{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:QPJ3CWW5MCPFJX4NBY3SY3X7MM","short_pith_number":"pith:QPJ3CWW5","canonical_record":{"source":{"id":"2411.11017","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-11-17T09:42:08Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"013b070a4588dbb6a3583d6fb9203dddb1c8ffb0cfc54b6ced06ca21c9de0c86","abstract_canon_sha256":"b20cf192a560826fdf9da4e1712b711ff6cdb8a872d81042398fee94951e6863"},"schema_version":"1.0"},"canonical_sha256":"83d3b15add609e54df8d0e372c6eff631b1761e53ba3bb6156333f45d3f6af59","source":{"kind":"arxiv","id":"2411.11017","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2411.11017","created_at":"2026-07-05T11:39:45Z"},{"alias_kind":"arxiv_version","alias_value":"2411.11017v3","created_at":"2026-07-05T11:39:45Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2411.11017","created_at":"2026-07-05T11:39:45Z"},{"alias_kind":"pith_short_12","alias_value":"QPJ3CWW5MCPF","created_at":"2026-07-05T11:39:45Z"},{"alias_kind":"pith_short_16","alias_value":"QPJ3CWW5MCPFJX4N","created_at":"2026-07-05T11:39:45Z"},{"alias_kind":"pith_short_8","alias_value":"QPJ3CWW5","created_at":"2026-07-05T11:39:45Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:QPJ3CWW5MCPFJX4NBY3SY3X7MM","target":"record","payload":{"canonical_record":{"source":{"id":"2411.11017","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-11-17T09:42:08Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"013b070a4588dbb6a3583d6fb9203dddb1c8ffb0cfc54b6ced06ca21c9de0c86","abstract_canon_sha256":"b20cf192a560826fdf9da4e1712b711ff6cdb8a872d81042398fee94951e6863"},"schema_version":"1.0"},"canonical_sha256":"83d3b15add609e54df8d0e372c6eff631b1761e53ba3bb6156333f45d3f6af59","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:39:45.747034Z","signature_b64":"bkdTszEwN/QjK1bK3P38jiukJW4EJbc5jvG2zEjAZ0Nkme48D5JKAffUatRHpg/nLeh4e5p8IoAwW+9wyt3gCQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"83d3b15add609e54df8d0e372c6eff631b1761e53ba3bb6156333f45d3f6af59","last_reissued_at":"2026-07-05T11:39:45.746576Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:39:45.746576Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2411.11017","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:39:45Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"DWsZpK7L3H/jFw7OqpnEF85kf6R+NQLR6Bk0xW0w+ZSWTshjS6Jf3VVnCved8uOun1UorqWhdL4XOufSJifRDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-18T13:24:34.499404Z"},"content_sha256":"f144800a2bb8e171941ba2e514d4838a4e64c58a55a4ca69dffd64333e167353","schema_version":"1.0","event_id":"sha256:f144800a2bb8e171941ba2e514d4838a4e64c58a55a4ca69dffd64333e167353"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:QPJ3CWW5MCPFJX4NBY3SY3X7MM","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"A Study of Malware Prevention in Linux Distributions","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Duc-Ly Vu, John Speed Meyers, Karla Obermeier-Velazquez, Paul Gibert, Santiago Torres-Arias, Thanh-Cong Nguyen, Trevor Dunlap","submitted_at":"2024-11-17T09:42:08Z","abstract_excerpt":"Malicious attacks on open-source software packages are a growing concern. The discovery of the XZ Utils backdoor intensified these concerns because of the potential widespread impact. This study, therefore, explores the challenges of preventing and detecting malware in Linux distribution package repositories. To do so, we ask two research questions: (1) What measures have Linux distributions implemented to counter malware, and how have maintainers experienced these efforts? (2) How effective are current malware detection tools in identifying malicious Linux packages? To answer these questions,"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2411.11017","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2411.11017/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:39:45Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"sYUVjILpWvwqW2wixRKH6viYnmyi9J3TXKaH2sR8mrMxZOVjkN0ELUL1ZmPDtcCq/c7eNj50HUbEIfGfaPV1Ag==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-18T13:24:34.499769Z"},"content_sha256":"e485a4a963649f877d2920f50a4dc94c8f9f9770ef52c5dbd9b566267fd6a5d3","schema_version":"1.0","event_id":"sha256:e485a4a963649f877d2920f50a4dc94c8f9f9770ef52c5dbd9b566267fd6a5d3"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/QPJ3CWW5MCPFJX4NBY3SY3X7MM/bundle.json","state_url":"https://pith.science/pith/QPJ3CWW5MCPFJX4NBY3SY3X7MM/