And, package definitions in Guix are not shell scripts but highly abstracted functional installers that use the respective build tools of software packages. This makes them much easier to review - and quicker to write, in many cases.
Guix is also fully reproducible, and has the goal to provide safe distributely built software. (It gets significant hate from tech companies for requiring GPL licenses for the core distro, and thus not supporting binary code without source code).
As the case of the xz-utils package shows, this does not prevent that a widely used project is taken over by malicious actors, and stealthily malware becomes inserted. But the effort to do this is much larger, since this needs write access to the software’s source code.
And no, I don’t think Guix is the magical silver bullet for software security. But it is much better than unvetted shell scripts in AUR.
And of course, Guix has disadvantages, too. The biggest disadvantage is IMO that it is really slower than Arch’s pacman, because Guix - being based on source packages - sometimes builds stuff from source. But I think this does not matter so much if one is using it for ten or twelve extra packages. (It also got a lot faster with moving to Codeberg.)
Guix packages are vetted.
AUR packages aren’t.
And, package definitions in Guix are not shell scripts but highly abstracted functional installers that use the respective build tools of software packages. This makes them much easier to review - and quicker to write, in many cases.
Guix is also fully reproducible, and has the goal to provide safe distributely built software. (It gets significant hate from tech companies for requiring GPL licenses for the core distro, and thus not supporting binary code without source code).
As the case of the xz-utils package shows, this does not prevent that a widely used project is taken over by malicious actors, and stealthily malware becomes inserted. But the effort to do this is much larger, since this needs write access to the software’s source code.
And no, I don’t think Guix is the magical silver bullet for software security. But it is much better than unvetted shell scripts in AUR.
And of course, Guix has disadvantages, too. The biggest disadvantage is IMO that it is really slower than Arch’s pacman, because Guix - being based on source packages - sometimes builds stuff from source. But I think this does not matter so much if one is using it for ten or twelve extra packages. (It also got a lot faster with moving to Codeberg.)