{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:UJBY63D5XE5XSTSTPWD24F5REZ","short_pith_number":"pith:UJBY63D5","canonical_record":{"source":{"id":"2606.11175","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2026-06-09T17:51:26Z","cross_cats_sorted":[],"title_canon_sha256":"a204500a88768bcbe9163dcd7b8d9bfbeab041def1a6999a9be533829245419c","abstract_canon_sha256":"4c22896f7ba1fe856c29bcbc754929db241f3d14bed6a65c309e2918a09b4d53"},"schema_version":"1.0"},"canonical_sha256":"a2438f6c7db93b794e537d87ae17b126701889010d0b33bbe53af49138b28a78","source":{"kind":"arxiv","id":"2606.11175","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.11175","created_at":"2026-06-10T01:11:15Z"},{"alias_kind":"arxiv_version","alias_value":"2606.11175v1","created_at":"2026-06-10T01:11:15Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.11175","created_at":"2026-06-10T01:11:15Z"},{"alias_kind":"pith_short_12","alias_value":"UJBY63D5XE5X","created_at":"2026-06-10T01:11:15Z"},{"alias_kind":"pith_short_16","alias_value":"UJBY63D5XE5XSTST","created_at":"2026-06-10T01:11:15Z"},{"alias_kind":"pith_short_8","alias_value":"UJBY63D5","created_at":"2026-06-10T01:11:15Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:UJBY63D5XE5XSTSTPWD24F5REZ","target":"record","payload":{"canonical_record":{"source":{"id":"2606.11175","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2026-06-09T17:51:26Z","cross_cats_sorted":[],"title_canon_sha256":"a204500a88768bcbe9163dcd7b8d9bfbeab041def1a6999a9be533829245419c","abstract_canon_sha256":"4c22896f7ba1fe856c29bcbc754929db241f3d14bed6a65c309e2918a09b4d53"},"schema_version":"1.0"},"canonical_sha256":"a2438f6c7db93b794e537d87ae17b126701889010d0b33bbe53af49138b28a78","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-06-10T01:11:15.322729Z","signature_b64":"X14OyyDwA0f1EuSQICPOBvr5TtJGgyA5tXzh4xa3Kj3pUoG4SlyLZZZjkVjXq7s5OPkoG92cUzKYwFsDRgjTDA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"a2438f6c7db93b794e537d87ae17b126701889010d0b33bbe53af49138b28a78","last_reissued_at":"2026-06-10T01:11:15.321938Z","signature_status":"signed_v1","first_computed_at":"2026-06-10T01:11:15.321938Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2606.11175","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-10T01:11:15Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"zeJn8iR8A97+dIIVLDmm1A5Mt6QZKtbGpJRfh4/l+WO2VZ0K2IuDFlqp8ReaLp/2Ug1qLYjOiCujE9V/rZirCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-24T23:11:51.760725Z"},"content_sha256":"ec16da4db072880e56390ddb16e8fbec98d474a7d64108789c78f7741f51b724","schema_version":"1.0","event_id":"sha256:ec16da4db072880e56390ddb16e8fbec98d474a7d64108789c78f7741f51b724"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:UJBY63D5XE5XSTSTPWD24F5REZ","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Anchors that Don't Lift: Understanding Supply Chain Driven Kernel Lock-In and Governance-Mediated Mitigation Strategies in SOHO Devices","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Ashita Gupta, Chester Rebeiro, Mainack Mondal, Rajdeep Ghosh, Ritwik Badola","submitted_at":"2026-06-09T17:51:26Z","abstract_excerpt":"Small Office/Home Office (SOHO) devices are widely popular, yet often attacked due to security vulnerabilities in their firmware, affecting thousands of devices. These security vulnerabilities often stem from outdated Linux kernel versions included in SOHO device firmware. Naturally, prior work audited the extent and impact of this issue by simple Linux version extraction and version number based vulnerability mapping. However, it is unclear how many of these anticipated vulnerabilities actually exist in the heavily customized SOHO kernels and if there are any barriers towards updating Linux k"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.11175","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2606.11175/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-10T01:11:15Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ZLsOtorm8ZOkuk/d+3IVhdpCrYojCU0U5KqDf1qQNkU+7Hpgajez0HRF04f3oS8gWqLvXk9+vT78ZG+N3xG1Aw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-24T23:11:51.761104Z"},"content_sha256":"1c37c570df3d64f50b18b823fcff9bd65b1c00ec7887770ad39dccaf0a9d9478","schema_version":"1.0","event_id":"sha256:1c37c570df3d64f50b18b823fcff9bd65b1c00ec7887770ad39dccaf0a9d9478"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/UJBY63D5XE5XSTSTPWD24F5REZ/bundle.json","state_url":"https://pith.science