{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2023:USAZ334CQXURS4G3E54UG2JNMP","short_pith_number":"pith:USAZ334C","canonical_record":{"source":{"id":"2310.06300","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2023-10-10T04:25:30Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"e2fcb6b4d2bdfce300e776a28fa049f3bba59a71028e4fa3b172435cb22c5e74","abstract_canon_sha256":"b0c3b28852243c4f25481cba286bee84b2e96b1a57e4df31ea664479887c4ad5"},"schema_version":"1.0"},"canonical_sha256":"a4819def8285e91970db277943692d63fdd809e5cfd8b5507cff390f0df805da","source":{"kind":"arxiv","id":"2310.06300","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2310.06300","created_at":"2026-07-05T08:28:57Z"},{"alias_kind":"arxiv_version","alias_value":"2310.06300v2","created_at":"2026-07-05T08:28:57Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2310.06300","created_at":"2026-07-05T08:28:57Z"},{"alias_kind":"pith_short_12","alias_value":"USAZ334CQXUR","created_at":"2026-07-05T08:28:57Z"},{"alias_kind":"pith_short_16","alias_value":"USAZ334CQXURS4G3","created_at":"2026-07-05T08:28:57Z"},{"alias_kind":"pith_short_8","alias_value":"USAZ334C","created_at":"2026-07-05T08:28:57Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2023:USAZ334CQXURS4G3E54UG2JNMP","target":"record","payload":{"canonical_record":{"source":{"id":"2310.06300","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2023-10-10T04:25:30Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"e2fcb6b4d2bdfce300e776a28fa049f3bba59a71028e4fa3b172435cb22c5e74","abstract_canon_sha256":"b0c3b28852243c4f25481cba286bee84b2e96b1a57e4df31ea664479887c4ad5"},"schema_version":"1.0"},"canonical_sha256":"a4819def8285e91970db277943692d63fdd809e5cfd8b5507cff390f0df805da","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T08:28:57.369050Z","signature_b64":"7DcWBQUeKmB7PVbcOuKCflr/ZBMNKLM+8E2NO507YWyDiao80sPZ04kuPpk9pC40v9TWnNJM8e6OcTFVjLwZCA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"a4819def8285e91970db277943692d63fdd809e5cfd8b5507cff390f0df805da","last_reissued_at":"2026-07-05T08:28:57.368541Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T08:28:57.368541Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2310.06300","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:28:57Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"NlIpI+dM2rTMoOxyN9/8ZWCN/WijvxjeT53BH5r8OGuDBVT56se4wQgJJRExIKfdaQfvDYd3GeAAPv7e+C2rAg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T01:10:27.871287Z"},"content_sha256":"c914a06301b9367cbda35110f76151934214e70e294ba029ad2146076a478745","schema_version":"1.0","event_id":"sha256:c914a06301b9367cbda35110f76151934214e70e294ba029ad2146076a478745"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2023:USAZ334CQXURS4G3E54UG2JNMP","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"An Empirically Grounded Reference Architecture for Software Supply Chain Metadata Management","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"M. Ali Babar, Nguyen Khoi Tran, Samodha Pallewatta","submitted_at":"2023-10-10T04:25:30Z","abstract_excerpt":"With the rapid rise in Software Supply Chain (SSC) attacks, organisations need thorough and trustworthy visibility over the entire SSC of their software inventory to detect risks early and identify compromised assets rapidly in the event of an SSC attack. One way to achieve such visibility is through SSC metadata, machine-readable and authenticated documents describing an artefact's lifecycle. Adopting SSC metadata requires organisations to procure or develop a Software Supply Chain Metadata Management system (SCM2), a suite of software tools for performing life cycle activities of SSC metadat"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2310.06300","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2310.06300/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:28:57Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Cf+DQReKJyY5OeLKLOxO5zC/V5Xk0jKBvPqTE9YftXxHEtkylCCgAjpbC0uhYweFWCasENiaUbNU60GXJFFDDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T01:10:27.872206Z"},"content_sha256":"71de7370821471c05f8bc6565a59fcd187c0f2aebad8c47434155d0c31e17a8b","schema_version":"1.0","event_id":"sha256:71de7370821471c05f8bc6565a59fcd187c0f2aebad8c47434155d0c31e17a8b"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/USAZ334CQXURS4G3E54UG2JNMP/bundle.json","state_url":"https://pith.science/pith/USAZ334CQXURS4G3E54UG2JNMP/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/USAZ334CQXURS4G3E54UG2JNMP/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-06T01:10:27Z","links":{"resolver":"https://pith.science/pith/USAZ334CQXURS4G3E54UG2JNMP","bundle":"https://pith.science/pith/USAZ334CQXURS4G3E54UG2JNMP/bundle.json","state":"https://pith.science/pith/USAZ334CQXURS4G3E54UG2JNMP/state.json","well_known_bundle":"https://pith.science/.well-known/pith/USAZ334CQXURS4G3E54UG2JNMP/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2023:USAZ334CQXURS4G3E54UG2JNMP","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"b0c3b28852243c4f25481cba286bee84b2e96b1a57e4df31ea664479887c4ad5","cross_cats_sorted":["cs.SE"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2023-10-10T04:25:30Z","title_canon_sha256":"e2fcb6b4d2bdfce300e776a28fa049f3bba59a71028e4fa3b172435cb22c5e74"},"schema_version":"1.0","source":{"id":"2310.06300","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2310.06300","created_at":"2026-07-05T08:28:57Z"},{"alias_kind":"arxiv_version","alias_value":"2310.06300v2","created_at":"2026-07-05T08:28:57Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2310.06300","created_at":"2026-07-05T08:28:57Z"},{"alias_kind":"pith_short_12","alias_value":"USAZ334CQXUR","created_at":"2026-07-05T08:28:57Z"},{"alias_kind":"pith_short_16","alias_value":"USAZ334CQXURS4G3","created_at":"2026-07-05T08:28:57Z"},{"alias_kind":"pith_short_8","alias_value":"USAZ334C","created_at":"2026-07-05T08:28:57Z"}],"graph_snapshots":[{"event_id":"sha256:71de7370821471c05f8bc6565a59fcd187c0f2aebad8c47434155d0c31e17a8b","target":"graph","created_at":"2026-07-05T08:28:57Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2310.06300/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"With the rapid rise in Software Supply Chain (SSC) attacks, organisations need thorough and trustworthy visibility over the entire SSC of their software inventory to detect risks early and identify compromised assets rapidly in the event of an SSC attack. One way to achieve such visibility is through SSC metadata, machine-readable and authenticated documents describing an artefact's lifecycle. Adopting SSC metadata requires organisations to procure or develop a Software Supply Chain Metadata Management system (SCM2), a suite of software tools for performing life cycle activities of SSC metadat","authors_text":"M. Ali Babar, Nguyen Khoi Tran, Samodha Pallewatta","cross_cats":["cs.SE"],"headline":"","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2023-10-10T04:25:30Z","title":"An Empirically Grounded Reference Architecture for Software Supply Chain Metadata Management"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2310.06300","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:c914a06301b9367cbda35110f76151934214e70e294ba029ad2146076a478745","target":"record","created_at":"2026-07-05T08:28:57Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"b0c3b28852243c4f25481cba286bee84b2e96b1a57e4df31ea664479887c4ad5","cross_cats_sorted":["cs.SE"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2023-10-10T04:25:30Z","title_canon_sha256":"e2fcb6b4d2bdfce300e776a28fa049f3bba59a71028e4fa3b172435cb22c5e74"},"schema_version":"1.0","source":{"id":"2310.06300","kind":"arxiv","version":2}},"canonical_sha256":"a4819def8285e91970db277943692d63fdd809e5cfd8b5507cff390f0df805da","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"a4819def8285e91970db277943692d63fdd809e5cfd8b5507cff390f0df805da","first_computed_at":"2026-07-05T08:28:57.368541Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T08:28:57.368541Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"7DcWBQUeKmB7PVbcOuKCflr/ZBMNKLM+8E2NO507YWyDiao80sPZ04kuPpk9pC40v9TWnNJM8e6OcTFVjLwZCA==","signature_status":"signed_v1","signed_at":"2026-07-05T08:28:57.369050Z","signed_message":"canonical_sha256_bytes"},"source_id":"2310.06300","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:c914a06301b9367cbda35110f76151934214e70e294ba029ad2146076a478745","sha256:71de7370821471c05f8bc6565a59fcd187c0f2aebad8c47434155d0c31e17a8b"],"state_sha256":"3bdadafb73bf7045ae275e9d736411772cbe72e5948f05a750c016aa72d350ae"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"6Fubr9cyQV8YxFs6evn19WLCo4XLUeaSgB1p4xXootDs+TgBqchwbhhgLISi1e9gIIYrST42CZsldPcA05lgCw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-06T01:10:27.879402Z","bundle_sha256":"2b19efd444144e917adbcf71f2a0014a9a2d19a22508d571ad1716ef4c1e9ab5"}}