{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:IGCKLPE4DI5KXKFPW755IZFXM5","short_pith_number":"pith:IGCKLPE4","canonical_record":{"source":{"id":"2512.21781","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-12-25T20:50:51Z","cross_cats_sorted":[],"title_canon_sha256":"6d9ca95bd4b4afeeb92dd9eb67d343b8adf1e84e8d7e387fd112fc227b1fdbb0","abstract_canon_sha256":"2075b7e206c44474ddc052a2bf66d95bb74f8537025aa7c1bd9b4a75fc2e5a74"},"schema_version":"1.0"},"canonical_sha256":"4184a5bc9c1a3aaba8afb7fbd464b7676f593483c23901b3a65aec776893ff11","source":{"kind":"arxiv","id":"2512.21781","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2512.21781","created_at":"2026-06-12T01:08:19Z"},{"alias_kind":"arxiv_version","alias_value":"2512.21781v2","created_at":"2026-06-12T01:08:19Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2512.21781","created_at":"2026-06-12T01:08:19Z"},{"alias_kind":"pith_short_12","alias_value":"IGCKLPE4DI5K","created_at":"2026-06-12T01:08:19Z"},{"alias_kind":"pith_short_16","alias_value":"IGCKLPE4DI5KXKFP","created_at":"2026-06-12T01:08:19Z"},{"alias_kind":"pith_short_8","alias_value":"IGCKLPE4","created_at":"2026-06-12T01:08:19Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:IGCKLPE4DI5KXKFPW755IZFXM5","target":"record","payload":{"canonical_record":{"source":{"id":"2512.21781","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-12-25T20:50:51Z","cross_cats_sorted":[],"title_canon_sha256":"6d9ca95bd4b4afeeb92dd9eb67d343b8adf1e84e8d7e387fd112fc227b1fdbb0","abstract_canon_sha256":"2075b7e206c44474ddc052a2bf66d95bb74f8537025aa7c1bd9b4a75fc2e5a74"},"schema_version":"1.0"},"canonical_sha256":"4184a5bc9c1a3aaba8afb7fbd464b7676f593483c23901b3a65aec776893ff11","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-06-12T01:08:19.834192Z","signature_b64":"8yeBwxSoOTHjSUmq7GBvEOv9KPSZrhB3cYXbsfy6Cjmtezv/NTq+WEydw/J4GrkNJ6x/joY0MvInZGLaoxaLAQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"4184a5bc9c1a3aaba8afb7fbd464b7676f593483c23901b3a65aec776893ff11","last_reissued_at":"2026-06-12T01:08:19.833170Z","signature_status":"signed_v1","first_computed_at":"2026-06-12T01:08:19.833170Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2512.21781","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-12T01:08:19Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Aa4DdmzFnsUG9cgkEFfYS2THY9RRnNa9G/ZmLRNXlpzg9jFCkPKZHzdaAiTIPfGIBzR6eO+NH7XzXfBgXZjKCQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-28T08:03:35.978118Z"},"content_sha256":"2387a6b78c5ae3f1a7476c6d7d9d2ceb50562ea9722081adda15dd7d43930df7","schema_version":"1.0","event_id":"sha256:2387a6b78c5ae3f1a7476c6d7d9d2ceb50562ea9722081adda15dd7d43930df7"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:IGCKLPE4DI5KXKFPW755IZFXM5","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"The State of the SBOM Tool Ecosystems: A Comparative Analysis of SPDX and CycloneDX","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.SE","authors_text":"Abdul Ali Bangash, Arshdeep Singh, Bram Adams, Tongxu Ge, Zhimin Zhao, Zitao Wang","submitted_at":"2025-12-25T20:50:51Z","abstract_excerpt":"Software Bills of Materials (SBOMs) improve software release transparency by documenting components and dependencies, but their practical value depends on the tools that generate, analyze, and manage them. This paper compares the tool ecosystems of the two dominant SBOM formats: SPDX and CycloneDX. We analyze 108 open-source and 62 proprietary SBOM tools, compare ecosystem-level health metrics across 470 SPDX and 171 CycloneDX tools, examine 36,990 issue reports from open-source tools, and study the top 250 open-source projects using each format. Our results show that CycloneDX-using projects "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2512.21781","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2512.21781/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-12T01:08:19Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"aNkrGN3Mcyi5W4Fv2wFpLaeg+QEiQkk4oC9kbWgJXaoQQTmXHVmqL8/NXbPOXeJu1QXl5P56KrlKMzTAWiX6CQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-28T08:03:35.978499Z"},"content_sha256":"7e9d271283321da0b54d4ecbb35e848b8459a5f38059c42329df2870797f7051","schema_version":"1.0","event_id":"sha256:7e9d271283321da0b54d4ecbb35e848b8459a5f38059c42329df2870797f7051"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/IGCKLPE4DI5KXKFPW755IZFXM5/bundle.json","state_url":"https