{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:MJBUGW7FBZDTU66LWIBMJ7J5M5","short_pith_number":"pith:MJBUGW7F","canonical_record":{"source":{"id":"2606.00625","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-30T08:59:40Z","cross_cats_sorted":[],"title_canon_sha256":"b1d547e7d2252d7eb929d31a69cd56a3344706d990cebf99d82487e100d78fc4","abstract_canon_sha256":"66da0fd5999326c3f29c1f446c79580a744b151996b0bd88607f86791f414dd3"},"schema_version":"1.0"},"canonical_sha256":"6243435be50e473a7bcbb202c4fd3d674b6ff865638c7304fc600633689f6940","source":{"kind":"arxiv","id":"2606.00625","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.00625","created_at":"2026-06-02T01:04:00Z"},{"alias_kind":"arxiv_version","alias_value":"2606.00625v1","created_at":"2026-06-02T01:04:00Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.00625","created_at":"2026-06-02T01:04:00Z"},{"alias_kind":"pith_short_12","alias_value":"MJBUGW7FBZDT","created_at":"2026-06-02T01:04:00Z"},{"alias_kind":"pith_short_16","alias_value":"MJBUGW7FBZDTU66L","created_at":"2026-06-02T01:04:00Z"},{"alias_kind":"pith_short_8","alias_value":"MJBUGW7F","created_at":"2026-06-02T01:04:00Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:MJBUGW7FBZDTU66LWIBMJ7J5M5","target":"record","payload":{"canonical_record":{"source":{"id":"2606.00625","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-30T08:59:40Z","cross_cats_sorted":[],"title_canon_sha256":"b1d547e7d2252d7eb929d31a69cd56a3344706d990cebf99d82487e100d78fc4","abstract_canon_sha256":"66da0fd5999326c3f29c1f446c79580a744b151996b0bd88607f86791f414dd3"},"schema_version":"1.0"},"canonical_sha256":"6243435be50e473a7bcbb202c4fd3d674b6ff865638c7304fc600633689f6940","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-06-02T01:04:00.171658Z","signature_b64":"4yNDHnZ5+Tr66313z02+fTi5ZYk2q7u8PGGRYuNABK1QRjNN99PrQ1h0NUu6cLNKiiwulmkyA08T6Aw4/ETfDw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"6243435be50e473a7bcbb202c4fd3d674b6ff865638c7304fc600633689f6940","last_reissued_at":"2026-06-02T01:04:00.171255Z","signature_status":"signed_v1","first_computed_at":"2026-06-02T01:04:00.171255Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2606.00625","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-02T01:04:00Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"O9InRNzUxoNR6OErqiirX6UkxKaLrgZsSqWLFSutveDdhdCHOXcojHQ+SngJDDfQ4fGI21dZ03QZzGlrB6Q3Bw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-23T01:01:40.345844Z"},"content_sha256":"b8938d9fde5194caf417d36e8ad7004560158af113fb6816b34c0205b015d3e1","schema_version":"1.0","event_id":"sha256:b8938d9fde5194caf417d36e8ad7004560158af113fb6816b34c0205b015d3e1"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:MJBUGW7FBZDTU66LWIBMJ7J5M5","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"NICE: A Framework for Declarative and Machine-Checkable Vulnerability Reproduction","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Julien Malka, Minh-Lu\\^an Nguyen, Olivier Levillain, Stefano Zacchiroli, Th\\'eo Zimmermann","submitted_at":"2026-05-30T08:59:40Z","abstract_excerpt":"Reproducing software vulnerabilities is fundamental to security researchers, open-source maintainers, and educators. Yet, vulnerabilities remain hard to reproduce today, and even when they can be reproduced, recreating a software environment where the vulnerability can be exploited becomes harder and harder over time. We present NICE, the NIx CvE reproduction framework, which uses declarative recipes to build and automatically validate vulnerable environments. In NICE, a reproduced CVE comprises one or more NixOS virtual machine configurations, a scripted exploitation scenario, and machine-che"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.00625","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2606.00625/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-02T01:04:00Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"zh0TCfA1VXQA6S1RuXe+Rkohrst4ZrPZ/rq3le++R4vwJ8Cwd6SEekXSVicK9o+KbzYSNi5YRRsV0u731y3dDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-23T01:01:40.346392Z"},"content_sha256":"e5d800494ba8f7395bc745aa3e6dd2069d33fea38b910310c66a309ce064f00b","schema_version":"1.0","event_id":"sha256:e5d800494ba8f7395bc745aa3e6dd2069d33fea38b910310c66a309ce064f00b"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/MJBUGW7FBZDTU66LWIBMJ7J5M5/bundle.json","state_url":"https://pith