{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2023:T4KBGESZ2UPVQ5HDHY4REPT6NH","short_pith_number":"pith:T4KBGESZ","canonical_record":{"source":{"id":"2307.02088","kind":"arxiv","version":4},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-07-05T07:56:48Z","cross_cats_sorted":[],"title_canon_sha256":"46f6dca62f68c400a999d5c353d081e4a9340fdf21f9e925584f349e917db8e2","abstract_canon_sha256":"1b4e5f8a707eb968cc78f39ea5edf83dfd8ee9988a41e53c5325e116c559c355"},"schema_version":"1.0"},"canonical_sha256":"9f14131259d51f5874e33e39123e7e69f8b5e69e63ef57cd11f8c995400134ab","source":{"kind":"arxiv","id":"2307.02088","version":4},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2307.02088","created_at":"2026-07-05T07:34:48Z"},{"alias_kind":"arxiv_version","alias_value":"2307.02088v4","created_at":"2026-07-05T07:34:48Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2307.02088","created_at":"2026-07-05T07:34:48Z"},{"alias_kind":"pith_short_12","alias_value":"T4KBGESZ2UPV","created_at":"2026-07-05T07:34:48Z"},{"alias_kind":"pith_short_16","alias_value":"T4KBGESZ2UPVQ5HD","created_at":"2026-07-05T07:34:48Z"},{"alias_kind":"pith_short_8","alias_value":"T4KBGESZ","created_at":"2026-07-05T07:34:48Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2023:T4KBGESZ2UPVQ5HDHY4REPT6NH","target":"record","payload":{"canonical_record":{"source":{"id":"2307.02088","kind":"arxiv","version":4},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-07-05T07:56:48Z","cross_cats_sorted":[],"title_canon_sha256":"46f6dca62f68c400a999d5c353d081e4a9340fdf21f9e925584f349e917db8e2","abstract_canon_sha256":"1b4e5f8a707eb968cc78f39ea5edf83dfd8ee9988a41e53c5325e116c559c355"},"schema_version":"1.0"},"canonical_sha256":"9f14131259d51f5874e33e39123e7e69f8b5e69e63ef57cd11f8c995400134ab","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T07:34:48.995031Z","signature_b64":"C5DTR1lui6xcYZaP3FEqcf3mmbnc7F3n7bnkqVa9EaXQAKF+hJsPTtrnAIE6VDt8DtRHKbXGsWPNergOLDgNAQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"9f14131259d51f5874e33e39123e7e69f8b5e69e63ef57cd11f8c995400134ab","last_reissued_at":"2026-07-05T07:34:48.994625Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T07:34:48.994625Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2307.02088","source_version":4,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T07:34:48Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"7q3jOAa8kNF39fIbFnpFL3A33qvMqf2VFuOwcsaiQv4dFhLtjSM+suzzHV5GjgD66T9vKdJC5t2LcKRpq//6Cg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-22T14:23:15.746022Z"},"content_sha256":"a32013ced7ad992f985be8694a2bfc6b82a155ec295d00c604b1c912f83a9027","schema_version":"1.0","event_id":"sha256:a32013ced7ad992f985be8694a2bfc6b82a155ec295d00c604b1c912f83a9027"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2023:T4KBGESZ2UPVQ5HDHY4REPT6NH","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Trust in Software Supply Chains: Blockchain-Enabled SBOM and the AIBOM Future","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.SE","authors_text":"Boming Xia, Dawen Zhang, Liming Zhu, Qinghua Lu, Yue Liu, Zhenchang Xing","submitted_at":"2023-07-05T07:56:48Z","abstract_excerpt":"The robustness of critical infrastructure systems is contingent upon the integrity and transparency of their software supply chains. A Software Bill of Materials (SBOM) is pivotal in this regard, offering an exhaustive inventory of components and dependencies crucial to software development. However, prevalent challenges in SBOM sharing, such as data tampering risks and vendors' reluctance to fully disclose sensitive information, significantly hinder its effective implementation. These challenges pose a notable threat to the security of critical infrastructure and systems where transparency an"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2307.02088","kind":"arxiv","version":4},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2307.02088/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T07:34:48Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"SuljkJevhEBpk8mHsV4oBb55N5ujUk8tXKdw77BaBXpKn1eYXw/f/R54QEgKPZ96NhzFbIFn7uIHXEbDJyhFBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-22T14:23:15.746359Z"},"content_sha256":"bca939647f9e59ca89dc7cce9ca09a932444efa07af55157a36db71918ecd1c2","schema_version":"1.0","event_id":"sha256:bca939647f9e59ca89dc7cce9ca09a932444efa07af55157a36db71918ecd1c2"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/T4KBGESZ2UPVQ5HDHY4REPT6NH/bundle.json","state_url":"