Oboi here we go 🙄
Ubuntu has managed to do away with GNU Core Utilities in its default stack. The last three holdouts, cp, mv and rm, have moved to uutils’ coreutils; the Rust reimplementation Canonical has been feeding into the distro since 2025.
They had been held back from 26.04 LTS over flaws in the uutils versions. Everything else, from ls and cat to chmod and du, made that jump in earlier releases.
This change, while big, sits hidden away in an obscure mention in Canonical’s work-in-progress release notes for Ubuntu 26.10.
It’s been a long road
Canonical started oxidising Ubuntu last year, and Ubuntu 25.10 became the first release to ship coreutils as the default. That release also made sudo-rs the default privilege tool, replacing a command that had been in place for decades.
26.04 was the release where the plan did slow down quite a bit, as Canonical kept cp, mv, and rm on their GNU versions due to a bunch of TOCTOU issues that were blocking the full implementation.
These were caught during an audit, when Canonical commissioned Zellic for two rounds between December 2025 and March 2026, focusing on the most security-sensitive utilities first.
Across both rounds, Zellic raised 113 issues, and 44 of them were assigned CVEs. Canonical says the vast majority have been resolved.
Getting here has had its ups and downs, and the last stretch was not clean. In July, uutils cp went back into the archive and came straight out again after it broke live image builds.
The fix was quick; as the developers marked it “Critical,” the fix went upstream, and the migration landed in time for 26.10. What changes for you?
When typing commands, nothing changes for you on the surface. uutils coreutils is designed to be a drop-in replacement for essential GNU tools, and the project treats any divergence from GNU as a bug, further pointing out that some options may still be missing or behave differently.
So if you prefer staying on the GNU version, you have the option to install the coreutils-from-gnu package that houses all the required components.
The next stage
Coreutils is one piece of a broader campaign. Earlier this year, Canonical became a Gold Sponsor of the Trifecta Tech Foundation, pitching in €40,000 a year to fund memory-safe system software.
Under this, their current target is ntpd-rs, a Rust rewrite of the tools Ubuntu uses to keep its clock in sync. While work is still ongoing, it has already arrived for testing.
Its transition to being default is targeted for Ubuntu 27.04.
What Canonical is gradually building up towards is the completion of their oxidation vision for Ubuntu, and it’s not about blindly including new components. Rather, it looks like a measured approach that’s being worked out a few steps at a time.
As for the tech, I will leave it to those who are experts in the field. My worries are about the licensing. I just love GPL licences.
As a developer I love rust but canonical can fuck all the way off with this shameless license laundering.
Yeah, they only need to replace about fifty thousand GPL packages, and voila, Ubuntu’s laundered! Should take only about a hundred thousand years at this pace, very realistic.
I really don’t see what they would gain by license laundering… They’ll unGPL Debian, Gnome, Wayland and the Linux Kernal next?
If you wanted something out of copyleft, you would have an easier time just building on top of FreeBSD. It does like ~80% of what Ubuntu does already.
I don’t feel too hot about them using MIT either, but I fail to see why they would implement this just to get rid of a GPL component. Seems expensive for nothing.
Yea know that is a fair point. I guess I struggle to see any other reason to support this? Even though I believe rust is nominally more secure it’ll be a decade before any core utils clone will be as hardened as the original just by virtue of the original having decades of bug finding and fixes done already.
I don’t think canonical would go through the effort under normal circumstances but I think they’re just taking the opportunity in front of them to ride the rust hype into a less copyleft ecosystem.
This actually ties into a broader complaint I have that the rust ecosystem is built around MIT due to influence of the corporate backers of the rust foundation. Which is unfortunate because I actually really love rust as a language.
My bet is, Canonical as a service provider has a customer that is willing to pay for access to more secure rust utils. Or they want to save resources fixing CVEs.
There’s also the spectre of future security regulations possibly demanding these changes one day too.
