> It doesn't take away the fact that they did not check xz, and probably only few of their other dependencies. Xz is also used by Debian's package manager (bot

> It doesn't take away the fact that they did not check xz, and probably only few of their other dependencies. Xz is also used by Debian's package manager (both dpkg and apt). Or tar. Or the Linux kernel. Or... It already was a system library on Linux systems before systemd started using it as well. Your post reads like you have no real idea what Xz is and how it is used. Btw, do you think the Linux kernel developers are also clueless for using Xz?