Wow:

"That line is *not* in the upstream source of build-to-host, nor is

build-to-host used by xz in git. However, it is present in the tarballs

released upstream, except for the "source code" links, which I think github"

They pwned the release distribution; source in git is fine.

Nuts.