Just to make this more explicit because it came up a few times in replies and really it should be on the main thread: In our past discussion of this, we've talked about BINARIES. Today's discovery pertains to both binaries and tarballs, and even a component that was checked into the repo. In those respects, our prediction was slightly off, there were details we missed and those details are important.