GNU Guix has [disclosed vulnerabilities](https://guix.gnu.org/blog/2026/guix-substitute-pull-vulnerabilities/) affecting two of its most critical operations: `guix substitute`, which fetches pre-built