On Thu, 2026-07-30 at 21:57 +0200, Rutherther wrote: > > Hey Guix, > > recently someone on IRC asked if it would be possible to do minor > releases of Guix, due to the recent security vulnerability in > substitutes. It definitely would make sense. > > I told them that it's not possible due to how Guix releases work with > the pull logic not accepting descendants, but I realized I was wrong > in > that regard. > > It should be perfectly fine to take the release-1.5.0 branch, create > release-1.5.1 and put a few commits on top of it - cherry picking the > fixes for the daemon for example. > > Then we would have to merge it to master with a merge commit (no code > needs a change in master, though, it could be just a merge commit > without changes in master with the proper resolution this can be > done). > This ensures that people using it can pull to latest master. > > I think doing minor releases would make sense for critical bugs and > for > security fixes to Guix itself. As long as this is kept, it should be > fairly trivial to ensure the release works fine, since we're building > on > top of something that has already been released, just doing small > fixes. > > What do you think of this idea? > > Regards > Rutherther
Hi Rutherther, This seems like a great idea. Please tell me if there is anything I can do to help. Have a nice day, Noé
