Ubuntu's Rustification Has a New Milestone! Coreutils Migration is Complete
a month ago by SocialistVibes01 to c/linux
Oboi here we go đ
Ubuntu has managed to do away with GNU Core Utilities in its default stack. The last three holdouts, cp, mv and rm, have moved to uutils' coreutils; the Rust reimplementation Canonical has been feeding into the distro since 2025.
They had been held back from 26.04 LTS over flaws in the uutils versions. Everything else, from ls and cat to chmod and du, made that jump in earlier releases.
This change, while big, sits hidden away in an obscure mention in Canonical's work-in-progress release notes for Ubuntu 26.10.
It's been a long road
Canonical started oxidising Ubuntu last year, and Ubuntu 25.10 became the first release to ship coreutils as the default. That release also made sudo-rs the default privilege tool, replacing a command that had been in place for decades.
26.04 was the release where the plan did slow down quite a bit, as Canonical kept cp, mv, and rm on their GNU versions due to a bunch of TOCTOU issues that were blocking the full implementation.
These were caught during an audit, when Canonical commissioned Zellic for two rounds between December 2025 and March 2026, focusing on the most security-sensitive utilities first.
Across both rounds, Zellic raised 113 issues, and 44 of them were assigned CVEs. Canonical says the vast majority have been resolved.
Getting here has had its ups and downs, and the last stretch was not clean. In July, uutils cp went back into the archive and came straight out again after it broke live image builds.
The fix was quick; as the developers marked it "Critical," the fix went upstream, and the migration landed in time for 26.10. What changes for you?
When typing commands, nothing changes for you on the surface. uutils coreutils is designed to be a drop-in replacement for essential GNU tools, and the project treats any divergence from GNU as a bug, further pointing out that some options may still be missing or behave differently.
So if you prefer staying on the GNU version, you have the option to install the coreutils-from-gnu package that houses all the required components.
The next stage
Coreutils is one piece of a broader campaign. Earlier this year, Canonical became a Gold Sponsor of the Trifecta Tech Foundation, pitching in âŹ40,000 a year to fund memory-safe system software.
Under this, their current target is ntpd-rs, a Rust rewrite of the tools Ubuntu uses to keep its clock in sync. While work is still ongoing, it has already arrived for testing.
Its transition to being default is targeted for Ubuntu 27.04.
What Canonical is gradually building up towards is the completion of their oxidation vision for Ubuntu, and it's not about blindly including new components. Rather, it looks like a measured approach that's being worked out a few steps at a time.
I really don't see what they would gain by license laundering... They'll unGPL Debian, Gnome, Wayland and the Linux Kernal next?
If you wanted something out of copyleft, you would have an easier time just building on top of FreeBSD. It does like ~80% of what Ubuntu does already.
I don't feel too hot about them using MIT either, but I fail to see why they would implement this just to get rid of a GPL component. Seems expensive for nothing.
Yea know that is a fair point. I guess I struggle to see any other reason to support this? Even though I believe rust is nominally more secure itâll be a decade before any core utils clone will be as hardened as the original just by virtue of the original having decades of bug finding and fixes done already.
I donât think canonical would go through the effort under normal circumstances but I think theyâre just taking the opportunity in front of them to ride the rust hype into a less copyleft ecosystem.
This actually ties into a broader complaint I have that the rust ecosystem is built around MIT due to influence of the corporate backers of the rust foundation. Which is unfortunate because I actually really love rust as a language.
My bet is, Canonical as a service provider has a customer that is willing to pay for access to more secure rust utils. Or they want to save resources fixing CVEs.
There's also the spectre of future security regulations possibly demanding these changes one day too.
I still think its built on someone else's money. lol
Ubuntu did invest in a security audit of uutils. It revealed issues that show fundamental misunderstandings on how to use posix APIs. If they cared about security they would have postponed the adoption at least one more cycle. Uutils are they not ready for general availability.
Plus after decades of bug fixing coreutils doesn't have lots of security issues.
The VP of engineering of canonical keynoted Rust conf about uutils and is pushing forward the project. My guess is for political capital inside canonical.
Will long term uutils or another coreutils written in Rust will be a great improvement. Today is not the day.
