Why it mattersA signed publisher on the uv binary lets security teams allowlist Astral rather than a shifting checksum list, and stops Gatekeeper and antivirus from quarantining a fresh install of the Python package manager.
Astral released uv 0.12.12 on 2026-09-09 with signed and notarized executables for the first time. The macOS and Windows binaries in the release archives, and the uv and uv_build wheels, are now shipped with a publisher signature that operating systems and antivirus can verify.
The macOS executables are signed with an Apple Developer ID certificate and then notarized by Apple. On Windows, the executables carry a timestamped Authenticode signature issued through Azure Artifact Signing. Astral says this enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.
What actually changes on a fresh install
On macOS, an unsigned binary downloaded through the browser is put in quarantine and Gatekeeper refuses to run it until the user right-clicks to open, or clears the quarantine bit. A notarized binary that Apple has stamped skips that step, and the same is true for a user who copies uv into a locked-down corporate image. On Windows, an Authenticode signature lets SmartScreen and enterprise application control policies recognise Astral as the publisher instead of treating the file as unknown. Windows Defender and third-party antivirus scanners lean on the same signature to lower the false positive rate on new releases.
The change matters most for corporate and CI environments that already run publisher-based allowlists, because the entry can now name Astral rather than a hash that has to be re-added on every version bump. It also closes a small window where a swapped binary served from a compromised mirror would run without complaint.
The release carries one bug fix alongside the signing work: distributions uploaded after the exclude-newer cutoff are now excluded from lockfiles and generated requirement hashes, so an exclude-newer lockfile no longer pins a wheel that was published after the requested date.
The signing infrastructure sits behind it
Two separate chains of trust do this. On the macOS side, the developer certificate is issued by Apple to the identified publisher, and notarization is an extra scan Apple runs on the uploaded binary before stapling an approval to it. On the Windows side, Azure Artifact Signing holds a certificate for the publisher and applies a signature with a trusted timestamp, so the signature stays valid even after the certificate itself rotates.
The release also carries GitHub Artifact Attestations, and Astral notes that any artifact can be verified against the source repository with gh attestation verify --repo astral-sh/uv. Attestations bind the artifact to the workflow that produced it in the astral-sh/uv repository, which is a separate check from the OS-level publisher signature.
For teams still on an older uv, the upgrade path is unchanged: the same installer script or wheel, and no configuration change on the caller side. The first release built and signed on the new infrastructure is 0.12.12, so anyone allowlisting by publisher needs the new binary to see the signature.
Source
- Release notes: astral-sh/uv 0.12.12
Source: Astral
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually shipping with them. Short, and only when there is something worth reading.
