Post #2095331

@corbet I don't think the Debian maintenance state was relevant here. The malicious releases equally landed in other distros and the attacker e.g. pushed for pulling 5.6.1 to Ubuntu noble. In fact the last upload prior to the security revert officially changed the maintainer field to what was already the defacto xz maintainer in Debian: https://tracker.debian.org/news/1515323/accepted-xz-utils-561-1-source-into-unstable/