xz and rancher-desktop default images

[DevRCRun]

Hi all

As a relative newbie to rancher, can I ask if the backdoored xz version would ever have been included in any of Rancher desktops default images?

I see the statement from Alpine that it was only ever in their edge release and having had a quick look at some of the project's image repos here on github, I think not, but would rather seek a definitive answer where I'm not that familiar with the project.

Many thanks for your time

[jandubois]

It was never included in any Rancher Desktop build. We build the alpine-lima ISO and wsl-distro tarball using Alpine 3.19 repos.

You can verify this yourself with

$ rdctl shell apk list | grep xz
WARNING: opening from cache https://dl-cdn.alpinelinux.org/alpine/v3.19/main: No such file or directory
WARNING: opening from cache https://dl-cdn.alpinelinux.org/alpine/v3.19/community: No such file or directory
xz-5.4.5-r0 x86_64 {xz} (GPL-2.0-or-later AND Public-Domain AND LGPL-2.1-or-later) [installed]
xz-libs-5.4.5-r0 x86_64 {xz} (GPL-2.0-or-later AND Public-Domain AND LGPL-2.1-or-later) [installed]

But even if that version would be included, it would have no effect because Alpine uses OpenRC and not systemd, so should not be loaded into the sshd process.

[DevRCRun]

Wonderful, thank you for the prompt and detailed answer