Rust uutils Coreutils Dev Calls Project 'Subpar' Amid Ubuntu Adoption

The candid admission came not from a critic but from inside the project itself. A developer working on uutils coreutils, the Rust-based reimplementation of GNU's foundational command-line utilities now shipping by default in Ubuntu 25.10, posted a frank assessment in a GitHub issue thread: "Our actual implementation is so subpar I don't even have words."

The comments centered on `uu_timeout`, the uutils replacement for GNU's `timeout` command. The developer described attempting a rewrite ten times since last October or November, writing that "GNU timeout is just absurdly full of undocumented edge cases... and we don't even cover half." A separate line captured the toll: "I'm just frustrated with uu timeout to the point of absolute exhaustion."

Tech journalist Bryan Lunduke of The Lunduke Journal amplified the thread, framing the frustration as an illustration of what happens when a project collides with the accumulated complexity of battle-tested C code. GNU coreutils has been refined over decades, accumulating handling for edge cases that are rarely documented but often relied upon by scripts, build systems, and system services across millions of machines. The uutils project aims to be a drop-in replacement where differences with GNU behavior are treated as bugs, which raises the stakes for every missed case.

Those stakes became concrete when Ubuntu 25.10 shipped with a broken `date` implementation. The `-r` flag, which is supposed to display a file's modification time, instead returned the current date on every invocation because developers had wired up the argument parser but never connected it to any actual logic. The `unattended-upgrades` process depends on that flag to check whether packages need updating, meaning the bug silently disabled automatic security updates across Ubuntu 25.10 desktops, servers, cloud deployments, and container images. Systems running rust-coreutils version 0.2.2-0ubuntu2 or earlier were affected; the fix landed in 0.2.2-0ubuntu2.1.

Canonical's broader "oxidize Ubuntu" initiative, which already replaced `sudo` with the Rust-based `sudo-rs`, positions uutils as part of a deliberate push for memory safety and a modernized contributor base. The uutils project's own site notes that Ubuntu is "carefully but purposefully" adopting the codebase, with Debian following the same path.

Carefully is doing real work in that sentence. GNU coreutils accumulated only 17 CVEs since 2003, meaning the security argument for replacement is modest. What remains is the longer-term bet that Rust's memory safety and cleaner codebase will pay dividends for a next generation of contributors who never want to maintain C. Whether that payoff justifies the transition friction is now being answered in real time, one broken flag and one exhausted developer at a time.