aebecd04254ea55d7749811e7e6f72ad169be4324c7378af8107a9d","source":{"kind":"arxiv","id":"2409.10411","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2409.10411","created_at":"2026-07-05T11:23:18Z"},{"alias_kind":"arxiv_version","alias_value":"2409.10411v2","created_at":"2026-07-05T11:23:18Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2409.10411","created_at":"2026-07-05T11:23:18Z"},{"alias_kind":"pith_short_12","alias_value":"ERF3M2SK5PWN","created_at":"2026-07-05T11:23:18Z"},{"alias_kind":"pith_short_16","alias_value":"ERF3M2SK5PWNAQSU","created_at":"2026-07-05T11:23:18Z"},{"alias_kind":"pith_short_8","alias_value":"ERF3M2SK","created_at":"2026-07-05T11:23:18Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:ERF3M2SK5PWNAQSU5JK5O5EYCH","target":"record","payload":{"canonical_record":{"source":{"id":"2409.10411","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-09-16T15:44:43Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"419f0137340a78f116b2c49d43a24e9af945bc375fb020223eae142fd45230ef","abstract_canon_sha256":"11a5a53e86c5072d4f59145a4a5b9c90149b8147add82bbfe8a6f4f51181e390"},"schema_version":"1.0"},"canonical_sha256":"244bb66a4aebecd04254ea55d7749811e7e6f72ad169be4324c7378af8107a9d","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:23:18.259515Z","signature_b64":"j7xwed9fkml8RhAy1cTQOt+gVZ0qYBvWKavE8FvaYxQhvszEY9ebyiTXBLiZmNU+40JouNb8+zWYoCNrequdAQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"244bb66a4aebecd04254ea55d7749811e7e6f72ad169be4324c7378af8107a9d","last_reissued_at":"2026-07-05T11:23:18.258987Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:23:18.258987Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2409.10411","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:23:18Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"vE97HMhA9UQuAt67hdxceqIGv2FBxCO5vcJ5tiLo7jIRyvfUE/PHWFKmRb88LWKn8NCNjjWIn8pZxk7J95ucDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-23T23:03:27.543288Z"},"content_sha256":"59404811f2dde80247ab6d6ca1846479015eaf016e7c15f8fc81edf0095215cb","schema_version":"1.0","event_id":"sha256:59404811f2dde80247ab6d6ca1846479015eaf016e7c15f8fc81edf0095215cb"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:ERF3M2SK5PWNAQSU5JK5O5EYCH","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Assessing Privacy Compliance of Android Third-Party SDKs","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Chuan Yan, Guangdong Bai, Jin Song Dong, Kailong Wang, Mark Huasong Meng, Qing Zhang, Sin Gee Teo, Zeyu Wang","submitted_at":"2024-09-16T15:44:43Z","abstract_excerpt":"Third-party Software Development Kits (SDKs) are widely adopted in Android app development, to effortlessly accelerate development pipelines and enhance app functionality. However, this convenience raises substantial concerns about unauthorized access to users' privacy-sensitive information, which could be further abused for illegitimate purposes like user tracking or monetization. Our study offers a targeted analysis of user privacy protection among Android third-party SDKs, filling a critical gap in the Android software supply chain. It focuses on two aspects of their privacy practices, incl"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2409.10411","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2409.10411/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:23:18Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"1WmS8YDkVqd7G46izAd9mk4fjLgNQ9EgG5e1qEetoksEGl9dir7fx9Tz8M7X35ANXEQ7AKpurPCpP6U+fm3QBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-23T23:03:27.544277Z"},"content_sha256":"04bd5075de7d75cdb05695b5f2ce2d0eea3a52c4f1d2315ae958566c0a9a7a00","schema_version":"1.0","event_id":"sha256:04bd5075de7d75cdb05695b5f2ce2d0eea3a52c4f1d2315ae958566c0a9a7a00"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/ERF3M2SK5PWNAQSU5JK5O5EYCH/bundle.json","state_url":"https://pith.science/pith/ERF3M2SK5PWNAQSU5JK5O5EYCH/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/ERF3M2SK5PWNAQSU5JK5O5EYCH/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-23T23:03:27Z","links":{"resolver":"https://pith.science/pith/ERF3M2SK5PWNAQSU5JK5O5EYCH","bundle":"https://pith.science