From 0718cfd24bc5fc19cba4906420dbf548e04a489e Mon Sep 17 00:00:00 2001 From: Manuel de Brito Fontes Date: Mon, 19 Oct 2026 20:39:00 -0300 Subject: [PATCH] image: GNU's coreutils, not uutils' 26.04 installs coreutils from uutils by default, and OSV lists 21 findings against rust-coreutils 0.10.0 with no fix in the archive (#205); none against gnu-coreutils 9.7. Ubuntu ships both behind the coreutils package. mkosi installs the essential set, uutils included, before the image's own list, so the list swaps them and removes rust-coreutils, which apt's autoremove would keep: the essential set installed it as asked for. Checked: packages.txt has coreutils-from-gnu and gnu-coreutils and no rust-coreutils; the image is 855M against 877M; ls in the guest is GNU coreutils 9.7 and cp is gnucp; task boot:logind passes (SSH login, user services, sudo, logout). Co-Authored-By: Claude Opus 5.5 --- image/mkosi.conf | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/image/mkosi.conf b/image/mkosi.conf index 4eb3b71..a7377c2 100644 --- a/image/mkosi.conf +++ b/image/mkosi.conf @@ -87,6 +87,15 @@ Packages= apt dpkg coreutils + # GNU's coreutils and not uutils', 26.04's default: on 2026-10-19 OSV listed 21 + # findings against rust-coreutils 0.10.0 with no fix in the archive, and none against + # gnu-coreutils 9.7. Ubuntu ships both behind `coreutils`. mkosi installs the essential + # set, uutils' included, before this list, so the list swaps them: the trailing `-` is + # apt's for "remove". rust-coreutils is named too: the essential set installs it as + # asked for, so apt's autoremove leaves it although nothing needs it any more. + coreutils-from-gnu + coreutils-from-uutils- + rust-coreutils- login passwd adduser