On Sat, 11 Jul 2026 14:24:06 +0000 João Augusto <[email protected]> wrote:
> Hi all, just read the thread. > > As I recently installed the system on top of a Debian distribution > and ran `guix pull` and then `guix upgrade`. Would that fix the > vulnerabilities, since we are using the latest commit? > > Also, maybe would be good to just include a heads-up in the > installation guide, at least until the next release? There is already some information in the "Upgrading Guix"[1][2] section of the manual, but it has 2 issues: - It's not adapted to the last vulnerability as there is no mention of using --no-substitute. - The advices are good but the order is not optimal. For instance you cannot do systemd restart guix-daemon before doing 'sudo -i guix pull'. And maybe the whole section could be reworked to directly address the issue of how to upgrade instead of doing [upgrade this way] and [but it won't work if [...]]. I didn't find the time to do that yet, and it's been a while since I found that we needed to do 'sudo -i guix pull' before, and I was even the person who did the mistake in the first place, but we had only 'sudo -i guix pull' and 'systemd restart guix-daemon' before, so what we have right now is at least better than before. Though, if someone wants to fix it and does a patch, feel free to add me in the list of reviewers (I may have some time to help review). References: -----------[ [1]info "Upgrading Guix" [2]https://guix.gnu.org/manual/devel/en/html_node/Upgrading-Guix.html Denis.
pgpvIa5wf8OmH.pgp
Description: OpenPGP digital signature
