In order to assist development in a number of languages I've been researching convenient ways of packaging their libraries or otherwise managing them.
An option I've found which seems fairly functional is Guix. However, I've been wondering about the security aspects of Guix which I may be partly overlooking.
One of the obvious risks is the one of a malicious definition, no different from a malicious Debian or Arch package.
Should I refrain from using this on any security-critical machine or does it seem about as trustworthy as Debian itself should be considered?