Canonical sponsors AI translation from C to Rust – open source goes on the memory offensive

Ubuntu behind an AI-assisted automatic C-to-Rust conversion project. The goal: truly safe Rust, not just code that compiles without unsafe everywhere.

The Concrete Case

Start with a classic bug: a buffer overflow in a system daemon written in C. Fixable, but likely to reappear in a different form six months later because C cannot mechanically guarantee the absence of such errors. Now imagine the same code rewritten in Rust—where the compiler makes this bug structurally impossible. This is the ambition Canonical (Ubuntu’s publisher) is financially supporting: automatically translating millions of lines of C into secure Rust, with the help of AI.

Why It’s Non-Trivial

C→Rust automatic translation already exists—the c2rust tool has done this for years. Problem: it produces Rust that is syntactically valid but unsafe everywhere. Which exactly negates the point from a memory safety perspective. We’ve changed the syntax without changing the guarantees.

What the project backed by Canonical aims for is idiomatic and safe Rust: code that leverages Rust’s type system (ownership, borrowing, lifetimes) to express and verify security invariants at compile time. This is fundamentally hard because C and Rust don’t share the same mental models:

// C - correct or use-after-free depending on usage context
char* get_value(struct Map* m, const char* key) {
 return hashmap_get(m, key); // potentially invalid pointer if m is modified
}

// Rust - the compiler forbids modifying m during the borrow
fn get_value<'a>(m: &'a HashMap<&str, String>, key: &str) -> Option<&'a String> {
 m.get(key) // lifetime validity guaranteed by the compiler
}

The AI must understand that these two functions are not mechanically equivalent—and that a naive translation would produce an unsafe block, not a true migration.

The Subtext: AI in Open Source, Next Act

Here we find a direct echo of the debate shaking the free software world. Linus Torvalds has ruled for the Linux kernel: AI-assisted contributions are welcome; opponents can fork. Canonical follows the same pragmatic logic—AI as a tool for mass modernization, not as a threat to integrity.

The real question remains human validation: who reviews the generated Rust? Who guarantees that the original C semantics are preserved, including edge-case behaviors? A tool that generates 95% correct Rust and 5% subtly incorrect code is more dangerous than a 100% unsafe tool—because it gives false assurance.

What to Expect

If the project lives up to its promises, it will significantly accelerate the transition of system layers to Rust—a movement already well underway (Android, Windows, Linux kernel, OpenSSL). With Canonical targeting Ubuntu, this directly impacts the low-level layers of millions of production servers.