tangentially following the thread.
But if i'm understanding. You have a somewhat "critical" piece of software, dealing with "Aerospace" components, that I gather are used for Aerospace related projects. Given that you mentioned "chain of custody" (supply channel) this implies some level of importance beyond the old used parts that are useless.... or the hobbyist markets.
If this is commercial, and the client/vendor in any way/shape/form interfaces with major operations in the space/aerospace industries, or the defence industry, and if your client is US based, you might want to have the guy sign waivers saying you are not responsible for anything related to this, and you might actually want to tell him/advise him to get someone else to run the system.
The industries I mentioned above, frown upon systems that aren't locked down/tight!
Your mileage might vary.
Good luck