Hmm you could very well be right. I guess Iâm being to reasonable by knowing new rust code is not automatically (and not usually) more secure then old c battle tested c code. Shareholders and CEOs donât understand that, I wouldnât be surprised if someoneâs been convinced rust is axiomatically more secure and bankrolling the migration over it
Yeah, they only need to replace about fifty thousand GPL packages, and voila, Ubuntu's laundered! Should take only about a hundred thousand years at this pace, very realistic.
How is this license laundering? These are complete new implementations and the original projects are not touched.
Because Canonicals real goal is to move Ubuntu entirely to corporate friendly licensing under the pretense of migrating to rust. Obviously they leave the original untouched, itâs a matter of adoption. Without the oxidization argument nobody would have gone along with Ubuntu just deciding to do a clean room implementation of gnu tools in corporate friendly licensing, by making it about oxidation they are able to manipulate a large portion of the rust community into contributing/supporting their license laundering.
It's not even Ubuntu doing the new implementation. And no, having a new project that is compatible to an existing one does not make it a license laundering. The word "license laundering" doesn't even make sense.
Uh call it whatever you want but canonical pouring money and resources into development of corporate friendly licensed clones to existing tools so they can avoid copyleft restrictions in the future is not good. I never understand when people feel the need to defend corporations obviously harmful behavior.
This is not a takeover of GPL project, this is a new project that is compatible to existing tools with GPL license. The old GPL projects are untouched and not controlled by Canonical.
He's knows but is being cynical about it.
Who's issuing the paychecks, Canonical or Microslop?
Why does it matter?
Its not 1-1 so this is going to fry some bash scripts and install scripts. At work we had to stop using Ubuntu because of a couple of bad installs via this change. Debian is just as good so its fine.
I have no opinions on the rewrite, but I wish they made a flavor or something just for this.
I had a problem literally today because some script was relying on a particular behaviour of dirname that was handled differently between uutils and GNU. It's been fixed already in a newer version than the one I had, but it took me a long time to figure out what the heck was going on, because finding a missing expectation in a nested shell script is tough...
It was just mysteriously doing the wrong thing.
I remember it was a common problem between Mac os and Linux as well.
One of the first things I get brew to do.
If you're going to rely on shell scripts, you should stick to the built-in functionality of your shell as much as possible, as external commands can differ, or even be completely overridden, in random environments for a myriad of reasons.
For example, use ${var%/*} instead of $(dirname $var). Forking out a whole OS process for such minuscule tasks is stupid anyway.
This goes against la-la unix philosophy dreamy thoughts and beliefs, or portability fantasies. But it's the right thing to do in the real world. And gives you at least some level of control over expected behavior.
I would argue the entire point of shell scripts is to coordinate running external programs, that's what the shell is for, but I'm a dreamer.
If I was just going to use the built-ins I'd use Python or Ruby or something.
In this particular case I didn't write the shell script, I was just debugging it because it broke on my system when I was running something.
Also your implementation has a bug because dirname blah.png returns "." đ
Also your implementation has a bug because dirname blah.png returns â.â đ
It wasn't meant as a 1-1 implementation, but fair enough.
I would argue that this helps my point. Because that's an ambiguity dirname doesn't help with. What if "bla.png" is, or expected to be, a dir?
And if you're going to test, are you going to use shell bult-ins or the test command from coreutils? And if you're calling test, are you calling it with the full path so you don't get a shell builtin anyway or not?
If I was just going to use the built-ins Iâd use Python or Ruby or something.
Using a better language is absolutely the right thing to do for anything that is not trivial.
Python is a shit choice for another reason though. They don't know what backward compatibility means. So you may find your script broken in 2-3 years anyway. I don't know about Ruby.
Parent mentioned that the supposed bug was already fixed, that's not the point.
And they target GNU compliance, not POSIX compliance. Which is hard mode, since if it was the latter, they could have just checked out the freebsd utils or whatever at will whenever they felt unsure about something.
The corporate adoption on uutils already started.
https://learn.microsoft.com/...
Windows is now using uutils for their coreutils. I want to see if Microsoft gives back anything to the project with that permissive license. Also, aren't canonical and Microsoft partners or something? I saw the Ubuntu wsl news.
They've been partners ever since WSL launched, it was initially only available with Ubuntu.
Trust that Microsoft will send upstream any feature they don't want to maintain themselves. Slowly, but surely there will be featured that only work on Windows. Then, when they believe they don't have to play nice anymore, they'll close off the code.
Embrace, Extend, Extinguish.
