Hi Rutherther,
On Thu Jul 30, 2026 at 9:57 PM CEST, Rutherther wrote: > recently someone on IRC asked if it would be possible to do minor > releases of Guix, due to the recent security vulnerability in > substitutes. It definitely would make sense. Months have passed (sorry for that!) and it would still make sense! It’s even more relevant today as the process to get to the next release as started. To me, and you correct me if I’m wrong, regular releases (major/minor) and security releases (patch) follow (mostly) the same process. So we don’t need to reinvent the wheel. > Then we would have to merge it to master with a merge commit (no code > needs a change in master, though, it could be just a merge commit > without changes in master with the proper resolution this can be done). > This ensures that people using it can pull to latest master. Oh… I didn’t see this one coming! I guess your right. The merge should be "trivial" as the security branch only contains changes that are already presents in master. But we should expect some conflicts anyway. I’ve actually never tried on a real project as, usually, the patch branch (for instance 1.5.x) is never merged back into the main branch. > I think doing minor releases would make sense for critical bugs and for > security fixes to Guix itself. As long as this is kept, it should be > fairly trivial to ensure the release works fine, since we're building on > top of something that has already been released, just doing small fixes. Several discussions have started in the meantime and now would be the good time to get everyone on the same thread/boat and give it a go. WDYT? -- Tanguy
