Ubuntu's Docs List Seven Commands Kept on GNU Coreutils in 25.10, Five in 26.04 and None in 26.10, as Scripts, an Audit and Image Builds Found Bugs

Overview

Ubuntu’s server documentation lists which core commands still run from GNU Coreutils instead of the Rust-based uutils implementation: seven in Ubuntu 25.10, five in 26.04 LTS and none in 26.10 (the counts are the Herald’s, taken from the entries in the documentation’s table as read on 2026-11-11). Set against press coverage of the bugs found along the way, the Herald’s reading is that the rollout was staged command by command, and that the problems reached the maintainers through several different channels: an Ubuntu developer’s report, benchmark runs at Phoronix, Ubuntu’s own upgrade tooling, a security audit that Canonical commissioned, and image builds. The uutils project’s headline test-pass percentage, meanwhile, moved with the size and accounting of the GNU test suite as well as with the code. That reading is the Herald’s own; the facts below are attributed to their sources, with article dates as each outlet prints them.

Background: a rollout staged by command

According to Ubuntu’s documentation, Ubuntu 25.10 changed the default provider of coreutils from GNU Coreutils to uutils Coreutils and of sudo from sudo.ws to sudo-rs, while earlier releases kept their existing providers. From 25.10, the same page says, coreutils-from-<provider> packages decide which implementation answers standard commands such as cp and chmod, and because of “known incompatibilities” some commands are configured to stay on GNU in 25.10 and 26.04 LTS. Its table lists chmod, chown, cp, df, mv, rm and true for 25.10; cp, df, mv, rm and true for 26.04; and none for 26.10 and later. The page does not give a reason for each command, and it describes the current configuration, which may differ from the state at each release’s launch. The Herald’s April report on 26.04 described rust-coreutils as installed by default; the table is the detail of which commands in that release still ran from GNU.

The switch began on 4 September 2025, when Phoronix reported that Canonical engineer Julian Andres Klode had announced the rust-coreutils transition was landing in the release pocket, with images now built using it. Three problems from the 25.10 cycle show how differently bugs arrived:

• Performance, found by a developer. On 15 September 2025 Phoronix wrote that the transition had “uncovered a few performance issues”, among them a bug report about cksum being “up to 17x slower than GNU for some large files” and a base64 slowdown that an Ubuntu developer had pointed out.
• Breakage, found by benchmarks. On 26 September 2025 Phoronix’s Michael Larabel reported that benchmarks he ran failed with MD5 checksum errors on 25.10. The common factor was Makeself archives, which run md5sum; swapping in the GNU package made the same files run, and he noted Launchpad reports of VirtualBox’s Makeself files failing too.
• A regression in Ubuntu’s own tooling. On 23 October 2025 Phoronix reported that a date -r difference broke unattended upgrades on 25.10. An Ubuntu developer had earlier written that the upstream fix could be pulled in later while the team focused on “critical issues that could introduce unsafety further down the chain”; a fixed package was then in the proposed archive.

The sudo-rs half of the change had its own incident: Phoronix reported on 11 November 2025 two moderate security issues in sudo-rs, fixed in sudo-rs 0.2.10 and sent to 25.10 users as a stable release update.

Current situation: audit, a revert, and a completed switch

On 22 April 2026, the day before 26.04 LTS, Phoronix reported that Canonical had commissioned a security audit of Rust Coreutils that identified 113 issues in total, most since addressed. Ubuntu 26.04 was to ship with Rust Coreutils 0.8, with cp, mv and rm still provided by GNU because the Rust versions had unresolved time-of-check to time-of-use (TOCTOU) issues; Canonical hoped to reach “100% rust-coreutils” in 26.10. Linuxiac, which largely summarises the project’s release notes, lists TOCTOU fixes touching cp and mv in 0.9.0 and 0.11.0.