So, they will have to continue to support feature for feature, bug for bug with coreutils and others forever? What's the endgame here?
Relicensing
uutils is MIT
Unless other distros switch away from coreutils, it will remain the standard. It seems a lot of work for little/no upside.
This is dumb, I have to use osX for work and having coreutils be similar but not quite the same is a PITA, why would you inflict this on yourself to close a class of bugs that aren't really a huge concern for coreutils.
The problem with macOS is that they use BSD utils, which are lacking functionality from GNU utils. If anything, Rust uutils being pushover-licensed means that Apple would be more likely to replace their broken coreutils with uutils and you'd get more parity with the coreutils installed on most Linux systems.
And I say that as someone that despises pushover licenses, but this creates the probably that macOS utils won't suck someday.
One of the first things I do on brew is pop everything back in for scripting. That way WSL / Linux / Mac OS all scripting works mostly the same way. It gets about 90% of the way there for most standardization. And to be honest, if it starts getting out of control, other langs such as python are going to be better for the maintenance side.
As for the tech, I will leave it to those who are experts in the field. My worries are about the licensing. I just love GPL licences.
MIT: The recipient of this source code can do with it as they please. That may include building it, distributing it, modifying it, building and distributing those modifications, commercializing it, whatever.
GPL: The recipient of this software, including builds of it, is entitled to the source code that was used to build it. Anyone with the source code can modify it, share those modifications, make builds with it, etc, but you cannot restrict the rights of the recipients of your builds more than the terms you yourself received the source code under. So you can make changes and distribute builds of those changes, but users you distribute builds to are also entitled to your code including the changes you made.
AGPL: Same as GPL, except the recipients of this software also include users of the software, such as over a network. This was because with SaaS suddenly people were using software they hadn't "received", because it was running on someone else's computer and they only provided inputs and received outputs, so the licence was created to bring this back in line with the spirit of the GPL.
LGPL: You can use this library in your non-GPL code, and it doesn't "infect" your entire codebase by extending the entitlement of the source code outside the library to all users of your builds. It does still entitle users to the source code of the library itself though, especially if you've made changes to the code of that library.
People often talk about the GPL preventing commercial uses, but that's actually not true. You're allowed to sell GPL software. It's just a somewhat risky venture, because all users you sell software to also get all the source code. That means anyone can buy your software, request the source, and then immediately start competing with you by offering it themselves for free or cheaper or whatever. So it's allowed, but rarely works for very long unless you have a lot of good will in the community.
Two additions:
- some software is also sold under a separate license in addition to GPL, so you can choose if you want free open source or paid closed source (e.g. Qt has this model)
- being in breach of license terms doesn't mean you're forced to do anything automatically: it means you can get sued and a judge might order you to do something (probably pay money) to heal the breach, or you can settle out of court (probably by paying money).
There's an ongoing lawsuit: https://sfconservancy.org/...
It just takes forever and lots of money. That's not a software license problem though, that's more of an "American Legal System" problem. And I say that not to imply that it's worse than other legal systems, just that I know it's one with these problems and I don't know about others.
AGPL helps a bit more for commercial uses as its more strict. But its will not 100% of what people think of protection.
Very nice breakdown.
MIT: I build my thing on top of your thing, it's my thing now. I sell it, you have no rights.
GPL: I build my thing on top of your thing and your license forces me to distribute my thing under the GPL, including the source code.
There are legitimate arguments for both. Sometimes it sucks when proprietary things get built on top of MIT code but sometimes it takes money for innovation, and in the realm of code the world often benefits anyway by virtue of copycats or distillation.
Most times innovation needs money, it takes public money to do so.
Best website to look up any licence:
Here you go:
So for someone coming back into the open source linux world and went back to Ubuntu, does this mean that they're becoming like Microsoft? Does this mean I need to try a different OS?
Faaack I love Ubuntu but I won't stand for sticking with enshittification. Windows 11 dogshit is unavoidable trash and Ubuntu is at least a silver lining for a put together somewhat well managed OS.
Why Ubuntu though? For someone migrating from Windows I can recommend using an immutable distro like Bazzite/Silverblue/Kinoite (based on Fedora Atomic) or Opensuse Tumbleweed.
For me it's cause it's always been touted as a beginner Linux system
I think its beginner because it's all put together and it teaches prompt installs. It's also feels more like android to me and it's cute. It's Debian streamlined.
