If it were a supply chain attack, I find it hard to believe that a) it would have originated from Debian at all, and b) that the people making the patch would h

If it were a supply chain attack, I find it hard to believe that a) it would have originated from Debian at all, and b) that the people making the patch would have posted to the openssl-dev mailing list to ask their opinion on the correctness of the patch before including/shipping it. https://lwn.net/Articles/282038/ https://lwn.net/Articles/282038/