Ubuntu 26.10 completes transition to Rust-based coreutils (omgubuntu.co.uk)

172 points by theanonymousone 19 hours ago

collinfunk 18 hours ago

I really don't understand why Canonical rushes this. If 'rm' can't remove all possible directory entries, that is a big issue:

  $ podman run --rm -it ubuntu:26.10
  $ apt update -y; apt upgrade -y
  $ rm --version
  rm (uutils coreutils) 0.10.0
  $ gnumkdir -p $(yes a/ | head -n $((32 * 1024)) | tr -d '\n')
  $ rm -rf a
  Segmentation fault (core dumped) rm -rf a
  $ ls a
  a
  $ gnurm -rf a
  $ ls a
  ls: cannot access 'a': No such file or directory

monegator 21 minutes ago

but it segfaulted in a memory safe way.

teekert 18 hours ago

Rush? This is an interim release (95% or so only tracks LTS's) that is not even out yet... Go file a bug reports if you have some time.

Symbiote 2 hours ago

The bug report I filed several months ago hasn't been looked at. Many of these utilities were released and made the default for Ubuntu 26.04 LTS!

There's a whole load of basic bugs reported and ignored:

https://bugs.launchpad.net/ubuntu/+source/rust-coreutils

rwmj an hour ago

mixmastamyk 17 hours ago

I did, and the original dev of the component fixed it within a few days. It was straightforward, a backwards reading of a spec, reordered.

The fix is still sitting unmerged many months later.

This surprised me since I thought the project was in heavy bugfix/compat mode. I won’t touch it until I see some velocity on open bugs.

baq 3 hours ago

collinfunk 18 hours ago

I have. It has been an open bug upstream for years as well.

teekert 18 hours ago

LtWorf 3 hours ago

My experience is that filing bug reports to ubuntu is a complete waste of time. Not sure if it's different for paying users.

jeffbee 18 hours ago

Reporting bugs before Ubuntu releases has never worked for me. They always land a bunch of major changes after the supposed "freeze" then they ignore all feedback because of the freeze. It's infuriating.

collinfunk 17 hours ago

znpy an hour ago

And that’s why i keep ubuntu far from my computers…

barbarkaragul an hour ago

Hi, this is not a one bug.when the change app flags not working or not happening. I was measured with bsd and busybox.

amelius 18 hours ago

Let them first fix Snap.

tjoff 4 hours ago

There is no reason for anyone on any distro to use snap.

It will die so just leave it alone.

0x696C6961 9 hours ago

They need to kill snap ...

LtWorf 3 hours ago

cute_boi 4 hours ago

froh 2 hours ago

to enable GPL free embedded Ubuntu, field tested on all platforms (because it happens to be the default).

dark-star 18 hours ago

yeah, this is a bug. And yes, it should be fixed. But I don't think it will affect many users, I mean who has a 32000 -evels deep directory on their system?

geokon 2 hours ago

It's less about the specific issue and more indicative of bad/insufficient test coverage

tosti 16 hours ago

What programmer or programming language can't iterate a loop more than 32000 times?!

IshKebab 16 hours ago

Ygg2 16 hours ago

hulitu 4 hours ago

secondcoming 18 hours ago

That way of thinking just means it'll never be fixed

abirch 18 hours ago

gpm 18 hours ago

7bit 18 hours ago

IshKebab 16 hours ago

I mean, that should work... but you can see why that would be considered low priority right?

lynx97 4 hours ago

Wow! Memory safety and such... Reminds me when a friend of mine wrote in IRC long time ago: "Hmm, tail just segfaulted." When I asked "Are you on Hurd?" he just replied "Yes."

erminpour 2 hours ago

Whether you like Rust or not, it's questionable as to why Canonical would push this so much and do it in such a cavalier way.

Will this really make coreutils more secure? I doubt it, if anything there will be a river of new bugs.

So, again, why are they pushing Rust so much? Having Microsoft make Rust a 'Tier-1' language also doesn't bode well.

pjmlp an hour ago

Canonical has been pushing its own agenda for ages, how many examples do you need?

Microsoft making Rust tier 1 is great, it means probably one day we get a VS proper support instead of VSCode only.

If you head off to Microsoft official blogs, you will find out that Microsoft already has tier 1 support for Java (ironically), Python and Go, besides the usual .NET languages and C++.

