{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2023:T7HQWTEAY2ROLCG4T2N3P3YRZA","short_pith_number":"pith:T7HQWTEA","canonical_record":{"source":{"id":"2307.16557","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2023-07-31T10:37:12Z","cross_cats_sorted":[],"title_canon_sha256":"773031497e8def12874e8835819b63c3b5860e90b0e9ee13b8d6d1e974e2ec12","abstract_canon_sha256":"ef5f869c0939481fb92729aa8c97225798a64598d8b55ce73709d4de69969ce3"},"schema_version":"1.0"},"canonical_sha256":"9fcf0b4c80c6a2e588dc9e9bb7ef11c82a10cad426d0301b5e3fd499d7d358ab","source":{"kind":"arxiv","id":"2307.16557","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2307.16557","created_at":"2026-07-05T06:36:05Z"},{"alias_kind":"arxiv_version","alias_value":"2307.16557v1","created_at":"2026-07-05T06:36:05Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2307.16557","created_at":"2026-07-05T06:36:05Z"},{"alias_kind":"pith_short_12","alias_value":"T7HQWTEAY2RO","created_at":"2026-07-05T06:36:05Z"},{"alias_kind":"pith_short_16","alias_value":"T7HQWTEAY2ROLCG4","created_at":"2026-07-05T06:36:05Z"},{"alias_kind":"pith_short_8","alias_value":"T7HQWTEA","created_at":"2026-07-05T06:36:05Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2023:T7HQWTEAY2ROLCG4T2N3P3YRZA","target":"record","payload":{"canonical_record":{"source":{"id":"2307.16557","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2023-07-31T10:37:12Z","cross_cats_sorted":[],"title_canon_sha256":"773031497e8def12874e8835819b63c3b5860e90b0e9ee13b8d6d1e974e2ec12","abstract_canon_sha256":"ef5f869c0939481fb92729aa8c97225798a64598d8b55ce73709d4de69969ce3"},"schema_version":"1.0"},"canonical_sha256":"9fcf0b4c80c6a2e588dc9e9bb7ef11c82a10cad426d0301b5e3fd499d7d358ab","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T06:36:05.140676Z","signature_b64":"tCkP40rtGe/kL16Fv0DZrssKwaYWR/6XvlduiVKDs+WXv16HvYk7kbGGtr2AdpzsO7197uOuB9tG64XQ6lPiAw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"9fcf0b4c80c6a2e588dc9e9bb7ef11c82a10cad426d0301b5e3fd499d7d358ab","last_reissued_at":"2026-07-05T06:36:05.140309Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T06:36:05.140309Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2307.16557","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T06:36:05Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"21jYSBRDtIATEsXRX44b2G6nlvr16t2FAX/oMQYDKdOBeEruzFWygCmBdFfwIl3pVJe6mPzmjdhx1Z3x++h9Cg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-01T08:17:47.826417Z"},"content_sha256":"389de54c2439818ef432f6f409107e70fa6a019f8f7f4e1b223c754817fc7b85","schema_version":"1.0","event_id":"sha256:389de54c2439818ef432f6f409107e70fa6a019f8f7f4e1b223c754817fc7b85"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2023:T7HQWTEAY2ROLCG4T2N3P3YRZA","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"S3C2 Summit 2023-02: Industry Secure Supply Chain Summit","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Alexandros Kapravelos, Christian Kastner, Laurie Williams, Michel Cucker, Trevor Dunlap, William Enck, Yasemin Acar","submitted_at":"2023-07-31T10:37:12Z","abstract_excerpt":"Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing fatal damage to businesses and organizations. Past well-known examples of software supply chain attacks are the SolarWinds or log4j incidents that have affected thousands of customers and businesses. The US government and industry are equally interested in enhancing software supply chain security. On February 22, 2023, researchers from the NSF-supported Secure Software Supply Chain Center (S3C2) conducted a Secure Software Supply Chain Summit with a diverse set of 17 practiti"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2307.16557","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2307.16557/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T06:36:05Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"cZszlC5vMv0DmZaD5PdHbMLkoK41yiBgOzyMnp6kFrXVpStwbLxhdG0cG1O6xQt+RHplU9A6brfbqhtcvZ2qBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-01T08:17:47.827260Z"},"content_sha256":"bb5bf31a9996cfdf09a42eaf2961b1b7904736f55e0764d019adf6a4b75d6896","schema_version":"1.0","event_id":"sha256:bb5bf31a9996cfdf09a42eaf2961b1b7904736f55e0764d019adf6a4b75d6896"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/T7HQWTEAY2ROLCG4T2N3P3YRZA/bundle.json","state_