[PySide] Source/build provenance and build-specific SBOM for PySide6 6.11.1 Windows wheels

[EP JA]

Hello Qt for Python team,

I am resending this inquiry after confirming my mailing-list subscription;
the initial attempt was rejected as a non-member post.

We are preparing a proprietary Windows desktop application using the
PySide6,
PySide6_Essentials, PySide6_Addons and shiboken6 6.11.1 cp310-abi3 win_amd64
wheels obtained through PyPI. We are assessing the applicable open-source
licensing route, not requesting legal certification or claiming a
commercial license.

The attached technical ZIP contains artifact-identities.json, which lists
the four exact wheel names and
SHA-256 values, 76 shipped files that match wheel members and RECORD,
retained
source-archive identities, FFmpeg exported configurations and Chromium
version
declarations. It does not contain our proprietary source, binaries or user
data.

We found Qt's SBOM documentation but no files with recognizable SBOM/SPDX/
CycloneDX/build-provenance names in these four retained wheels. Could you
point
us to existing published material for these exact builds, or clarify its
availability?

1. Corresponding source commits, patches, build recipes/configuration and
   toolchain information for the Qt, PySide and Shiboken binaries in these
wheels.
2. A build-specific SBOM or equivalent third-party manifest for WebEngine,
   Chromium and Qt PDF. If hashes differ from another Qt distribution, how
   should that manifest be related to the wheel binaries? We do not assume
that
   an installer SDK's SBOM automatically describes the PyPI wheels.
3. The Chromium revision/patch selection and relevant multimedia build
flags.
   The retained source declares chrome/VERSION 140.0.7339.225 while its
   CHROMIUM_VERSION describes base 140.0.7339.264 with security patches up
to
   148.0.7778.96. We would like to understand that relationship for these
wheels.
4. Build provenance and changes for the five external FFmpeg DLLs, including
   the actual zlib source/version used. The exported configuration mentions
   zlib-1.3.1 paths; we do not treat that path as proof of the linked
version.
5. Existing instructions for building compatible modified replacements,
   including required matching bindings/plugins. Generic build instructions
   help, but do not by themselves identify the original wheel build.

Our local checks establish artifact identity and partial configuration
correspondence, not a complete source/build or third-party licensing
closure.
If another public project channel is more appropriate, please direct us
there.

Thank you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.qt-project.org/pipermail/pyside/attachments/20261023/804d0dd5/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: MORPHY_consulta_tecnica_Qt_NO_ENVIADA.zip
Type: application/x-zip-compressed
Size: 8529 bytes
Desc: not available
URL: <http://lists.qt-project.org/pipermail/pyside/attachments/20261023/804d0dd5/attachment.bin>