Is the original git repository still available somewhere?

deng · on April 3, 2024

Note the malicious m4 build scripts were not checked into git, but only put in the released tar balls. You can see the original content here:

https://salsa.debian.org/debian/xz-utils/-/tree/debian/5.6.0...

throwaway4good · on April 3, 2024

The test file containing the backdoor seems to be here:

https://git.rootprojects.org/root/xz/commit/6e636819e8f07033...

deng · on April 3, 2024

Yes, the binary "test files" were checked in. But the code that actually decompresses and executes the shell code in that file is in this m4 script, which only exists in the tar archive:

https://salsa.debian.org/debian/xz-utils/-/blob/debian/5.6.0...

rrdharan · on April 3, 2024

Yes: https://git.rootprojects.org/root/xz