https://lwn.net/Articles/1043103/ LWN.net Logo LWN .net News from the source LWN * Content + Weekly Edition + Archives + Search + Kernel + Security + Events calendar + Unread comments + ------------------------------------------------------------- + LWN FAQ + Write for us [INS::INS] User: [ ] Password: [ ] [Log in] | [Subscribe] | [Register] Subscribe / Log in / New account Date bug affects Ubuntu 25.10 automatic updates [Posted October 23, 2025 by jzb] The Ubuntu Project has announced that a bug in the Rust-based uutils version of the date command shipped with Ubuntu 25.10 broke automatic updates: Some Ubuntu 25.10 systems have been unable to automatically check for available software updates. Affected machines include cloud deployments, container images, Ubuntu Desktop and Ubuntu Server installs. The announcement includes remediation instructions for those affected by the bug. Systems with the rust-coreutils package version 0.2.2-0ubuntu2 or earlier have the bug, it is fixed in 0.2.2-0ubuntu2.1 or later. It does not impact manual updates using the apt command or other utilities. Ubuntu embarked on a project to "oxidize" the distribution by switching to uutils and sudo-rs for the 25.10 release, and to see if the Rust-based utilities would be suitable for the long-term-release slated for next April. LWN covered that project in March. ----------------------------------------- [Log in] to post comments The next Ubuntu release... Posted Oct 23, 2025 20:52 UTC (Thu) by dskoll (subscriber, #1630) [ Link] (2 responses) ... will be called Grateful Guinea-Pig But seriously. Rewriting C utilities that have been battle-tested for decades in Rust might be a good idea in the long term, but anyone could have predicted short-term hiccups. [Reply to this comment] The next Ubuntu release... Posted Oct 23, 2025 21:38 UTC (Thu) by geofft (subscriber, #59789) [ Link] (1 responses) Which is why I'm glad they're doing it! It seems like the kind of thing that one can be understandably scared to ever do, and I say this as one of the folks involved with getting some Rust in the Linux kernel. [Reply to this comment] The next Ubuntu release... Posted Oct 23, 2025 22:21 UTC (Thu) by dskoll (subscriber, #1630) [ Link] I don't have anything against Rust (nor against C), but I do think it's unfortunate that the Rust utilities are licensed under the MIT license rather than the GPL. But that's a whole other debate... [Reply to this comment] uutils is doing well, but needs to be carefully managed Posted Oct 23, 2025 21:12 UTC (Thu) by pixelbeat (guest, #7440) [Link ] Note ubuntu 25.10 is still using GNU for the "scary" commands like cp, mv, rm, ... They should rip that band aid off sooner rather than later, so that any data corruption possibilities are identified before ubuntu 25.10 becomes more established or the next LTS release becomes imminent. Copying a file on unix has lots of edge cases multiplied by various file sytems and even kernel bugs etc. Then there are fundamental issues with SIGPIPE handling in all the uutils https://github.com/uutils/coreutils/issues/8919 Also there are questionable interface changes being added like 12 ways to get a sha3 https://github.com/uutils/coreutils/issues/8984 I wish them well, but this needs to be carefully managed. [Reply to this comment] No problems for oldschool Linux users ... Posted Oct 23, 2025 21:35 UTC (Thu) by JMB (guest, #74439) [Link] It is interesting that it seems that automatic updates are of high priority. For Smartphone Junkies that may be true (due to fear of missing out), but for experts there is no need to get even security fixes in less than a week. And concerning servers ... in most cases even extreme security relevant problems are not fixed due to other priorities anyway ... form frozen zone ... to ice age. At least the problem shows that it is not fuitile to have tested the new Rust code ... but still wondering if concerning all bugs Rust really have a positive benefit for experienced coders ... seems more a hype than something which can be prooved. [Reply to this comment] uutils date bug timeline and root cause Posted Oct 23, 2025 22:00 UTC (Thu) by geofft (subscriber, #59789) [ Link] I think it would be interesting for Ubuntu to do (at some point, not right this second) an incident report / postmortem on how this happened. Looks like this was originally reported in https://pad.lv/2127970 on October 16, exactly one week ago and also exactly one week after Ubuntu 25.10's release. The reporter originally mentioned the bug in the context of a homegrown backup script that was failing silently, and they got the fix into the proposed stable update repository yesterday, with an (understandable) argument about why it wasn't same-day levels of urgent. This morning, someone pointed out that it breaks unattended-upgrades. It seems to me that it was only at this point that it was tracked as a security issue, and the package is now available in both the (prod) stable updates repository and the more minimal security updates repository. The actual bug itself is simply that support for `date -r ` wasn't implemented. The issue https://github.com/uutils/coreutils/ issues/8621 and the pull request implementing support https:// github.com/uutils/coreutils/pull/8630 were both filed on the same day, September 12 of this year, and it was reviewed and merged into main two days later. This, understandably, postdates whichever release Ubuntu snapshotted. I think I am mostly surprised that the command silently accepted -r and did nothing, and indeed from the actual diff (https://github.com/ uutils/coreutils/commit/88a7fa7adfa048...) it's pretty clear that the argument parser had support for it but it wasn't wired up to do anything. If the command had instead returned an argument parsing error, I think this would have been caught a lot quicker. It does seem a little bit odd that whoever implemented this in the argument parser didn't at least add an "if -r, throw 'todo'" case. But it's also interesting that this was not statically caught. The Rust compiler is pretty good at warning and complaining about unused variables. (To be fair, most C compilers and many other languages are too, though anecdotally these warnings seem less noisy in Rust and I've seen more codebases in Rust where this is a hard failure than C codebases using -Werror. Also, Rust has #[must_use], if you want to be thorough.) However, there wasn't actually an unused variable here; you can see that you get the value out of the parsed-arguments object by asking for the value of the flag. I wonder if it's worth thinking about an argument-parsing API in Rust that would raise an unused-variable warning at compile time if a parsed command-line flag or argument is never used in the code. It might also be possible to do this with the existing parser with a sufficiently clever linter. Either way, the lack of compile-time detection of this bug feels at odds with the philosophy of a Rust rewrite of coreutils, i.e., that there's merit in having tools do the checking instead of trusting and expecting people to write perfect code. I also think it would be very much worth it for Ubuntu and the uutils developers to manually do an audit for all arguments that are parsed in an argument parser but not actually implemented. If this pattern happened once, it likely isn't the only case. [Reply to this comment] [INS::INS] Copyright (c) 2025, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds