3 ms·

also wasn't the backdoor reproducible to begin with? If it had targeted every system, you'd just get reproducible backdoored binaries.

• dzaima 2y ago
  The infected version was only the tarball, which was part of the obfuscation (i.e. people may look at git commits, but who individually checks autogenerated code in tarballs of every release) Building from the git commit the release claimed to be from would result in a different binary than building from the tarball if the environment check passed.