{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2021:OU4LK55VYCTK7AZBBDNRMU3QXF","short_pith_number":"pith:OU4LK55V","canonical_record":{"source":{"id":"2101.09563","kind":"arxiv","version":5},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.SE","submitted_at":"2021-01-23T19:10:55Z","cross_cats_sorted":[],"title_canon_sha256":"2de1e831cd6c92c54b0b7a1950346b4e7166bf2cbda0628fd3039602351946b7","abstract_canon_sha256":"d9d2993fa8bb458caf8f01d02d2705ea43cd2b22bc8cb16db6fa4f749340fbb8"},"schema_version":"1.0"},"canonical_sha256":"7538b577b5c0a6af832108db165370b949615498d9ddf1adcc625805bde5f02f","source":{"kind":"arxiv","id":"2101.09563","version":5},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2101.09563","created_at":"2026-07-05T04:27:27Z"},{"alias_kind":"arxiv_version","alias_value":"2101.09563v5","created_at":"2026-07-05T04:27:27Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2101.09563","created_at":"2026-07-05T04:27:27Z"},{"alias_kind":"pith_short_12","alias_value":"OU4LK55VYCTK","created_at":"2026-07-05T04:27:27Z"},{"alias_kind":"pith_short_16","alias_value":"OU4LK55VYCTK7AZB","created_at":"2026-07-05T04:27:27Z"},{"alias_kind":"pith_short_8","alias_value":"OU4LK55V","created_at":"2026-07-05T04:27:27Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2021:OU4LK55VYCTK7AZBBDNRMU3QXF","target":"record","payload":{"canonical_record":{"source":{"id":"2101.09563","kind":"arxiv","version":5},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.SE","submitted_at":"2021-01-23T19:10:55Z","cross_cats_sorted":[],"title_canon_sha256":"2de1e831cd6c92c54b0b7a1950346b4e7166bf2cbda0628fd3039602351946b7","abstract_canon_sha256":"d9d2993fa8bb458caf8f01d02d2705ea43cd2b22bc8cb16db6fa4f749340fbb8"},"schema_version":"1.0"},"canonical_sha256":"7538b577b5c0a6af832108db165370b949615498d9ddf1adcc625805bde5f02f","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T04:27:27.828001Z","signature_b64":"M4yRxHfDBxQsZbCvBVM5ZPCrytfVK6//sOguDSqTO3e16fQr5/s9o23lANg8Vnwh/74mv/yeqAlKlJqOjU/EDw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"7538b577b5c0a6af832108db165370b949615498d9ddf1adcc625805bde5f02f","last_reissued_at":"2026-07-05T04:27:27.827439Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T04:27:27.827439Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2101.09563","source_version":5,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:27:27Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"3snd+VqTZHQwLyXblGkfBdzzU9eubWJH1U/XS2oJYFV8mibT3j3nzn9A4tYj25BMeXfSmiq7y6AfrKZp/7goCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T13:43:50.597413Z"},"content_sha256":"7554580ce25a22a1a9aa7ebd35de2509bcc72139e924c7e5959f9e6f7b0401c0","schema_version":"1.0","event_id":"sha256:7554580ce25a22a1a9aa7ebd35de2509bcc72139e924c7e5959f9e6f7b0401c0"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2021:OU4LK55VYCTK7AZBBDNRMU3QXF","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Pr\\\"azi: From Package-based to Call-based Dependency Networks","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.SE","authors_text":"Georgios Gousios, Joseph Hejderup, Konstantinos Triantafyllou, Moritz Beller","submitted_at":"2021-01-23T19:10:55Z","abstract_excerpt":"Modern programming languages such as Java, JavaScript, and Rust encourage software reuse by hosting diverse and fast-growing repositories of highly interdependent packages (i.e., reusable libraries) for their users. The standard way to study the interdependence between software packages is to infer a package dependency network by parsing manifest data. Such networks help answer questions such as \"How many packages have dependencies to packages with known security issues?\" or \"What are the most used packages?\". However, an overlooked aspect in existing studies is that manifest-inferred relation"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2101.09563","kind":"arxiv","version":5},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2101.09563/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:27:27Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Lp/BI/obMCL4NN9k4JcslFBj0pjzRxZzUNKIMlHMDoqiFCoHrsvONQMFALmHyprWBTe9gZl954ij7DlwGNTaAw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T13:43:50.597791Z"},"content_sha256":"6f068f704e020a94384468fdc5f2765880000f259b28c66a213ac1955b96d64e","schema_version":"1.0","event_id":"sha256:6f068f704e020a94384468fdc5f2765880000f259b28c66a213ac1955b96d64e"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/OU4LK55VYCTK7AZBBDNRMU3QXF/bundle.json","state_url":"https://pith.science