Debian developer Julian Andres Klode has announced that hard Rust dependencies will be introduced into the APT package manager from May 2026. In the future, central parts of APT will be implemented in the Rust programming language. This affects, among other things, the code for parsing .deb, .ar, and .tar archives, as well as HTTP signature verification.

APT (Advanced Package Tool) is the central tool for package management in Debian and distributions based on it, such as Ubuntu. The planned switch to Rust thus affects one of the distribution’s most fundamental system components. Klode justifies the move with the advantages of memory-safe programming languages and better possibilities for unit tests.

The Rust integration initially includes the Rust compiler, the standard library, and the Sequoia ecosystem. Sequoia is an OpenPGP implementation in Rust that is already used in various projects. By using Rust, typical memory errors such as buffer overflows or use-after-free, which frequently open security vulnerabilities in C and C++, are to be avoided.

The announcement is explicitly also aimed at maintainers of less common Debian ports. Klode addresses architectures such as m68k, hppa (HP PA-RISC), sh4 (SuperH), and Alpha directly in the message. These ports now have six months to provide a functioning Rust toolchain; otherwise, support may be discontinued.

Modernization versus Retro Hardware

In his message, Klode emphasizes that it is important for the project to evolve and adopt modern technologies. The distribution cannot be held back by attempts to port modern software to retro computing devices. This stance is likely to be debated controversially within the community, as Debian traditionally strives for very broad hardware support.

The decision is part of a larger trend: the Linux kernel has also begun integrating Rust to gradually implement security-critical components in the memory-safe language. In recent years, Rust has established itself as the preferred alternative to C and C++ for system-level programming when it comes to security and reliability.

For users of Debian on common architectures such as x86-64, ARM, or RISC-V, the transition is likely to be transparent, as Rust is already fully supported for these platforms. The deadline of May 2026 at least gives maintainers of smaller ports some time to either implement a Rust toolchain or officially discontinue their ports.

The full announcement can be found in a message to the Debian developer mailing lists.

(fo)

Don’t miss any news – follow us on Facebook, LinkedIn or Mastodon.

This article was originally published in German. It was translated with technical assistance and editorially reviewed before publication.