Seven of our remediation roles are public, with the shared library they depend on. The fixes themselves are a morning's work each. What took the time was deciding what a pack must declare and demonstrate before anything will run it as root across a fleet, and only some of those gates exist today.
Seven years of relicensing, three forks with foundations behind them, two walk-backs and one proprietary vendor ending perpetual licences outright. Read as supply chain rather than as community drama, the pattern is consistent: the licence on a dependency is a commercial term, and commercial terms change.
Every attestation chain ends in something you trust for reasons that have nothing to do with technology. Knowing where yours ends is more use to you than the chain itself.
The backdoor sat in the release tarball and not in the git tree. Closing that gap is what reproducibility is for, and it's the highest-value control to come out of the whole incident.
Mitigation code available
A backdoor in xz-utils 5.6.0 and 5.6.1, planted over a multi-year social engineering campaign against a burnt-out maintainer, and caught by one engineer who wondered why SSH was half a second slow.
A phrase that barely existed last year is now in ministerial speeches. It was introduced by the company that sells the accelerators, and the definition it carries makes buying those accelerators the proof of sovereignty.
Mandated, useful and routinely oversold. A bill of materials answers "where is it running" in seconds, which is valuable because that question used to take days.
Mitigation code available
Six days after Log4Shell went public we shipped an Ansible role that stripped JndiLookup from every JAR it could find, a week ahead of the joint advisory. Almost none of those days went on the fix. They went on answering where Log4j was running, which is a question about your own estate rather than about Apache.
