Could the XZ backdoor have been detected with better Git and Debian packaging practices?
How did the changes in the binary test files tests/files/bad-3-corrupt_lzma2.xz and tests/files/good-large_compressed.lzma, and the makefile change in m4/build-to-host.m4) manifest to the Debian maintainer? Was there a chance of noticing something odd?
https://optimizedbyotto.com/post/xz-backdoor-debian-git-detection/Open linkView original on programming.dev
2 replies
Author has some good thoughts, but it's important to mention that the xz backdoor did not make it into debian stable, only sid.
Debian already had policies to handle stuff like this, which is how bookworm wasn't affected.
There was a bunch of luck involved that Andres Freund detected this. Give more time, it would have ended up in stable releases eventually if not detected.