Truly seems that way currently. He said he'd really dig in starting next week and just checked his email on vacation and saw this whole mess.

It may be hard for him to re-establish trust. Maintaining xz for more than a decade then doing this would be quite a "long con" but if HN threads are any indication, many will still be suspicious.

His commits on these links look legit to me. It's a sad situation for him if he wasn't involved.

The fact GitHub suspended his account too suggests that they might have info saying he is involved.

Or you know, they just reacted with a ban hammer on all accounts related to xz and to heck with innocence.

Personally, I doubt that. I would assume that GitHub just banned all accounts that were directly associated with the project as a precaution.

I think it was somewhat irresponsible to block everything. It hampers instigation of the repo's history. It's good that Lasse had another mirror.

Woops, too late to edit this comment and say *investigation

Honestly, he should call it quits and just drop xz utils and move on with life. He maintained it for 15 years and struggled to get anyone else to help until Jia showed up. Meanwhile the Linux ecosystem depended on it.

The Linux ecosystem will either figure shit out and maintain it or move into a different archive library.