‘guix substitute‘ and ‘guix pull‘ Vulnerabilities
submitted by
guix.gnu.org/en/blog/2026/guix-substitute-pull-…
These correspond roughly to apt upgrade and apt update. A substitute is a pre-compiled package.