{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:WUXJDILFHV5DFRSWAKDROFHLVL","short_pith_number":"pith:WUXJDILF","canonical_record":{"source":{"id":"2408.07321","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2024-08-14T06:43:06Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"e50647bae5034e272a319a54e409fbc0aa82593b14f3152dba834a4d0158265a","abstract_canon_sha256":"11be17fe72d6cb87549a6fc32965b1d1476301989dcd36953957d0ffbc162eec"},"schema_version":"1.0"},"canonical_sha256":"b52e91a1653d7a32c65602871714ebaae1e568bcb0fcb2117625abb388377f0f","source":{"kind":"arxiv","id":"2408.07321","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2408.07321","created_at":"2026-07-05T11:53:41Z"},{"alias_kind":"arxiv_version","alias_value":"2408.07321v2","created_at":"2026-07-05T11:53:41Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2408.07321","created_at":"2026-07-05T11:53:41Z"},{"alias_kind":"pith_short_12","alias_value":"WUXJDILFHV5D","created_at":"2026-07-05T11:53:41Z"},{"alias_kind":"pith_short_16","alias_value":"WUXJDILFHV5DFRSW","created_at":"2026-07-05T11:53:41Z"},{"alias_kind":"pith_short_8","alias_value":"WUXJDILF","created_at":"2026-07-05T11:53:41Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:WUXJDILFHV5DFRSWAKDROFHLVL","target":"record","payload":{"canonical_record":{"source":{"id":"2408.07321","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2024-08-14T06:43:06Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"e50647bae5034e272a319a54e409fbc0aa82593b14f3152dba834a4d0158265a","abstract_canon_sha256":"11be17fe72d6cb87549a6fc32965b1d1476301989dcd36953957d0ffbc162eec"},"schema_version":"1.0"},"canonical_sha256":"b52e91a1653d7a32c65602871714ebaae1e568bcb0fcb2117625abb388377f0f","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:53:41.429744Z","signature_b64":"3opIp8lasgToN9k8wxuutFLCr7t4nh89/pXxX9ZNbXiR4crBZ03GANzYrqTwURxBzLsaJcodrz9m5J/9eJuiCA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"b52e91a1653d7a32c65602871714ebaae1e568bcb0fcb2117625abb388377f0f","last_reissued_at":"2026-07-05T11:53:41.429244Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:53:41.429244Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2408.07321","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:53:41Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"KJQRK58968QnZdnsB8u9kMyFFJ8yCQYgIffMOYvFRPSHfGnyPiiSZZWigdPvex6FwN0OUHI7OlR4IVJgYYrSAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-06T17:09:57.983388Z"},"content_sha256":"9b00122d03f09239c2057251664583db3bdd68a0f856c868ba91ef6be4ee8984","schema_version":"1.0","event_id":"sha256:9b00122d03f09239c2057251664583db3bdd68a0f856c868ba91ef6be4ee8984"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:WUXJDILFHV5DFRSWAKDROFHLVL","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"VERCATION: Precise Vulnerable Open-source Software Version Identification based on Static Analysis and LLM","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.SE","authors_text":"Chaopeng Dong, David Lo, Limin Sun, Lwin Khin Shar, Shichao Lv, Shouguo Yang, Ting Zhang, Yiran Cheng, Zhiqiang Shi","submitted_at":"2024-08-14T06:43:06Z","abstract_excerpt":"Open-source software (OSS) has experienced a surge in popularity, attributed to its collaborative development model and cost-effective nature. However, the adoption of specific software versions in development projects may introduce security risks when these versions bring along vulnerabilities. Current methods of identifying vulnerable versions typically analyze and extract the code features involved in vulnerability patches using static analysis with pre-defined rules. They then use code clone detection to identify the vulnerable versions. These methods are hindered by imprecision due to (1)"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2408.07321","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2408.07321/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:53:41Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"n0Db4fJeOxBS1j7ZUGFyyyDAZfUUZu5XpK1Nd/jEw8aM36mpMZ9qu2kNjHU9gv0OGLMyTIEcXt8Ag4M292mTBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-06T17:09:57.983761Z"},"content_sha256":"665fef24201ca2614ced008e258de97c9b22e3bb24807a473379f8c1f9d1c912","schema_version":"1.0","event_id":"sha256:665fef24201ca2614ced008e258de97c9b22e3bb24807a473379f8c1f9d1c912"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/WUXJDILFHV5DFRSWAKDROFHLVL/bundle.json","state_url":"https://pith.science/pith/WUXJDILFHV5DFRSWAKDROFHLVL/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/WUXJDILFHV5DFRSWAKDROFHLVL/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-06T17:09:57Z","links":{"resolver":"https://pith.science/pith/WUXJDILFHV5DFRSWAKDROFHLVL","bundle":"https://pith.science/pith/WUXJDILFHV5DFRSWAKDROFHLVL/bundle.json","state":"https://pith.science/pith/WUXJDILFHV5DFRSWAKDROFHLVL/state.json","well_known_bundle":"https://pith.science/.well-known/pith/WUXJDILFHV5DFRSWAKDROFHLVL/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:WUXJDILFHV5DFRSWAKDROFHLVL","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"11be17fe72d6cb87549a6fc32965b1d1476301989dcd36953957d0ffbc162eec","cross_cats_sorted":["cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2024-08-14T06:43:06Z","title_canon_sha256":"e50647bae5034e272a319a54e409fbc0aa82593b14f3152dba834a4d0158265a"},"schema_version":"1.0","source":{"id":"2408.07321","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2408.07321","created_at":"2026-07-05T11:53:41Z"},{"alias_kind":"arxiv_version","alias_value":"2408.07321v2","created_at":"2026-07-05T11:53:41Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2408.07321","created_at":"2026-07-05T11:53:41Z"},{"alias_kind":"pith_short_12","alias_value":"WUXJDILFHV5D","created_at":"2026-07-05T11:53:41Z"},{"alias_kind":"pith_short_16","alias_value":"WUXJDILFHV5DFRSW","created_at":"2026-07-05T11:53:41Z"},{"alias_kind":"pith_short_8","alias_value":"WUXJDILF","created_at":"2026-07-05T11:53:41Z"}],"graph_snapshots":[{"event_id":"sha256:665fef24201ca2614ced008e258de97c9b22e3bb24807a473379f8c1f9d1c912","target":"graph","created_at":"2026-07-05T11:53:41Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2408.07321/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Open-source software (OSS) has experienced a surge in popularity, attributed to its collaborative development model and cost-effective nature. However, the adoption of specific software versions in development projects may introduce security risks when these versions bring along vulnerabilities. Current methods of identifying vulnerable versions typically analyze and extract the code features involved in vulnerability patches using static analysis with pre-defined rules. They then use code clone detection to identify the vulnerable versions. These methods are hindered by imprecision due to (1)","authors_text":"Chaopeng Dong, David Lo, Limin Sun, Lwin Khin Shar, Shichao Lv, Shouguo Yang, Ting Zhang, Yiran Cheng, Zhiqiang Shi","cross_cats":["cs.CR"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2024-08-14T06:43:06Z","title":"VERCATION: Precise Vulnerable Open-source Software Version Identification based on Static Analysis and LLM"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2408.07321","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:9b00122d03f09239c2057251664583db3bdd68a0f856c868ba91ef6be4ee8984","target":"record","created_at":"2026-07-05T11:53:41Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"11be17fe72d6cb87549a6fc32965b1d1476301989dcd36953957d0ffbc162eec","cross_cats_sorted":["cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2024-08-14T06:43:06Z","title_canon_sha256":"e50647bae5034e272a319a54e409fbc0aa82593b14f3152dba834a4d0158265a"},"schema_version":"1.0","source":{"id":"2408.07321","kind":"arxiv","version":2}},"canonical_sha256":"b52e91a1653d7a32c65602871714ebaae1e568bcb0fcb2117625abb388377f0f","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"b52e91a1653d7a32c65602871714ebaae1e568bcb0fcb2117625abb388377f0f","first_computed_at":"2026-07-05T11:53:41.429244Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:53:41.429244Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"3opIp8lasgToN9k8wxuutFLCr7t4nh89/pXxX9ZNbXiR4crBZ03GANzYrqTwURxBzLsaJcodrz9m5J/9eJuiCA==","signature_status":"signed_v1","signed_at":"2026-07-05T11:53:41.429744Z","signed_message":"canonical_sha256_bytes"},"source_id":"2408.07321","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:9b00122d03f09239c2057251664583db3bdd68a0f856c868ba91ef6be4ee8984","sha256:665fef24201ca2614ced008e258de97c9b22e3bb24807a473379f8c1f9d1c912"],"state_sha256":"2c2936eb8d27584e9b66d2583ee08c2dabe09a7f526c1d95bb8dbb986594c089"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"0XZ2o1RC2PJS/GuEuy2HGVqF+QVxfbtCt/JiJdShljZSu14xIlJKDi96S5FSxWt/+LFS9DhQF+R8H9Zl7B7hCw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-06T17:09:57.985788Z","bundle_sha256":"0c761ce4fb3e34838c0a925fa0e9ed9330a033d0226c0f5b1bc65112531ae365"}}