> The release tarball thing was just an added benefit to the attackers, but not critical. IMO. What I mean is that Debian and Fedora presumably download the ta

> The release tarball thing was just an added benefit to the attackers, but not critical. IMO. What I mean is that Debian and Fedora presumably download the tarball and build from there, rather than cloning a repo and building from the repo. If they did the latter, it would have been much more difficult to manipulate the build process to inject the backdoor that lived inside the testcase binaries, because that change to the build scripts would be out in the open. But I could be mistaken...