chainoftrust.dev · install-time trust report REV b73e597 · PINNED · RECOMPUTABLE

WarningsInspected 2026-09-05 · recomputable

astral-sh/uv

github.com/astral-sh/uv at b73e597cb1aa3d962dd2df5c692718ba4d851969 · examined 2026-09-05 15:47 UTCServed from cache

The chain of trust: breaks at agent config · amber holds a warning · dashed was not established

Some of what installing this would do is worth reading before you agree to it.

The written summary was skipped for this report. The findings below are the analysis; the summary is only prose over them.

Annotations: 13 findings, 13 distinct concerns

WARNING · agent-config / Claude Code hook manifest

The repository ships 2 Claude Code hook manifests. A harness that indexes a cloned working tree can pick these up without any install step being run.

.claude/settings.json, .codex/hooks.json

WARNING · agent-config / agent skill definition

The repository ships 1 agent skill definition. A harness that indexes a cloned working tree can pick these up without any install step being run.

.codex/skills/load-github-action-thread/SKILL.md

WARNING · agent-config / hooks

The hook manifest registers 2 lifecycle hooks: PostToolUse, SessionStart. Hooks run when their event fires, without the user invoking anything by name.

.claude/settings.json, .codex/hooks.json

WARNING · prose / the project states a limit on what its security policy covers

The project states a limit on what its security policy covers. The sentence it says that in is quoted verbatim, from SECURITY.md.

SECURITY.md

WARNING · prose / the documentation advertises piping a downloaded script straight into a shell

The documentation advertises piping a downloaded script straight into a shell. The sentence it says that in is quoted verbatim, from README.md.

README.md

NOTE · agent-config / agent instruction file

The repository ships 2 agent instruction files. A harness that indexes a cloned working tree can pick these up without any install step being run.

AGENTS.md, CLAUDE.md

NOTE · unauditable-surface / committed-binaries

26 compiled or packaged artefacts are committed to the repository. Reading the source does not tell you what these contain.

crates/uv-trampoline-builder/trampolines/uv-trampoline-aarch64-console.exe, crates/uv-trampoline-builder/trampolines/uv-trampoline-aarch64-gui.exe, crates/uv-trampoline-builder/trampolines/uv-trampoline-i686-console.exe, and 23 more

NOTE · install-path / build-backend

The Python build backend is maturin. A pip install runs this backend, which compiles or generates whatever the backend is configured to produce.

pyproject.toml build-system

NOTE · agent-config / hook-commands

The hook manifest runs 2 commands. The first is quoted verbatim.

bash agents/hooks/session-start.sh

.claude/settings.json, .codex/hooks.json

CLEAN · unauditable-surface / census

3% of the repository by size (42 of 1734 files) is binary or generated and cannot be reviewed by reading.

file listing at the analysed commit

CLEAN · install-path / verification

The latest release publishes integrity files (source.tar.gz.sha256, uv-aarch64-apple-darwin.tar.gz.sha256, uv-aarch64-pc-windows-msvc.zip.sha256, and 16 more). No install script is committed to the repository, so how they are consumed depends on the instructions you follow.

release 0.12.10

CLEAN · trust-root / activity

The last push was 1 day ago (2026-09-05).

GitHub repository pushed_at field

CLEAN · trust-root / concentration

Among the 100 most active contributors, the busiest (charliermarsh) accounts for about 33% of commits.

GitHub contributors API, first page

Unsurveyed: declared out of scope

Hatched = not measured

OpenSSF Scorecard has no published result for this repository, so its maintenance-hygiene score is not shown.
Nothing was executed. The installer was not run, the package was not installed, and no binary was launched, so every statement here is about what the code says it does rather than what it did.
The contents of compiled and generated files were not reviewed. They can only be read by running the project's own build or by disassembly.
Install scripts hosted outside this repository were not fetched. Only scripts committed to the repository itself are read.

Declared limits are as load-bearing as findings: this is the difference between a report and a scanner that implies completeness.

What the project says about itself

⚠ Untrusted input: nonce-fenced, rendered inert

These are not considered vulnerabilities in uv.SECURITY.md · the project states a limit on what its security policy covers

curl -LsSf https://astral.sh/uv/install.sh | sh ```README.md · the documentation advertises piping a downloaded script straight into a shell

Quoted verbatim from the repository at this commit, reproduced so you can weigh them. This text was treated as data, never as instructions.

Target

astral-sh/uv

Revision

b73e597

Files listed / read

1734 / 8 · 0 executed

Method

read one at a time over HTTPS. Nothing cloned, extracted, installed or executed

Generated

2026-09-05 15:47:09 UTC · served from cache

Verdict

arithmetic over distinct concerns, recomputable by anyone

Formats

JSON · new survey

Share on X