user47827: What's the purpose of using Guix within Gitian? Doesn't that reintroduce dependencies and security concerns that were the purpose of transitioning from Gitian to Guix?
My understanding was that Gitian was reproducible but not bootstrappable and that Guix is an improvement to bootstrappable and reproducible?
This question was asked by robertspigler on IRC.

user48884: Gitian achieved reproducibility through the use of a virtual machine to isolate the toolchain used for building. This means that any and all unaudited and untrusted third party binaries execute in a contained environment where they are less likely to pollute and cause damage to the host system.
On the other hand, Guix is intended to be run directly on the host itself, so if there are any unaudited and untrusted third party binaries executed, they could cause damage to the host.
So some developers, notably luke-jr, want to perform Guix builds within a virtual machine to minimize this risk. This could be achieved by installing Guix inside of a virtual machine, but we already have Gitian and the infrastructure around it, so it is also possible to achieve this by running Guix within Gitian and avoid the need for such developers to figure out how to install Guix in a VM, and maintain the VM.
Furthermore, many people who have participated in the reproducible builds process may not have Guix setup yet. By doing Guix inside of Gitian, it will be possible for those people to participate in the new release process with minimal changes. Providing an easy way to transition from Gitian to Guix is the primary motivation for enabling Guix within Gitian.
Of course the recommended method is still to use Guix directly rather than through Gitian. There is a significant performance penalty for using Guix inside of Gitian. Additionally, running Guix directly allows for issues to be more easily debugged and worked through as the toolchain and extra binaries built will still be available to the builder.

47827: <p>What's the purpose of using Guix within Gitian? Doesn't that reintroduce dependencies and security concerns that were the purpose of transitioning from Gitian to Guix?</p>
<p>My understanding was that Gitian was reproducible but not bootstrappable and that Guix is an improvement to bootstrappable and reproducible?</p>
<p>This question was asked by robertspigler on IRC.</p>
 48884: <p>Gitian achieved reproducibility through the use of a virtual machine to isolate the toolchain used for building. This means that any and all unaudited and untrusted third party binaries execute in a contained environment where they are less likely to pollute and cause damage to the host system.</p>
<p>On the other hand, Guix is intended to be run directly on the host itself, so if there are any unaudited and untrusted third party binaries executed, they could cause damage to the host.</p>
<p>So some developers, notably luke-jr, want to perform Guix builds within a virtual machine to minimize this risk. This could be achieved by installing Guix inside of a virtual machine, but we already have Gitian and the infrastructure around it, so it is also possible to achieve this by running Guix within Gitian and avoid the need for such developers to figure out how to install Guix in a VM, and maintain the VM.</p>
<p>Furthermore, many people who have participated in the reproducible builds process may not have Guix setup yet. By doing Guix inside of Gitian, it will be possible for those people to participate in the new release process with minimal changes. Providing an easy way to transition from Gitian to Guix is the primary motivation for enabling Guix within Gitian.</p>
<p>Of course the recommended method is still to use Guix directly rather than through Gitian. There is a significant performance penalty for using Guix inside of Gitian. Additionally, running Guix directly allows for issues to be more easily debugged and worked through as the toolchain and extra binaries built will still be available to the builder.</p>
