Hello,
Recently, an announce have been made about vulnerabilities in
Guix-daemon:
https://guix.gnu.org/en/blog/2026/guix-substitute-pull-vulnerabilities/
At the end of the blog post, there is a Scheme script to test if our
version of guix-daemon have the vulnerabilities.
After upgrading Guix to version 51f7af3, restarted the Guix-daemon and run
the test script, I get this result:
restore-file: not vulnerable
fetch-narinfos: not vulnerable
file-uris: vulnerable
cache-key: error: ice-9/eval.scm:293:34: ERROR:
1. &invoke-error:
program:
"/gnu/store/aiaw9whilrny22a8p83ar4ch0i97chl1-git-minimal-2.54.0/bin/git"
arguments: ("fetch" "--" "origin"
"5a2d9baeda971df575c017669bca8eb8faa22ebd")
exit-status: 128
term-signal: #f
stop-signal: #f
I use Guix on a foreign distribution and followed the blog post
instruction to upgrade the Guix-daemon (except I added the
"--no-substitutes" flag). Is it normal to still have a vulnerability
about file-uris ?
Best regards
-------
Gendre Sébastien
