‘guix substitute‘ and ‘guix pull‘ Vulnerabilities

These correspond roughly to apt upgrade and apt update. A substitute is a pre-compiled package.