Hello Guix,

Thanks to all for the fixes for the `guix pull` and `guix substitute`
vulnerabilities!

I am trying to upgrade my Guix system using --no-substitute.
A `guix pull --no-substitutes` was successful but I chose to cancel a
system reconfigure with --no-substitutes after several days of building
compiler toolchains locally...

Since `guix pull --no-substitutes` was already successful, I am trying
to use the deamon that came with that to reconfigure my system, using
the following procedure:

```
guix pull --no-substitutes  # do not use substitutes
guix repl -- guix-substitute-and-pull-vuln-check.scm  # result: vulnerable
sudo herd stop guix-daemon
sudo -E guix-daemon --build-users-group=guixbuild &  # run guix-daemon from 
user profile (already upgraded)
guix repl -- guix-substitute-and-pull-vuln-check.scm  # result: not vulnerable
sudo guix system reconfigure /run/current-system/configuration.scm  # use 
substitutes to reconfigure system
```

Compared to the guidance in the blog post
(https://guix.gnu.org/en/blog/2026/guix-substitute-pull-vulnerabilities/),
I think this removes the trade-off between building everything locally
and upgrading with a vulnerable daemon for the system reconfiguration
step.  Please let me know if you see a problem with this approach.

Posting it here in case anyone else is also trying to rebuild their
system configuration without substitutes.

Best,
Lukas

Attachment: signature.asc
Description: PGP signature

Reply via email to