consider downgrading xz-utils further

15:00 < jcristau> looks like gentoo went back to 5.4.2 (https://bugs.gentoo.org/928134#c16)
15:06 < carnil> maybe we should do that as well, I was looking trough the commits between 5.4.2..5.4.5. To be clear, the revert we have done was a emergecy stop-gap measure knowing that the payload is activated in the specific
                versions. But to date we do neither exactly know what all is the payload doing and neither if further backdoorsteps are introoduced before.

stable has 5.4.1-0.2 so that might be an option, depending on what is decided in #2.