There is a lot of noize about this

xz

vulnerability happening. We should probably figure out if we’re impacted. (I say, as I run out the door)

Correct; we also don't use the tarball and use our own build system to build, so there could still be source code issues, but the most immediate threat doesn't touch us.

Yes. And it sounds like an attack targeting amd64 sshd.

the xz submodule link has been disabled https://github.com/tukaani-project/xz/tree/03c51c5c08fe3579d8bbc8eea8251a1128001330

I see; also https://tukaani.org/xz-backdoor/