Because of the "xz backdoor" situation (https://tukaani.org/xz-backdoor/, https://boehs.org/node/everything-i-know-about-the-xz-backdoor), the vcpkg port of liblzma is currently not working (it's pointing to github sources which are currently online, see microsoft/vcpkg#37839 / microsoft/vcpkg#37957).

While Arrow C++ itself doesn't depend on liblzma directly, it is being built because of one of our (recursive) dependencies (note: in all built wheels we have always used older, not-affected versions of liblzma, given that we are building with an older snapshot of vcpkg). But that means that our vcpkg install is failing to build Arrow C++ in the wheel building pipeline.