Hi, Simon Tournier <[email protected]> writes:
> Hi, > > If you install Guix System from the released image v1.5.0, yes, > guix-daemon is vulnerable BUT… > > …once the installation complete, right after and before any other > action, if you run ’guix pull` as root and update your system, then > you’ll get the last guix-daemon – free from these vulnerabilities. > > I agree it’s far from perfect because the intermediary step is > vulnerable and resource-costly. > > As the blog post says [0], one question reads: > > Whether to pass --no-substitutes is therefore a judgment call > that must take into consideration how long it has been since > these vulnerabilities were made public, how exposed the network > paths between your system and your substitute servers are, how > feasible it is for the system in question to build guix by > itself, whether the system in question has multiple users, and > of course, your threat model. > > And it’s hard to answer for you. :-) > > Hope that helps. > > 0: https://guix.gnu.org/en/blog/2026/guix-substitute-pull-vulnerabilities/ Yes, it could work. But, as you say, it will mean using a vulnerable version of Guix-daemon. Best regards ------- Gendre Sébastien
signature.asc
Description: PGP signature
