The three commands standing between Ubuntu and a fully Rust coreutils stack have moved. With 26.10, codenamed Stonking Stingray, the default core utilities run entirely on uutils, and the release notes state the result plainly: “100% Rust coreutils.” The migration started back in 25.10 and deliberately paused for cp, mv and rm at the 26.04 LTS, where compatibility questions and time-of-check-to-time-of-use race concerns kept the GNU versions as defaults. Those concerns were worked through, and the interim release, due October 15 with about nine months of support, finishes the job.
The PGP side
The release notes give OpenPGP its own heading, and the title is “an oxidized OpenPGP.” Sequoia PGP, a Rust implementation, has been adopted into the main archive as an officially supported option, with sq and sqv positioned as counterparts to gpg and gpgv. The stated goal is for Sequoia to become Ubuntu’s default OpenPGP toolchain while keeping full interoperability, and for now the older C implementations remain installed and available. Encryption tooling is exactly where memory safety earns its keep, so the direction here is less surprising than the speed of it.
The uutils release behind the change
The other half of the story shipped a few weeks earlier: uutils 0.12.0, described by its maintainers as a release “focused on compatibility fixes for our Ubuntu friends.” It fixes the divergences Ubuntu prioritized, and it makes a promise that matters more than any single fix: a utility that is significantly slower than GNU is now treated as a bug, not a wishlist item. The project reports 653 passing and 21 failing tests on the GNU test suite, and it removed the last C dependency in expr. One more item for the governance-minded: a review found contributions that carried comments and code from GNU coreutils, against the project’s rule that uutils is an original implementation. The tree was rewritten to fix it, and the GNU maintainers were notified.
The OpenSSH split
Ubuntu Server’s OpenSSH is now two source packages. The main one is built without GSSAPI and Kerberos support, and that support, which includes a sizeable patch that upstream never accepted but deployers rely on, lives in openssh-gssapi with its own server and client packages. Fresh installs get the lean versions; the release upgrader detects Kerberos use and selects the right variant during an upgrade. Fewer features compiled into an internet-facing daemon is a smaller attack surface by default, and the split keeps the people who need Kerberos exactly where they were.
My read
Three changes, one direction: the foundation of the distribution is moving to memory-safe implementations where the risk is highest, and the interim release is where the experiments graduate. Scripts will not notice the coreutils swap except when they hit a difference, and the uutils policy now says to report those as bugs. Administrators with Kerberos in the mix should let the upgrade tool make its choice and then verify it. The part to remember when the next LTS arrives: this future is already shipping.
Source: the release notes and the uutils release.