On Sun, Mar 05, 2017 at 03:27:49PM -0800, Maxim Cournoyer wrote:
> The complete lists of packages affected are:
> 
> 1. libpwquality
> 2. font-liberation
>
> 4. elfutils
> 5. mlocate
> 6. python2-dogtail
> 7. python-kitchen
> 8. libaio
> 9. libosinfo

In commit 7bc19c92054b7b6d5a9268a7f2d3344adf04cce4 (gnu: xmlto: Fix
source URL.) I changed the xmlto package definition to download the
source code from Debian.

I didn't find a "real" upstream source.