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/QPJ3CWW5MCPFJX4NBY3SY3X7MM/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-18T13:24:34Z","links":{"resolver":"https://pith.science/pith/QPJ3CWW5MCPFJX4NBY3SY3X7MM","bundle":"https://pith.science/pith/QPJ3CWW5MCPFJX4NBY3SY3X7MM/bundle.json","state":"https://pith.science/pith/QPJ3CWW5MCPFJX4NBY3SY3X7MM/state.json","well_known_bundle":"https://pith.science/.well-known/pith/QPJ3CWW5MCPFJX4NBY3SY3X7MM/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:QPJ3CWW5MCPFJX4NBY3SY3X7MM","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"b20cf192a560826fdf9da4e1712b711ff6cdb8a872d81042398fee94951e6863","cross_cats_sorted":["cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-11-17T09:42:08Z","title_canon_sha256":"013b070a4588dbb6a3583d6fb9203dddb1c8ffb0cfc54b6ced06ca21c9de0c86"},"schema_version":"1.0","source":{"id":"2411.11017","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2411.11017","created_at":"2026-07-05T11:39:45Z"},{"alias_kind":"arxiv_version","alias_value":"2411.11017v3","created_at":"2026-07-05T11:39:45Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2411.11017","created_at":"2026-07-05T11:39:45Z"},{"alias_kind":"pith_short_12","alias_value":"QPJ3CWW5MCPF","created_at":"2026-07-05T11:39:45Z"},{"alias_kind":"pith_short_16","alias_value":"QPJ3CWW5MCPFJX4N","created_at":"2026-07-05T11:39:45Z"},{"alias_kind":"pith_short_8","alias_value":"QPJ3CWW5","created_at":"2026-07-05T11:39:45Z"}],"graph_snapshots":[{"event_id":"sha256:e485a4a963649f877d2920f50a4dc94c8f9f9770ef52c5dbd9b566267fd6a5d3","target":"graph","created_at":"2026-07-05T11:39:45Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2411.11017/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Malicious attacks on open-source software packages are a growing concern. The discovery of the XZ Utils backdoor intensified these concerns because of the potential widespread impact. This study, therefore, explores the challenges of preventing and detecting malware in Linux distribution package repositories. To do so, we ask two research questions: (1) What measures have Linux distributions implemented to counter malware, and how have maintainers experienced these efforts? (2) How effective are current malware detection tools in identifying malicious Linux packages? To answer these questions,","authors_text":"Duc-Ly Vu, John Speed Meyers, Karla Obermeier-Velazquez, Paul Gibert, Santiago Torres-Arias, Thanh-Cong Nguyen, Trevor Dunlap","cross_cats":["cs.SE"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-11-17T09:42:08Z","title":"A Study of Malware Prevention in Linux Distributions"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2411.11017","kind":"arxiv","version":3},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:f144800a2bb8e171941ba2e514d4838a4e64c58a55a4ca69dffd64333e167353","target":"record","created_at":"2026-07-05T11:39:45Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"b20cf192a560826fdf9da4e1712b711ff6cdb8a872d81042398fee94951e6863","cross_cats_sorted":["cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-11-17T09:42:08Z","title_canon_sha256":"013b070a4588dbb6a3583d6fb9203dddb1c8ffb0cfc54b6ced06ca21c9de0c86"},"schema_version":"1.0","source":{"id":"2411.11017","kind":"arxiv","version":3}},"canonical_sha256":"83d3b15add609e54df8d0e372c6eff631b1761e53ba3bb6156333f45d3f6af59","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"83d3b15add609e54df8d0e372c6eff631b1761e53ba3bb6156333f45d3f6af59","first_computed_at":"2026-07-05T11:39:45.746576Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:39:45.746576Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"bkdTszEwN/QjK1bK3P38jiukJW4EJbc5jvG2zEjAZ0Nkme48D5JKAffUatRHpg/nLeh4e5p8IoAwW+9wyt3gCQ==","signature_status":"signed_v1","signed_at":"2026-07-05T11:39:45.747034Z","signed_message":"canonical_sha256_bytes"},"source_id":"2411.11017","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:f144800a2bb8e171941ba2e514d4838a4e64c58a55a4ca69dffd64333e167353","sha256:e485a4a963649f877d2920f50a4dc94c8f9f9770ef52c5dbd9b566267fd6a5d3"],"state_sha256":"40735a44cbba6342417aa078fff044872fa92d146be2955ea679af6fb3b6c7b2"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"TktNxreQMv+w39lhRWjQM5a40fLveOcJAtgGtsejt4QhWWlG2nb4u7ZvpMWbDj+xp0+AvQeOg0JLJDgGfiArBQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-18T13:24:34.502205Z","bundle_sha256":"f017ad15bbd53b1ffa5c9f074f77d5e49d1e7474b447777dcde31763dc99fcd4"}}