The relevant code was (allegedly) not part of source control, but inserted during the build process.
> Evidence suggests that as early as October 2019, these attackers have been testing their ability to insert code by adding empty classes. Therefore, insertion of malicious code into the SolarWinds.Orion.Core.BusinessLayer.dll likely occurred at an early stage, before the final stages of the software build, which would include digitally signing the compiled code.
They talk about adding classes at an early stage... I assumed that meant modifying the source code in some fashion. Sounds like you took it to mean they inserted binary (MSIL?) code during the build? Or are you referring to a different paragraph that indicates this wasn't part of source control?
1. Source code as available on development machines and version control
2. Source code as available on build machines
3. .dll generated by build machines
I would assume (based on the article's language that you quoted) that manipulation happened on (2), not (1) or (3).
https://www.solarwinds.com/securityadvisory/faq
> Our initial investigations point to an issue in the Orion software build system in which the vulnerability was insert which, if present and activated, could potentially allow an attacker to compromise the server on which the Orion Platform products run.
Under "With these processes in place how was your code compromised?"
Seems to me like this malware might as well have been added to the calling assembly.