Debian has announced plans to make Rust a required dependency for its core APT package manager, starting no earlier than May 2026. This move aims to enhance security and stability in system tools. The change will impact Ubuntu and other Debian-based distributions.
Debian, one of the oldest and most influential Linux distributions, has outlined a shift in its development strategy by adopting Rust for system-level tools and future packages. Julian Andres Klode, a long-time Debian developer and lead maintainer of the Advanced Package Tool (APT), shared this on the Debian developer list. He stated that he plans "to introduce hard Rust dependencies and Rust code into APT, no earlier than May 2026." This initially covers the Rust compiler, standard library, and the Sequoia ecosystem, a Debian project for a Rust-based OpenPGP implementation.
The decision targets code for parsing .deb, .ar, .tar files, and HTTP signature verification, which Klode noted would "strongly benefit from memory-safe languages and a stronger approach to unit testing." Rust's memory-safe design helps prevent issues like buffer overflows, null pointer dereferences, and race conditions common in C and C++.
APT underpins Debian and derivatives including Ubuntu, Linux Mint, and MX Linux, so Rust integration will extend to these. Canonical has already added Rust to Ubuntu's sudo. Debian's next release, version 14 codenamed Forky, expected in mid-2026, will incorporate deeper Rust use in core utilities, build tools, and security modules.
Reactions vary. Klode urged ports without a Rust toolchain to implement one within six months or face sunset, adding, "Rust already is a hard requirement for most Debian ports." Only four older architectures—alpha, hppa, m68k, and sh4—lack support. Developer John Paul Adrian Glaubitz criticized the "confrontational approach." Bjørn Mork questioned potential new bugs from rewriting and timelines for improvements, asking if regressions should be accepted. Some distributions like antiX stick to older Debian versions for legacy hardware.