mbox series

[bug#70022,0/2] Binary Installation: Add more distros.

Message ID cover.1711495227.git.GNUtoo@cyberdimension.org
Headers show
Series Binary Installation: Add more distros. | expand

Message

Denis 'GNUtoo' Carikli March 26, 2024, 11:45 p.m. UTC 
Hi, this patchset documents the status of Guix packages in Trisquel and
Parabola that I also both use.

For Trisquel the guix package probably comes from some upstram
distribution.

For Parabola, the package comes from AUR, the Arch Linux User repository,
which is a community repository for Arch Linux where anyone can
contribute/maintain packages. I added that package in Parabola, and the
guix-installer packages was made from scratch by me.

As for the list of distributions that have Guix packages, we can find more at
https://repology.org/project/guix/versions but unfortunately I'm not familiar
enough with the other ones (like Nix/NixOS, Alpine, etc) yet to confidently
add instructions to install the guix package.

More distros having guix packages can be found at:

Denis 'GNUtoo' Carikli (2):
  doc: Binary Installation: mention Trisquel package.
  doc: Binary Installation: add Parabola packages.

 doc/guix.texi | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)


base-commit: c3f15443bc6d457758aad1326dcc6dcad9cf8d6e

Comments

pelzflorian (Florian Pelz) March 27, 2024, 4:09 p.m. UTC | #1 
Hi Denis.  This is in principle a great improvement, however note that
recently (4th March or so) a local privilege escalation vulnerability in
guix-daemon was discovered
<https://guix.gnu.org/en/blog/2024/fixed-output-derivation-sandbox-bypass-cve-2024-27297/>
and many distros have not fixed it yet, such as AUR and therefore your
Parabola pcr package or Debian’s long-term releases, which Debian’s guix
packager complained about
<https://security-tracker.debian.org/tracker/CVE-2024-27297>.

Perhaps we should think about how and where we can also instruct users
to upgrade their daemon in a timely manner.  This will be different for
guix packages (that configure a vulnerable daemon systemd service) and
for guix-install (where it is enough to follow the guix pull news file,
if the admin actually uses guix pull themself and can see the news).

Otherwise LGTM.

Regards,
Florian