Hi,
On Sun, 25 Oct 2026 at 12:49, Sébastien Gendre <[email protected]> wrote:
> Do we have any update on how to install Guix System, or Guix package
> manager, on a new computer while avoiding the vulnerabilities fixed this
> summer ?
>
> I would love to switch my laptop to Guix System. Now, it's on
> Fedora + Guix package manager. Does the Guix-daemon used on the
> installation disk of Guix System is still vulnerable ?
If you install Guix System from the released image v1.5.0, yes,
guix-daemon is vulnerable BUT…
…once the installation complete, right after and before any other
action, if you run ’guix pull` as root and update your system, then
you’ll get the last guix-daemon – free from these vulnerabilities.
I agree it’s far from perfect because the intermediary step is
vulnerable and resource-costly.
As the blog post says [0], one question reads:
Whether to pass --no-substitutes is therefore a judgment call
that must take into consideration how long it has been since
these vulnerabilities were made public, how exposed the network
paths between your system and your substitute servers are, how
feasible it is for the system in question to build guix by
itself, whether the system in question has multiple users, and
of course, your threat model.
And it’s hard to answer for you. :-)
Hope that helps.
Cheers,
simon
0: https://guix.gnu.org/en/blog/2026/guix-substitute-pull-vulnerabilities/
