Fixed
Status Update
No update yet.
Comments
ts...@redhat.com
Red
kr...@arm.com
Thank you for reporting this here, Tom.
It seems to me that this does not need to be coordinated in private?
If so, I think it would be best to close this ticket and instead coordinate the work that might still be needed in public in our regular channels such as the regular issue tracker, Discourse, etc.
Do you think so too?
It seems to me that this does not need to be coordinated in private?
If so, I think it would be best to close this ticket and instead coordinate the work that might still be needed in public in our regular channels such as the regular issue tracker, Discourse, etc.
Do you think so too?
ts...@redhat.com
OK that's fine with me.
kr...@arm.com
[Empty comment from Monorail migration]
ts...@redhat.com
Using the script from https://github.com/llvm/llvm-admin/pull/10 , which looks at issues, pull requests, and commits, this is the user's activity in the last year with the LLVM org:
Created Issues:
https://github.com/llvm/llvm-project/issues/63957
Issue Comments:
https://github.com/llvm/llvm-project/issues/67779#issuecomment-1740960310
Created Pull Requests:
None
Commits:
None
Created Issues:
Issue Comments:
Created Pull Requests:
None
Commits:
None
kr...@arm.com
The last comment indicates that Tom did review the codebase appropriately to ensure that this user has not made any commits or other contributions to the project.
Tom, could you confirm that?
If so, we can close this ticket.
Tom, could you confirm that?
If so, we can close this ticket.
kr...@arm.com
Tom has confirmed in private communication that he also thinks this ticket can be closed.
Description
GitHub user JiaT75 who was responsible (or had their credentials compromised) for committing malicious code to the xz repository. Filed an issue[1] in July of 2023 asking that a warning for certain code containing ifuncs to be removed. The backdoor for xz relied on ifuncs, so it's possible this was an attempt to mask the backdoor for users building xz with clang.
We should review our codebase to ensure that this user has not made any commits or other contributions to the project.
[1]