The current ISOs have some issues related to `mkinitcpio`. Users can edit the grub config by hitting `TAB` when the grub menu is visible. You must then remove the `intel-ucode` and `amd-ucode` parts from the grub config.

Calamares has an issue (which is suspected to be related to the mkinitcpio issue discussed previously). We're working on a fix for this. This second issue prevents Calamares from being able to install the OS.

Three years ago, #FDroid had a similar kind of attempt as the #xz #backdoor. A new contributor submitted a merge request to improve the search, which was oft requested but the maintainers hadn't found time to work on. There was also pressure from other random accounts to merge it. In the end, it became clear that it added a #SQLinjection #vuln. In this case, we managed to catch it before it was merged. Since similar tactics were used, I think its relevant now

https://gitlab.com/fdroid/fdroidclient/-/merge_requests/889

I wholeheartedly agree with what Russ wrote here:

"Also if there's anything the community can do for Lasse personally, please pass that along."

"Anyone can be the victim of social engineering."

"I suspect many of us here have had nightmares about being in Lasse's
position, and probably will have more of them in the future."

Indeed.

https://www.openwall.com/lists/oss-security/2024/03/30/25

(Easy) ways to help struggling open source projects:

- step in and help review a few PRs

- help the project triage/reproduce bugs

- if code in the PR looks complicated or is hard to understand, ask for an explanation

- express your gratitude to the maintainers

- make your company sponsor projects they depend on