Jon Seager, Vice President of Engineering at Canonical and Technical Lead of the Ubuntu project, announced the intention to integrate the NTP server ntpd-rs, written in Rust and already used in the infrastructure of the Let’s Encrypt certificate authority, in the upcoming Ubuntu 26.10 release. The ntpd-rs project will become the third component, after Rust Coreutils and sudo-rs, integrated into Ubuntu as part of an initiative to enhance the quality of the system environment by providing software that is initially developed with a focus on security, reliability, and correctness.
There is also a discussion about replacing the zlib library with zlib-rs and using the Sequoia package instead of GnuPG in the APT package manager. The ntpd-rs package is intended to be set as default for server the precision time synchronization client, which will eventually replace the currently used packages chrony, linuxptp, and possibly gpsd. The proposed implementation plan suggests delivering the current version of the ntpd-rs package in the Ubuntu 26.10 repositories as an option for testing. In Ubuntu 27.04, it is planned to use ntpd-rs by default as a unified server and client supporting the NTP, NTS, and PTP protocols.
The ntpd-rs project is developed by the Trifecta Tech Foundation, which is also responsible for the already integrated utility sudo-rs in Ubuntu. Canonical will finance the development of new features and enhancements in security for ntpd-rs. Among other things, ntpd-rs will integrate the contributions from the Statime project that develops the implementation of the PTP (Precision Time Protocol) in Rust, to unify the support of current time synchronization protocols in one package and use ntpd-rs not only as a replacement for chrony but also for linuxptp.
Additional features to be implemented in ntpd-rs before deployment include the implementation of gPTP and CSPTP protocols, support for the gpsd IP socket, multithreaded operation of NTP servers, the ability to operate in a multi-homed mode, the creation of isolation profiles based on AppArmor and seccomp, provision of tools for testing and performance assessment, improvements related to logging and configuration, and enhancements to the ntp-cli utility.
In addition to collaborative projects with the Trifecta Tech Foundation, Canonical has also become a "gold" member of the Rust Foundation, which is focused on the development and support of the Rust programming language and its ecosystem. Alongside Canonical, which is the sole gold member, key funding for Rust development comes from six platinum members — Google, Microsoft, Amazon, ARM, Meta, and Huawei. The contribution amount for gold members is $150,000 per year, while for platinum members it is $325,000.
Additionally, it is worth noting the announcement by Julian Andres Klode from Canonical, who is associated with the APT project, regarding the intention to reduce the number of parsers in the GRUB bootloader to decrease the attack surface. In Ubuntu 26.10, it is proposed to remove support for jpeg and png image formats, part_apple partition tables, and the ability to use btrfs, hfsplus, xfs, and zfs file systems for the /boot partition from the signed digital builds of GRUB. Furthermore, there are plans to remove support for using LVM, md-raid (except for raid1), and encrypted LUKS partitions in /boot.
It is noted that the Ubuntu installer always uses only the ext4 file system for /boot, and other file systems are not tested and pose a risk of bypassing the verified boot mode in light of the periodic discovery of vulnerabilities in GRUB (1, 2, 3, 4, 5, 6, 7). Regarding the removal of support for encrypting the /boot partition, such an operation is considered ineffective (security by obscurity) — in this context, it is essential to ensure the integrity check in the /boot partition, which is done using TPM FDE, rather than hiding data. For partitions other than /boot, LUKS, LVM, and MD-RAID can still be used as before. The restrictions will also not apply when booting without UEFI Secure Boot mode.
Source: opennet.ru