I still think its built on someone else’s money. lol
Hmm you could very well be right. I guess I’m being to reasonable by knowing new rust code is not automatically (and not usually) more secure then old c battle tested c code. Shareholders and CEOs don’t understand that, I wouldn’t be surprised if someone’s been convinced rust is axiomatically more secure and bankrolling the migration over it
I think that aligns with the deployment strategy right? They are targeting 27 which is the middle release and not LTS. Get some mileage on it prior to 28 LTS.
But yeah, its all corpo speech when they talk about it. Its probably some executive decision of the likes of “We think Rust is axiomatically better, so let’s implement it” like you said.
How is this license laundering? These are complete new implementations and the original projects are not touched.
Because Canonicals real goal is to move Ubuntu entirely to corporate friendly licensing under the pretense of migrating to rust. Obviously they leave the original untouched, it’s a matter of adoption. Without the oxidization argument nobody would have gone along with Ubuntu just deciding to do a clean room implementation of gnu tools in corporate friendly licensing, by making it about oxidation they are able to manipulate a large portion of the rust community into contributing/supporting their license laundering.
It’s not even Ubuntu doing the new implementation. And no, having a new project that is compatible to an existing one does not make it a license laundering. The word “license laundering” doesn’t even make sense.
Uh call it whatever you want but canonical pouring money and resources into development of corporate friendly licensed clones to existing tools so they can avoid copyleft restrictions in the future is not good. I never understand when people feel the need to defend corporations obviously harmful behavior.
This is not about defending corporations. It doesn’t matter who does that, I don’t think writing new tools with a different license is bad. My opinion has nothing to do about who does that, if communities, or corporations. I think having tools in a different language than C, especially something like Rust, is a good thing. Anyone who writes Rust code can read, adapt and make changes to it.
And for licensing, GPL can be problematic in some cases that is not compatible with every license. Therefore having an alternative in MIT license is a good thing. Even if it ends up being in a proprietary program, its still better than not able to use the code. The old GPL code is still maintained independently.
Anyone who writes Rust code can read, adapt and make changes to it
Lol. Anyone who writes C code can read, adapt and make changes to it
Anyone who writes Python code can read, adapt and make changes to it
Anyone who writes Ada code can read, adapt and make changes to it
What kind of argument is that?
What kind of argument is that?
I thought its obvious what I meant, based on the context of my entire reply. The argument is, anyone who writes and understands can make changes to the Rust code, but not on C or Python code. I can basic C coding, but wouldn’t trust me doing anything with it, but I would trust me doing something with Rust. Was it really that hard to understand? Also that means following is wrong:
Anyone who writes Python code can read, adapt and make changes to it
The code is Rust code. Anyone who writes Python code can NOT read, adapt and make changes to it. That’s my point with C vs Rust, because not everyone writes C (or Rust) code.
I actually an agree an independent rust project would be really cool. If it was also GPL. I have yet to encounter any argument against GPL that doesn’t boil down to corpo boot licking.
You say “Even if it ends up being in a proprietary program, it’s better than not being able to use the code”. This is a bad faith argument. Everyone can use GPL code freely, the restriction is only that you must also publish under GPL if you publish. I’m sorry your favorite corporation can’t profit off community projects without giving back to that community… not. If GPL was a real problem BSD would have overtaken Linux ages ago. But it didn’t because GPL is good not just for the community but for the project. The only people that don’t stand to gain from GPL are corporations that want to monopolize the technology.
One example is that GPL games cannot be published in Steam, with using Steams proprietary tools and features.
And in general I am not actually against for any company to use MIT licensed products without open sourcing their own proprietary tools. It would be nice if they open sourced it, but I am against in forcing companies to do so. Now I understand the risks involved here, but its not like MIT license is the devil, just like GPL can be problematic in some cases, MIT can too.
i don’t really trust this
The rust has set in and the rot begins…
The corporate adoption on uutils already started.
https://learn.microsoft.com/en-us/windows/core-utils/overview
Windows is now using uutils for their coreutils. I want to see if Microsoft gives back anything to the project with that permissive license. Also, aren’t canonical and Microsoft partners or something? I saw the Ubuntu wsl news.
