Provenance Record

Analysis, 1493 words (range 800-2000), 17 sources (minimum 4). Examines a topic with a stated thesis labelled as the Herald's reading: the rollout was staged command by command, bugs reached the project through different channels (developer report, benchmark runs, Ubuntu's own upgrade tooling, a commissioned audit, image builds), and the uutils headline pass rate moved with the size and accounting of the GNU test suite. Facts are attributed to sources with dates as each outlet prints them; the Herald's counts and reading are labelled; a closing section lists what the sources do not establish. Not a single-release recap. Verdict is APPROVE_WITH_CORRECTIONS for three clarifications on subordinate statements (see concerns and the corrections record).

All 17 snapshots read as extracted raw text from sources/2026-11/ubuntus-docs-list-seven-commands-kept-on-gnu-coreutils-in-2510-five-in-2604-and-none-in-2610-as-scripts-an-audit-and-image-builds-found-bugs/ (source-0..16.html.gz; sha256 prefixes of uncompressed content: 960091c03817, 871b31cc8caf, 612f861e2f9b, 329948191c39, c0b3f76fedc4, 4d084f89dcd2, 09918ed8029d, 27cb313e78a6, cf8c080e9610, a87b3538df45, cc5e5db1e7f5, 17a048d60dc7, faad2e9f3366, 1298436e2db5, a92a3dcfe19a, 416a9526d3f5, 210d099fee78). suspicious_patterns null for all 17. Route for the eight Phoronix pages (source-8..15): snapshots are Archive.org captures (archive_fallback true, Wayback captures dated 2026-07-03 to 2026-11-02), read as raw text; no live-site fetch was needed. COUNTS: source-7 (Ubuntu Server docs 'System utility replacements', footer 'Last updated on Oct 01, 2026', i.e. the live current docs, not a development copy) table rows read as raw text: 'Ubuntu 25.10: chmod, chown, cp, df, mv, rm, true' = 7; 'Ubuntu 26.04 LTS: cp, df, mv, rm, true' = 5; 'Ubuntu 26.10 and later: None' = 0; '24.04 LTS and earlier: All'. Recount confirms 7/5/0. The 26.10 row's scope is '26.10 and later' and the page was last updated two weeks before the 15 October 2026 release (Linuxiac article published 2026-10-15T12:23Z says it is released); the article says the counts are as read on 2026-11-11 and that the page describes the current configuration, which may differ from each release's launch state, which is adequate. Docs quotes ('known incompatibilities', build-essential 'could result in build failures or inconsistent build behavior due to differences between the two implementations', Expect prompt, no sudoreplay, no sudoers.ldap, --allow-remove-essential, update-alternatives unsuitable, rust-coreutils installable on 24.04 but not configurable as default) all verified verbatim or faithfully. PHORONIX (one outlet, Michael Larabel byline throughout): source-8 (4 Sep 2025, Klode, release pocket) confirmed; source-14 (15 Sep 2025; 'uncovered a few performance issues', cksum 'up to 17x slower than GNU for some large files', base64 raised by an Ubuntu developer) confirmed; source-11 (26 Sep 2025; Makeself/md5sum, Unigine and GravityMark, coreutils-from-gnu fixes it, Launchpad VirtualBox reports) confirmed; source-10 (23 Oct 2025; date -r, unattended-upgrades, quote 'critical issues that could introduce unsafety further down the chain', fixed package in proposed archive) confirmed; source-13 (22 Apr 2026; Canonical commissioned audit, 113 issues total, 0.8 in 26.04, cp/mv/rm on GNU for TOCTOU, 'Canonical hoped for 100% rust-coreutils' in 26.10) confirmed, with caveats below; source-9 (3 Jul 2026; cp -L, Launchpad 'critical', live media ISO builds, revert to GNU cp 'as had been also done before due to other bugs', commenter quote 'We came to know only because the builds failed', 'cp -afL is used in only one place') confirmed; source-12 (16 Sep 2026; draft release notes updated to reflect '100%') confirmed; source-15 (11 Nov 2025; two moderate sudo-rs issues, 0.2.10, SRU) confirmed except that the SRU is described as in progress (clarification 3). THE REGISTER (source-16, 9 Jul 2026, Liam Proven byline): confirms a new Rust cp bug about the -L switch, 'the team has reverted to using the classic C-based GNU cp command' and the quoted 'shows how subtle behavior of the new replacements for these core Unix commands is risky'. It does not mention image builds or Launchpad, so 'the same bug' is the writer's inference (clarification 2). 'Neither outlet says which Ubuntu series the images belong to' verified: true for both. LINUXIAC (three articles = one outlet; editor Bobby): source-4 (0.11, 31 Aug 2026) lists cp/mv TOCTOU fixes and 653 passing/'from 645 in version 0.10'/94.44% to 95.33%; source-5 (0.9) lists TOCTOU fixes for cp, mv, recursive chmod and 665 to 690 tests; source-6 (26.10 released, 15 Oct 2026) says 'Canonical has now switched the remaining commands, including cp, mv, and rm' verbatim. Linuxiac is a news-summary outlet restating release notes (the article says it 'largely summarises the project's release notes'), and the 26.10 piece restates Ubuntu's release; it counts as an outlet but adds no independent verification. UUTILS release notes (source-0..3, GitHub): GNU test-suite tables recounted from raw text. 0.8.0 630 pass/665 total = 94.74% (shown in the 0.9.0 table); 0.9.0 625/690 = 90.58%, published 2026-05-30T14:43Z; 0.10.0 645/690 = 93.48%, 2026-08-05T21:30Z; 0.11.0 653/685 = 95.33%, 2026-08-31T20:36Z; 0.12.0 653/692 = 94.36%, 2026-09-17T06:31Z, and '653/674 (96.9%)' counting only tests that run. BOTH 0.10.0 figures verified: 93.48% in the 0.10.0 notes (Total 690) and 94.44% in the 0.11.0 table (0.10.0 restated with Total 683, Skip 9, Fail 28, Error 1); the 0.11.0 notes say 'We also list the tests excluded from the pass/fail percentages now' without tying it to the restatement, as the article says, and Linuxiac independently repeats 94.44%. 0.9.0 attribution of the 21 to 56 failure jump to the 9.10 to 9.11 reference change (+25 tests) and 'no previously-passing functionality regressed' verified, and the notes indeed do not explain why 5 fewer tests passed. 0.12.0 quotes ('compatibility fixes for our Ubuntu friends', bugs Ubuntu 'asked us to prioritize', install -D data loss, du on 32-bit, cp -R collisions, chmod -R through symlinks) verified; the notes say a utility significantly slower than GNU is a bug (0.11 and 0.12), as the article says. ABSENCE CLAIMS tested against all 17 snapshots: no snapshot gives a reason for chmod, chown, df or true being on the 25.10 list; none says whether the GNU test suite exercises the md5sum, date -r or cp -L cases (0.9.0 only mentions an md5sum test-stderr cleanup, which is unrelated); none says how many users were affected or whether gaps remain in 26.10; the three absence statements hold. Phoronix's 16 Sep 2026 text names cp, mv and rm for 25.10/26.04 while the docs table lists chmod, chown, df and true too; neither claims exclusivity and the article attributes each list to its own source. INDEPENDENCE (Analysis): sources counted per outlet are Phoronix (8 articles, 1 outlet), The Register (1), Linuxiac (3 articles, 1 outlet), uutils GitHub (4 pages, the subject), Ubuntu docs (1 page, the subject's own docs). Independent outlets: 3, of which 2 (Phoronix, The Register) do original reporting and 1 (Linuxiac) restates release notes. Requirement of at least 2 independent met, also if Linuxiac is excluded. Per case: Makeself and date -r are single-outlet (Phoronix) in the article; image-build cp -L is two outlets (Phoronix, The Register); the audit rests on Phoronix relaying Canonical's blog post (vendor-originated figure, see clarification 1); the pass-rate analysis rests on the project's own notes by design and is labelled as the project's figures. ALLOWLIST: ubuntu.com, phoronix.com, linuxiac.com, theregister.com, github.com are all already on config/source_allowlist.txt; no additions. The article does not cite Ubuntu Discourse, Launchpad or OSNews/OMG Ubuntu as sources (Discourse and Launchpad appear only as things Phoronix mentions). Anthropic disclosure: not required - the story is about Canonical, Ubuntu and the uutils project; Anthropic, Claude and Anthropic products appear nowhere in the headline, summary, lead or body (contributor model appears only in submission metadata).

