- cross-posted to:
- linux@lemmy.ml
- cross-posted to:
- linux@lemmy.ml
Ubuntu has managed to do away with GNU Core Utilities in its default stack. The last three holdouts, cp, mv and rm, have moved to uutils’ coreutils; the Rust reimplementation Canonical has been feeding into the distro since 2025.
They had been held back from 26.04 LTS over flaws in the uutils versions. Everything else, from ls and cat to chmod and du, made that jump in earlier releases.
This change, while big, sits hidden away in an obscure mention in Canonical’s work-in-progress release notes for Ubuntu 26.10.
It’s been a long road
Canonical started oxidising Ubuntu last year, and Ubuntu 25.10 became the first release to ship coreutils as the default. That release also made sudo-rs the default privilege tool, replacing a command that had been in place for decades.
26.04 was the release where the plan did slow down quite a bit, as Canonical kept cp, mv, and rm on their GNU versions due to a bunch of TOCTOU issues that were blocking the full implementation.
These were caught during an audit, when Canonical commissioned Zellic for two rounds between December 2025 and March 2026, focusing on the most security-sensitive utilities first.
Across both rounds, Zellic raised 113 issues, and 44 of them were assigned CVEs. Canonical says the vast majority have been resolved.
Getting here has had its ups and downs, and the last stretch was not clean. In July, uutils cp went back into the archive and came straight out again after it broke live image builds.
The fix was quick; as the developers marked it “Critical,” the fix went upstream, and the migration landed in time for 26.10. What changes for you?
When typing commands, nothing changes for you on the surface. uutils coreutils is designed to be a drop-in replacement for essential GNU tools, and the project treats any divergence from GNU as a bug, further pointing out that some options may still be missing or behave differently.
So if you prefer staying on the GNU version, you have the option to install the coreutils-from-gnu package that houses all the required components.
The next stage
Coreutils is one piece of a broader campaign. Earlier this year, Canonical became a Gold Sponsor of the Trifecta Tech Foundation, pitching in €40,000 a year to fund memory-safe system software.
Under this, their current target is ntpd-rs, a Rust rewrite of the tools Ubuntu uses to keep its clock in sync. While work is still ongoing, it has already arrived for testing.
Its transition to being default is targeted for Ubuntu 27.04.
What Canonical is gradually building up towards is the completion of their oxidation vision for Ubuntu, and it’s not about blindly including new components. Rather, it looks like a measured approach that’s being worked out a few steps at a time.
You must log in or # to comment.
re-writing things like these in rust feels like it’s probably a benefit in the long run. But the move from GPL to MIT license leaves a really bad taste in the mouth and feels like its more for the benefit of corporations and undermining copyleft.
This is why the BSDs never really took off. Corporations like Apple took them and made them their own, and stopped contributing proportionally to the profit they made off them.
Linux has the cancer license (in the words of Bill Gates) that had brought more Linux, and any attempt to capture it results in a fork. Copyleft has proved much more resilient than MIT, it forces you give without taking away.
While the feel-good kid stories we all heard and believed were nice, Linux would have never gone big if it wasn’t for a billion dollars dedicated by IBM to development in the 90’s, and continued funded development from other companies like RH (which IBM ironically eventually bought).
Most software installed in your system right now is not gnu-licensed btw. Fully functioning non-gnu distributions (sans the kernel) already exist too, with no tangible effect on the user experience for most.
Rust is okay, but nothing good will come out of this de-GPL-ization.
I’m sure this is the actual goal.
Yeah. I’m convinced they’re making these moves to be able to sell the company to Microsoft when the time comes.
Why would Microsoft want to buy Canonical? Microsoft’s main profit is from subscriptions like Azure and 365. Their other main product is Windows. Owning Ubuntu wouldn’t add anything to any of those. They already have their own Microsoft Linux distro.
And Canonical already has a good relationship with Microsoft.
This is a great comment. Not because it’s more stupid than the others, or because of the hilarious scenario envisioned. But because it transparently introduces the cognitive dissonance around liberal licenses, while still presenting as agreeable among the clueless.
The best way to “sell” open source code is to license it non-liberally while retaining copyright fully, or retaining the right to re-license for 3rd parties. And guess what, the latter is what Canonical does with its GPL-licensed projects + their contributor agreement.
In fact, you can go too copyleft to the point of becoming non-free (e.g. the SSPL).
The reason why liberal licenses are framed as corpo-friendly is because corpos can just take, they don’t need to “buy” anything.
Still the hilarious theories around “selling” coreutils, and the continued general ignorance about practically everything from the gantry here, gave me a good chuckle. Although its all starting to get derivative and repetitive.
So … tools that are used hundreds, if not thousands of times a day, by millions of people, over decades, replaced by rewriting in a different language, within 12 months, by what appears to be a blockchain web3 security company.
What could possibly go wrong?
Zellic did not write uutils/coreutils, they audited them. That is to say that they reviewed the existing source code and reported the issues they found.
Besides that, the first release of uutils/coreutils was back in April, 2020: https://github.com/uutils/coreutils/releases/tag/0.0.1
I am not familiar with Zellic, but given the popularity of Rust in the crypto space, I am also not surprised that a company that audits Rust code has ties to crypto
Besides that, the first release of uutils/coreutils was back in April, 2000
uutils predates Rust by 15 years lol
Thanks, fixed the typo, lol
within 12 months
The first uutils release, v0.0.1, was in April 2020.
Are you saying the transition to it was fast? Because it really was way too fast.
I absolutely think that it was too fast.
by what appears to be a blockchain web3 security company.
Huh?
What makes you think they have anything to do with crypto?
zellic
Oh, I thought you meant the Trifecta Tech Foundation.
Looks like zellic do code security audits, but they also specialize in auditing crypto (at least that’s how they’re differentiating themselves from other code security auditors in their advertising).
The general work would be the same so it seems fair to pay them for an audit.
You know that sudo-rs and uutils are unrelated right?
This is so bad on so many levels. Security, licensing, reliability, compatibility; it smells of corporate takeover.
Oh well. I never liked Ubuntu anyways.
That’s good news. Now, maybe NixOS?
You’re free to override coreutils with uutils. NixOS allows you to do that right now!
Coreutils are still in mkDerivation. Changing it to uutils would require rebuilding everything that isn’t a fixed output derivation.
But also, how would you replace coreutils with uutils? Using an overlay would mean rebuilding everything and putting it into systemPackages would surely mean a conflict.
An overlay and rebuild the world, yes. Maybe Nixpkgs Hydra can build this package set too, but I am strongly against making it the default.
Wait really? I just added them as a user package to overlay the system one
