Five Files, One Fault Line

A backdoored release of xz Utils (5.6.0 and 5.6.1, CVE-2024-3094, CVSS 10.0) was caught by a Microsoft engineer chasing a half-second SSH delay, exposing a multi-year social-engineering operation against a sole maintainer. Around that event sit four commercial ones that together define the modern open-source contract: Redis's March 2024 move to RSALv2/SSPLv1 and the resulting Valkey fork; HashiCorp's August 2023 BUSL relicense of Terraform and the OpenTofu fork; Elastic's August 2024 restoration of AGPLv3 for Elasticsearch; and Redis's own return to an AGPLv3 option with Redis 8 in May 2025.

The 500-Millisecond Warning

The number that should haunt every platform team is not 10.0. It is roughly 500 milliseconds — the anomalous SSH login latency Andres Freund noticed while micro-benchmarking, which unravelled the most sophisticated supply-chain compromise yet documented. Freund was not looking for an intrusion. There was no scanner alert, no SBOM diff, no policy gate. Detection was accidental, and it happened at the outermost edge of the window before the backdoor reached stable distributions.

"Given the activity over several weeks, the committer is either directly involved or there was some quite severe compromise of their system."

— Andres Freund, oss-security mailing list, 29 March 2024

The implication the trade press under-covered is that the compromised asset was never the code. It was the trust graph. Tooling audits artefacts: hashes, signatures, dependency trees. Nothing in the standard stack models the fact that a burned-out maintainer, publicly pressured over response times, was handed a co-maintainer who spent two years accumulating commit rights before weaponising them. Provenance systems answer "who built this binary." They do not answer "who vouched for the human who could merge it, and why." Until maintainer-privilege graphs are treated as a first-class, auditable attack surface, Sigstore and SLSA are locks on a door whose frame is rotten.

The Relicensers Have a Case — and the Reversals Prove It

It is fashionable to read BUSL and SSPL as corporate betrayal. That reading is incomplete. Permissive licensing was written for a world where the primary competitor was another software vendor, not a hyperscaler that can operate your project as a managed service, capture the margin, and contribute nothing proportionate back. HashiCorp, Elastic and Redis were not attacking the commons; they were repricing a free option that their largest competitors had been exercising at scale.

The stronger evidence for the market's discipline is what happened next. Elastic restored AGPLv3 in August 2024 — Shay Banon announced it under the plain title "Elasticsearch is open source, again." Redis added AGPLv3 with Redis 8 in May 2025. Neither reversed out of sentiment. Forks imposed real switching costs on customers and real competitive costs on vendors, and the calculus changed. The lesson is not that relicensing is immoral. It is that in a functioning commons, the fork threat is the enforcement mechanism — and it works precisely because it is expensive for everyone.

Minnesota, 2021: The rehearsal nobody costed

The precedent is not Log4Shell. It is the "Hypocrite Commits" research by Qiushi Wu and Kangjie Lu at the University of Minnesota, which demonstrated that deliberately vulnerable patches could be submitted to the Linux kernel under the cover of ordinary academic contribution. Greg Kroah-Hartman's response was institutional, not technical: University of Minnesota submissions were barred pending re-review, and previously accepted patches were re-audited.

That episode established, three years before xz, that contribution itself is an attack vector and that the only effective control is reputation gating. The industry absorbed the wrong lesson — it invested in scanning outputs rather than vetting inputs. xz was Hypocrite Commits with a longer time horizon and no published paper. What we can learn is uncomfortable: the control that would have caught Jia Tan is not a tool. It is a second competent human with merge rights and enough paid time to be suspicious.

Provenance Becomes a Procurement Gate, Not a Security Control

The second-order effect of these five events is contractual. SBOM consumption has shifted from an engineering nicety to a purchasing precondition in regulated and public-sector buyers, and the EU Cyber Resilience Act's obligations on manufacturers placing products with digital elements on the market push liability toward whoever ships the assembled artefact. That is a genuine advance — and it is also a paperwork advance. A signed, attested build of a backdoored library is still a backdoored library; xz would have produced a perfectly valid attestation. Organisations that treat SBOM completeness as risk reduction are buying the compliance artefact and skipping the control. The durable advantage goes to teams that pair provenance with behavioural verification: reproducible builds, differential performance testing, and egress monitoring on build runners.

Forking Is Not Free, and Copyleft Is Not Costless

The mirror-image error is fork triumphalism. Valkey and OpenTofu succeeded because foundation stewardship and hyperscaler engineering funding arrived immediately — a condition almost no other project enjoys. Most forks fragment maintainer attention, split CVE triage, break API and state-file compatibility assumptions, and leave downstream operators arbitrating between two governance regimes they did not choose. Equally, the celebrated return of AGPLv3 is not frictionless: many enterprises maintain blanket internal bans on AGPL-linked components, so a licence restoration expands legal availability without automatically restoring practical adoption. Open source recovered its licence. It has not recovered its second maintainer.

The Ledger Nobody Audits

The third implication is financial, and it is the one procurement departments consistently miss. IBM's acquisition of HashiCorp for approximately $6.4 billion was priced on an installed base whose continuity depended on a community that had just been relicensed against. Meanwhile the critical compression, crypto and logging libraries underneath those valuations remain funded at hobbyist scale. Sovereign and foundation-backed funding programmes are a serious response, but they are grants against a maintenance liability that compounds daily. Expect this to reprice: maintainer continuity, bus-factor disclosure and paid-triage capacity are becoming diligence line items in M&A and in cyber-insurance underwriting, because they predict incident probability better than any scan.

What Operators Should Do This Quarter

• Inventory your bus factor, not just your SBOM. Rank your top 50 transitive dependencies by active maintainer count and last-release cadence. Anything at one maintainer with production-critical privilege is an unpriced liability — fund it, mirror it, or staff a internal fork.
• Pin, mirror, and gate compression and crypto libraries. Do not consume xz-class dependencies directly from upstream stable tags. Run an internal artefact mirror with a deliberate promotion delay; that delay is what saved most distributions in 2024.
• Instrument build and login paths for latency anomalies. Freund found CVE-2024-3094 through performance regression. Cheap, high-signal, and almost nobody does it.
• Re-read your licence exposure before your next audit. Track BUSL/SSPL/AGPL components explicitly, with legal sign-off and a documented fork fallback (Valkey, OpenTofu, OpenSearch) tested in staging — not theorised.
• Pay for triage. If your product depends on a project, a funded maintainer relationship is cheaper than one incident retrospective.

Six Months Out — Forecast, Not Fact

By mid-2027, expect three shifts. First, maintainer-privilege attestation moves from proposal to procurement language: buyers will ask who can merge, how they were vetted, and when rights were last reviewed. Second, licence volatility gets priced — enterprise architecture review boards will require a fork-exit plan for any single-vendor-controlled dependency, normalising what OpenTofu and Valkey proved viable. Third, the funding argument finally lands in the insurance column rather than the ethics column, because underwriters will correlate bus factor with claim frequency. None of this fixes the valve. It does mean someone will finally be paid to inspect it.