We saw some supply-chain attacks on Linux distrubtions during #insomnihack. There an attacker would've been able to insert random code into packages. Now it seems to be the same for Fedora:
Which makes me wonder why they went through all that trouble with the XZ Utils backdoor (https://en.wikipedia.org/wiki/XZ_Utils_backdoor)? The frontdoor seems to be wide open!
