{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2023:TKGD736DGZL2BXV3CCF5RA7JTO","short_pith_number":"pith:TKGD736D","canonical_record":{"source":{"id":"2301.12348","kind":"arxiv","version":9},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-01-29T04:04:13Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"853c4e6716840cc6d8c2f471272b33c9b9b82e41ca885efd2574137877886c51","abstract_canon_sha256":"4b2914f4143ba1395148910148dbc72068c62e37ac58c93bf976c3080e6d49ff"},"schema_version":"1.0"},"canonical_sha256":"9a8c3fefc33657a0debb108bd883e99ba2374b3ebcbc73fa252b33dc3e1cb7ae","source":{"kind":"arxiv","id":"2301.12348","version":9},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2301.12348","created_at":"2026-07-05T06:49:01Z"},{"alias_kind":"arxiv_version","alias_value":"2301.12348v9","created_at":"2026-07-05T06:49:01Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2301.12348","created_at":"2026-07-05T06:49:01Z"},{"alias_kind":"pith_short_12","alias_value":"TKGD736DGZL2","created_at":"2026-07-05T06:49:01Z"},{"alias_kind":"pith_short_16","alias_value":"TKGD736DGZL2BXV3","created_at":"2026-07-05T06:49:01Z"},{"alias_kind":"pith_short_8","alias_value":"TKGD736D","created_at":"2026-07-05T06:49:01Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2023:TKGD736DGZL2BXV3CCF5RA7JTO","target":"record","payload":{"canonical_record":{"source":{"id":"2301.12348","kind":"arxiv","version":9},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-01-29T04:04:13Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"853c4e6716840cc6d8c2f471272b33c9b9b82e41ca885efd2574137877886c51","abstract_canon_sha256":"4b2914f4143ba1395148910148dbc72068c62e37ac58c93bf976c3080e6d49ff"},"schema_version":"1.0"},"canonical_sha256":"9a8c3fefc33657a0debb108bd883e99ba2374b3ebcbc73fa252b33dc3e1cb7ae","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T06:49:01.813275Z","signature_b64":"oKx5glxklTBufFNaD/DHIlNNdxXBJpgLForjIXjMByhdOBGRtgsV65sF/VWdhNqVDVCV3EFQHXsDRLMy42RZAg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"9a8c3fefc33657a0debb108bd883e99ba2374b3ebcbc73fa252b33dc3e1cb7ae","last_reissued_at":"2026-07-05T06:49:01.812665Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T06:49:01.812665Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2301.12348","source_version":9,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T06:49:01Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"eHQ4oaF2LkeF6yK7c567FH6VZ1p1IzGp/YzLtMwTVgy6mgXPJnmXvh4e3kyf80kWKfQGZTH/zI4+Iopyx4UYDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-10T10:09:08.973192Z"},"content_sha256":"b2c4a9e1e93499740869b32c4f24feddb94f8ac3442757d1854d6456f0b3b502","schema_version":"1.0","event_id":"sha256:b2c4a9e1e93499740869b32c4f24feddb94f8ac3442757d1854d6456f0b3b502"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2023:TKGD736DGZL2BXV3CCF5RA7JTO","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Demystifying Privacy Policy of Third-Party Libraries in Mobile Apps","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.SE","authors_text":"Haoyu Wang, Hao Zhou, Kaifa Zhao, Le Yu, Shiyao Zhou, Xian Zhan, Xiapu Luo, Yepang Liu","submitted_at":"2023-01-29T04:04:13Z","abstract_excerpt":"The privacy of personal information has received significant attention in mobile software. Although previous researchers have designed some methods to identify the conflict between app behavior and privacy policies, little is known about investigating regulation requirements for third-party libraries (TPLs). The regulators enacted multiple regulations to regulate the usage of personal information for TPLs (e.g., the \"California Consumer Privacy Act\" requires businesses clearly notify consumers if they share consumers' data with third parties or not). However, it remains challenging to analyze "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2301.12348","kind":"arxiv","version":9},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2301.12348/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T06:49:01Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"CdxsG9NQyVbqLIedStCRPsEfcYh0eSBxIHnLOgqwE09hPcPc0KnH9wPzwAMI6egmoJASKuv5ArDOHrnfx49cCQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-10T10:09:08.973579Z"},"content_sha256":"9541feda2dbe950b63c5025d203874266d84a1c9e02cc600c7d41d5c2e0b9b63","schema_version":"1.0","event_id":"sha256:9541feda2dbe950b63c5025d203874266d84a1c9e02cc600c7d41d5c2e0b9b63"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/TKGD736DGZL2BXV3CCF5RA7JTO/bundle.json","state_url":"https://pith.science/pith/