Image: GitHub
Why it mattersA signed publisher on the uv binary lets security teams allowlist Astral rather than a checksum list that changes with every release, and stops Gatekeeper and antivirus from quarantining a fresh install of the Python package manager.
Astral released uv 0.12.12 on 2026-09-09 with signed and notarized executables for the first time. The macOS and Windows binaries in the release archives, and the uv and uv_build wheels, now carry a publisher signature that operating systems and antivirus can verify.
The macOS executables are signed with an Apple Developer ID certificate and then notarized by Apple. On Windows, the executables carry a timestamped Authenticode signature issued through Azure Artifact Signing. Astral says this enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.
What actually changes on a fresh install
On macOS, an unsigned binary downloaded through the browser is put in quarantine and Gatekeeper refuses to run it until the user right-clicks to open, or clears the quarantine bit. A notarized binary that Apple has approved skips that step, and the same is true for a user who copies uv into a restricted corporate system image. On Windows, an Authenticode signature lets SmartScreen and enterprise application control policies recognise Astral as the publisher instead of treating the file as unknown. Windows Defender and third-party antivirus scanners use the same signature to lower the false positive rate on new releases.
The change matters most for corporate and CI environments that already run publisher-based allowlists, because the entry can now name Astral rather than a hash that has to be re-added for every new version. It also removes a small risk that a replaced binary served from a compromised mirror would run without any warning.
The release includes one bug fix alongside the signing work: distributions uploaded after the exclude-newer cutoff are now excluded from lockfiles and generated requirement hashes, so an exclude-newer lockfile no longer locks in a wheel that was published after the requested date.
The signing infrastructure behind it
Two separate chains of trust do this. On the macOS side, the developer certificate is issued by Apple to the identified publisher, and notarization is an extra scan Apple runs on the uploaded binary before attaching an approval to it. On the Windows side, Azure Artifact Signing holds a certificate for the publisher and applies a signature with a trusted timestamp, so the signature stays valid even after the certificate itself is replaced.
The release also carries GitHub Artifact Attestations, and Astral notes that any artifact can be verified against the source repository with gh attestation verify --repo astral-sh/uv. Attestations link the artifact to the workflow that produced it in the astral-sh/uv repository, which is a separate check from the OS-level publisher signature.
For teams still on an older uv, the upgrade path is unchanged: the same installer script or wheel, and no configuration change on the caller side. The first release built and signed on the new infrastructure is 0.12.12, so anyone allowlisting by publisher needs the new binary to see the signature.
Source
- Release notes: astral-sh/uv 0.12.12
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
