⚠ Several critical #Guix daemon vulnerabilities and a minor vulnerability in ‘pull’ and ‘time-machine’ have been fixed: time to upgrade! ⚠
https://guix.gnu.org/blog/2026/guix-substitute-pull-vulnerabilities/
@civodul For some reason I still see "Looking for substitutes..." messages in the build log even with --no-substitutes. Is there a way to detect whether some "bad" substitute was downloaded or do I just need to go ahead and nuke my laptop?
@graywolf You mentioned elsewhere that ‘--no-substitutes’ was ineffective because you were offloading, did I get that right?