TKGD736DGZL2BXV3CCF5RA7JTO/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/TKGD736DGZL2BXV3CCF5RA7JTO/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-10T10:09:08Z","links":{"resolver":"https://pith.science/pith/TKGD736DGZL2BXV3CCF5RA7JTO","bundle":"https://pith.science/pith/TKGD736DGZL2BXV3CCF5RA7JTO/bundle.json","state":"https://pith.science/pith/TKGD736DGZL2BXV3CCF5RA7JTO/state.json","well_known_bundle":"https://pith.science/.well-known/pith/TKGD736DGZL2BXV3CCF5RA7JTO/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2023:TKGD736DGZL2BXV3CCF5RA7JTO","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"4b2914f4143ba1395148910148dbc72068c62e37ac58c93bf976c3080e6d49ff","cross_cats_sorted":["cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-01-29T04:04:13Z","title_canon_sha256":"853c4e6716840cc6d8c2f471272b33c9b9b82e41ca885efd2574137877886c51"},"schema_version":"1.0","source":{"id":"2301.12348","kind":"arxiv","version":9}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2301.12348","created_at":"2026-07-05T06:49:01Z"},{"alias_kind":"arxiv_version","alias_value":"2301.12348v9","created_at":"2026-07-05T06:49:01Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2301.12348","created_at":"2026-07-05T06:49:01Z"},{"alias_kind":"pith_short_12","alias_value":"TKGD736DGZL2","created_at":"2026-07-05T06:49:01Z"},{"alias_kind":"pith_short_16","alias_value":"TKGD736DGZL2BXV3","created_at":"2026-07-05T06:49:01Z"},{"alias_kind":"pith_short_8","alias_value":"TKGD736D","created_at":"2026-07-05T06:49:01Z"}],"graph_snapshots":[{"event_id":"sha256:9541feda2dbe950b63c5025d203874266d84a1c9e02cc600c7d41d5c2e0b9b63","target":"graph","created_at":"2026-07-05T06:49:01Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2301.12348/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The privacy of personal information has received significant attention in mobile software. Although previous researchers have designed some methods to identify the conflict between app behavior and privacy policies, little is known about investigating regulation requirements for third-party libraries (TPLs). The regulators enacted multiple regulations to regulate the usage of personal information for TPLs (e.g., the \"California Consumer Privacy Act\" requires businesses clearly notify consumers if they share consumers' data with third parties or not). However, it remains challenging to analyze ","authors_text":"Haoyu Wang, Hao Zhou, Kaifa Zhao, Le Yu, Shiyao Zhou, Xian Zhan, Xiapu Luo, Yepang Liu","cross_cats":["cs.CR"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-01-29T04:04:13Z","title":"Demystifying Privacy Policy of Third-Party Libraries in Mobile Apps"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2301.12348","kind":"arxiv","version":9},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:b2c4a9e1e93499740869b32c4f24feddb94f8ac3442757d1854d6456f0b3b502","target":"record","created_at":"2026-07-05T06:49:01Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"4b2914f4143ba1395148910148dbc72068c62e37ac58c93bf976c3080e6d49ff","cross_cats_sorted":["cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-01-29T04:04:13Z","title_canon_sha256":"853c4e6716840cc6d8c2f471272b33c9b9b82e41ca885efd2574137877886c51"},"schema_version":"1.0","source":{"id":"2301.12348","kind":"arxiv","version":9}},"canonical_sha256":"9a8c3fefc33657a0debb108bd883e99ba2374b3ebcbc73fa252b33dc3e1cb7ae","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"9a8c3fefc33657a0debb108bd883e99ba2374b3ebcbc73fa252b33dc3e1cb7ae","first_computed_at":"2026-07-05T06:49:01.812665Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T06:49:01.812665Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"oKx5glxklTBufFNaD/DHIlNNdxXBJpgLForjIXjMByhdOBGRtgsV65sF/VWdhNqVDVCV3EFQHXsDRLMy42RZAg==","signature_status":"signed_v1","signed_at":"2026-07-05T06:49:01.813275Z","signed_message":"canonical_sha256_bytes"},"source_id":"2301.12348","source_kind":"arxiv","source_version":9}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:b2c4a9e1e93499740869b32c4f24feddb94f8ac3442757d1854d6456f0b3b502","sha256:9541feda2dbe950b63c5025d203874266d84a1c9e02cc600c7d41d5c2e0b9b63"],"state_sha256":"f8e8dc0489e13dfa071c22a224856867dd8c9463946dd285bea750ebee0beaa8"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"V9hQQ8Vhr4P28151wFMM9ZU6k1SnvYOI+2htSSD9kmTh2yq0PB5lcRgsrabLcXpK/AnLKSlsIDx/vmTu8WkKAg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-10T10:09:08.976861Z","bundle_sha256":"69d960667045439050075dc12e8ce733f6771c4b39f1d417685e381d07884972"}}