Hi, Do we have any update on how to install Guix System, or Guix package manager, on a new computer while avoiding the vulnerabilities fixed this summer ?
I would love to switch my laptop to Guix System. Now, it's on Fedora + Guix package manager. Does the Guix-daemon used on the installation disk of Guix System is still vulnerable ? I quote my initial message bellow, where I list the different installation methods: Sébastien Gendre <[email protected]> writes: > [[PGP Signed Part:Good signature from B586F7C77239E29E Sébastien Gendre > <[email protected]> (trust ultimate) created at 2026-07-10T20:50:05+0200 using RSA]] > Hello everyone, > > Recently, we get vulnerability fixes on Guix-daemon, as announced on the > Guix blog: > https://guix.gnu.org/en/blog/2026/guix-substitute-pull-vulnerabilities/ > > A big thank you to everyone who has worked on it. > > > Do you know if the different installation methods of Guix and Guix > System will install the vulnerable or fixed version of Guix-daemon ? > > For the methods listed here: https://guix.gnu.org/en/download/ > They will all provide the version 1.5.0 of Guix and Guix System, so > probably the vulnerable version of Guix-daemon ? > > For the methods listed here: https://guix.gnu.org/en/download/latest/ > Do they provide all the fixed version of Guix-daemon ? > > For the method suggested on the manual, there is a bash script to > download: https://guix.gnu.org/guix-install.sh > After executing it, does the user get the fixed version of Guix-daemon ? > > I probably forget other method of installation. But if you get > information about it, don't hesitate to share it. > > > > Best regards > > ------- > Gendre Sébastien > > [[End of PGP Signed Part]]
