{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:TBBQDE4EIOOZ6NH3CX5EMBPAA2","short_pith_number":"pith:TBBQDE4E","canonical_record":{"source":{"id":"2408.16529","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-08-29T13:40:06Z","cross_cats_sorted":[],"title_canon_sha256":"7fdd731ed615e5fb8b0a20bd7dfca662e9a000dc17104a2f03bca6c9e1260b25","abstract_canon_sha256":"670f4e8a24efcd1a6f9e7246ecfa1e3b67859b2fd8b7937e3ac9fe99d598b5c3"},"schema_version":"1.0"},"canonical_sha256":"9843019384439d9f34fb15fa4605e006bf9319f4dc5c308c83f07d177c9a4bb7","source":{"kind":"arxiv","id":"2408.16529","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2408.16529","created_at":"2026-07-05T09:00:42Z"},{"alias_kind":"arxiv_version","alias_value":"2408.16529v1","created_at":"2026-07-05T09:00:42Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2408.16529","created_at":"2026-07-05T09:00:42Z"},{"alias_kind":"pith_short_12","alias_value":"TBBQDE4EIOOZ","created_at":"2026-07-05T09:00:42Z"},{"alias_kind":"pith_short_16","alias_value":"TBBQDE4EIOOZ6NH3","created_at":"2026-07-05T09:00:42Z"},{"alias_kind":"pith_short_8","alias_value":"TBBQDE4E","created_at":"2026-07-05T09:00:42Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:TBBQDE4EIOOZ6NH3CX5EMBPAA2","target":"record","payload":{"canonical_record":{"source":{"id":"2408.16529","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-08-29T13:40:06Z","cross_cats_sorted":[],"title_canon_sha256":"7fdd731ed615e5fb8b0a20bd7dfca662e9a000dc17104a2f03bca6c9e1260b25","abstract_canon_sha256":"670f4e8a24efcd1a6f9e7246ecfa1e3b67859b2fd8b7937e3ac9fe99d598b5c3"},"schema_version":"1.0"},"canonical_sha256":"9843019384439d9f34fb15fa4605e006bf9319f4dc5c308c83f07d177c9a4bb7","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T09:00:42.811789Z","signature_b64":"qe7QY8eGsGzS1uTwDwp+ncenjL+4pCgTXvHr9MGmaOgFzdXCelXWJehDU/cFhhBbUbaE/YYZYY7/ybsDBUKNBQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"9843019384439d9f34fb15fa4605e006bf9319f4dc5c308c83f07d177c9a4bb7","last_reissued_at":"2026-07-05T09:00:42.811287Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T09:00:42.811287Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2408.16529","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T09:00:42Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"zlaO4iPGkriVpTTCFU2S9fBGdAq22rUDZpn5mFfv8vFKGWDGgvwdi5AxMLPB/VImFvrQf7cHzgqYroRB6h3WAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-12T14:05:19.275405Z"},"content_sha256":"51513983bd0c1fe0a5a12e89caf8d2d72c958febf18aca06eae172bc831ba8f4","schema_version":"1.0","event_id":"sha256:51513983bd0c1fe0a5a12e89caf8d2d72c958febf18aca06eae172bc831ba8f4"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:TBBQDE4EIOOZ6NH3CX5EMBPAA2","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"S3C2 Summit 2023-11: Industry Secure Supply Chain Summit","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Alexandros Kapravelos, Christian K\\\"astner, Dominik Wermke, Laurie Williams, Michel Cukier, Nusrat Zahan, William Enck, Yasemin Acar","submitted_at":"2024-08-29T13:40:06Z","abstract_excerpt":"Cyber attacks leveraging or targeting the software supply chain, such as the SolarWinds and the Log4j incidents, affected thousands of businesses and their customers, drawing attention from both industry and government stakeholders. To foster open dialogue, facilitate mutual sharing, and discuss shared challenges encountered by stakeholders in securing their software supply chain, researchers from the NSF-supported Secure Software Supply Chain Center (S3C2) organize Secure Supply Chain Summits with stakeholders. This paper summarizes the Industry Secure Supply Chain Summit held on November 16,"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2408.16529","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2408.16529/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T09:00:42Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"O789mfdj8HW+Szii5EDTq0HX89Mt4UL0BE+QGk+ESUM6X4RC5Kv6YXwab41kq2Mobp0f2q7wpTMqu9eKzz9yBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-12T14:05:19.277084Z"},"content_sha256":"3190f601918544f566444cae988719cf89b549011603abca951837b1cde248ab","schema_version":"1.0","event_id":"sha256:3190f601918544f566444cae988719cf89b549011603abca951837b1cde248ab"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/TBBQDE4EIOOZ6NH3CX5EMBPAA2/bundle.json","state_url":"https://pith.science/pith