://pith.science/pith/IGCKLPE4DI5KXKFPW755IZFXM5/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/IGCKLPE4DI5KXKFPW755IZFXM5/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-28T08:03:35Z","links":{"resolver":"https://pith.science/pith/IGCKLPE4DI5KXKFPW755IZFXM5","bundle":"https://pith.science/pith/IGCKLPE4DI5KXKFPW755IZFXM5/bundle.json","state":"https://pith.science/pith/IGCKLPE4DI5KXKFPW755IZFXM5/state.json","well_known_bundle":"https://pith.science/.well-known/pith/IGCKLPE4DI5KXKFPW755IZFXM5/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:IGCKLPE4DI5KXKFPW755IZFXM5","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"2075b7e206c44474ddc052a2bf66d95bb74f8537025aa7c1bd9b4a75fc2e5a74","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-12-25T20:50:51Z","title_canon_sha256":"6d9ca95bd4b4afeeb92dd9eb67d343b8adf1e84e8d7e387fd112fc227b1fdbb0"},"schema_version":"1.0","source":{"id":"2512.21781","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2512.21781","created_at":"2026-06-12T01:08:19Z"},{"alias_kind":"arxiv_version","alias_value":"2512.21781v2","created_at":"2026-06-12T01:08:19Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2512.21781","created_at":"2026-06-12T01:08:19Z"},{"alias_kind":"pith_short_12","alias_value":"IGCKLPE4DI5K","created_at":"2026-06-12T01:08:19Z"},{"alias_kind":"pith_short_16","alias_value":"IGCKLPE4DI5KXKFP","created_at":"2026-06-12T01:08:19Z"},{"alias_kind":"pith_short_8","alias_value":"IGCKLPE4","created_at":"2026-06-12T01:08:19Z"}],"graph_snapshots":[{"event_id":"sha256:7e9d271283321da0b54d4ecbb35e848b8459a5f38059c42329df2870797f7051","target":"graph","created_at":"2026-06-12T01:08:19Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2512.21781/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Software Bills of Materials (SBOMs) improve software release transparency by documenting components and dependencies, but their practical value depends on the tools that generate, analyze, and manage them. This paper compares the tool ecosystems of the two dominant SBOM formats: SPDX and CycloneDX. We analyze 108 open-source and 62 proprietary SBOM tools, compare ecosystem-level health metrics across 470 SPDX and 171 CycloneDX tools, examine 36,990 issue reports from open-source tools, and study the top 250 open-source projects using each format. Our results show that CycloneDX-using projects ","authors_text":"Abdul Ali Bangash, Arshdeep Singh, Bram Adams, Tongxu Ge, Zhimin Zhao, Zitao Wang","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-12-25T20:50:51Z","title":"The State of the SBOM Tool Ecosystems: A Comparative Analysis of SPDX and CycloneDX"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2512.21781","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:2387a6b78c5ae3f1a7476c6d7d9d2ceb50562ea9722081adda15dd7d43930df7","target":"record","created_at":"2026-06-12T01:08:19Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"2075b7e206c44474ddc052a2bf66d95bb74f8537025aa7c1bd9b4a75fc2e5a74","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-12-25T20:50:51Z","title_canon_sha256":"6d9ca95bd4b4afeeb92dd9eb67d343b8adf1e84e8d7e387fd112fc227b1fdbb0"},"schema_version":"1.0","source":{"id":"2512.21781","kind":"arxiv","version":2}},"canonical_sha256":"4184a5bc9c1a3aaba8afb7fbd464b7676f593483c23901b3a65aec776893ff11","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"4184a5bc9c1a3aaba8afb7fbd464b7676f593483c23901b3a65aec776893ff11","first_computed_at":"2026-06-12T01:08:19.833170Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-06-12T01:08:19.833170Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"8yeBwxSoOTHjSUmq7GBvEOv9KPSZrhB3cYXbsfy6Cjmtezv/NTq+WEydw/J4GrkNJ6x/joY0MvInZGLaoxaLAQ==","signature_status":"signed_v1","signed_at":"2026-06-12T01:08:19.834192Z","signed_message":"canonical_sha256_bytes"},"source_id":"2512.21781","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:2387a6b78c5ae3f1a7476c6d7d9d2ceb50562ea9722081adda15dd7d43930df7","sha256:7e9d271283321da0b54d4ecbb35e848b8459a5f38059c42329df2870797f7051"],"state_sha256":"3e9293c3ae46fe715697d68903879fc205ed383a023fedf7452a98171fbe3284"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Gc4qvTlffYldFG3I3pnyn/LjNkNhz6jdECo2rwyh1o+g1ZMVSZZNidhUV+SNYBR2EFjwfh/RVlSniHc4YatyAQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-28T08:03:35.980921Z","bundle_sha256":"c7ebd8a38313918d50098f6ac8bae55455d484e11c060081b71c11bef23167be"}}