Grafts are still functional. We're not modifying existing builds. We generate new artifacts with updated references (think copy-on-write). However, these new

Grafts are still functional. We're not modifying existing builds. We generate new artifacts with updated references (think copy-on-write). However, these new artifacts don't need recompilation. They are copies with their embedded references recursively replaced such that they refer to the fixed variant of a library. This mostly just works, but it can lead to problems when upstream introduces ABI changes in security fixes. This is very rare but it happened at least once (I think it was openssl) --- like any other distro that updated the library in place users experienced problems. The assumption with grafts is that this doesn't happen, which is valid in the vast majority of cases that we encountered so far. That said, in Guix we try to minimize the period during which grafts are needed by "ungrafting" as soon as a properly rebuilt artifact is available on the build farm. This doesn't help those users who build everything from source exclusively, of course. But this is where reproducible builds help. Users don't have to be building everything from source if they have the tools to gauge how much they can trust providers of binary substitutes.