/pith/OU4LK55VYCTK7AZBBDNRMU3QXF/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/OU4LK55VYCTK7AZBBDNRMU3QXF/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-07T13:43:50Z","links":{"resolver":"https://pith.science/pith/OU4LK55VYCTK7AZBBDNRMU3QXF","bundle":"https://pith.science/pith/OU4LK55VYCTK7AZBBDNRMU3QXF/bundle.json","state":"https://pith.science/pith/OU4LK55VYCTK7AZBBDNRMU3QXF/state.json","well_known_bundle":"https://pith.science/.well-known/pith/OU4LK55VYCTK7AZBBDNRMU3QXF/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2021:OU4LK55VYCTK7AZBBDNRMU3QXF","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"d9d2993fa8bb458caf8f01d02d2705ea43cd2b22bc8cb16db6fa4f749340fbb8","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.SE","submitted_at":"2021-01-23T19:10:55Z","title_canon_sha256":"2de1e831cd6c92c54b0b7a1950346b4e7166bf2cbda0628fd3039602351946b7"},"schema_version":"1.0","source":{"id":"2101.09563","kind":"arxiv","version":5}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2101.09563","created_at":"2026-07-05T04:27:27Z"},{"alias_kind":"arxiv_version","alias_value":"2101.09563v5","created_at":"2026-07-05T04:27:27Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2101.09563","created_at":"2026-07-05T04:27:27Z"},{"alias_kind":"pith_short_12","alias_value":"OU4LK55VYCTK","created_at":"2026-07-05T04:27:27Z"},{"alias_kind":"pith_short_16","alias_value":"OU4LK55VYCTK7AZB","created_at":"2026-07-05T04:27:27Z"},{"alias_kind":"pith_short_8","alias_value":"OU4LK55V","created_at":"2026-07-05T04:27:27Z"}],"graph_snapshots":[{"event_id":"sha256:6f068f704e020a94384468fdc5f2765880000f259b28c66a213ac1955b96d64e","target":"graph","created_at":"2026-07-05T04:27:27Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2101.09563/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Modern programming languages such as Java, JavaScript, and Rust encourage software reuse by hosting diverse and fast-growing repositories of highly interdependent packages (i.e., reusable libraries) for their users. The standard way to study the interdependence between software packages is to infer a package dependency network by parsing manifest data. Such networks help answer questions such as \"How many packages have dependencies to packages with known security issues?\" or \"What are the most used packages?\". However, an overlooked aspect in existing studies is that manifest-inferred relation","authors_text":"Georgios Gousios, Joseph Hejderup, Konstantinos Triantafyllou, Moritz Beller","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.SE","submitted_at":"2021-01-23T19:10:55Z","title":"Pr\\\"azi: From Package-based to Call-based Dependency Networks"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2101.09563","kind":"arxiv","version":5},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:7554580ce25a22a1a9aa7ebd35de2509bcc72139e924c7e5959f9e6f7b0401c0","target":"record","created_at":"2026-07-05T04:27:27Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"d9d2993fa8bb458caf8f01d02d2705ea43cd2b22bc8cb16db6fa4f749340fbb8","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.SE","submitted_at":"2021-01-23T19:10:55Z","title_canon_sha256":"2de1e831cd6c92c54b0b7a1950346b4e7166bf2cbda0628fd3039602351946b7"},"schema_version":"1.0","source":{"id":"2101.09563","kind":"arxiv","version":5}},"canonical_sha256":"7538b577b5c0a6af832108db165370b949615498d9ddf1adcc625805bde5f02f","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"7538b577b5c0a6af832108db165370b949615498d9ddf1adcc625805bde5f02f","first_computed_at":"2026-07-05T04:27:27.827439Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T04:27:27.827439Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"M4yRxHfDBxQsZbCvBVM5ZPCrytfVK6//sOguDSqTO3e16fQr5/s9o23lANg8Vnwh/74mv/yeqAlKlJqOjU/EDw==","signature_status":"signed_v1","signed_at":"2026-07-05T04:27:27.828001Z","signed_message":"canonical_sha256_bytes"},"source_id":"2101.09563","source_kind":"arxiv","source_version":5}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:7554580ce25a22a1a9aa7ebd35de2509bcc72139e924c7e5959f9e6f7b0401c0","sha256:6f068f704e020a94384468fdc5f2765880000f259b28c66a213ac1955b96d64e"],"state_sha256":"713ec135bf32534ef8a625edf7c40c3b962e0d98b416ce7484972cd5adaa8a38"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"/Lnc/KAX8acOfYftxmciDAt6yuCRlVAJ3XOsbHp+FxLOYV2UxC/8l/WmddWf+t+M3hAHCidEtKPXe1zZas/wDQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-07T13:43:50.599967Z","bundle_sha256":"18d05d100fb1c366ada2037c86a05392851d4edacee3b4af11ad892ce25e789d"}}