SSH Key Update
+On 2024-03-29, a backdoor was discovered in the + xz-utils + software. Inferencium systems did have the affected versions of + this software installed, and the tools were used. The software has since been downgraded to + the last-known safe version.
+After extensive research, it + has been discovered + that specific criteria must be met for the backdoor to be effective. Based on + what is known, Inferencium systems are unaffected by this attack + for the following reasons:
+-
+
- Inferencium systems run Gentoo Linux, which does not include Debian and Red Hat + OpenSSH patches. +
- Inferencium systems use musl libc, not glibc. As musl does not support glibc's
+ non-standard
IFUNCfunctionality, the backdoor cannot run.
+ - Inferencium systems use Clang as the system compiler, and lld as the system + linker, not GCC and ld. +
- Inferencium systems use OpenRC as the init system, not systemd. libsystemd and + systemd-notify do not work with OpenRC. +
The only criteria met by Inferencium systems is amd64 as the system
+ architecture; this is not enough for the backdoor to be effective. Even if all criteria
+ other than running glibc were met, Inferencium systems would still be unaffected by this
+ attack due to musl not supporting the required IFUNC functionality.
Despite the evidence, it is unknown exactly what this malicious code does and is + capable of in entirety. As a precautionary measure, I have generated a new SSH key and + classifed the previous key as compromised. You can find my new key on the + Key webpage.
+There is no evidence that my previous key was compromised, so this is entirely a + precautionary measure. All files and Git commits, tags, and releases signed with the + previous key, even after discovery of the backdoor, up to 2024-04-01, are secure and validly + signed by me; the key should not be trusted after this date.
+