GitHub has suspended @JiaT75's account. EDIT: Lasse Collin's account @Larhzu has also been suspended. EDIT: Github has disabled all Tukaani repositories, incl

GitHub has suspended @JiaT75's account. EDIT: Lasse Collin's account @Larhzu has also been suspended. EDIT: Github has disabled all Tukaani repositories, including downloads from the releases page. -- EDIT: Just did a bit of poking. xz-embedded was touched by Jia as well and it appears to be used in the linux kernel. I did quick look and it doesn't appear Jia touched anything of interest in there. I also checked the previous mirror at the tukaani project website, and nothing was out of place other than lagging a few commits behind: https://gist.github.com/Qix-/f1a1b9a933e8847f56103bc14783ab7b https://gist.github.com/Qix-/f1a1b9a933e8847f56103bc14783ab7... -- Here's a mailing list message from them ca. 2022. https://listor.tp-sv.se/pipermail/tp-sv_listor.tp-sv.se/2022-November/000802.html https://listor.tp-sv.se/pipermail/tp-sv_listor.tp-sv.se/2022... -- MinGW w64 on AUR was last published by Jia on Feb 29: https://aur.archlinux.org/cgit/aur.git/log/?h=mingw-w64-xz https://aur.archlinux.org/cgit/aur.git/log/?h=mingw-w64-xz (found by searching their public key: 22D465F2B4C173803B20C6DE59FCF207FEA7F445) -- pacman-static on AUR still lists their public key as a contributor, xz was last updated to 5.4.5 on 17-11-2023: https://aur.archlinux.org/cgit/aur.git/?h=pacman-static https://aur.archlinux.org/cgit/aur.git/?h=pacman-static EDIT: I've emailed the maintainer to have the key removed. -- Alpine was patched as of 6 hours ago. https://git.alpinelinux.org/aports/commit/?id=982d2c6bcbbb579e85bb27c40be84072ca0b1fd9 https://git.alpinelinux.org/aports/commit/?id=982d2c6bcbbb57... -- OpenSUSE is still listing Jia's public key: https://sources.suse.com/SUSE:SLE-15-SP6:GA/xz/576e550c49a3667a44b6375fb28916e5/xz.keyring https://sources.suse.com/SUSE:SLE-15-SP6:GA/xz/576e550c49a36... (cross-ref with https://web.archive.org/web/20240329235153/https://tukaani.org/misc/jia_tan_pubkey.txt https://web.archive.org/web/20240329235153/https://tukaani.o...) EDIT: Spoke with some folks in the package channel on libera, seems to be a non-issue. It is not used as attestation nor an ACL. -- Arch appears to still list Jia as an approved publisher, if I'm understanding this page correctly. https://gitlab.archlinux.org/archlinux/packaging/packages/xz/-/blob/main/keys/pgp/22D465F2B4C173803B20C6DE59FCF207FEA7F445.asc https://gitlab.archlinux.org/archlinux/packaging/packages/xz... EDIT: Just sent an email to the last committer to bring it to their attention. EDIT: It's been removed. -- jiatan's Libera info indicates they registered on Dec 12 13:43:12 2022 with no timezone information. -NickServ- Information on jiatan (account jiatan): -NickServ- Registered : Dec 12 13:43:12 2022 +0000 (1y 15w 3d ago) -NickServ- Last seen : (less than two weeks ago) -NickServ- User seen : (less than two weeks ago) -NickServ- Flags : HideMail, Private -NickServ- jiatan has enabled nick protection -NickServ- *** End of Info *** /whowas expired not too long ago, unfortunately. If anyone has it I'd love to know. They are not registered on freenode. EDIT: Libera has stated they have not received any requests for information from any agencies as of yet (30th Saturday March 2024 00:39:31 UTC). EDIT: Jia Tan was using a VPN to connect; that's all I'll be sharing here.