Hi, I think the argument that things that don't exist can't be abused is a good one.
However, a regular user can install it anyway. I don't remember when I last ran "guix package -i" as root. I just run it using my regular user account. So to separate the outputs adds just a miniscule step. In the end, there's a trade-off to be made. Either we trust users to develop, too, or not. Obviously they can use it for good or bad, then. I myself am a free software hacker and I'd prefer if systems automatically had the development stuff installed so others can be free software hackers, too. And an experienced hacker doesn't need header files either. I made up some of my own just searching Google - it's not difficult and takes about 30 min at most. If we want hardened critical production systems, I agree it should only contain absolutely required files with programs as simple as one can get them, use SELinux and use hardened gcc and someone should have reviewed the base libraries and any other stuff that runs (basically until a reasonable confidence level is reached). I don't think Guix should do that, though. IMO locking down everything for users is basically the antithesis of the FSF.