So one more sign that I am right to be suspicious of rust. Thank you for sharing :)
This is dumb, I have to use osX for work and having coreutils be similar but not quite the same is a PITA, why would you inflict this on yourself to close a class of bugs that aren’t really a huge concern for coreutils.
So for someone coming back into the open source linux world and went back to Ubuntu, does this mean that they’re becoming like Microsoft? Does this mean I need to try a different OS?
Faaack I love Ubuntu but I won’t stand for sticking with enshittification. Windows 11 dogshit is unavoidable trash and Ubuntu is at least a silver lining for a put together somewhat well managed OS.
Why Ubuntu though? For someone migrating from Windows I can recommend using an immutable distro like Bazzite/Silverblue/Kinoite (based on Fedora Atomic) or Opensuse Tumbleweed.
For me it’s cause it’s always been touted as a beginner Linux system
IDK that I would consider Ubuntu a beginner Linux system simply because it uses Snap over the most established Flatpak
I think its beginner because it’s all put together and it teaches prompt installs. It’s also feels more like android to me and it’s cute. It’s Debian streamlined.
Linux Mint seems like a better Debian variant, but I would choose Fedora over both
I’ll try Fedora at some point too. After being on Ubuntu since May, I’m on team: I don’t want to go back to Windows. I’m going to enroll in college next Spring, I’ve been looking for a used Windows laptop because they don’t use Linux programs. 😞 I wish I went back sooner. I wish I never went back to Windows at all.
It’s easy to leave Windows after you realize how little you use their shit.
Try Linux Mint
I tried cinnamon mint and didn’t like it. I tried arch and didn’t like it but I’ll test out that cachy OS at some point. I’m also a nerdy mother fucker that doesn’t need as much as they think.
Like I can use gimp and Librewolf on Ubuntu and be happy. ⅔ of the time I’m just using the browser.
Like everyone I just wish Ubuntu had punchier rgb settings for the picture quality.
Ubuntu in 2008 was a recommended beginner OS and I think I’m still going off of that tbh 🤦🏻♂️
Too bad, Linux Mint is THE beginner Linux distro nowadays. Ubuntu is slowly but irreversibly going down the path of irrelevance.
Linux Mint
I tried cinnamon mint out on live boot like an hour ago. I get what you mean. Maybe I’ll switch to that at some point or when Ubuntu becomes entirely irrelevant.
Try it again in December when LM gains a huge upgrade
That’s a shame that Ubuntu is dieing out. I might try mint again. Debian made me sad, I really wanted that to be good but it just wasn’t to me. I have to go through the other “legacy os’s.”. I think the Wayland window switching is nice and I lie the side bar but someone else mentioned you can make almost any OS look and feel like Ubuntu with skins.
I’m downloading cinnamon mint right now. I’m gonna live try it for a day or two
deleted by creator
I don’t understand why Canonical is replacing the existing GNU tools. Unlike many others, I don’t think its “taking over GPL projects” or “license laundering” and I am also not against MIT license. My question is, why Canonical is doing this.
MIT is cancer
I don’t think so.
You could understand if you used a materialist analysis.
Canonical sells products and support to corporations. The gpl is a problem for corporations because it requires that they contribute their changes back into the commons, creating additional overhead in many ways.
Canonical is funding, prioritizing and providing support for a rewrite of a gpl project in a different language with a more permissive license.
Put two and two together. Canonical is bankrolling and pushing something that materially benefits them.
Rust eliminates memory safety vulnerabilities. It accounts for a large percentage of bugs that need patching in live environments, like servers.
I believe Ubuntu wants to grow in iot or embedded devices so reducing patching needs gives them a competitive edge there.
