The Ballad of XZ utils

[Verse 1] Lasse Collin talked about the burnout Though he kept the project going He was doing what he could But the list of issues kept on growing [Verse 2] X Z U-tills, a small compression tool Sat at the bottom of the stack Used everywhere It was just perfect to attack [Verse 3] Billion dollar cloud providers Built their billion dollar products on his back No salary, no support Just a tired maintainer holding up their stack [Verse 4] In 2021 a new name appeared Jia Tan, useful patches full of thought Careful work, good clean code Is how he earned his spot [Verse 5] Jia Tan kept being useful, building trust Till he was in the door Then voices in the forums started pushing The project needed help, the people wanted more [Verse 6] No one knew who it was Whose voices wouldn't quit But the pressure kept on coming Until Jia Tan had the privilege to commit [Verse 7] He put it in the build scripts In the tarball, not the source A backdoor aimed at SSH Patient effort got him what he couldn't get by force [Verse 8] Three weeks from shipping with Debian Andres Freund was measuring how long a process took SSH was slow, half a second Just enough to make him look [Verse 9] He followed where the numbers took him Found what two years of work had hid Andres saw the backdoor Noticed what Jia Tan did [Verse 10] Nobody knows who Jia Tan was The persona disappeared Most likely a state planned it out The patient work of years [Verse 11] There are others like Lasse right now Holding the stack up, working alone The companies above keep shipping Building on ground they've never owned [Verse 12] The companies keep shipping, keep on building Keep taking what the commons has to give Until the next stranger with two years of patience Shows us how close to the edge we live