Removing Guix from Debian

Summary

Welcome to LWN.net The following subscription-only content has been made available to you by an LWN subscriber. Thousands of subscribers depend on LWN for the best news from the Linux and free software communities. If you enjoy this article, please consider subscribing to LWN. Thank you for visiting LWN.net! By Joe BrockmeierSeptember 2, 2025 As a rule, if a package is shipped with a Debian release, users can count on it being available, and updated, for the entire life of the release. If package foo is included in the stable release—currently Debian 13 ("trixie")—a user can reasonably expect that it will continue to be available with security backports as long as that release is supported, though it may not be included in Debian 14 ("forky"). However, it is likely that the Guix package manager will soon be removed from the repositories for Debian 13 and Debian 12 ("bookworm", also called oldstable). Debian has the Advanced Package Tool (APT) for package management, of course, but Guix offers a different approach and can be used in conjunction with other distribution package managers. Guix is inspired by Nix's functional package management; it offers transactional upgrades and rollbacks, package management for unprivileged users, and more. Unlike Nix, its packages are defined using the Guile implementation of the Scheme programming language. There is also a GNU Guix distribution as well; LWN covered both NixOS and Guix in February 2024, and looked at Nix alternative Lix in July 2024. On June 24, the Guix project disclosed several security vulnerabilities that affected the guix-daemon, which is a program that is used to build software and access the store where successful builds are kept. Two of the vulnerabilities, CVE-2025-46415 and CVE-2025-46416, would allow a local user to gain the privileges of any build users, manipulate build output, as well as gain the privileges of the daemon user. The vulnerabilities also impacted Nix and Lix package managers. The disclosu...