@feld @wdormann @mirabilos the backdoor is stored in the compressed test data and not active in the commits. It is activated by an extra line added in the configure step of the build script in the tarball attached to the release. To be clear, there is nothing to find in the commits except obfuscated code in a compressed file that live in the test data