Re:Timeline of the xz open source attack
by Hackbraten on Tuesday April 02, 2024 @03:33PM
(#39909938)
Exactly.
The threat actor had signed and uploaded the compromised source tarball to GitHub as a release artifact.
They then applied for an NMU (non-maintainer upload) with Debian, which got accepted, and that's how the tarball ended up on Debian's infrastructure.
Re:Timeline of the xz open source attack
by sloowm on Tuesday April 02, 2024 @05:03PM
(#39910827)
Thanks for the extra explanation. I guess this is harder to protect against than I thought and it's more that some distro's got somewhat lucky than debian and fedora doing something that is out of the ordinary.
The threat actor had signed and uploaded the compromised source tarball to GitHub as a release artifact. They then applied for an NMU (non-maintainer upload) with Debian, which got accepted, and that's how the tarball ended up on Debian's infrastructure.