The orjson-3.7.8.tar test resource was originally downloaded from 1 and piped through zcat to turn it into a plain TAR as the GZ compression is not related to the bug. The orjson project is dual-licensed under Apache-2.0 or MIT, see 2.