Try Linux Mint
I tried cinnamon mint and didn't like it. I tried arch and didn't like it but I'll test out that cachy OS at some point. I'm also a nerdy mother fucker that doesn't need as much as they think.
Like I can use gimp and Librewolf on Ubuntu and be happy. â of the time I'm just using the browser.
Like everyone I just wish Ubuntu had punchier rgb settings for the picture quality.
Ubuntu in 2008 was a recommended beginner OS and I think I'm still going off of that tbh đ€Šđ»ââïž
I don't understand why Canonical is replacing the existing GNU tools. Unlike many others, I don't think its "taking over GPL projects" or "license laundering" and I am also not against MIT license. My question is, why Canonical is doing this.
MIT is cancer
I think if someone licenses their applications wrong, they shouldn't use my library. That's why I license them as GPL.
But there's also LGPL if you're more tolerant to having your work used for less free software than I am.
I don't think so.
Why not?
Im not sure as well. A lot of popular stuff is on MIT. But if I were to guess, its one of the most permissive licenses, which is somewhat a bad thing when companies suction up solutions with AI and spit them out without attributing the coder involved.
I don't think Ai companies care about the license at all, or cannot be checked after the training. So that is not really an argument to me.
You could understand if you used a materialist analysis.
Canonical sells products and support to corporations. The gpl is a problem for corporations because it requires that they contribute their changes back into the commons, creating additional overhead in many ways.
Canonical is funding, prioritizing and providing support for a rewrite of a gpl project in a different language with a more permissive license.
Put two and two together. Canonical is bankrolling and pushing something that materially benefits them.
But from all the things why core-utils? I don't think it is common to need changes in core-utils. Now with this MIT version it may certainly be needed, because of broken compatibility. So it feels like instead of doing nothing (because they work as is) and using GNU core-utils they switch to MIT core-utils that are slightly incompatible and because of that need work. I would assume that it will certainly provide patches for MIT core-utils, but I am sure it will just make another platform target for scripts like macOS. Some GPL projects will change their scripts to make them work with Ubuntu.
I guess corporations will corporate.
Because the kernel is the kernel, you just accept it for what it is. The vendors modules are required to run on the stupid soc made on three generations old fabs youâre targeting in your build and the only other part you need to be portable is the standard core utilities.
Getting ahead of the curve regarding potential future legislations/regulations around unsafe languages, which may introduce contract conditions, liabilities...etc (See 2:30-4:30 of this talk for an overview).
If they listened to the calls describing this move as premature, and it arguably was, they could have gotten strapped for time later.
An implementation in a good safe fast modern language that developers actually enjoy has other tangible benefits of course. But if people want the "corpo reason", the above should provide an answer.
Little late, but currently watching the entirety of the talk. Very interesting to see a honest view from someone who is invested into safety and C++. The language itself will probably never be safe, but maybe "safe enough".
but maybe âsafe enoughâ.
It won't be. Bjarne doesn't want any real workable safety to be added. And that's for the best because it's a shit language. And falling out of favor, especially for new projects, is the best outcome.
Thanks for providing a source. I will watch it at later time and put it on Watch Later list. Until then I can't really say anything about it, just wanted to thank you.
Rust eliminates memory safety vulnerabilities. It accounts for a large percentage of bugs that need patching in live environments, like servers.
I believe Ubuntu wants to grow in iot or embedded devices so reducing patching needs gives them a competitive edge there.
Whilst that may be true, I would expect coreutils has all memory issues debugged by now.
I can understand new applications - or perhaps extended versions - to be created in Rust, rather than reinventing perfectly good wheels.
It feels like they're doing this just for the sake of it, and I expect there's probably better things that could be done with the money / labour
You'd like to think so..
https://app.opencve.io/cve/?product=coreutils&vendor=gnu
Latest cve is a heap overflow.
Interesting, thanks.
Looks like nothing has been found for 17 years until - presumably - someone pointed AI at the (entire?) suite and found 2 CVEs with a very low (<1%) chance of being exploited.
I'd guess that'll be the last 2 bugs left...
@lemmy.ml
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by AlpĂĄr-Etele MĂ©der, licensed under CC BY 3.0
go to feed...
@lemmy.ml
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by AlpĂĄr-Etele MĂ©der, licensed under CC BY 3.0
go to feed...
As a developer I love rust but canonical can fuck all the way off with this shameless license laundering.
save