Re: [oss-security] Analysis on who is Jia Tan, and who he could work for, reading xz.git

[Jacob Bachmeyer]

Alejandro Colomar wrote:

Hi Jacob,

Thanks to your script, I've found a mistake in my analysis of the
timestamps.

Interesting.  I am very happy to have helped clear the air.

The commit dates in +0200 recently seem to be because Jia Tan rebased
some commits from Lasse, and used --committer-date-is-author-date.

        commit 3007e74ef250f0ce95d97ffbdf2282284f93764d
        Author:     Lasse Collin <lasse.col...@tukaani.org>
        AuthorDate: Tue Mar 5 23:21:26 2024 +0200
        Commit:     Lasse Collin <lasse.col...@tukaani.org>
        CommitDate: Tue Mar 5 23:23:16 2024 +0200

        commit 6e97b299f1b22e366ec42ba5dc5b9d0746e87b84
        Author:     Lasse Collin <lasse.col...@tukaani.org>
        AuthorDate: Tue Mar 5 23:21:26 2024 +0200
        Commit:     Jia Tan <jiat0...@gmail.com>
        CommitDate: Tue Mar 5 23:21:26 2024 +0200

$ git describe --all --contains 3007e74ef250f0ce95d97ffbdf2282284f93764d
master~37
$ git describe --all --contains 6e97b299f1b22e366ec42ba5dc5b9d0746e87b84
tags/v5.6.1~9

The other three commits have a similar story.  So it was a red herring.
Then, all of Jia's actions have consistently been in +0800.

Very interesting---that red herring has gotten quite a bit of press.

Now I'm using your scripts to collect data from several projects where I
work, to compare with data points that I know well.

Excellent!  Now we are likely to get somewhere.


-- Jacob