url":"https://pith.science/pith/T7HQWTEAY2ROLCG4T2N3P3YRZA/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/T7HQWTEAY2ROLCG4T2N3P3YRZA/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-01T08:17:47Z","links":{"resolver":"https://pith.science/pith/T7HQWTEAY2ROLCG4T2N3P3YRZA","bundle":"https://pith.science/pith/T7HQWTEAY2ROLCG4T2N3P3YRZA/bundle.json","state":"https://pith.science/pith/T7HQWTEAY2ROLCG4T2N3P3YRZA/state.json","well_known_bundle":"https://pith.science/.well-known/pith/T7HQWTEAY2ROLCG4T2N3P3YRZA/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2023:T7HQWTEAY2ROLCG4T2N3P3YRZA","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"ef5f869c0939481fb92729aa8c97225798a64598d8b55ce73709d4de69969ce3","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2023-07-31T10:37:12Z","title_canon_sha256":"773031497e8def12874e8835819b63c3b5860e90b0e9ee13b8d6d1e974e2ec12"},"schema_version":"1.0","source":{"id":"2307.16557","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2307.16557","created_at":"2026-07-05T06:36:05Z"},{"alias_kind":"arxiv_version","alias_value":"2307.16557v1","created_at":"2026-07-05T06:36:05Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2307.16557","created_at":"2026-07-05T06:36:05Z"},{"alias_kind":"pith_short_12","alias_value":"T7HQWTEAY2RO","created_at":"2026-07-05T06:36:05Z"},{"alias_kind":"pith_short_16","alias_value":"T7HQWTEAY2ROLCG4","created_at":"2026-07-05T06:36:05Z"},{"alias_kind":"pith_short_8","alias_value":"T7HQWTEA","created_at":"2026-07-05T06:36:05Z"}],"graph_snapshots":[{"event_id":"sha256:bb5bf31a9996cfdf09a42eaf2961b1b7904736f55e0764d019adf6a4b75d6896","target":"graph","created_at":"2026-07-05T06:36:05Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2307.16557/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing fatal damage to businesses and organizations. Past well-known examples of software supply chain attacks are the SolarWinds or log4j incidents that have affected thousands of customers and businesses. The US government and industry are equally interested in enhancing software supply chain security. On February 22, 2023, researchers from the NSF-supported Secure Software Supply Chain Center (S3C2) conducted a Secure Software Supply Chain Summit with a diverse set of 17 practiti","authors_text":"Alexandros Kapravelos, Christian Kastner, Laurie Williams, Michel Cucker, Trevor Dunlap, William Enck, Yasemin Acar","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2023-07-31T10:37:12Z","title":"S3C2 Summit 2023-02: Industry Secure Supply Chain Summit"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2307.16557","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:389de54c2439818ef432f6f409107e70fa6a019f8f7f4e1b223c754817fc7b85","target":"record","created_at":"2026-07-05T06:36:05Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"ef5f869c0939481fb92729aa8c97225798a64598d8b55ce73709d4de69969ce3","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2023-07-31T10:37:12Z","title_canon_sha256":"773031497e8def12874e8835819b63c3b5860e90b0e9ee13b8d6d1e974e2ec12"},"schema_version":"1.0","source":{"id":"2307.16557","kind":"arxiv","version":1}},"canonical_sha256":"9fcf0b4c80c6a2e588dc9e9bb7ef11c82a10cad426d0301b5e3fd499d7d358ab","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"9fcf0b4c80c6a2e588dc9e9bb7ef11c82a10cad426d0301b5e3fd499d7d358ab","first_computed_at":"2026-07-05T06:36:05.140309Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T06:36:05.140309Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"tCkP40rtGe/kL16Fv0DZrssKwaYWR/6XvlduiVKDs+WXv16HvYk7kbGGtr2AdpzsO7197uOuB9tG64XQ6lPiAw==","signature_status":"signed_v1","signed_at":"2026-07-05T06:36:05.140676Z","signed_message":"canonical_sha256_bytes"},"source_id":"2307.16557","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:389de54c2439818ef432f6f409107e70fa6a019f8f7f4e1b223c754817fc7b85","sha256:bb5bf31a9996cfdf09a42eaf2961b1b7904736f55e0764d019adf6a4b75d6896"],"state_sha256":"7d11193cb37764672eaf2d48b3c634ffb3f7f4c5721307d84b2be28594fcc6ac"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"105VrWW1+cEKqZ8y4VY7QOegNwlfQVwi8v0MGRP96cvw5f1zg7BIuBwoGNJg+VM6DBSWArSvVFwVpK72gjdBAA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-01T08:17:47.833504Z","bundle_sha256":"983247a59dbfcd896f488ce0cb4965747b71e4c2de1f672f4577a832761104a7"}}