Actually the fact that they do not have binary blobs in their repo immediately stops the xz attack. Not saying attackers would fail with curl in general. Just

Actually the fact that they do not have binary blobs in their repo immediately stops the xz attack. Not saying attackers would fail with curl in general. Just repeating the exact method from xz is not possible.