# Tukaani Project ## Identification The upstream project associated with XZ Utils, explicitly named through `tukaani.org/xz/`. ## Notebook evidence - [[Scanned_20260730-1946|Scanned_20260730-1946]], PDF pages 7 and 20. ## Owner-supplied early interpretation Bryant McGill states that his source-era attention to the Tukaani/XZ upstream identity was deliberate: he believed the dependency's placement and role were intentional and part of a larger [[Surveillance|surveillance architecture]], before public disclosure of the 2024 XZ backdoor. Recording the upstream URL is therefore treated as an early provenance inquiry rather than an incidental bookmark. The later [[CVE-2024-3094]] incident confirms that intentional compromise entered the XZ upstream/release chain. It does not establish that Bryant's earlier suspected architecture involved the same actors, versions, mechanism, or purpose. ## Relationships and evidentiary boundary [[XZ Utils]] · [[CVE-2024-3094]] · [[Software Supply-Chain Provenance]]. The tool or name is preserved as research context. Written proximity does not by itself prove installation, execution, authorization, compromise, ownership, or coordination; dual-use tools require lawful, scoped testing and reproducible evidence.