Post #1356970

@airtower@woem.men If you care for my opinion: My first step (if allowed by executive dysfunction) would probably be to contact someone high up in the Debian project, just making sure that they are aware of it. And, in any case, and sorry if this is blunt, ensure that the bus-factor of that knowledge is > 1. I’m of course extremely primed by your framing, but the way you put it, this could indeed be another attempt at an xz-like supply chain attack…