/TBBQDE4EIOOZ6NH3CX5EMBPAA2/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/TBBQDE4EIOOZ6NH3CX5EMBPAA2/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-12T14:05:19Z","links":{"resolver":"https://pith.science/pith/TBBQDE4EIOOZ6NH3CX5EMBPAA2","bundle":"https://pith.science/pith/TBBQDE4EIOOZ6NH3CX5EMBPAA2/bundle.json","state":"https://pith.science/pith/TBBQDE4EIOOZ6NH3CX5EMBPAA2/state.json","well_known_bundle":"https://pith.science/.well-known/pith/TBBQDE4EIOOZ6NH3CX5EMBPAA2/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:TBBQDE4EIOOZ6NH3CX5EMBPAA2","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"670f4e8a24efcd1a6f9e7246ecfa1e3b67859b2fd8b7937e3ac9fe99d598b5c3","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-08-29T13:40:06Z","title_canon_sha256":"7fdd731ed615e5fb8b0a20bd7dfca662e9a000dc17104a2f03bca6c9e1260b25"},"schema_version":"1.0","source":{"id":"2408.16529","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2408.16529","created_at":"2026-07-05T09:00:42Z"},{"alias_kind":"arxiv_version","alias_value":"2408.16529v1","created_at":"2026-07-05T09:00:42Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2408.16529","created_at":"2026-07-05T09:00:42Z"},{"alias_kind":"pith_short_12","alias_value":"TBBQDE4EIOOZ","created_at":"2026-07-05T09:00:42Z"},{"alias_kind":"pith_short_16","alias_value":"TBBQDE4EIOOZ6NH3","created_at":"2026-07-05T09:00:42Z"},{"alias_kind":"pith_short_8","alias_value":"TBBQDE4E","created_at":"2026-07-05T09:00:42Z"}],"graph_snapshots":[{"event_id":"sha256:3190f601918544f566444cae988719cf89b549011603abca951837b1cde248ab","target":"graph","created_at":"2026-07-05T09:00:42Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2408.16529/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Cyber attacks leveraging or targeting the software supply chain, such as the SolarWinds and the Log4j incidents, affected thousands of businesses and their customers, drawing attention from both industry and government stakeholders. To foster open dialogue, facilitate mutual sharing, and discuss shared challenges encountered by stakeholders in securing their software supply chain, researchers from the NSF-supported Secure Software Supply Chain Center (S3C2) organize Secure Supply Chain Summits with stakeholders. This paper summarizes the Industry Secure Supply Chain Summit held on November 16,","authors_text":"Alexandros Kapravelos, Christian K\\\"astner, Dominik Wermke, Laurie Williams, Michel Cukier, Nusrat Zahan, William Enck, Yasemin Acar","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-08-29T13:40:06Z","title":"S3C2 Summit 2023-11: Industry Secure Supply Chain Summit"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2408.16529","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:51513983bd0c1fe0a5a12e89caf8d2d72c958febf18aca06eae172bc831ba8f4","target":"record","created_at":"2026-07-05T09:00:42Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"670f4e8a24efcd1a6f9e7246ecfa1e3b67859b2fd8b7937e3ac9fe99d598b5c3","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-08-29T13:40:06Z","title_canon_sha256":"7fdd731ed615e5fb8b0a20bd7dfca662e9a000dc17104a2f03bca6c9e1260b25"},"schema_version":"1.0","source":{"id":"2408.16529","kind":"arxiv","version":1}},"canonical_sha256":"9843019384439d9f34fb15fa4605e006bf9319f4dc5c308c83f07d177c9a4bb7","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"9843019384439d9f34fb15fa4605e006bf9319f4dc5c308c83f07d177c9a4bb7","first_computed_at":"2026-07-05T09:00:42.811287Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T09:00:42.811287Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"qe7QY8eGsGzS1uTwDwp+ncenjL+4pCgTXvHr9MGmaOgFzdXCelXWJehDU/cFhhBbUbaE/YYZYY7/ybsDBUKNBQ==","signature_status":"signed_v1","signed_at":"2026-07-05T09:00:42.811789Z","signed_message":"canonical_sha256_bytes"},"source_id":"2408.16529","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:51513983bd0c1fe0a5a12e89caf8d2d72c958febf18aca06eae172bc831ba8f4","sha256:3190f601918544f566444cae988719cf89b549011603abca951837b1cde248ab"],"state_sha256":"b87ef7756aee11ea73c4a4b3856b022a6dfbfe9f5a07b44d67d93304de8033ae"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"YZNUwKAX2m/sUvRSUKh+5ufCzdPr5Fdt7DiIDk+m3UEunKytHwWz+G/1iYEkRjKtbPNoAWp9hmXxGhk5w9ybCA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-12T14:05:19.285885Z","bundle_sha256":"a363d2a7f96c652bcff46f94b3922827891b4a615f82f2cfb809ff9829dbb0ab"}}