/pith/UJBY63D5XE5XSTSTPWD24F5REZ/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/UJBY63D5XE5XSTSTPWD24F5REZ/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-24T23:11:51Z","links":{"resolver":"https://pith.science/pith/UJBY63D5XE5XSTSTPWD24F5REZ","bundle":"https://pith.science/pith/UJBY63D5XE5XSTSTPWD24F5REZ/bundle.json","state":"https://pith.science/pith/UJBY63D5XE5XSTSTPWD24F5REZ/state.json","well_known_bundle":"https://pith.science/.well-known/pith/UJBY63D5XE5XSTSTPWD24F5REZ/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:UJBY63D5XE5XSTSTPWD24F5REZ","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"4c22896f7ba1fe856c29bcbc754929db241f3d14bed6a65c309e2918a09b4d53","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2026-06-09T17:51:26Z","title_canon_sha256":"a204500a88768bcbe9163dcd7b8d9bfbeab041def1a6999a9be533829245419c"},"schema_version":"1.0","source":{"id":"2606.11175","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.11175","created_at":"2026-06-10T01:11:15Z"},{"alias_kind":"arxiv_version","alias_value":"2606.11175v1","created_at":"2026-06-10T01:11:15Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.11175","created_at":"2026-06-10T01:11:15Z"},{"alias_kind":"pith_short_12","alias_value":"UJBY63D5XE5X","created_at":"2026-06-10T01:11:15Z"},{"alias_kind":"pith_short_16","alias_value":"UJBY63D5XE5XSTST","created_at":"2026-06-10T01:11:15Z"},{"alias_kind":"pith_short_8","alias_value":"UJBY63D5","created_at":"2026-06-10T01:11:15Z"}],"graph_snapshots":[{"event_id":"sha256:1c37c570df3d64f50b18b823fcff9bd65b1c00ec7887770ad39dccaf0a9d9478","target":"graph","created_at":"2026-06-10T01:11:15Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2606.11175/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Small Office/Home Office (SOHO) devices are widely popular, yet often attacked due to security vulnerabilities in their firmware, affecting thousands of devices. These security vulnerabilities often stem from outdated Linux kernel versions included in SOHO device firmware. Naturally, prior work audited the extent and impact of this issue by simple Linux version extraction and version number based vulnerability mapping. However, it is unclear how many of these anticipated vulnerabilities actually exist in the heavily customized SOHO kernels and if there are any barriers towards updating Linux k","authors_text":"Ashita Gupta, Chester Rebeiro, Mainack Mondal, Rajdeep Ghosh, Ritwik Badola","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2026-06-09T17:51:26Z","title":"Anchors that Don't Lift: Understanding Supply Chain Driven Kernel Lock-In and Governance-Mediated Mitigation Strategies in SOHO Devices"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.11175","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:ec16da4db072880e56390ddb16e8fbec98d474a7d64108789c78f7741f51b724","target":"record","created_at":"2026-06-10T01:11:15Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"4c22896f7ba1fe856c29bcbc754929db241f3d14bed6a65c309e2918a09b4d53","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2026-06-09T17:51:26Z","title_canon_sha256":"a204500a88768bcbe9163dcd7b8d9bfbeab041def1a6999a9be533829245419c"},"schema_version":"1.0","source":{"id":"2606.11175","kind":"arxiv","version":1}},"canonical_sha256":"a2438f6c7db93b794e537d87ae17b126701889010d0b33bbe53af49138b28a78","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"a2438f6c7db93b794e537d87ae17b126701889010d0b33bbe53af49138b28a78","first_computed_at":"2026-06-10T01:11:15.321938Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-06-10T01:11:15.321938Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"X14OyyDwA0f1EuSQICPOBvr5TtJGgyA5tXzh4xa3Kj3pUoG4SlyLZZZjkVjXq7s5OPkoG92cUzKYwFsDRgjTDA==","signature_status":"signed_v1","signed_at":"2026-06-10T01:11:15.322729Z","signed_message":"canonical_sha256_bytes"},"source_id":"2606.11175","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:ec16da4db072880e56390ddb16e8fbec98d474a7d64108789c78f7741f51b724","sha256:1c37c570df3d64f50b18b823fcff9bd65b1c00ec7887770ad39dccaf0a9d9478"],"state_sha256":"d9c3679a20c4a55fcab92676cba0b3d780d8300732d46188a6ccaa30f5c2fc2f"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"TRuK6DiWoFFFYdbKCBvR3CizedzQVOeZIzK+4ULBB9SthGGrT2tM3fgB8W6g0AHHU6GFbadc1B664FgZ1jH/Dw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-24T23:11:51.763202Z","bundle_sha256":"f505dee550d98ff6adbf1739b9fec6089a67ff4b718a024ff276d3a1589a9651"}}