Third-party attribution sources for workerd 1.20261006.1 native releases

[halalatocktok]

Could you point me to third-party licence/notice material, or a supported way to reconstruct it, for these unmodified native npm releases?

• @cloudflare/workerd-darwin-arm64@1.20261006.1, bin/workerd SHA-256 ddafaa2a1c1f68ffad60f843c8ddaf46fa855a7da3391ce9fea0702ac14c5ef8
• @cloudflare/workerd-linux-64@1.20261006.1, bin/workerd SHA-256 3ee1cc5b09497de8f47f513b5c5c485da99a9fc8b188b5618cb05de63f3b4b64

Their public npm provenance identifies source commit 107ea005f9702e5422a84bb5840ca9d9980cff0d and release run 37398039636. I checked the published npm package contents, the release assets, the source LICENSE, release workflow, src/workerd/server/BUILD.bazel, generated dependency modules and Rust lockfile at that commit.

Those establish useful source and build identities. I have not located a complete attribution mapping for third-party material incorporated into the two published binaries. The specific gap is coverage of the workerd runtime target under release_macos and release_linux, including transitive libraries, generated/header material, incorporated SDK material and any incorporated compiler runtime, distinguished from tools used only on the build host.

Is there an existing release-specific notice bundle or component/material record? If reconstruction from the pinned inputs is the supported route, which additional resolved inputs or attribution sources are needed to make that coverage complete? A conservative superset is useful if its coverage and exclusions are documented; an exact object-level linkage list is not essential.

Public references are sufficient. I am not requesting a rebuild, signed attestation, private build credentials or a legal assurance, and the missing mapping in my record is not an allegation of a licence violation. Thank you.

[Cla25-stack]

We are reviewing the already distributed @cloudflare/workerd-linux-64@1.20260929.1 Linux x64 artifact, SHA-256 32beee24553fa517f11b758af38137c400759563d5278d91244efa173dfa33c7. We request only existing producer materials; no rebuild or new release is requested.

1. For original run 36506892456 / commit 82b85cf, provide retained resolved action graph/linker response files showing the object/archive inputs to src/workerd/server/workerd.
2. Include input digests, selected C/C++ and Rust component versions, target features and actual applied patch hashes (including V8/SQLite/vendor changes).
3. Provide exact compiler, linker, static runtime and build-image material digests and a producer binding to the stated binary digest. The authenticated LinuxX64-bazel-profile artifact has already been inspected: it is timing/action-label evidence, not a replacement for this graph.

If any material is not retained or was never produced, please identify that exact gap. A source workspace lock, a timing profile, or generic source provenance should not be presented as the complete linked SBOM. Please exclude credentials, tokens and unrelated private build data. We can review an existing public artifact or a suitably scoped producer statement tied to the exact digest.