Malakun 18 hours ago

You can use coreutils-from-gnu instead uutils. However since 26.04 build-essential depends on coreutils-from-uutils, it cannot be upgraded while coreutils-from-gnu is installed.

https://bugs.launchpad.net/ubuntu/+source/build-essential/+b...

egorfine 17 hours ago

For now you can list dependent packages manually in apt-get install: https://packages.ubuntu.com/resolute/build-essential

But it's clear that Ubuntu will remove coreutils, genuine sudo and other tools from the future versions. It's the direction, it's ideological and thus nor merit nor our feedback will change anything here.

lioeters 15 hours ago

> genuine sudo

That made me curious, it sounds related to this:

Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords - 5 months ago (413 comments)

https://news.ycombinator.com/item?id=47464134

egorfine 14 hours ago

collinfunk 17 hours ago

You can use equivs to create a dummy coreutils-from-uutils package, as mentioned in the responses to that report.

It is frustrating that Canonical has no interest in fixing it, though. It makes it hard to take their claims seriously that you can still use GNU coreutils if you want.

dwattttt 2 hours ago

You're specifically frustrated about unbounded stack recursion exhausting the stack, triggered by multiple thousands of directories? It doesn't sound like this is about multi-thousand-deep directory structures, it sounds like it's about something else.

Because even diving into it, I would agree with a prioritisation decision that puts this bug down the bottom of a priority list.

Arcuru 17 hours ago

Has the code quality in that repo gotten to a good point then? I haven't followed it much, but last I looked[1] (which was a few years ago) almost every tool I looked at in detail had pretty bad performance or correctness issues.

[1] https://jackson.dev/post/rust-coreutils-dd/

egorfine 17 hours ago

The reason for existence of uutils is ideological, not technical. Thus code quality is of no use for the objective.

stouset 16 hours ago

I’m a huge proponent of Rust and generally lean a lot closer to the RIIR mentality than most, but this effort seems to be such a waste of effort and resources.

There have been a dozen CVEs reported against all of coreutils in the past twenty years. The most recent audit of uutils-coreutils turned up forty-four CVEs.

By all appearances they’re replacing battle-tested and fundamental tooling which hasn’t been a problem with extremely amateurish Rust. The threading highlighted in the linked post above seems pretty egregious.

egorfine 16 hours ago

tcfhgj 8 hours ago

I bet you don't know the reason for existence

estebank 17 hours ago

> last I looked[1] (which was a few years ago)

You weren't kidding: it was exactly 4 years ago ("September 13, 2022").

t0duf0du 3 hours ago

werdl an hour ago

I don't understand - I thought sudo-rs was supposed to be a drop-in replacement? If it implements a subset of features how can this be the case?

collinfunk 29 minutes ago

I don't think sudo-rs ever advertised itself as a drop in replacement. They seem pretty upfront that it isn't their goal. See this list:

https://github.com/trifectatechfoundation/sudo-rs#difference...

sehw 2 hours ago

People still use ubuntu when Debian and Mint exist?

pjmlp an hour ago

Yes, proprietary hardware support out of the box, and pre-installed option by the few OEMs that sell GNU/Linux computers.

LtWorf 2 hours ago

The power of marketing…

Ubuntu does offer some certifications but only for paying customers, so everyone else should really steer clear.

Surac 2 hours ago

Other distros are based of ununtu. Will the all ship with crippled coreutils from now on?

suby an hour ago

Linux Mint mentioned on their blog that they would be using the Rust versions.

SubiculumCode 4 hours ago

So what is the way forward for Linux to have sandboxi g as strong as Android? Appimage everything? I know it's possible now hacking together things, but I mean by default and integrated.

uecker 2 hours ago

Maybe we could develop trustworthy free-software applications again, instead of trying to establish a commercial apps ecosystem on top of Linux?

bayindirh 2 hours ago

Amutable. Building an immutable and image based system which even the installer can't modify, a-la macOS.

One systemd patch at a time.

hexfish an hour ago

AppImage is not a sandbox

Alien1Being an hour ago

Ubuntu continues on it's quixotic mission to kill Linux...

dsign 5 hours ago

Hmm, this doesn’t make sense. You simply don’t replace utilities with many decades of maturity and that “just work” with something that is not as mature. It will open all users of the distro to all sorts of subtle and not so subtle bugs. I for one don’t want to find myself staring at a mysterious segfault when I want to build the latest version of nodejs or flash a microcontroller. It’s such a pity; I have used Ubuntu for close to 23 years.

overfeed an hour ago

on the other hand, Rust is memory safe!

someothherguyy 4 hours ago

then install the other tool. no one is holding a gun to your head. it isn't windows.

nairboon 3 hours ago

Like how one can easily not use snap on Ubuntu? /s

hk1337 17 hours ago

Was there something wrong with how they are currently written or do they just want the badge that says they converted to Rust?

