Retained build-input evidence for Pillow 13.0.0 cp311 manylinux x86_64 wheel

[Bostame]

Retained build-input evidence for Pillow 13.0.0 cp311 manylinux x86_64 wheel

Hello, I am reviewing the build inputs and component notices of this published wheel:

• pillow-13.0.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl
• SHA256: a625df9a2a5597fa5e5266e01aefc82604bb85d291e3547981e863560d75da6c
• Size: 7,140,667 bytes

The retained publish information points to source revision 293218a and run 38960170632, attempt 2. I have checked publish information and the wheel's embedded SBOM/notice files, but those do not by themselves identify every effective native/static build input. This is an evidence question, not a vulnerability report.

Is retained evidence or an immutable reference available for:

1. The producing platform/job and its binding to this wheel hash, effective workflow revision, and any build attestation?
2. The exact digest/revision of the pillow-depends/archive/main.zip input actually used, including a cached copy if applicable?
3. The effective multibuild/submodule tree, toolchain/container identities, dependency caches, patches, and build/repair options? The declared multibuild gitlink is c893f305c6066b6d940e10d3333be8cb27fa3947.
4. The actual direct/transitive native/static source revisions and codec/library choices mapped to the shipped extensions and DSOs, including whether libimagequant is present?
5. Corresponding source/build instructions and component-specific licence/notice references for those shipped inputs?

A relevant existing manifest or sanitized excerpt would be helpful; I am not asking for repository-admin access, secrets, new builds or a guarantee about downstream licensing. If a historical input is unavailable, please identify it as unavailable rather than substituting current main or an unlabelled reconstruction. I am happy to be directed to existing documentation or an existing discussion.

Thank you.

[radarhere]

1. Information about the OS used to build the wheels is not published. If you are checking near the time of release, you can look at the GitHub Actions logs.
2. Main of pillow-depends at the time of release is used.
3. The multibuild version committed in the 13.0.0 (or whichever release) tag is used.
4. You can look at https://github.com/python-pillow/Pillow/blob/main/.github/workflows/wheels-dependencies.sh to see which dependencies are built for Linux. libimagequant is not among them.
5. You can find build instructions in the 'docs' directly of the 13.0.0 (or whichever release) source release, and an SBOM inside the distributed wheels.

[hugovk]

You can also find attestations and checksums at PyPI:

https://pypi.org/project/pillow/13.0.0/#pillow-13.0.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl