From: sam@email-scan.com   
      
   Henrik Carlqvist writes:   
      
   > Yes, this was even more sneaky. A malicious user has spent a couple of   
   > years to gain the trust to become co-maintainer of project xz. This   
   > malicious user "Jia Tan" could sign his commits and release packages with   
   > GPG keys probably built only for the purpose of a fake "Jia Tan" account.   
      
   Someone dug up ample evidence that "Jia Tan" is a composite entity.   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)