{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:HE7GFOOTB22B3M2IYSNDXCH3PY","short_pith_number":"pith:HE7GFOOT","canonical_record":{"source":{"id":"2409.05576","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2024-09-09T13:01:57Z","cross_cats_sorted":[],"title_canon_sha256":"061946c17f6c65af846a3b38fd55472a65586cb7a1d7c4a9a350cf6a641483bb","abstract_canon_sha256":"da901b0a550cea2fffdeb18bfedc364cb682f49fd67ea3f96d09fb120587bc97"},"schema_version":"1.0"},"canonical_sha256":"393e62b9d30eb41db348c49a3b88fb7e2d13201597996025c998c650ba8e196b","source":{"kind":"arxiv","id":"2409.05576","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2409.05576","created_at":"2026-07-05T09:04:51Z"},{"alias_kind":"arxiv_version","alias_value":"2409.05576v1","created_at":"2026-07-05T09:04:51Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2409.05576","created_at":"2026-07-05T09:04:51Z"},{"alias_kind":"pith_short_12","alias_value":"HE7GFOOTB22B","created_at":"2026-07-05T09:04:51Z"},{"alias_kind":"pith_short_16","alias_value":"HE7GFOOTB22B3M2I","created_at":"2026-07-05T09:04:51Z"},{"alias_kind":"pith_short_8","alias_value":"HE7GFOOT","created_at":"2026-07-05T09:04:51Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:HE7GFOOTB22B3M2IYSNDXCH3PY","target":"record","payload":{"canonical_record":{"source":{"id":"2409.05576","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2024-09-09T13:01:57Z","cross_cats_sorted":[],"title_canon_sha256":"061946c17f6c65af846a3b38fd55472a65586cb7a1d7c4a9a350cf6a641483bb","abstract_canon_sha256":"da901b0a550cea2fffdeb18bfedc364cb682f49fd67ea3f96d09fb120587bc97"},"schema_version":"1.0"},"canonical_sha256":"393e62b9d30eb41db348c49a3b88fb7e2d13201597996025c998c650ba8e196b","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T09:04:51.515897Z","signature_b64":"5m9NaknNo+Skj8URgDcHeenQVn1CDeEKCdNekNwfrOO8yEjkEuBD588r7IRSnyMxCHZv4quuPseYLKBvOOUsDQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"393e62b9d30eb41db348c49a3b88fb7e2d13201597996025c998c650ba8e196b","last_reissued_at":"2026-07-05T09:04:51.515422Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T09:04:51.515422Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2409.05576","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T09:04:51Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"0elpqrmCXRcOpQihVID1LrlGiPOCcN/Yog3pRER2q7E0LzOr3mNUWAZYTaZrEJ1zzPNjI06S1sWMP1GzoVdzBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-09T01:10:17.795330Z"},"content_sha256":"85c2ff176dead44879aa6307ec14650e748db7e587419407a9a31533f8f6923b","schema_version":"1.0","event_id":"sha256:85c2ff176dead44879aa6307ec14650e748db7e587419407a9a31533f8f6923b"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:HE7GFOOTB22B3M2IYSNDXCH3PY","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"JavaVFC: Java Vulnerability Fixing Commits from Open-source Software","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.SE","authors_text":"Hong Jin Kang, Ivana Clairine Irsan, Tan Bui, Ting Zhang, Yan Naing Tun, Yiran Cheng","submitted_at":"2024-09-09T13:01:57Z","abstract_excerpt":"We present a comprehensive dataset of Java vulnerability-fixing commits (VFCs) to advance research in Java vulnerability analysis. Our dataset, derived from thousands of open-source Java projects on GitHub, comprises two variants: JavaVFC and JavaVFC-extended. The dataset was constructed through a rigorous process involving heuristic rules and multiple rounds of manual labeling. We initially used keywords to filter candidate VFCs based on commit messages, then refined this keyword set through iterative manual labeling. The final labeling round achieved a precision score of 0.7 among three anno"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2409.05576","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2409.05576/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T09:04:51Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"l2XEASK2m+T50ZsVrGDY1PReLFWEGd0S2W1rjjv8coTAFAMNxc979vdINLvOiMKmS95K/KtNcp7qMUq5TxmTBQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-09T01:10:17.795853Z"},"content_sha256":"a523d9c1ce1d66a80c091810adb1472bded0fec71bb5f5836a7711bacec5b7f2","schema_version":"1.0","event_id":"sha256:a523d9c1ce1d66a80c091810adb1472bded0fec71bb5f5836a7711bacec5b7f2"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/HE7GFOOTB22B3M2IYSNDXCH3PY/bundle.json","state_url":"https://pith.science