{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:JQI2QZAWNP65AT3O7UXFWCJFS7","short_pith_number":"pith:JQI2QZAW","canonical_record":{"source":{"id":"2505.22023","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2025-05-28T06:42:37Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"bb7438a5b91d8e036c22d69aca98bf75f0546c0164bbe4aaa043b43230f4b3d8","abstract_canon_sha256":"337360d9878e50f3d4ec3e2b08665c1356d2c2125c1b1feda92735e333e72de1"},"schema_version":"1.0"},"canonical_sha256":"4c11a864166bfdd04f6efd2e5b092597d0437e883bc7e30de1fe25f1126a2141","source":{"kind":"arxiv","id":"2505.22023","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2505.22023","created_at":"2026-07-05T11:11:08Z"},{"alias_kind":"arxiv_version","alias_value":"2505.22023v1","created_at":"2026-07-05T11:11:08Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2505.22023","created_at":"2026-07-05T11:11:08Z"},{"alias_kind":"pith_short_12","alias_value":"JQI2QZAWNP65","created_at":"2026-07-05T11:11:08Z"},{"alias_kind":"pith_short_16","alias_value":"JQI2QZAWNP65AT3O","created_at":"2026-07-05T11:11:08Z"},{"alias_kind":"pith_short_8","alias_value":"JQI2QZAW","created_at":"2026-07-05T11:11:08Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:JQI2QZAWNP65AT3O7UXFWCJFS7","target":"record","payload":{"canonical_record":{"source":{"id":"2505.22023","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2025-05-28T06:42:37Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"bb7438a5b91d8e036c22d69aca98bf75f0546c0164bbe4aaa043b43230f4b3d8","abstract_canon_sha256":"337360d9878e50f3d4ec3e2b08665c1356d2c2125c1b1feda92735e333e72de1"},"schema_version":"1.0"},"canonical_sha256":"4c11a864166bfdd04f6efd2e5b092597d0437e883bc7e30de1fe25f1126a2141","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:11:08.222279Z","signature_b64":"ZXsr2XGJWutBNmFZ9Da0nku3sjYMzOsk181vlHWyZmtM/qEsA/Ja/ZxmJrvzcgIDxycED4H59Qc4gbMreDjIDA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"4c11a864166bfdd04f6efd2e5b092597d0437e883bc7e30de1fe25f1126a2141","last_reissued_at":"2026-07-05T11:11:08.221740Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:11:08.221740Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2505.22023","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:11:08Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"3KamnfhjKtra++KPXYqV+5QYnD0+cxxPMrzwwqwCkP4qB06a31UfQ9fqz459BK2fN3zmCPLmF/SWaJVLDkyKAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T07:00:29.841967Z"},"content_sha256":"768ce7eb29ea69107d62618e236f13dde1470ca8be35a483feda8eca79a0f1cd","schema_version":"1.0","event_id":"sha256:768ce7eb29ea69107d62618e236f13dde1470ca8be35a483feda8eca79a0f1cd"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:JQI2QZAWNP65AT3O7UXFWCJFS7","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Securing the Software Package Supply Chain for Critical Systems","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.SE","authors_text":"Akash Ravi, Ritwik Murali","submitted_at":"2025-05-28T06:42:37Z","abstract_excerpt":"Software systems have grown as an indispensable commodity used across various industries, and almost all essential services depend on them for effective operation. The software is no longer an independent or stand-alone piece of code written by a developer but rather a collection of packages designed by multiple developers across the globe. Ensuring the reliability and resilience of these systems is crucial since emerging threats target software supply chains, as demonstrated by the widespread SolarWinds hack in late 2020. These supply chains extend beyond patches and updates, involving distri"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2505.22023","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2505.22023/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:11:08Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"IGFl3eITbA1Ad5MTcX4m4rIWCJWDclYaZU30owFNpkCx95GuSS+YqJ1edL4/kn1RmypqmQJfTgWWwkl7wO/8Dg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T07:00:29.842448Z"},"content_sha256":"d2ab6c6f0dfd158fb08203ffc4893f7ff424ee9b04cf9df69722f8c404e5b344","schema_version":"1.0","event_id":"sha256:d2ab6c6f0dfd158fb08203ffc4893f7ff424ee9b04cf9df69722f8c404e5b344"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/JQI2QZAWNP65AT3O7UXFWCJFS7/bundle.json","state_url":"https://pith.science/pith/JQI2QZAWNP65AT3O7UXFWCJFS7/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/JQI2QZAWNP65AT3O7UXFWCJFS7/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-08T07:00:29Z","links":{"resolver":"https://pith.science/pith/JQI2QZAWNP65AT3O7UXFWCJFS7","bundle":"https://pith.science/pith/JQI2QZAWNP65AT3O7UXFWCJFS7/bundle.json","state":"https://pith.science/pith/JQI2QZAWNP65AT3O7UXFWCJFS7/state.json","well_known_bundle":"https://pith.science/.well-known/pith/JQI2QZAWNP65AT3O7UXFWCJFS7/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:JQI2QZAWNP65AT3O7UXFWCJFS7","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"337360d9878e50f3d4ec3e2b08665c1356d2c2125c1b1feda92735e333e72de1","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2025-05-28T06:42:37Z","title_canon_sha256":"bb7438a5b91d8e036c22d69aca98bf75f0546c0164bbe4aaa043b43230f4b3d8"},"schema_version":"1.0","source":{"id":"2505.22023","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2505.22023","created_at":"2026-07-05T11:11:08Z"},{"alias_kind":"arxiv_version","alias_value":"2505.22023v1","created_at":"2026-07-05T11:11:08Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2505.22023","created_at":"2026-07-05T11:11:08Z"},{"alias_kind":"pith_short_12","alias_value":"JQI2QZAWNP65","created_at":"2026-07-05T11:11:08Z"},{"alias_kind":"pith_short_16","alias_value":"JQI2QZAWNP65AT3O","created_at":"2026-07-05T11:11:08Z"},{"alias_kind":"pith_short_8","alias_value":"JQI2QZAW","created_at":"2026-07-05T11:11:08Z"}],"graph_snapshots":[{"event_id":"sha256:d2ab6c6f0dfd158fb08203ffc4893f7ff424ee9b04cf9df69722f8c404e5b344","target":"graph","created_at":"2026-07-05T11:11:08Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2505.22023/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Software systems have grown as an indispensable commodity used across various industries, and almost all essential services depend on them for effective operation. The software is no longer an independent or stand-alone piece of code written by a developer but rather a collection of packages designed by multiple developers across the globe. Ensuring the reliability and resilience of these systems is crucial since emerging threats target software supply chains, as demonstrated by the widespread SolarWinds hack in late 2020. These supply chains extend beyond patches and updates, involving distri","authors_text":"Akash Ravi, Ritwik Murali","cross_cats":["cs.CR"],"headline":"","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2025-05-28T06:42:37Z","title":"Securing the Software Package Supply Chain for Critical Systems"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2505.22023","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:768ce7eb29ea69107d62618e236f13dde1470ca8be35a483feda8eca79a0f1cd","target":"record","created_at":"2026-07-05T11:11:08Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"337360d9878e50f3d4ec3e2b08665c1356d2c2125c1b1feda92735e333e72de1","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2025-05-28T06:42:37Z","title_canon_sha256":"bb7438a5b91d8e036c22d69aca98bf75f0546c0164bbe4aaa043b43230f4b3d8"},"schema_version":"1.0","source":{"id":"2505.22023","kind":"arxiv","version":1}},"canonical_sha256":"4c11a864166bfdd04f6efd2e5b092597d0437e883bc7e30de1fe25f1126a2141","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"4c11a864166bfdd04f6efd2e5b092597d0437e883bc7e30de1fe25f1126a2141","first_computed_at":"2026-07-05T11:11:08.221740Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:11:08.221740Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"ZXsr2XGJWutBNmFZ9Da0nku3sjYMzOsk181vlHWyZmtM/qEsA/Ja/ZxmJrvzcgIDxycED4H59Qc4gbMreDjIDA==","signature_status":"signed_v1","signed_at":"2026-07-05T11:11:08.222279Z","signed_message":"canonical_sha256_bytes"},"source_id":"2505.22023","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:768ce7eb29ea69107d62618e236f13dde1470ca8be35a483feda8eca79a0f1cd","sha256:d2ab6c6f0dfd158fb08203ffc4893f7ff424ee9b04cf9df69722f8c404e5b344"],"state_sha256":"e5c24cab9ea99bc728b6bfb95bcebc2221979ff3f62adbc05f368f6d85ff99bc"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"2qfGYxFRYXNI0h0xHkuRCtgCu0rKoWZc8q8TnG+Uyg4NXpAVEiYSPfuX+R6ruKZIXpbraphIpULheXBpDczSAQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-08T07:00:29.845706Z","bundle_sha256":"7f59406f4aa2dc593a436d3d8ce6deaa1a987ba1238f3b73f26824b5045605d1"}}