corpus.blog
41,832 blogs · 5,239,565 posts Claim your blog
Record · corpus.blog/posts/01a0821d-cd09-71d0-94e9-878a0c106122

Could the XZ backdoor have been detected with better Git and Debian packaging practices?

Optimized by Otto · published 19 October 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at optimizedbyotto.com Wayback capture
2blogs citing
First cited
19 Oct 2025
Most recent
3 Dec 2025
Rank this month
not ranked
External links
42
Words captured
7,022

Cited by

Blog
In the post
Date
reproducible-builds.org
Reproducible Builds in November 2025 Read at the source ↗
3 Dec 2025
Colin Watson's blog - planet-debian
Mistaken dichotomies about dgit Read at the source ↗
19 Oct 2025

Links from this post

Link
Host
https://mastodon.social/@AndresFreundTec
mastodon.social
https://manpages.debian.org/unstable/devscripts/debsnap.1.en.html
manpages.debian.org
https://tracker.debian.org/pkg/xz-utils
tracker.debian.org
https://www.openpgp.org/
openpgp.org
https://keyring.debian.org/
keyring.debian.org
https://en.wikipedia.org/wiki/SHA-2
en.wikipedia.org
https://manpages.debian.org/unstable/devscripts/uscan.1.en.html
manpages.debian.org
https://manpages.debian.org/unstable/diffoscope-minimal/diffoscope.1.en.html
manpages.debian.org
https://udd.debian.org/cgi-bin/dep14stats.cgi
udd.debian.org
http://salsa.debian.org
salsa.debian.org
https://tracker.debian.org/pkg/coreutils
tracker.debian.org
https://tracker.debian.org/pkg/bash
tracker.debian.org
https://www.debian.org/doc/debian-policy/
debian.org
https://salsa.debian.org/debian/xz-utils
salsa.debian.org
https://dep-team.pages.debian.net/deps/dep14/
dep-team.pages.debian.net
https://gbp.sigxcpu.org/manual/
gbp.sigxcpu.org
https://git-scm.com/book/en/v2/Appendix-A:-Git-in-Other-Environments-Graphical-Interfaces
git-scm.com
https://manpages.debian.org/unstable/git-debpush/tag2upload.5.en.html
manpages.debian.org
https://manpages.debian.org/unstable/diffutils/diff.1.en.html
manpages.debian.org
https://manpages.debian.org/unstable/git-buildpackage/gbp-import-dscs.1.en.html
manpages.debian.org
https://manpages.debian.org/unstable/git-buildpackage/gbp-import-dsc.1.en.html
manpages.debian.org
https://salsa.debian.org/otto/xz-utils-2025-09-29/-/network/debian%2Funstable
salsa.debian.org
https://salsa.debian.org/otto/xz-utils-gbp-import-dscs-debsnap-generated/-/network/debian%2Flatest
salsa.debian.org
https://manpages.debian.org/unstable/dgit/dgit.1.en.html
manpages.debian.org
https://salsa.debian.org/debian/dh-make/-/blob/master/lib/debian/gbp.conf.ex
salsa.debian.org
https://meldmerge.org/
meldmerge.org
https://tukaani.org/xz-backdoor/
tukaani.org
https://en.wikipedia.org/wiki/GNU_Autotools
en.wikipedia.org
https://manpages.debian.org/unstable/xz-utils/xz.1.en.html
manpages.debian.org
https://ci.debian.net/
ci.debian.net
https://salsa.debian.org/debian/xz-utils/-/commit/cf44e4b
salsa.debian.org
https://en.wikipedia.org/wiki/M4_%28computer_language%29
en.wikipedia.org
The xz attack shell script Read at the source ↗
research.swtch.com
https://sources.debian.org/sha256/?checksum=331a4432631bec49fb8a1a65b08d5ec469573fe6bf8dc0d6dfed57f1e374f085&page=1
sources.debian.org
https://sources.debian.org/sha256/?checksum=8307c1f05ec9d5b8da3e3e5af369ed91b9209e517c632d8a95c7c2aa32650ec5&page=1
sources.debian.org
https://sources.debian.org/sha256/?checksum=b2261ee50f116d42c796b79593480a4368327d912bc63ef6cba145229358abff&page=1
sources.debian.org
https://github.com/Fraunhofer-AISEC/supply-graph
github.com
https://github.com/sony/esstra
github.com
https://luj.fr/blog/how-nixos-could-have-detected-xz.html
luj.fr
https://dep-team.pages.debian.net/deps/dep18/
dep-team.pages.debian.net
https://salsa.debian.org/dep-team/deps/-/merge_requests/21
salsa.debian.org
https://cyberpress.org/crowdstrike-npm-packages-compromised/
cyberpress.org
Elsewhere on optimizedbyotto.com (2)