/pith/ERF3M2SK5PWNAQSU5JK5O5EYCH/bundle.json","state":"https://pith.science/pith/ERF3M2SK5PWNAQSU5JK5O5EYCH/state.json","well_known_bundle":"https://pith.science/.well-known/pith/ERF3M2SK5PWNAQSU5JK5O5EYCH/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:ERF3M2SK5PWNAQSU5JK5O5EYCH","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"11a5a53e86c5072d4f59145a4a5b9c90149b8147add82bbfe8a6f4f51181e390","cross_cats_sorted":["cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-09-16T15:44:43Z","title_canon_sha256":"419f0137340a78f116b2c49d43a24e9af945bc375fb020223eae142fd45230ef"},"schema_version":"1.0","source":{"id":"2409.10411","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2409.10411","created_at":"2026-07-05T11:23:18Z"},{"alias_kind":"arxiv_version","alias_value":"2409.10411v2","created_at":"2026-07-05T11:23:18Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2409.10411","created_at":"2026-07-05T11:23:18Z"},{"alias_kind":"pith_short_12","alias_value":"ERF3M2SK5PWN","created_at":"2026-07-05T11:23:18Z"},{"alias_kind":"pith_short_16","alias_value":"ERF3M2SK5PWNAQSU","created_at":"2026-07-05T11:23:18Z"},{"alias_kind":"pith_short_8","alias_value":"ERF3M2SK","created_at":"2026-07-05T11:23:18Z"}],"graph_snapshots":[{"event_id":"sha256:04bd5075de7d75cdb05695b5f2ce2d0eea3a52c4f1d2315ae958566c0a9a7a00","target":"graph","created_at":"2026-07-05T11:23:18Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2409.10411/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Third-party Software Development Kits (SDKs) are widely adopted in Android app development, to effortlessly accelerate development pipelines and enhance app functionality. However, this convenience raises substantial concerns about unauthorized access to users' privacy-sensitive information, which could be further abused for illegitimate purposes like user tracking or monetization. Our study offers a targeted analysis of user privacy protection among Android third-party SDKs, filling a critical gap in the Android software supply chain. It focuses on two aspects of their privacy practices, incl","authors_text":"Chuan Yan, Guangdong Bai, Jin Song Dong, Kailong Wang, Mark Huasong Meng, Qing Zhang, Sin Gee Teo, Zeyu Wang","cross_cats":["cs.SE"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-09-16T15:44:43Z","title":"Assessing Privacy Compliance of Android Third-Party SDKs"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2409.10411","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:59404811f2dde80247ab6d6ca1846479015eaf016e7c15f8fc81edf0095215cb","target":"record","created_at":"2026-07-05T11:23:18Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"11a5a53e86c5072d4f59145a4a5b9c90149b8147add82bbfe8a6f4f51181e390","cross_cats_sorted":["cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-09-16T15:44:43Z","title_canon_sha256":"419f0137340a78f116b2c49d43a24e9af945bc375fb020223eae142fd45230ef"},"schema_version":"1.0","source":{"id":"2409.10411","kind":"arxiv","version":2}},"canonical_sha256":"244bb66a4aebecd04254ea55d7749811e7e6f72ad169be4324c7378af8107a9d","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"244bb66a4aebecd04254ea55d7749811e7e6f72ad169be4324c7378af8107a9d","first_computed_at":"2026-07-05T11:23:18.258987Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:23:18.258987Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"j7xwed9fkml8RhAy1cTQOt+gVZ0qYBvWKavE8FvaYxQhvszEY9ebyiTXBLiZmNU+40JouNb8+zWYoCNrequdAQ==","signature_status":"signed_v1","signed_at":"2026-07-05T11:23:18.259515Z","signed_message":"canonical_sha256_bytes"},"source_id":"2409.10411","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:59404811f2dde80247ab6d6ca1846479015eaf016e7c15f8fc81edf0095215cb","sha256:04bd5075de7d75cdb05695b5f2ce2d0eea3a52c4f1d2315ae958566c0a9a7a00"],"state_sha256":"2edd3e2e82ed1bfc3343a4ecbc39e7a262266f7dc898e5de0b4e12fecd67ccae"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"jKy+IeztJ+FjV88ZX2tz7/W9HVf5/URyzoz6fbM5+iBuoNwZqcLzygtUiN2ct58Vc0cyCt6u+3Wpz0rryKqFCg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-23T23:03:27.550827Z","bundle_sha256":"cd9c383702d0d54c037669b29fc19f8949836355987f4d2d848461695b358e36"}}