In July, image builds became another channel. On 3 July 2026 Phoronix reported that the Rust cp handled the -L argument differently from GNU, which made Ubuntu live-media image builds fail. A Launchpad bug was marked “critical” and a coreutils-from package update reverted cp to GNU, “as had been also done before due to other bugs”. A commenter on the bug, quoted by Phoronix, argued against repeated reverting because “We came to know only because the builds failed.” The Register reported the same bug on 9 July, said the team had reverted to GNU cp for now, and judged that it “shows how subtle behavior of the new replacements for these core Unix commands is risky”. Neither outlet says which Ubuntu series the images belong to.

On 16 September 2026 Phoronix reported that the 26.10 draft release notes reflected “100%” completion, with cp, mv and rm now coming from Rust Coreutils. The project’s 0.12.0 notes, published 2026-09-17 UTC, call the release one of “compatibility fixes for our Ubuntu friends” and say the bugs Ubuntu “asked us to prioritize” were fixed, including, among others, data loss in a parallel install -D, du on 32-bit architectures, cp -R name collisions and chmod -R through symlinks. Ubuntu 26.10 was released on 15 October 2026; Linuxiac wrote that “Canonical has now switched the remaining commands, including cp, mv, and rm.”

What the project’s compatibility figure did

The uutils release notes for 0.9.0, 0.10.0, 0.11.0 and 0.12.0 each include a GNU test-suite table. The figures below are the project’s own; dates are the GitHub publication timestamps in UTC.

Release	Published (UTC)	Tests passing	Pass rate in that release’s table
0.8.0 (shipped in Ubuntu 26.04)	n/a	630	94.74% (as shown in the 0.9.0 table)
0.9.0	2026-05-30	625	90.58%
0.10.0	2026-08-05	645	93.48%
0.11.0	2026-08-31	653	95.33%
0.12.0	2026-09-17	653	94.36% (96.9% counting only tests that run)

Three points follow from the tables, as the Herald’s reading. Between 0.8.0 and 0.9.0 the passing count fell from 630 to 625 and the rate from 94.74% to 90.58%. The 0.9.0 notes attribute the jump in failures (21 to 56) to the GNU reference moving from 9.10 to 9.11, which added 25 tests (665 to 690), and say no previously passing functionality regressed; they do not separately explain why five fewer tests passed. In 0.12.0 the count is unchanged at 653 while the rate falls from 95.33% to 94.36%, because the notes say the suite grew by 7 tests and 8 more are skipped on the reference runner; the project reports 653 of 674 tests (96.9%) when counting only those that run. And the same release appears at two values: the 0.11.0 table shows 0.10.0 at 94.44%, not the 93.48% in its own notes. The 0.11.0 notes mention a new list of tests excluded from the percentages but do not tie it to the restated figure, so the Herald does not reconcile the two.

Implications for developers

The answer to “which cp?” depends on the release. Per the documentation, releases up to 24.04 LTS use GNU for everything, the rust-coreutils package can be installed on 24.04 but cannot be made the default there, and switching providers on 25.10 and later requires --allow-remove-essential because apt treats the active package as Essential; update-alternatives is described as unsuitable. The page also says build-essential depends on the default provider because allowing either “could result in build failures or inconsistent build behavior due to differences between the two implementations”.

The documented failures sit where older software calls a command. In three of the incidents above, the commands were called by installers (md5sum inside Makeself archives), by apt’s daily systemd job (date -r, per a bug report Phoronix quotes) and by an image-build script (a commenter said the cp -afL combination appeared in only one place). Whether the GNU test suite exercises those cases is not stated in any of the cited sources, so the Herald draws no conclusion from the pass rate about them; the table above shows that the percentage depends on how the suite is counted.

For sudo-rs the page lists differences rather than exceptions. It has no per-command table for sudo; it lists known differences instead: a changed password prompt that it calls the most common error with Expect-based automation, no I/O logging or sudoreplay, and no sudoers.ldap, and it warns that the list cannot be kept fully up to date.

What the sources do not establish. The cited sources give no reason for the presence of chmod, chown, df or true on the 25.10 list, say nothing about how many users or pipelines were affected by any of the incidents, and do not say whether further compatibility gaps remain in 26.10. The uutils 0.11.0 notes say the project now treats a utility that is significantly slower than GNU as a bug, which is a statement of intent about performance, not a compatibility guarantee.