https://pith.science/pith/T4KBGESZ2UPVQ5HDHY4REPT6NH/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/T4KBGESZ2UPVQ5HDHY4REPT6NH/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-22T14:23:15Z","links":{"resolver":"https://pith.science/pith/T4KBGESZ2UPVQ5HDHY4REPT6NH","bundle":"https://pith.science/pith/T4KBGESZ2UPVQ5HDHY4REPT6NH/bundle.json","state":"https://pith.science/pith/T4KBGESZ2UPVQ5HDHY4REPT6NH/state.json","well_known_bundle":"https://pith.science/.well-known/pith/T4KBGESZ2UPVQ5HDHY4REPT6NH/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2023:T4KBGESZ2UPVQ5HDHY4REPT6NH","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"1b4e5f8a707eb968cc78f39ea5edf83dfd8ee9988a41e53c5325e116c559c355","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-07-05T07:56:48Z","title_canon_sha256":"46f6dca62f68c400a999d5c353d081e4a9340fdf21f9e925584f349e917db8e2"},"schema_version":"1.0","source":{"id":"2307.02088","kind":"arxiv","version":4}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2307.02088","created_at":"2026-07-05T07:34:48Z"},{"alias_kind":"arxiv_version","alias_value":"2307.02088v4","created_at":"2026-07-05T07:34:48Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2307.02088","created_at":"2026-07-05T07:34:48Z"},{"alias_kind":"pith_short_12","alias_value":"T4KBGESZ2UPV","created_at":"2026-07-05T07:34:48Z"},{"alias_kind":"pith_short_16","alias_value":"T4KBGESZ2UPVQ5HD","created_at":"2026-07-05T07:34:48Z"},{"alias_kind":"pith_short_8","alias_value":"T4KBGESZ","created_at":"2026-07-05T07:34:48Z"}],"graph_snapshots":[{"event_id":"sha256:bca939647f9e59ca89dc7cce9ca09a932444efa07af55157a36db71918ecd1c2","target":"graph","created_at":"2026-07-05T07:34:48Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2307.02088/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The robustness of critical infrastructure systems is contingent upon the integrity and transparency of their software supply chains. A Software Bill of Materials (SBOM) is pivotal in this regard, offering an exhaustive inventory of components and dependencies crucial to software development. However, prevalent challenges in SBOM sharing, such as data tampering risks and vendors' reluctance to fully disclose sensitive information, significantly hinder its effective implementation. These challenges pose a notable threat to the security of critical infrastructure and systems where transparency an","authors_text":"Boming Xia, Dawen Zhang, Liming Zhu, Qinghua Lu, Yue Liu, Zhenchang Xing","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-07-05T07:56:48Z","title":"Trust in Software Supply Chains: Blockchain-Enabled SBOM and the AIBOM Future"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2307.02088","kind":"arxiv","version":4},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:a32013ced7ad992f985be8694a2bfc6b82a155ec295d00c604b1c912f83a9027","target":"record","created_at":"2026-07-05T07:34:48Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"1b4e5f8a707eb968cc78f39ea5edf83dfd8ee9988a41e53c5325e116c559c355","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-07-05T07:56:48Z","title_canon_sha256":"46f6dca62f68c400a999d5c353d081e4a9340fdf21f9e925584f349e917db8e2"},"schema_version":"1.0","source":{"id":"2307.02088","kind":"arxiv","version":4}},"canonical_sha256":"9f14131259d51f5874e33e39123e7e69f8b5e69e63ef57cd11f8c995400134ab","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"9f14131259d51f5874e33e39123e7e69f8b5e69e63ef57cd11f8c995400134ab","first_computed_at":"2026-07-05T07:34:48.994625Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T07:34:48.994625Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"C5DTR1lui6xcYZaP3FEqcf3mmbnc7F3n7bnkqVa9EaXQAKF+hJsPTtrnAIE6VDt8DtRHKbXGsWPNergOLDgNAQ==","signature_status":"signed_v1","signed_at":"2026-07-05T07:34:48.995031Z","signed_message":"canonical_sha256_bytes"},"source_id":"2307.02088","source_kind":"arxiv","source_version":4}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:a32013ced7ad992f985be8694a2bfc6b82a155ec295d00c604b1c912f83a9027","sha256:bca939647f9e59ca89dc7cce9ca09a932444efa07af55157a36db71918ecd1c2"],"state_sha256":"0654ed26117443574bc2268f5f9b97d6a13049308df7e66fc5fabf20eac06ccd"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"D+F9095Gb2yJSLqhkVS3EyI6LB2zquVP1aPrEhMRGhlzndrISBaKnipl9Jj72mdFkyjDwvD3xfG0yXhMGpn0Bw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-22T14:23:15.749731Z","bundle_sha256":"b12e1607f538fe570e702ee05751b3df7b7e575694914acef565b250732cfc17"}}