Canonical ships rust-coreutils in Ubuntu 26.04, keeps cp mv rm on GNU

Canonical found 113 issues in its rust-coreutils audit and still shipped the package in Ubuntu 26.04 LTS, but it drew a hard line around cp, mv and rm: those commands stayed on GNU coreutils because eight TOCTOU bugs were still open as of April 22, 2026.

That split is the clearest sign yet that Ubuntu’s Rust migration is being managed as a safety project, not a flag-day replacement. Canonical said its internal review came from Ubuntu Foundations and Ubuntu Security, with juliank, bamf0, sarnold and hlibk involved, but that work was not enough to give LTS-level confidence on its own. Canonical then brought in Zellic for an independent audit split into two rounds, first from December 2025 through January 2026 and again from February through March 2026. Zellic found 73 issues in the first pass and 40 in the second, for 113 total, and Canonical said 30 mitigation pull requests were contributed upstream during the second round alone.

The practical result for Ubuntu users is more conservative than a full switch sounds. Ubuntu 26.04 LTS includes rust-coreutils 0.8.0, but the commands that most people touch when moving, copying or deleting files are still coming from GNU. That means the Rust implementation is already in the system, yet the riskiest file-operation paths remain on the older code until the TOCTOU problems are closed. For everyday users, the transition should feel mostly invisible. For tinkerers, the interesting part is under the hood: Ubuntu is trying to replace an Essential package without breaking bootstrapping, packaging, or the familiar command-line behavior people expect from ls, cp and mv.

That caution was already baked into the plan Canonical laid out in March and April 2025. The company said it wanted uutils coreutils to become the default in Ubuntu 25.10 and, if conditions were right, Ubuntu 26.04 LTS too. Julian Andres Klode later explained why the migration needed special packaging work: coreutils is an Essential package, and alternatives or diversions would not work cleanly during bootstrap. Canonical instead outlined provider packages such as coreutils-from-uutils and coreutils-from-gnu.

Canonical has framed the move as a push for resilience and safety first, not performance marketing. Ubuntu 25.10 served as the real-world proving ground, and Ubuntu 26.10 is now the target for 100% rust-coreutils. The same broader Rust effort also reached beyond coreutils in April 2026, when Canonical said it joined the Rust Foundation as a Gold member and planned to adopt ntpd-rs as the default time synchronization client and server.