Switching away from XZ

[Jonathan Schleifer <js%NetBSD.org@localhost>]

We all know about the XZ backdoor by now. But there is another 
interesting thing that I think we should discuss:

* There was an attempt to sabotage the Landlock sandbox on Linux.
* Capsicum support was outright removed from autotools-based builds.

It seems that the same entity who put the backdoor in XZ has a very high 
interest in making sure that the XZ utility runs without a sandbox.

I know this is all speculation, but to me, this is a very strong 
indicator that the same entity is sitting on a 0day against XZ that they 
would like to use, so they want to get rid of the sandbox before doing so.

Given that they probably also control other projects, just under a 
different fake identity, I think it might be a good idea to change all 
projects from XZ to either GZ, BZ2 or ZSTD archives. IMO the logical 
next thing for the attacker to do would be to create a malicious XZ for 
another project that then uses RCE in XZ.

Would there be objections in doing a mass replace of 
EXTRACT_SUFX=.tar.xz to EXTRACT_SUFX=.tar.gz/.tar.bz2/.tar.zst?

--
Jonathan