Headline counts 7/5/0 and every date, number and quote the article attributes to a source were traced to raw snapshot text; the 'each', 'all', 'none', 'both', 'only' statements were run against every snapshot: 'each include a GNU test-suite table' is true of all four release notes; 'None' in the docs is the table's exact entry for '26.10 and later'; 'Neither outlet says which series' holds. Derived figures: the article states no sums or ranks of its own beyond the 7/5/0 counts, which recount correctly, and the 'five fewer tests passed' difference (630 to 625) is correct. Three subordinate points are incomplete rather than wrong and are filed as clarifications: the audit total and status are Canonical's figures relayed by Phoronix, whose CVE counts disagree with each other (44 versus 70 plus 73, which do not sum to 113); The Register does not say its cp -L bug caused image-build failures; Phoronix says the sudo-rs SRU 'is being' rolled out. None touches the headline, summary or lead.

Well-sourced Analysis that meets the policy requirements (1493 words, 17 sources, 3 independent outlets of which 2 do original reporting, a thesis, facts and reading separated, absences stated). Headline counts 7/5/0 and the 93.48% / 94.44% pass-rate pair are verified from raw text. Three subordinate clarifications are filed as a corrections record; the article is otherwise accurate. Featured candidacy: 1 - careful, accurate retrospective on a Linux default-tooling change for a defined sysadmin and developer audience, but no new event or broad-audience news