A backdoor in xz

Seems like release builds, at least, ought to be isolated from binary blobs whenever possible. The build system of nearly any project could probably delete *all* test infrastructure (including testcase data), documentation directories (could contain binary "images"), etc. before starting the (release) build. Committing binary data to source respositories should also be seen as deeply taboo. Plenty of projects have been pretty lax about that or even chided others for being wary of binary blobs. The fact is: it's not "source" after all and it makes finding this kind of stuff even less likely.