{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2023:H6CY2KDVFOMTOLOXQXSBWSO5HB","short_pith_number":"pith:H6CY2KDV","canonical_record":{"source":{"id":"2306.10019","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CY","submitted_at":"2023-05-27T10:59:48Z","cross_cats_sorted":["cs.CR","cs.SE"],"title_canon_sha256":"d71d63d6141f89a0e459d94acfbc76e62b8fd237452f2436faefaee6e7245c95","abstract_canon_sha256":"9314aeea1b9778495a51cda76dc6618d24ca91998117350c12696532609ca840"},"schema_version":"1.0"},"canonical_sha256":"3f858d28752b99372dd785e41b49dd385b27ac3504f35e32cc7492ed9b23dd74","source":{"kind":"arxiv","id":"2306.10019","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2306.10019","created_at":"2026-07-05T07:30:19Z"},{"alias_kind":"arxiv_version","alias_value":"2306.10019v2","created_at":"2026-07-05T07:30:19Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2306.10019","created_at":"2026-07-05T07:30:19Z"},{"alias_kind":"pith_short_12","alias_value":"H6CY2KDVFOMT","created_at":"2026-07-05T07:30:19Z"},{"alias_kind":"pith_short_16","alias_value":"H6CY2KDVFOMTOLOX","created_at":"2026-07-05T07:30:19Z"},{"alias_kind":"pith_short_8","alias_value":"H6CY2KDV","created_at":"2026-07-05T07:30:19Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2023:H6CY2KDVFOMTOLOXQXSBWSO5HB","target":"record","payload":{"canonical_record":{"source":{"id":"2306.10019","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CY","submitted_at":"2023-05-27T10:59:48Z","cross_cats_sorted":["cs.CR","cs.SE"],"title_canon_sha256":"d71d63d6141f89a0e459d94acfbc76e62b8fd237452f2436faefaee6e7245c95","abstract_canon_sha256":"9314aeea1b9778495a51cda76dc6618d24ca91998117350c12696532609ca840"},"schema_version":"1.0"},"canonical_sha256":"3f858d28752b99372dd785e41b49dd385b27ac3504f35e32cc7492ed9b23dd74","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T07:30:19.858059Z","signature_b64":"ThZzJSwr/liylJroOEzohkXVSlLLGK0QsYzM26VWZ4zyd25R2PjzvLB47gTu+XLo15iu2hh+rFFdkz8sKnYzCA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"3f858d28752b99372dd785e41b49dd385b27ac3504f35e32cc7492ed9b23dd74","last_reissued_at":"2026-07-05T07:30:19.857654Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T07:30:19.857654Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2306.10019","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T07:30:19Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"U19KdO6otbwm+9I5rRQjIBx1YlOEly5+ZfJmfhpk2JUVP4KPCZdqFZers3+4BaXdxa5ic1flgT2ZMwQiaIWIBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T02:39:12.987378Z"},"content_sha256":"8de4023a46fcf22cb5e6127c009f31b8e0ac2c3efe7ca98c6586594a23655077","schema_version":"1.0","event_id":"sha256:8de4023a46fcf22cb5e6127c009f31b8e0ac2c3efe7ca98c6586594a23655077"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2023:H6CY2KDVFOMTOLOXQXSBWSO5HB","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Ethical Considerations Towards Protestware","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.CR","cs.SE"],"primary_cat":"cs.CY","authors_text":"Christoph Treude, Marc Cheong, Raula Gaikovina Kula","submitted_at":"2023-05-27T10:59:48Z","abstract_excerpt":"A key drawback to using a Open Source third-party library is the risk of introducing malicious attacks. In recently times, these threats have taken a new form, when maintainers turn their Open Source libraries into protestware. This is defined as software containing political messages delivered through these libraries, which can either be malicious or benign. Since developers are willing to freely open-up their software to these libraries, much trust and responsibility are placed on the maintainers to ensure that the library does what it promises to do. Using different frameworks commonly used"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2306.10019","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2306.10019/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T07:30:19Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"/uRMQHO9chJI4sBEkrqUn2CzenrTseDKJVnbW5mDqyqLUtfjZIefos12lIbAERrrr6oz7amdKsIUliIkfX/sDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T02:39:12.987803Z"},"content_sha256":"ec8e7f12cc02416b12dbe201303a6ac11cca460da01741ec0d20ef1389be3466","schema_version":"1.0","event_id":"sha256:ec8e7f12cc02416b12dbe201303a6ac11cca460da01741ec0d20ef1389be3466"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/H6CY2KDVFOMTOLOXQXSBWSO5HB/bundle.json","state_url":"https://pith.science/pith/H6CY2KDVFOMTOLOXQXSBWSO5HB/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/H6CY2KDVFOMTOLOXQXSBWSO5HB/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-07T02:39:12Z","links":{"resolver":"https://pith.science/pith/H6CY2KDVFOMTOLOXQXSBWSO5HB","bundle":"https://pith.science/pith/H6CY2KDVFOMTOLOXQXSBWSO5HB/bundle.json","state":"https://pith.science/pith/H6CY2KDVFOMTOLOXQXSBWSO5HB/state.json","well_known_bundle":"https://pith.science/.well-known/pith/H6CY2KDVFOMTOLOXQXSBWSO5HB/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2023:H6CY2KDVFOMTOLOXQXSBWSO5HB","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"9314aeea1b9778495a51cda76dc6618d24ca91998117350c12696532609ca840","cross_cats_sorted":["cs.CR","cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CY","submitted_at":"2023-05-27T10:59:48Z","title_canon_sha256":"d71d63d6141f89a0e459d94acfbc76e62b8fd237452f2436faefaee6e7245c95"},"schema_version":"1.0","source":{"id":"2306.10019","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2306.10019","created_at":"2026-07-05T07:30:19Z"},{"alias_kind":"arxiv_version","alias_value":"2306.10019v2","created_at":"2026-07-05T07:30:19Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2306.10019","created_at":"2026-07-05T07:30:19Z"},{"alias_kind":"pith_short_12","alias_value":"H6CY2KDVFOMT","created_at":"2026-07-05T07:30:19Z"},{"alias_kind":"pith_short_16","alias_value":"H6CY2KDVFOMTOLOX","created_at":"2026-07-05T07:30:19Z"},{"alias_kind":"pith_short_8","alias_value":"H6CY2KDV","created_at":"2026-07-05T07:30:19Z"}],"graph_snapshots":[{"event_id":"sha256:ec8e7f12cc02416b12dbe201303a6ac11cca460da01741ec0d20ef1389be3466","target":"graph","created_at":"2026-07-05T07:30:19Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2306.10019/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"A key drawback to using a Open Source third-party library is the risk of introducing malicious attacks. In recently times, these threats have taken a new form, when maintainers turn their Open Source libraries into protestware. This is defined as software containing political messages delivered through these libraries, which can either be malicious or benign. Since developers are willing to freely open-up their software to these libraries, much trust and responsibility are placed on the maintainers to ensure that the library does what it promises to do. Using different frameworks commonly used","authors_text":"Christoph Treude, Marc Cheong, Raula Gaikovina Kula","cross_cats":["cs.CR","cs.SE"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CY","submitted_at":"2023-05-27T10:59:48Z","title":"Ethical Considerations Towards Protestware"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2306.10019","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:8de4023a46fcf22cb5e6127c009f31b8e0ac2c3efe7ca98c6586594a23655077","target":"record","created_at":"2026-07-05T07:30:19Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"9314aeea1b9778495a51cda76dc6618d24ca91998117350c12696532609ca840","cross_cats_sorted":["cs.CR","cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CY","submitted_at":"2023-05-27T10:59:48Z","title_canon_sha256":"d71d63d6141f89a0e459d94acfbc76e62b8fd237452f2436faefaee6e7245c95"},"schema_version":"1.0","source":{"id":"2306.10019","kind":"arxiv","version":2}},"canonical_sha256":"3f858d28752b99372dd785e41b49dd385b27ac3504f35e32cc7492ed9b23dd74","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"3f858d28752b99372dd785e41b49dd385b27ac3504f35e32cc7492ed9b23dd74","first_computed_at":"2026-07-05T07:30:19.857654Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T07:30:19.857654Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"ThZzJSwr/liylJroOEzohkXVSlLLGK0QsYzM26VWZ4zyd25R2PjzvLB47gTu+XLo15iu2hh+rFFdkz8sKnYzCA==","signature_status":"signed_v1","signed_at":"2026-07-05T07:30:19.858059Z","signed_message":"canonical_sha256_bytes"},"source_id":"2306.10019","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:8de4023a46fcf22cb5e6127c009f31b8e0ac2c3efe7ca98c6586594a23655077","sha256:ec8e7f12cc02416b12dbe201303a6ac11cca460da01741ec0d20ef1389be3466"],"state_sha256":"002a1142b38609ae409eb097dcf05d2fc69ffc8258aa36b41d0aead7e97dfe02"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"J0I1agcKk1tmi6nNS0SviZsFVL8tXhQhwjM4cAPLSzreZT/EyjXfM1OJ2Ajcmy9oTF/sGsrd1Vn35MySoEomAw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-07T02:39:12.990572Z","bundle_sha256":"9c3decc0949b9a8ce31696f32f06b4fbfd14bb07e79480f7f11bd9ec9fdbc172"}}