Build provenance and compiler/header records for 0.1.9.post1 cp311 Linux wheel #87

Could you point us to the exact build job and compiler/header inputs for this published Linux wheel?

• Release: qdldl 0.1.9.post1
• File: qdldl-0.1.9.post1-cp311-cp311-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl
• Wheel SHA-256: e6d333d1de8f39ca3c34d0d88ee00a3d1b0d90f54dafad8d554b646c6110c7dd
• Native member: qdldl.cpython-311-x86_64-linux-gnu.so
• Member SHA-256: 7447c4901e9c3790767f0e2da4933c4105fca64d332c9f8e756e771055bad2f7

We verified the public wheel checksum and its native member against the installed artifact without installing or executing the downloaded wheel. PyPI's artifact record did not provide build provenance. The manylinux tag establishes compatibility but does not identify the compiler/header patch level.

The requested evidence is:

1. The wheel build job/run, exact source and submodule revisions, and builder image digest.
2. Compiler package versions, C++ header packages/hashes, include paths, compile flags and patch series, including bundled native dependencies.
3. Any existing artifact-specific assessment for the public GCC/libstdc++ advisories CVE-2026-114690, CVE-2026-114691 and CVE-2026-115455, distinguishing a shared-library update from code compiled from headers/templates. For 114690, absence of a parallel-mode flag alone does not exclude explicit GNU parallel calls.
4. If applicable, a corrected artifact and exact build provenance/hash, or a pointer to the maintained build that addresses the relevant header implementation.

This is a request for build records to support downstream assessment. We have not established that this wheel exposes a vulnerable operation; related binary strings alone do not establish reachability. No new exploit, application source, customer records or credentials are being disclosed. Existing immutable build/log references are welcome; please redirect us if another official release channel owns these records.

Prepared with Codex assistance and submitted with the account owner's authorization.