{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:VG5F6HA3BAYHXYBEF6OO36ACEB","short_pith_number":"pith:VG5F6HA3","canonical_record":{"source":{"id":"2412.00898","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2024-12-01T17:17:29Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"aa803ced039402967d708684b64e26618d6f76118ee466142b35ddee2ead639f","abstract_canon_sha256":"8eec134b43fa1e60e4dd4b2e75fbb4c6ad106c198eaa69ef6a49ecff06a069b0"},"schema_version":"1.0"},"canonical_sha256":"a9ba5f1c1b08307be0242f9cedf8022077fe01595a0e153560c448abe7e6b58d","source":{"kind":"arxiv","id":"2412.00898","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2412.00898","created_at":"2026-07-05T09:42:50Z"},{"alias_kind":"arxiv_version","alias_value":"2412.00898v1","created_at":"2026-07-05T09:42:50Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2412.00898","created_at":"2026-07-05T09:42:50Z"},{"alias_kind":"pith_short_12","alias_value":"VG5F6HA3BAYH","created_at":"2026-07-05T09:42:50Z"},{"alias_kind":"pith_short_16","alias_value":"VG5F6HA3BAYHXYBE","created_at":"2026-07-05T09:42:50Z"},{"alias_kind":"pith_short_8","alias_value":"VG5F6HA3","created_at":"2026-07-05T09:42:50Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:VG5F6HA3BAYHXYBEF6OO36ACEB","target":"record","payload":{"canonical_record":{"source":{"id":"2412.00898","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2024-12-01T17:17:29Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"aa803ced039402967d708684b64e26618d6f76118ee466142b35ddee2ead639f","abstract_canon_sha256":"8eec134b43fa1e60e4dd4b2e75fbb4c6ad106c198eaa69ef6a49ecff06a069b0"},"schema_version":"1.0"},"canonical_sha256":"a9ba5f1c1b08307be0242f9cedf8022077fe01595a0e153560c448abe7e6b58d","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T09:42:50.186623Z","signature_b64":"UCPvo3hn8yxqDk74yWXL/7m/anfYl+Th2IJTU4YRi+sjnZWg1UM/vM7eztaspf4vn4ZMdVANewcQAN3QuwAWCw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"a9ba5f1c1b08307be0242f9cedf8022077fe01595a0e153560c448abe7e6b58d","last_reissued_at":"2026-07-05T09:42:50.186084Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T09:42:50.186084Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2412.00898","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T09:42:50Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"jWZuY9FE/WwmXIypf5/1oNlZxIvJtbqF8YPTEzQTymj8VN+uakoZOOjiueiUWKpjwVXoEFx+y/2oEjKj/02TBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-14T01:41:37.599946Z"},"content_sha256":"c41c84a7905f426f9ff0b3a344cdc2fcb76588b186667521de811fe6ca4fcebf","schema_version":"1.0","event_id":"sha256:c41c84a7905f426f9ff0b3a344cdc2fcb76588b186667521de811fe6ca4fcebf"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:VG5F6HA3BAYHXYBEF6OO36ACEB","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Preserving Privacy in Software Composition Analysis: A Study of Technical Solutions and Enhancements","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.SE","authors_text":"Huaijin Wang, Qiyi Tang, Sen Nie, Shi Wu, Shuai Wang, Yanbo Dai, Zhibo Liu","submitted_at":"2024-12-01T17:17:29Z","abstract_excerpt":"Software composition analysis (SCA) denotes the process of identifying open-source software components in an input software application. SCA has been extensively developed and adopted by academia and industry. However, we notice that the modern SCA techniques in industry scenarios still need to be improved due to privacy concerns. Overall, SCA requires the users to upload their applications' source code to a remote SCA server, which then inspects the applications and reports the component usage to users. This process is privacy-sensitive since the applications may contain sensitive information"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2412.00898","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2412.00898/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T09:42:50Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"LzB2fR0PsYpyE7VrRwM7odn7U8Psqt7snOGckCBwn3N9P0aODiXjGZNslZWkwQgByTFDNqIzD9Uc2q/rxZhOBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-14T01:41:37.600900Z"},"content_sha256":"744f80b1ca6c231fbc2c01858344bb311cbb420eb842adcba26d3d42403a423d","schema_version":"1.0","event_id":"sha256:744f80b1ca6c231fbc2c01858344bb311cbb420eb842adcba26d3d42403a423d"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/VG5F6HA3BAYHXYBEF6OO36ACEB/bundle.json","state_url":"https://pith.science/pith/VG5F6HA3BAYHXYBEF6OO36ACEB/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/VG5F6HA3BAYHXYBEF6OO36ACEB/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-14T01:41:37Z","links":{"resolver":"https://pith.science/pith/VG5F6HA3BAYHXYBEF6OO36ACEB","bundle":"https://pith.science/pith/VG5F6HA3BAYHXYBEF6OO36ACEB/bundle.json","state":"https://pith.science/pith/VG5F6HA3BAYHXYBEF6OO36ACEB/state.json","well_known_bundle":"https://pith.science/.well-known/pith/VG5F6HA3BAYHXYBEF6OO36ACEB/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:VG5F6HA3BAYHXYBEF6OO36ACEB","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"8eec134b43fa1e60e4dd4b2e75fbb4c6ad106c198eaa69ef6a49ecff06a069b0","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2024-12-01T17:17:29Z","title_canon_sha256":"aa803ced039402967d708684b64e26618d6f76118ee466142b35ddee2ead639f"},"schema_version":"1.0","source":{"id":"2412.00898","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2412.00898","created_at":"2026-07-05T09:42:50Z"},{"alias_kind":"arxiv_version","alias_value":"2412.00898v1","created_at":"2026-07-05T09:42:50Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2412.00898","created_at":"2026-07-05T09:42:50Z"},{"alias_kind":"pith_short_12","alias_value":"VG5F6HA3BAYH","created_at":"2026-07-05T09:42:50Z"},{"alias_kind":"pith_short_16","alias_value":"VG5F6HA3BAYHXYBE","created_at":"2026-07-05T09:42:50Z"},{"alias_kind":"pith_short_8","alias_value":"VG5F6HA3","created_at":"2026-07-05T09:42:50Z"}],"graph_snapshots":[{"event_id":"sha256:744f80b1ca6c231fbc2c01858344bb311cbb420eb842adcba26d3d42403a423d","target":"graph","created_at":"2026-07-05T09:42:50Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2412.00898/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Software composition analysis (SCA) denotes the process of identifying open-source software components in an input software application. SCA has been extensively developed and adopted by academia and industry. However, we notice that the modern SCA techniques in industry scenarios still need to be improved due to privacy concerns. Overall, SCA requires the users to upload their applications' source code to a remote SCA server, which then inspects the applications and reports the component usage to users. This process is privacy-sensitive since the applications may contain sensitive information","authors_text":"Huaijin Wang, Qiyi Tang, Sen Nie, Shi Wu, Shuai Wang, Yanbo Dai, Zhibo Liu","cross_cats":["cs.CR"],"headline":"","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2024-12-01T17:17:29Z","title":"Preserving Privacy in Software Composition Analysis: A Study of Technical Solutions and Enhancements"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2412.00898","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:c41c84a7905f426f9ff0b3a344cdc2fcb76588b186667521de811fe6ca4fcebf","target":"record","created_at":"2026-07-05T09:42:50Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"8eec134b43fa1e60e4dd4b2e75fbb4c6ad106c198eaa69ef6a49ecff06a069b0","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2024-12-01T17:17:29Z","title_canon_sha256":"aa803ced039402967d708684b64e26618d6f76118ee466142b35ddee2ead639f"},"schema_version":"1.0","source":{"id":"2412.00898","kind":"arxiv","version":1}},"canonical_sha256":"a9ba5f1c1b08307be0242f9cedf8022077fe01595a0e153560c448abe7e6b58d","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"a9ba5f1c1b08307be0242f9cedf8022077fe01595a0e153560c448abe7e6b58d","first_computed_at":"2026-07-05T09:42:50.186084Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T09:42:50.186084Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"UCPvo3hn8yxqDk74yWXL/7m/anfYl+Th2IJTU4YRi+sjnZWg1UM/vM7eztaspf4vn4ZMdVANewcQAN3QuwAWCw==","signature_status":"signed_v1","signed_at":"2026-07-05T09:42:50.186623Z","signed_message":"canonical_sha256_bytes"},"source_id":"2412.00898","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:c41c84a7905f426f9ff0b3a344cdc2fcb76588b186667521de811fe6ca4fcebf","sha256:744f80b1ca6c231fbc2c01858344bb311cbb420eb842adcba26d3d42403a423d"],"state_sha256":"ef9108a903da656e1ffc3cceefd852c10e17e949dbde9741c22d45520fb921e8"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"otWRpI2ASub9AYXoXYDpeUYpcoGWSm+Gj9c5k5P5lr1Ku46R0AQkvgWBb2WZ1GFQfCgnY+qPq/aoOu9bpmLLAA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-14T01:41:37.669376Z","bundle_sha256":"e41be51c02f2ab577e3d96cf0850e4ea9bcf24b1ea8fcd7855e2900db46ab744"}}