Wow:

"That line is *not* in the upstream source of build-to-host, nor is
build-to-host used by xz in git.  However, it is present in the tarballs
released upstream, except for the "source code" links, which I think github"

They pwned the release distribution; source in git is fine.

Nuts.