{"_canonicalization":{"envelope_id":"axm_ + sha256(envelope minus {signature, axiom_id, anchors})","envelope_signature":"ed25519(envelope minus {signature, axiom_id})","json":"sort_keys=True, separators=(',',':'), ensure_ascii=False, allow_nan=False, utf-8","leaf_hash":"sha256(0x00 || canonical_json(envelope_full))","seal_signature":"ed25519(seal minus {signature, sig_algorithm})"},"axiom_id":"axm_d66bcdece8320b9290093efa6386a4deefd86697c570d0af9d4c1d359eea364a","bitcoin_anchor":{"bitcoin_attestations":["bitcoin_block_949451"],"calendar_attestations":["https://finney.calendar.eternitywall.com","https://btc.calendar.catallaxy.com","https://alice.btc.calendar.opentimestamps.org","https://bob.btc.calendar.opentimestamps.org"],"ots_url":"/registry/data/substrate/anchors/77fc9c28fae777b81da5b495b3115474df6592dfac590333213d3bdf8b94a9b3.ots","stamped_at":"2026-05-15T03:00:03Z","status":"bitcoin"},"envelope":{"anchors":[{"chain":"crovia.axiom_graph","height":0,"merkle_proof":"spider_vendor_press_v1","root_at_anchor":"spider_vendor_press_v1"}],"axiom_id":"axm_d66bcdece8320b9290093efa6386a4deefd86697c570d0af9d4c1d359eea364a","axiom_type":"AX.OBS","body":{"axiom_subtype":"news.vendor_press.v1","category":"news","fingerprint":"9db509259538fdcf838dd36a72a0d8827a37ab09ba5632f541b9cc2f34e38969","published":"Thu, 07 May 2026 00:00:00 -0400","receipt_hash":"9db509259538fdcf838dd36a72a0d8827a37ab09ba5632f541b9cc2f34e38969","schema":"spider.news.vendor_press.v1","spider":"vendor_press","spider_record":{"axiom_subtype":"news.vendor_press.v1","category":"news","decision_hint":"POSITIVE","envelope_target":"AX.OBS","fingerprint":"9db509259538fdcf838dd36a72a0d8827a37ab09ba5632f541b9cc2f34e38969","observed_at":"2026-05-07T04:43:30.601849Z","parent_run_hash":"b20b3beeadde500bb99eda3b869d50b00c5259b2c78c650d83e786ac81b85801","published":"Thu, 07 May 2026 00:00:00 -0400","runtime_version":"0.1.0","schema":"spider.news.vendor_press.v1","source_status":200,"source_url":"https://export.arxiv.org/rss/cs.AI","spider":"vendor_press","summary_excerpt":"arXiv:2605.03309v1 Announce Type: cross \nAbstract: Dependency confusion attacks exploit a structural gap in software distribution: once a package is installed, there is no cryptographic proof of which registry distributed it. Every existing defense is configuration-based and fails silently when misconfigured. We present a cryptographic distribution provenance system comprising three components: (1) cryptographic registry identity, where every registry holds an Ed25519 keypair and signs every artifact it distributes; (2) a dual-signature model, where the publisher signs at packaging time and the registry countersigns at publication time; and (3) authoritative namespace binding, where consumers pin registry fingerprints and the resolver cryptographically rejects artifacts from unauthorized registries. These create three defense layers requiring simultaneous compromise for a successful attack. A comparison across eight ecosystems (npm, Cargo, Hex.pm, PyPI, Go modules, Docker/OCI, NuGet, M","title":"Cryptographic Registry Provenance: Structural Defense Against Dependency Confusion in AI Package Ecosystems","url":"https://arxiv.org/abs/2605.03309","vendor":"arxiv_cs_ai"},"summary":"arXiv:2605.03309v1 Announce Type: cross \nAbstract: Dependency confusion attacks exploit a structural gap in software distribution: once a package is installed, there is no cryptographic proof of which registry distributed it. Every existing defense is configuration-based and fails silently when misconfigured. We present a cryptographic distribution provenance system comprising three components: (1) cryptographic registry identity, where every registry holds an Ed25519 keypair and signs every artifact it distributes; (2) a dual-signature model, where the publisher signs at packaging time and the registry countersigns at publication time; and (3) authoritative namespace binding, where consumers pin registry fingerprints and the resolver cryptographically rejects artifacts from unauthorized registries. These create three defense layers requiring simultaneous compromise for a successful attack. A comparison across eight ecosystems (npm, Cargo, Hex.pm, PyPI, Go modules, Docker/OCI, NuGet, M","title":"Cryptographic Registry Provenance: Structural Defense Against Dependency Confusion in AI Package Ecosystems","vendor":"arxiv_cs_ai"},"confidence":{"method":"deterministic"},"decision":"POSITIVE","issued_at":"2026-05-07T04:43:30Z","notes":"Spider vendor_press (news) news.vendor_press.v1","object":{"captured_by":"crovia.spider.vendor_press","primary_source_url":"https://arxiv.org/abs/2605.03309"},"predecessors":[],"schema":"crovia.axiom.v1","signature":"ed25519:bfe7d517118fc2c50ea0caa5d1b155013c9c037eb4eef50abb2abdc145e1a0d64e977ef955b146d16901b5d3e81c85ba0e03673a81e3258c7615659061858808","signer":"crovia.substrate","subject":{"observed_at":"2026-05-07T04:43:30Z","source_collector":"spider:vendor_press","target_id":"https://arxiv.org/abs/2605.03309"},"tsa":{"authority":"crovia.substrate.bootstrap","rfc3161_token":"{\"kind\":\"crovia.bootstrap.tsa\",\"source_jsonl\":\"/opt/crovia/spider/data/news/vendor_press_v1.jsonl\",\"source_seal_merkle_root\":\"spider_vendor_press_v1\",\"upgrade_path\":\"Sessione H \\u2014 OpenTimestamps weekly anchor\"}"},"zk_mode":"clear","zk_proof":null},"ledger":{"leaf_hash":"f90006d72e8325cc537f1233387bbfc16882141af388e478c280a8b7df05504a","leaf_index":118270,"ledger_path":"/opt/crovia/substrate/axiom_ledger.jsonl"},"merkle_proof":{"hash_alg":"sha256","leaf_prefix":"0x00","node_prefix":"0x01","odd_leaf_rule":"duplicate_last","path":[{"sibling":"6bc6162f8f3276c861b0cafae9c3a328b93eaa5ed733293789f6c645dc708ab1","side":"right"},{"sibling":"7e59800668f140a94f7c8c472d7d96619dab85225af1e20593a9ecd191654646","side":"left"},{"sibling":"a384f56bc45ba5ff785e761514114cea84e42dd91b035a117ad7731a94073e93","side":"left"},{"sibling":"203154e6ed4ad460bcfd467b1d5aa91ce37d23a01d17767e7e2dd1390794f3f1","side":"left"},{"sibling":"068ed2eeac6074c0ecb706625c280809640e9e948cc090e343cdf256238f3354","side":"left"},{"sibling":"f1ce40097c7b14a0d22084f542808967c45441bde11e15fd0e39b5936adf6130","side":"left"},{"sibling":"1b5d9d099a141dbd9b65685d9424ef07b508b27c0e01ef2b925d1dd5d95de03a","side":"left"},{"sibling":"c25c853cb3dd8c7f1b99fc80fd602c044932de34c1b34bd69ab1d5b8c94e42b1","side":"left"},{"sibling":"3d3124224341dac361f0e93f24f70795342ba216dc1c0065e7fa7592d943b488","side":"left"},{"sibling":"438bef084db8613e8143527769e3c677e12a59f8a6e2dea114f88afab0446a43","side":"right"},{"sibling":"8e758a4477dfc0838d2e8ea2bdbd583bc3192683e75fd9cde217ee6a3b2f3ac8","side":"left"},{"sibling":"4219f746e463e594ccd6447debdf736a57e77319b12bcb74d8ece2b5860064c6","side":"left"},{"sibling":"05f89b32c00462e60adf95c1fe4579cdc2791b36e8b17573d8f3b5fd5da95a0b","side":"right"},{"sibling":"8ccd9937a2c0d5c04044d07d1557791b7d07bb31eac41a39a675608d44b38f23","side":"right"},{"sibling":"3a5e69cf0803f4c91f3895ed7c9a95748fef240bec4422e167c05300f79f06c0","side":"left"},{"sibling":"f2817ab288b5324fe49770372c7a10f33f7cd11005f8d4c0a730316f5229dc98","side":"left"},{"sibling":"725fac972e772ca0dc598810ea1abc70df472f72d2d6ab8a0baee2b80e5d2f4c","side":"left"},{"sibling":"98fc57dfef8873b512edc8340f7181df57302bb96777625e072235c62d7c5895","side":"right"}]},"schema":"crovia.axiom_proof.v1","seal":{"first_collector_run_id":"","first_receipt_hash":"","jsonl_path":"/opt/crovia/substrate/axiom_ledger.jsonl","key_id":"430895f101d38164","last_collector_run_id":"","last_receipt_hash":"","leaf_count":134292,"merkle_root":"77fc9c28fae777b81da5b495b3115474df6592dfac590333213d3bdf8b94a9b3","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","run_id":"hourly_json_retrofit_20260515T023701Z","schema":"crovia.seal.v1","seal_family_version":"crovia-seal-family/1","seal_kind":"substrate_batch","sealed_at":"2026-05-15T02:37:25Z","sig_algorithm":"ed25519","signature":"68107a834b00b24f5d4501e5ec727445311f132a486567ecc4c72a4e6dff24c8c21f2de3105293353ba5fdbe370d032819af6aa70f694e2e39b6af6737507009","signer_version":"1.1.0"},"trust_root":{"key_id":"430895f101d38164","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","signature_algorithm":"ed25519","url":"/registry/canon/TRUST_ROOT.md"},"verifier":{"spec":"/registry/canon/AXIOM_RECEIPT_v1.md","url":"/v/axm_d66bcdece8320b9290093efa6386a4deefd86697c570d0af9d4c1d359eea364a"}}