On: Backdoor in upstream xz/liblzma leading to SSH server compromise

[duskwuff]

No. There's no good reason HTTP response decoding would ever be implemented in terms of libarchive; using libz directly is simpler and supports some use cases (like streaming reads) which libarchive doesn't.