Hello Guix, Thanks to all for the fixes for the `guix pull` and `guix substitute` vulnerabilities!
I am trying to upgrade my Guix system using --no-substitute. A `guix pull --no-substitutes` was successful but I chose to cancel a system reconfigure with --no-substitutes after several days of building compiler toolchains locally... Since `guix pull --no-substitutes` was already successful, I am trying to use the deamon that came with that to reconfigure my system, using the following procedure: ``` guix pull --no-substitutes # do not use substitutes guix repl -- guix-substitute-and-pull-vuln-check.scm # result: vulnerable sudo herd stop guix-daemon sudo -E guix-daemon --build-users-group=guixbuild & # run guix-daemon from user profile (already upgraded) guix repl -- guix-substitute-and-pull-vuln-check.scm # result: not vulnerable sudo guix system reconfigure /run/current-system/configuration.scm # use substitutes to reconfigure system ``` Compared to the guidance in the blog post (https://guix.gnu.org/en/blog/2026/guix-substitute-pull-vulnerabilities/), I think this removes the trade-off between building everything locally and upgrading with a vulnerable daemon for the system reconfiguration step. Please let me know if you see a problem with this approach. Posting it here in case anyone else is also trying to rebuild their system configuration without substitutes. Best, Lukas
signature.asc
Description: PGP signature
