B-19 · Medium
planarian @ a924e09 · Spec v4.6 · snapshot main · all versions
A package referenced only by a store-path string (an
ExecStart=naming/nix/store/…directly, a script’s interpolated path) has nometato read at evaluation, so a fix to it does not move the security floor
| Breaks | Status | Mitigation | Closes in |
|---|---|---|---|
| Correct (I16) | Open | Residue of B-2: the evaluated inspected set covers every package value; the CVE feed matching the built closure covers strings | B |
The guarantees it narrows
I16.