4 ms·
Is the original git repository still available somewhere?
by throwaway4good 3y ago
Is the original git repository still available somewhere?
- rrdharan 3y agoYes: https://git.rootprojects.org/root/xz https://git.rootprojects.org/root/xz
- deng 3y agoNote the malicious m4 build scripts were not checked into git, but only put in the released tar balls. You can see the original content here: https://salsa.debian.org/debian/xz-utils/-/tree/debian/5.6.0-0.2 https://salsa.debian.org/debian/xz-utils/-/tree/debian/5.6.0...
- throwaway4good 3y agoThe test file containing the backdoor seems to be here: https://git.rootprojects.org/root/xz/commit/6e636819e8f070330d835fce46289a3ff72a7b89 https://git.rootprojects.org/root/xz/commit/6e636819e8f07033...
- deng 3y agoYes, the binary "test files" were checked in. But the code that actually decompresses and executes the shell code in that file is in this m4 script, which only exists in the tar archive: https://salsa.debian.org/debian/xz-utils/-/blob/debian/5.6.0-0.2/m4/build-to-host.m4 https://salsa.debian.org/debian/xz-utils/-/blob/debian/5.6.0...