/pith/HE7GFOOTB22B3M2IYSNDXCH3PY/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/HE7GFOOTB22B3M2IYSNDXCH3PY/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-09T01:10:17Z","links":{"resolver":"https://pith.science/pith/HE7GFOOTB22B3M2IYSNDXCH3PY","bundle":"https://pith.science/pith/HE7GFOOTB22B3M2IYSNDXCH3PY/bundle.json","state":"https://pith.science/pith/HE7GFOOTB22B3M2IYSNDXCH3PY/state.json","well_known_bundle":"https://pith.science/.well-known/pith/HE7GFOOTB22B3M2IYSNDXCH3PY/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:HE7GFOOTB22B3M2IYSNDXCH3PY","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"da901b0a550cea2fffdeb18bfedc364cb682f49fd67ea3f96d09fb120587bc97","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2024-09-09T13:01:57Z","title_canon_sha256":"061946c17f6c65af846a3b38fd55472a65586cb7a1d7c4a9a350cf6a641483bb"},"schema_version":"1.0","source":{"id":"2409.05576","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2409.05576","created_at":"2026-07-05T09:04:51Z"},{"alias_kind":"arxiv_version","alias_value":"2409.05576v1","created_at":"2026-07-05T09:04:51Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2409.05576","created_at":"2026-07-05T09:04:51Z"},{"alias_kind":"pith_short_12","alias_value":"HE7GFOOTB22B","created_at":"2026-07-05T09:04:51Z"},{"alias_kind":"pith_short_16","alias_value":"HE7GFOOTB22B3M2I","created_at":"2026-07-05T09:04:51Z"},{"alias_kind":"pith_short_8","alias_value":"HE7GFOOT","created_at":"2026-07-05T09:04:51Z"}],"graph_snapshots":[{"event_id":"sha256:a523d9c1ce1d66a80c091810adb1472bded0fec71bb5f5836a7711bacec5b7f2","target":"graph","created_at":"2026-07-05T09:04:51Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2409.05576/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"We present a comprehensive dataset of Java vulnerability-fixing commits (VFCs) to advance research in Java vulnerability analysis. Our dataset, derived from thousands of open-source Java projects on GitHub, comprises two variants: JavaVFC and JavaVFC-extended. The dataset was constructed through a rigorous process involving heuristic rules and multiple rounds of manual labeling. We initially used keywords to filter candidate VFCs based on commit messages, then refined this keyword set through iterative manual labeling. The final labeling round achieved a precision score of 0.7 among three anno","authors_text":"Hong Jin Kang, Ivana Clairine Irsan, Tan Bui, Ting Zhang, Yan Naing Tun, Yiran Cheng","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2024-09-09T13:01:57Z","title":"JavaVFC: Java Vulnerability Fixing Commits from Open-source Software"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2409.05576","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:85c2ff176dead44879aa6307ec14650e748db7e587419407a9a31533f8f6923b","target":"record","created_at":"2026-07-05T09:04:51Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"da901b0a550cea2fffdeb18bfedc364cb682f49fd67ea3f96d09fb120587bc97","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2024-09-09T13:01:57Z","title_canon_sha256":"061946c17f6c65af846a3b38fd55472a65586cb7a1d7c4a9a350cf6a641483bb"},"schema_version":"1.0","source":{"id":"2409.05576","kind":"arxiv","version":1}},"canonical_sha256":"393e62b9d30eb41db348c49a3b88fb7e2d13201597996025c998c650ba8e196b","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"393e62b9d30eb41db348c49a3b88fb7e2d13201597996025c998c650ba8e196b","first_computed_at":"2026-07-05T09:04:51.515422Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T09:04:51.515422Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"5m9NaknNo+Skj8URgDcHeenQVn1CDeEKCdNekNwfrOO8yEjkEuBD588r7IRSnyMxCHZv4quuPseYLKBvOOUsDQ==","signature_status":"signed_v1","signed_at":"2026-07-05T09:04:51.515897Z","signed_message":"canonical_sha256_bytes"},"source_id":"2409.05576","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:85c2ff176dead44879aa6307ec14650e748db7e587419407a9a31533f8f6923b","sha256:a523d9c1ce1d66a80c091810adb1472bded0fec71bb5f5836a7711bacec5b7f2"],"state_sha256":"ef3e892e0346afde950d2065a567d6aefbd9f7225ccfefce22b873b71b507c2c"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"2n/nmzBpsO4PZsyv82PaVLTusETXDtMQJq5SsfQK9epNT42zR8xEf3g4A6JpeKkolCgkxjZVzGFezJnTBZKBAw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-09T01:10:17.799539Z","bundle_sha256":"d373aaad16e0d1db72b16dc34d33215076eafd47a45284e6560c6c8459782686"}}