.science/pith/MJBUGW7FBZDTU66LWIBMJ7J5M5/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/MJBUGW7FBZDTU66LWIBMJ7J5M5/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-23T01:01:40Z","links":{"resolver":"https://pith.science/pith/MJBUGW7FBZDTU66LWIBMJ7J5M5","bundle":"https://pith.science/pith/MJBUGW7FBZDTU66LWIBMJ7J5M5/bundle.json","state":"https://pith.science/pith/MJBUGW7FBZDTU66LWIBMJ7J5M5/state.json","well_known_bundle":"https://pith.science/.well-known/pith/MJBUGW7FBZDTU66LWIBMJ7J5M5/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:MJBUGW7FBZDTU66LWIBMJ7J5M5","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"66da0fd5999326c3f29c1f446c79580a744b151996b0bd88607f86791f414dd3","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-30T08:59:40Z","title_canon_sha256":"b1d547e7d2252d7eb929d31a69cd56a3344706d990cebf99d82487e100d78fc4"},"schema_version":"1.0","source":{"id":"2606.00625","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.00625","created_at":"2026-06-02T01:04:00Z"},{"alias_kind":"arxiv_version","alias_value":"2606.00625v1","created_at":"2026-06-02T01:04:00Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.00625","created_at":"2026-06-02T01:04:00Z"},{"alias_kind":"pith_short_12","alias_value":"MJBUGW7FBZDT","created_at":"2026-06-02T01:04:00Z"},{"alias_kind":"pith_short_16","alias_value":"MJBUGW7FBZDTU66L","created_at":"2026-06-02T01:04:00Z"},{"alias_kind":"pith_short_8","alias_value":"MJBUGW7F","created_at":"2026-06-02T01:04:00Z"}],"graph_snapshots":[{"event_id":"sha256:e5d800494ba8f7395bc745aa3e6dd2069d33fea38b910310c66a309ce064f00b","target":"graph","created_at":"2026-06-02T01:04:00Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2606.00625/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Reproducing software vulnerabilities is fundamental to security researchers, open-source maintainers, and educators. Yet, vulnerabilities remain hard to reproduce today, and even when they can be reproduced, recreating a software environment where the vulnerability can be exploited becomes harder and harder over time. We present NICE, the NIx CvE reproduction framework, which uses declarative recipes to build and automatically validate vulnerable environments. In NICE, a reproduced CVE comprises one or more NixOS virtual machine configurations, a scripted exploitation scenario, and machine-che","authors_text":"Julien Malka, Minh-Lu\\^an Nguyen, Olivier Levillain, Stefano Zacchiroli, Th\\'eo Zimmermann","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-30T08:59:40Z","title":"NICE: A Framework for Declarative and Machine-Checkable Vulnerability Reproduction"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.00625","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:b8938d9fde5194caf417d36e8ad7004560158af113fb6816b34c0205b015d3e1","target":"record","created_at":"2026-06-02T01:04:00Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"66da0fd5999326c3f29c1f446c79580a744b151996b0bd88607f86791f414dd3","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-30T08:59:40Z","title_canon_sha256":"b1d547e7d2252d7eb929d31a69cd56a3344706d990cebf99d82487e100d78fc4"},"schema_version":"1.0","source":{"id":"2606.00625","kind":"arxiv","version":1}},"canonical_sha256":"6243435be50e473a7bcbb202c4fd3d674b6ff865638c7304fc600633689f6940","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"6243435be50e473a7bcbb202c4fd3d674b6ff865638c7304fc600633689f6940","first_computed_at":"2026-06-02T01:04:00.171255Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-06-02T01:04:00.171255Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"4yNDHnZ5+Tr66313z02+fTi5ZYk2q7u8PGGRYuNABK1QRjNN99PrQ1h0NUu6cLNKiiwulmkyA08T6Aw4/ETfDw==","signature_status":"signed_v1","signed_at":"2026-06-02T01:04:00.171658Z","signed_message":"canonical_sha256_bytes"},"source_id":"2606.00625","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:b8938d9fde5194caf417d36e8ad7004560158af113fb6816b34c0205b015d3e1","sha256:e5d800494ba8f7395bc745aa3e6dd2069d33fea38b910310c66a309ce064f00b"],"state_sha256":"d6470eb6d96842b5061ff09f013d2a9597a814375e18738a47529dd92854ab98"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"4PPf2AUx5ajYGjPkIiCQeteJStMwnTjxmj7hgke+kyYbFsHdr6yVXNdSUWavYC0TwZ74G+z7HxXbbJEtbORyBA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-23T01:01:40.352404Z","bundle_sha256":"7a3ddc0cfb450c5d13f05b666cc415d6294a6132d930c7c85fe23f0b3681c5a7"}}