{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:XJISG5WUTI34FESWNR4NT6VJYC","short_pith_number":"pith:XJISG5WU","canonical_record":{"source":{"id":"2507.20502","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2025-07-28T03:43:29Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"6aa42243bebad40a86d01674718b78ed86d93c75577f3566e4f6015d6e0b4b47","abstract_canon_sha256":"0a957e3cc990e3721f3994f248eaec88a181d43a68797fa907e39dcc60a2b82b"},"schema_version":"1.0"},"canonical_sha256":"ba512376d49a37c292566c78d9faa9c09fdb74f85b161454d4484676351b261f","source":{"kind":"arxiv","id":"2507.20502","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2507.20502","created_at":"2026-07-05T11:44:20Z"},{"alias_kind":"arxiv_version","alias_value":"2507.20502v1","created_at":"2026-07-05T11:44:20Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2507.20502","created_at":"2026-07-05T11:44:20Z"},{"alias_kind":"pith_short_12","alias_value":"XJISG5WUTI34","created_at":"2026-07-05T11:44:20Z"},{"alias_kind":"pith_short_16","alias_value":"XJISG5WUTI34FESW","created_at":"2026-07-05T11:44:20Z"},{"alias_kind":"pith_short_8","alias_value":"XJISG5WU","created_at":"2026-07-05T11:44:20Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:XJISG5WUTI34FESWNR4NT6VJYC","target":"record","payload":{"canonical_record":{"source":{"id":"2507.20502","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2025-07-28T03:43:29Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"6aa42243bebad40a86d01674718b78ed86d93c75577f3566e4f6015d6e0b4b47","abstract_canon_sha256":"0a957e3cc990e3721f3994f248eaec88a181d43a68797fa907e39dcc60a2b82b"},"schema_version":"1.0"},"canonical_sha256":"ba512376d49a37c292566c78d9faa9c09fdb74f85b161454d4484676351b261f","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:44:20.363127Z","signature_b64":"WCHUyHf76qaR4i5prb0WQ/vbdkzSELOTr0JAleYJmyCsjSyk7jddApfBQGCp1InHPVE6TqXlhIIPH5t7d+jjCA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"ba512376d49a37c292566c78d9faa9c09fdb74f85b161454d4484676351b261f","last_reissued_at":"2026-07-05T11:44:20.362680Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:44:20.362680Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2507.20502","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:44:20Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"vIb3+ym0m8RmtVqsCm60EErPsgzxqN7I/SK4obCQvQvIjyBFMq/OiZ+5DTmdHzC3iuP2phSWgfFP4eYRTmVZCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T18:37:58.807504Z"},"content_sha256":"39acd1e12d4260816f4933c4bb18ed112640fbfa15a8c4d9ba0b06404035ebb1","schema_version":"1.0","event_id":"sha256:39acd1e12d4260816f4933c4bb18ed112640fbfa15a8c4d9ba0b06404035ebb1"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:XJISG5WUTI34FESWNR4NT6VJYC","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"VDGraph: A Graph-Theoretic Approach to Unlock Insights from SBOM and SCA Data","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.SE","authors_text":"David Sastre Medina, David Starobinski, Howell Xia, Jonah Gluck, Sevval Simsek","submitted_at":"2025-07-28T03:43:29Z","abstract_excerpt":"The high complexity of modern software supply chains necessitates tools such as Software Bill of Materials (SBOMs) to manage component dependencies, and Software Composition Analysis (SCA) tools to identify vulnerabilities. While there exists limited integration between SBOMs and SCA tools, a unified view of complex dependency-vulnerability relationships remains elusive. In this paper, we introduce VDGraph, a novel knowledge graph-based methodology for integrating vulnerability and dependency data into a holistic view. VDGraph consolidates SBOM and SCA outputs into a graph representation of so"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2507.20502","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2507.20502/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:44:20Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"kju1QuaevcVDcf9twJnxkTxNNGFTj19OZnVY7CgW3b6tmlWNEkktF1VIIlAeb3wSU256Csm8HXH46IZ7wQPdBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T18:37:58.808012Z"},"content_sha256":"b3400c05ce9eae0536d2304b5c2315f1cf8407c4b80fe24b920d248524730851","schema_version":"1.0","event_id":"sha256:b3400c05ce9eae0536d2304b5c2315f1cf8407c4b80fe24b920d248524730851"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/XJISG5WUTI34FESWNR4NT6VJYC/bundle.json","state_url":"https://pith.science/pith/XJISG5WUTI34FESWNR4NT6VJYC/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/XJISG5WUTI34FESWNR4NT6VJYC/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-07T18:37:58Z","links":{"resolver":"https://pith.science/pith/XJISG5WUTI34FESWNR4NT6VJYC","bundle":"https://pith.science/pith/XJISG5WUTI34FESWNR4NT6VJYC/bundle.json","state":"https://pith.science/pith/XJISG5WUTI34FESWNR4NT6VJYC/state.json","well_known_bundle":"https://pith.science/.well-known/pith/XJISG5WUTI34FESWNR4NT6VJYC/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:XJISG5WUTI34FESWNR4NT6VJYC","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"0a957e3cc990e3721f3994f248eaec88a181d43a68797fa907e39dcc60a2b82b","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2025-07-28T03:43:29Z","title_canon_sha256":"6aa42243bebad40a86d01674718b78ed86d93c75577f3566e4f6015d6e0b4b47"},"schema_version":"1.0","source":{"id":"2507.20502","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2507.20502","created_at":"2026-07-05T11:44:20Z"},{"alias_kind":"arxiv_version","alias_value":"2507.20502v1","created_at":"2026-07-05T11:44:20Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2507.20502","created_at":"2026-07-05T11:44:20Z"},{"alias_kind":"pith_short_12","alias_value":"XJISG5WUTI34","created_at":"2026-07-05T11:44:20Z"},{"alias_kind":"pith_short_16","alias_value":"XJISG5WUTI34FESW","created_at":"2026-07-05T11:44:20Z"},{"alias_kind":"pith_short_8","alias_value":"XJISG5WU","created_at":"2026-07-05T11:44:20Z"}],"graph_snapshots":[{"event_id":"sha256:b3400c05ce9eae0536d2304b5c2315f1cf8407c4b80fe24b920d248524730851","target":"graph","created_at":"2026-07-05T11:44:20Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2507.20502/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The high complexity of modern software supply chains necessitates tools such as Software Bill of Materials (SBOMs) to manage component dependencies, and Software Composition Analysis (SCA) tools to identify vulnerabilities. While there exists limited integration between SBOMs and SCA tools, a unified view of complex dependency-vulnerability relationships remains elusive. In this paper, we introduce VDGraph, a novel knowledge graph-based methodology for integrating vulnerability and dependency data into a holistic view. VDGraph consolidates SBOM and SCA outputs into a graph representation of so","authors_text":"David Sastre Medina, David Starobinski, Howell Xia, Jonah Gluck, Sevval Simsek","cross_cats":["cs.CR"],"headline":"","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2025-07-28T03:43:29Z","title":"VDGraph: A Graph-Theoretic Approach to Unlock Insights from SBOM and SCA Data"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2507.20502","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:39acd1e12d4260816f4933c4bb18ed112640fbfa15a8c4d9ba0b06404035ebb1","target":"record","created_at":"2026-07-05T11:44:20Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"0a957e3cc990e3721f3994f248eaec88a181d43a68797fa907e39dcc60a2b82b","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2025-07-28T03:43:29Z","title_canon_sha256":"6aa42243bebad40a86d01674718b78ed86d93c75577f3566e4f6015d6e0b4b47"},"schema_version":"1.0","source":{"id":"2507.20502","kind":"arxiv","version":1}},"canonical_sha256":"ba512376d49a37c292566c78d9faa9c09fdb74f85b161454d4484676351b261f","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"ba512376d49a37c292566c78d9faa9c09fdb74f85b161454d4484676351b261f","first_computed_at":"2026-07-05T11:44:20.362680Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:44:20.362680Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"WCHUyHf76qaR4i5prb0WQ/vbdkzSELOTr0JAleYJmyCsjSyk7jddApfBQGCp1InHPVE6TqXlhIIPH5t7d+jjCA==","signature_status":"signed_v1","signed_at":"2026-07-05T11:44:20.363127Z","signed_message":"canonical_sha256_bytes"},"source_id":"2507.20502","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:39acd1e12d4260816f4933c4bb18ed112640fbfa15a8c4d9ba0b06404035ebb1","sha256:b3400c05ce9eae0536d2304b5c2315f1cf8407c4b80fe24b920d248524730851"],"state_sha256":"f42d4cf265c5d2c3c4f583e2ca04595f951d2eb8fbc697f4c6908f4654c40c4f"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"FiDLkCquTEBWnsblu4ICyw2RjmNbHicZ0BE5X2x4GkMKiktEnFHxEFrJ2MrYMWkLQM29S8Bwk88VGwP1bPOnCg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-07T18:37:58.812153Z","bundle_sha256":"c2a6acba06cfd81b47a29d3111cfc04fd8072d3756760c2f8479f7f12e66c968"}}