November 25, 2025
Rust vs Retro: Fight Night
Apt Rust requirement raises questions
“Rust or bust” for Debian’s software installer — and the comments are on fire
TLDR: Debian’s APT will require the Rust language by May 2026, nudging older architectures to update or stay on legacy APT. Comments erupted over tone, corporate influence, and whether this is real progress or hype, making it a flashpoint for how open-source decisions get made and communicated.
Debian’s APT — the tool that installs software — just dropped a bomb: maintainer Julian Andres Klode says APT will require Rust by May 2026, pushing older, unofficial architectures to catch up or stick with old APT. The tech is meant to make parsing packages safer and signatures more reliable, but the community’s reaction? Pure internet theater. One camp cheers the move as modern and sane; another hears “thank you for understanding” as “discussion closed,” calling the tone heavy-handed. In the middle, people debate whether Rust everywhere is progress or “shiny object syndrome.”
The comments turned spicy fast. Petcat roasted the idea of a Rust-to-C workaround as spiteful upstream swimming. Elteto says maintainers are just tired of endless blockers. Then geerlingguy tossed a grenade: the maintainer works for Canonical (Ubuntu’s parent), stoking the meme of “the tail wagging the dog.” Others point out most affected ports aren’t officially supported anyway, so the sky isn’t falling. Meanwhile, APT contributor David Kalnischkies hints at “security theater?”, suggesting less fragile parsing might beat rewrites. TL;DR: it’s not just about code — it’s governance, tone, and who gets to decide. Grab popcorn, the LWN thread and Debian-devel are sizzling.
Key Points
- •APT plans to require Rust starting in May 2026, per an announcement by maintainer Julian Andres Klode.
- •The change targets safer parsing of .deb/.ar/.tar and improved HTTP signature verification via Rust and Sequoia ecosystem.
- •Unofficial Debian ports without Rust must add a working Rust toolchain or use older APT versions; official releases are unaffected.
- •Rust is already required on most architectures due to APT’s use of Sequoia-PGP’s sqv; gpgv is used as a fallback where Rust isn’t available.
- •Developers debated scope and communication; alternatives like removing in-house parsing code were suggested to reduce bugs.