Debian's APT Reaches Its 'No Earlier Than May 2026' Rust Window With No Code Merged Yet and Four Legacy Ports Still on the Clock
The window Julian Andres Klode set for APT's hard Rust dependency has arrived, but no Rust code has landed in APT yet and alpha, hppa, m68k, and sh4 still lack toolchains.
Overview
In late October 2025, Julian Andres Klode, described by Linuxiac as “a long-time Debian developer and one of the primary maintainers of the APT package manager,” told the project he intended to bring Rust into APT’s core. As The Register reported, Klode emailed the debian-devel mailing list with the plan: “I plan to introduce hard Rust dependencies and Rust code into APT, no earlier than May 2026.” That window has now opened. What has not happened, according to the available reporting, is the merge itself: as LWN.net noted in its follow-up coverage, no Rust code had been merged into APT, and the announcement represented a future requirement rather than an existing implementation.
What We Know
The timeline came directly from Klode. LWN.net reported that he announced APT would acquire “hard Rust dependencies sometime after May 2026,” and The Register recorded that he emailed the debian-devel mailing list to make the case. The announcement itself went out on October 31, according to LWN.net.
The components Klode flagged for Rust are specific. As quoted by The Register, he wrote that “our code to parse .deb, .ar, .tar, and the HTTP signature verification code would strongly benefit from memory safe languages.” heise online described the same scope, reporting that the change “affects, among other things, the code for parsing .deb, .ar, and .tar archives, as well as HTTP signature verification.”
The initial dependency set is the Rust compiler, the standard library, and the Sequoia ecosystem. The Register quoted Klode writing that “this extends at first to the Rust compiler and standard library, and the Sequoia ecosystem,” and explained that Sequoia is “a Rust implementation of OpenPGP.” heise online added that Sequoia “is already used in various projects.” That last point matters for understanding how incremental the shift is: LWN.net reported that APT already depends on Sequoia-PGP’s sqv tool for signature verification on supported architectures, which means a Rust requirement is, in practice, already present there.
Klode framed the move around memory safety and testing. Linuxiac reported that the flagged components “would strongly benefit from memory-safe languages and a stronger approach to unit testing,” and heise online reported that Klode “justifies the move with the advantages of memory-safe programming languages and better possibilities for unit tests.”
The sharpest edge of the announcement falls on a small set of ports. The Register reported that “Rust is already a hard requirement on all Debian release architectures and ports except for alpha, hppa, m68k, and sh4.” heise online named the same four, listing “architectures such as m68k, hppa (HP PA-RISC), sh4 (SuperH), and Alpha.” None of the four is an officially supported release architecture: LWN.net reported that none are currently officially supported, with the most recent official support ending with Debian 6.0. Its earlier coverage put finer dates on it, noting that m68k was dropped as an official release architecture in Debian 4.0, and alpha and hppa in Debian 6.0, while sh4 was never official, per LWN.net.
For the maintainers of those ports, Klode set a clock. The Register and LWN.net both quoted the same instruction: “If you maintain a port without a working Rust toolchain, please ensure it has one within the next 6 months, or sunset the port.”
Reaction
The announcement drew pushback from inside Debian. LWN.net reported that David Kalnischkies, a major APT contributor, questioned the approach, and that John Paul Adrian Glaubitz, a Debian developer, criticized the communication style. Glaubitz, who has contributed to Rust porting work, expressed frustration in a comment quoted by LWN.net: “I have to say I’m starting to feel sorry for the time I have invested in the Rust project.”
Klode defended the direction in broader terms. Linuxiac quoted him arguing that “it’s important for the project as whole to be able to move forward and rely on modern tools and technologies and not be held back by trying to shoehorn modern software on retro computing devices.”
What We Don’t Know
The reporting available predates any merge, so several things remain open. There is no confirmed date for when the first Rust code actually lands in APT — the May 2026 framing is a floor, expressed by Klode and his coverage as “no earlier than May 2026” and “sometime after May 2026,” not a release date. It is also not yet established from these sources whether the maintainers of alpha, hppa, m68k, or sh4 have produced working Rust toolchains within the six-month window, or whether any of those ports will be sunset as a result. The precise sequencing of which parsing component moves to Rust first was not detailed beyond the .deb, .ar, .tar, and HTTP signature verification list.
Analysis
The APT change sits alongside a wider pattern in Debian-family software of moving security-sensitive C code toward Rust. The Linux kernel made Rust a permanent fixture rather than an experiment, as previously reported, and Ubuntu has been folding Rust-based core utilities into its long-term-support base, as previously reported. APT is a different kind of target from a coreutils binary or a kernel subsystem: it is the single most-used administrative tool on a Debian system, and the code Klode named — archive parsing and signature verification — is exactly the attack surface that processes untrusted input. That makes the memory-safety argument concrete rather than abstract.
The friction is equally concrete. Because Rust is already a hard requirement everywhere except four unofficial ports, the practical question is not whether mainstream Debian users notice the change — they will not — but whether the project is willing to let a small number of retrocomputing ports lapse to keep its core tooling modern. Klode’s framing makes that trade-off explicit. With the announced window now reached and, per the reporting available, no code yet merged, the next concrete signal will be the first Rust commit to land in APT itself.