Ubuntu 26.10 adds a new Rust-based OpenPGP implementation called Sequoia (sq) alongside GnuPG tool, which it plans to 'phase out'.

Surprisingly, it’s LGPL v2.

The Sequoia PGP is part of the default seed, with the sq package in the main repo and officially supported. It’s said to provide a “modern, and memory-safe OpenPGP implementation”.

Ubuntu isn’t making Sequoia the distribution’s default OpenPGP toolchain. It ships preinstalled, but lives alongside the standard implementation.

However, the goal is to make Sequoia PGP Ubuntu’s default in the near future, with sq and sqv replacing gpg and gpgv.

For now, gpg will still invoke GnuPG, while sq (or an app configured to use Sequoia’s libraries) calls on Sequoia. Users can run e.g., sq sign or sq verify instead of gpg from the command line to try it too.

Canonical says adopting Sequoia will enable Ubuntu to maintain OpenPGP interoperability while benefiting from a “more maintainable and memory-safe foundation”.

It’s not the only Rust-related change in the new Ubuntu release, either. Ubuntu 26.10 ships a full set of Rust-based core utilities out-of-the-box, completing work that began in 25.10. GNU-versions of cp, mv, and rm are now provided by uutils.

Canonical’s engineers plan to ‘oxidise’ more foundational packages in future releases. A Rust rewrite of the Network Time Protocol (NTP) being eyed for inclusion as the default time sync client in Ubuntu 27.04.

The company is also a gold sponsor of the Trifecta Tech Foundation, paying €40,000 a year to help fund work on Rust software.