Re: news item: Introduction of app-alternatives/coreutils

Arthur Zamarin <[email protected]> Tue, 24 Mar 2026 10:30:45 +0200
Newsgroups	gmane.linux.gentoo.devel
Message-ID	<[email protected]>
On 20/03/2026 9:35 pm, moltonel 3x Combo wrote:
> Hi,
> 
> This news item can also be reviewed at
> https://github.com/gentoo/gentoo-news/pull/5
> The corresponding code PR is at https://codeberg.org/gentoo/gentoo/pulls/89
> This is my first time posting here and I'm not a Gentoo dev, apologies
> if I made mistakes.
> 
> 

I'm giving here my reply after reading all this long and branched
thread. I'm putting this reply with my QA and Arch Teams hat, without
the Council hat.


I see here multiple big issues:

* This is very risky change for users, which can break the system during
upgrade, but even if not, can break any random stuff somewhere in the
system, and it would be too hard to detect and debug. We Gentoo devs
already know that random upstream sometimes use obscure features without
any reason, and I'm sure someone uses some random feature of coreuils
that uutils won't implement exactly (they already declared as such for
some random rare stuff).

* We must have a way to see the fact a user modified with uutils his
system. Print in someway that can be easily seen that it was done. I
also acknowledge that most likely, various devs will just ignore such
bug reports because they don't care about uutils (in similar ways like
bugs on arch level, musl, llvm and similar are many times handled).

* The News Item gives an advertisement in a place a silent experiment is
happening. I think most of us prefer users don't migrate to uutils *for
now* (who knows what the future holds, but let's not be hasty).

* I think we should at least mask the possibility of migrating behind a
use.mask, until further tests are done by various devs, some users, and
maybe one tinderbox run. A use.mask is a really good way to warn the
user, and make him understand he goes into YOLO territory.

* Security wise, I think the claims of safer because Rust is bogus. Rust
helps mainly with memory issues, but does nothing for logic ones. With
coreutils, I don't think memory issues were often or something, but
rather the logic ones where the "common" (I mean common by the percent
from total CVEs, not that it happens common time-wise). The latest CVEs
for uutils confirm it, and remember, it wasn't audited by the same scale.

In total I see no reason for a News Item, or making the migration
without a mask, and if we go with it, we must add a clear way to notify
the build log the system is "special".

-- 
Arthur Zamarin
[email protected]
Gentoo Linux developer (Council, Python, pkgcore stack, QA, Arch Teams)
OpenPGP_signature.asc (application/pgp-signature, 525 B)