Le samedi 30 août 2025 à 01:20 +0200, Denis 'GNUtoo' Carikli a écrit : > If you however just did 'sudo apt install guix' to install Guix, then > the daemon will not be upgraded with the command above, and it will > most likely contain security vulnerabilities (The Guix daemon from > Guix 1.4.0 contains several privilege escalation vulnerabilities). > > The "2.5 Upgrading Guix" section of the manual[1] was updated a few > days ago to reflect that and also contains instructions to upgrade the > daemon when guix was installed with 'sudo apt install guix', and it has > more details on the issue as well.
Thanks, I had never realized this before. Currently, the Trisquel wiki suggests installing with 'sudo apt install guix' and it is missing the new instructions of the guix manual for this case, so I'd like to update it. Now, I am hesitating between: 1) add the missing instructions of the manual in order to update the guix daemon if guix was installed with 'sudo apt install guix' 2) recommend installing with the script I noticed that the udpated manual says that guix-install.sh is packaged in Parabola, so I would tend to update the Trisquel wiki by recommending to install with the script instead of 'sudo apt install guix'. Do you see any reason to use the package rather than the script? -- David Lecompte <[email protected]>