Flimm 4 hours ago

Neither. They basically see Rust as the future. They want to be able to attract young contributors and to hire young employees who are excited about Rust and who want the safety features. Bear in mind, the average age of the Linux developer is increasing. They also see technical benefits in Rust. And they are increasing test coverage of both the Rust tools and the tools written in C, IIRC.

My source is this interview with the VP of Engineering at Canonical on this topic: https://corrode.dev/podcast/s05e05-canonical/

pjmlp an hour ago

Interestingly enough, young developers have no issues writing C or C++ when it comes to game development, Pebble, Arduino or ESP-32 coding.

collinfunk 23 minutes ago

Canonical hasn't contributed anything to GNU coreutils in the time since the switch was announced, just to be clear.

uecker 2 hours ago

In reality, I think it much more about taking more control over parts of the ecosystem - the license change is part of it, but also getting rid of the old stubborn communities and maintainers.

01HNNWZ0MV43FF 6 hours ago

License. GNU is copyleft and the new thing is permissive.

We might see a fracture open slowly. For me, even AGPL is not enough

zahlman 5 hours ago

Once they have a more permissive license, cui bono?

pjmlp 3 hours ago

nalekberov 2 hours ago

If you ask their motivation? "We want to make them safer"

They worked pretty fine for decades, now, who needs these rewrites? Not saying it's useless, but in practice, what benefits did this bring?

froh 2 hours ago

it's GPL free. which is good for embedded, the business side of it. like cars.

rwmj an hour ago

Good for car manufacturers, not necessarily for cars or their owners. As a car owner I quite like manufacturers to be forced to produce source code.

justincormack an hour ago

The kernel is still GPL

grougnax 3 hours ago

Can’t wait for the whole Rust rewrite of Linux!

atoav an hour ago

I would be very curious about a bit more concrete and substential criticism what is bad (or good) about how the both versions, that goes beyond general arguments like:

  Just because it is Rust, it is not safe!  
  
  It worked before, don't replace it!  
  
  etc.  
  
Not that these are not valid points of criticism, but in my opinion if we have two core utils we can (and should) pick the better one after careful continous evaluation. And if the old one is the better one on the day of the release, so be it. Having two competing solutions can have benefits for everybody looking for the best core utils they can get in the long run.

I had to reimplement and reverse engineer old tech myself as part of my dayjob and had those engineers seen my results it probably would have improved their work as well, since I usually found oddities that they probably did not intend to be that way. This means my work on their work could be seen as another pair of eyeballs, bullet-proofing their original work, instead of seeing me as a threat. That additional pair of eyeballs is crucial to open source software.

This is why it is sad that too much about this whole discussion feels like yet another culture war, heated on the stove of social media figures looking to convert heat into ad revenue.

Which is why I would love to have more concrete points of technical criticism of specific bits maybe even to specific lines in the code or specific reproducable behavior.

If we go the culture-war route nobody wins, if we discuss both solutions on their merits, we all can win.

mrheosuper a minute ago

> since I usually found oddities that they probably did not intend to be that way.

Or it could be you don't have the context like they did. Maybe some hardware bug/quirk that happens on some exotic machine that you don't have.

arjie 4 hours ago

Everything online reminds of when Ubuntu switched to dash for init scripts or something. Good times.

asrk-qlwu 18 hours ago

From the company that distributed Amazon spyware (https://www.fsf.org/blogs/rms/ubuntu-spyware-what-to-do) and now turns Debian into Slopian. No thanks.

WatchDog 2 hours ago

Fil-C[0] can compile GNU coreutils, it has stronger* memory safety guarantees than rust, none of the compatibility issues that a wholesale rewrite has, and performance that seems to be within about a factor of two[1] compared to the normally compiled code..

[0]: https://fil-c.org/.

[1]: https://bannalia.blogspot.com/2025/11/comparing-run-time-per...

* Guaranteed to crash rather than potentially grant arbitrary code execution.

quotemstr an hour ago

"Stronger" is absolute bullshit. No data race prevention. No intra-object protection. Mandatory GC, and 5x the compute cost. Nothing like a statically safe language.

logicchains an hour ago

It's coreutils, there shouldn't be any threads to be data racing.

tcfhgj 28 minutes ago