Artifact-specific bundled-component attribution for cffi 1.17.1 Linux aarch64 wheel #284

Hello, we are reviewing attribution for this previously published wheel.

Wheel: cffi-1.17.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl
SHA256: da95af8214998d77a98cc14e3a3bd00aa191526343078b530ceb0bd710fb48a5
Size: 478850 bytes.

Native members observed in that wheel:

• _cffi_backend.cpython-312-aarch64-linux-gnu.so — SHA256 a22408bcda96b839df2dbfd8f5b17be1d4b6940d721fed574ab361f02cc10097

Please provide, or point to existing publisher-controlled evidence for, the complete bundled or statically linked component inventory for this exact wheel: component names/versions and source references, build target/features relevant to included components, and the applicable license, copyright and notice texts, including changes introduced by patches. Please explain the relationship between that inventory and the wheel/native-member SHA256 values above, distinguishing bundled/static code from external dynamic dependencies and build-only candidates. An artifact-specific publisher statement supported by applicable primary source/notice evidence may provide this relationship; you do not need to generate new member hashes if an exact wheel binding identifies the shipped members. Conservative additional notice coverage may be useful, provided included versus merely covered components remain distinguished. A sufficiently corroborated inventory and notices are useful; a cryptographically signed attestation is optional. A source lockfile or a workflow version alone does not establish which components are present in the released bytes. If historical artifact-specific evidence is unavailable, please say so; this request does not ask you to rebuild, execute or publish a replacement artifact.

The retained Linux build workflow declares static libffi 3.4.2. Please corroborate the libffi source, patches, selected components and applicable notices for this Linux aarch64 wheel, along with any other statically bundled code. Windows libffi notice files are insufficient to attribute the Linux binary.

Thank you. Existing primary documentation or release records are welcome; please do not include private build logs, credentials or customer information.