On 2026-10-26 17:36, Sébastien Gendre wrote: > Daniel Lakeland <[email protected]> writes: > >> If you have a guix system that is up to date and need to install a new >> system you can use the 1.5.0 installer on the new system, set up the new >> system to receive deployments from the up to date system and then guix >> deploy the update to the new system from the up to date system... This >> seems like it should be relatively safe as the up to date system is the one >> verifying the substitutes. > > But, the 1.5.0 Guix System install will use its Guix-daemon to install > the new system. And this daemon is still vulnerable.
If the vulnerability is within (guix subsitute) and the substitutes are verified by the up-to-date system, then the vulnerability of the system being updated should not apply, as far as I can tell. Meanwhile, I just tried a 'guix system reconfigure buildbox.scm' for the machine I am setting up to build for other local machines. It is old, but a corei7 with 16gb ram. The build took over 2 full days and finally failed due to an un-buildable dependency. I forgot to use the 'time' command so I don't know exactly how long it took, but after it failed i ran the check script from https://guix.gnu.org/en/blog/2026/guix-substitute-pull-vulnerabilities/ - which indicates that this guix is not vulnerable. So I guess I must have already done the update without remembering I did it? I hope so, because if it takes 2 days to do part of the build, and the computer is vulnerable during that time, it's obviously not ideal. When I did the mitigation on the machine this one replaces (that one mysteriously died on me one day when I unplugged a usb mouse and then plugged it back into the same port, killing the main board and both ssd drives) it took only about 18 hours iirc. In any case the update *with* substitutes is now complete, having taken 6m20s. Time to reboot!
