Re: Concerning uniliateral decision making with respect to the coreutils package

Sylvestre Ledru <[email protected]> writes:

> Except a single email, I haven't been involved in any conversation for
> Debian on uutils vs gnu coreutils (I wasn't
> even aware of the experimental work).
> However, taking a step back, as a packager of a few important
> packages, i often do make unilateral decisions...
> that can be discussed or challenged but it is the way Debian works for
> most of the work.

Well, when 'awk' was removed from the list of essential packages [1],
there seemed to be agreement that doing such removals should require
discussion on debian-devel beforehand, as is the documented process for
additions.

Given the number of behavior divergences, often problematic, between GNU
coreutils and uutils, I do not think this situation is much different
than an addition and/or a removal (*).

> Also, afaik, it isn't that secret as you found some threads talking
> about it. ;)

Those people only know about it because they installed Debian
Experimental packages and borked their system. That is perfectly fine as
Debian Experimental is allowed to do that. However, I would be surprised
if more than a handful did that, and their messages were likely
overlooked.

(*) I do think that statement requires some additional context to back
it up. After Canonical funded Zellic's audit of uutils [2], I noticed
that many had not been fixed in the Ubuntu LTS release [3].

Since then, I have watched the launchpad reports and found many to be
quite concerning [4]. In particular, I personally find it shocking that
Canonical has still not fixed this one:

    $ podman run --rm -it ubuntu:26.04
    $ { apt update -y; apt upgrade -y; } > /dev/null 2>&1
    $ apt install locales-all > /dev/null 2>&1
    $ export LC_ALL=en_US.UTF-8
    $ printf 'USA\nU.S.A\nU-S-A\n' | sort -u
    USA
    $ printf 'USA\nU.S.A\nU-S-A\n' | gnusort -u
    U-S-A
    U.S.A
    USA

It has publicly been reported to them here:

    * https://bugs.launchpad.net/ubuntu/+source/rust-coreutils/+bug/2154364

And mistakenly closed as "Invalid" here:

    * https://bugs.launchpad.net/ubuntu/+source/rust-coreutils/+bug/2148904

And affected other projects here, and likely more:

    * https://github.com/gbif/ipt/issues/3060
    * https://github.com/dehydrated-io/dehydrated/issues/999

Other notable issues are with 'install', which has caused problems in a
few projects, e.g., buildroot.

Canonical was very clear that they intended for users to have the
ability to use GNU coreutils on Ubuntu if they wanted to. However, I am
disappointed that this is de facto impossible given that doing so would
break "build-essential". Unfortunately, Canonical seems uninterested in
satisfying their promise [5].

Ultimately, I would not like Debian follow this decision and face
similar problems. However, my larger concern is that it seems this
change was purposely being made in secret to avoid dissenting opinions.

Collin

[1] https://lwn.net/Articles/1019898/
[2] https://discourse.ubuntu.com/t/an-update-on-rust-coreutils/80773
[3] https://www.openwall.com/lists/oss-security/2026/05/02/2
[4] https://bugs.launchpad.net/ubuntu/+source/rust-coreutils
[5] https://bugs.launchpad.net/ubuntu/+source/build-essential/+bug/2148691