CodeVetter · Repo Unpack · System map
astral-sh/uv
The cargo workspace at Cargo.toml includes every crate under crates/*, except scripts and the nightly-only crates/uv-trampoline. Product version 0.12.17 is shared by the uv, uv-version, and uv-build packages; most library crates are 0.0.84. Edition is 2024 and the MSRV is rust-version 1.96.0, licensed MIT OR Apache-2.0. The user-facing process starts at crates/uv/src/bin/uv.rs, which calls the unsafe uv::main in crates/uv/src/lib.rs. That function parses clap types from uv-cli, then runs an async dispatcher on a current-thread Tokio runtime. A separate PyPI wheel is built with maturin and a small Python launcher. Deployment artifacts are musl binaries produced by the Dockerfile (cargo auditable zigbuild --release) and GitHub Actions release workflows.
- Workspace members are crates/* with resolver 2. scripts and crates/uv-trampoline are excluded because the trampoline crate needs nightly. Shared package metadata sets edition 2024, rust-version 1.96.0, and license MIT OR Apache-2.0.
- The uv library crate is version 0.12.17, default-run uv, and depends on the internal crates (uv-cli, uv-resolver, uv-lock, uv-client, uv-cache, uv-python, uv-auth, uv-publish, uv-workspace, and others). Optional features include performance-memory-allocator, self-update (axoupdater, only for the cargo-dist installer), and test-* gates.
- crates/uv/src/bin/uv.rs is the real CLI entrypoint. When the performance-memory-allocator feature is on it links that allocator, then calls unsafe uv::main(std::env::args_os()) before any other threads exist.
- uv::main sets the UV environment variable to std::env::current_exe, parses Cli::try_parse_from, and on failure calls suggest_subcommand. It then builds a current-thread Tokio runtime on a thread named main2 with min_stack_size, block_on(run(..., GlobalInitialization::Initialize)), and shutdown_background so leftover resolver HTTP tasks do not delay exit.
- Two companion binaries share the install directory. uvx rewrites argv to uv tool uvx and execs a sibling uv (Unix CommandExt::exec, Windows uv_windows::spawn_child). uvw is a Windows GUI-subsystem binary (windows_subsystem = windows) that execs the sibling uv with the original arguments and no console.
- The PyPI package uv is built by maturin (bindings = bin, manifest-path crates/uv/Cargo.toml, python-source python, requires-python >=3.8). python/uv/__main__.py locates the bundled binary via find_uv_bin, copies VIRTUAL_ENV when the interpreter is already in a venv, sets UV_INTERNAL__PARENT_INTERPRETER, and execs or subprocess-runs uv.
- Command modules are declared in crates/uv/src/commands/mod.rs: auth, pip, project, python, tool, publish, venv, workspace, cache_*, build_frontend, build_backend, and optional self_update. ExitStatus is Success, Failure, Error, or External(u8). UvError splits user, argument, and unexpected failures so the entrypoint can pick the exit code.
- The crate map in crates/README.md separates the PEP 517 build frontend (uv-build-frontend), Simple-API client (uv-client), wheel installer (uv-install-wheel), PubGrub-backed resolver (uv-resolver), cache (uv-cache), interpreter discovery (uv-python), and workspace layer (uv-workspace). uv-dispatch is the shared struct that resolves and builds sdists in isolated environments and implements uv-types traits.
- HTTP access is centralized in base_client_builder, which constructs BaseClientBuilder from connectivity, system_certs, allow_insecure_host, preview, read/connect timeouts, retries, metadata_range_request, cache_read_concurrency, and http/https/no_proxy settings, optionally attaching custom certificates.
- The Docker image is a two-stage build: ubuntu:24.04 installs a pinned rustup, uv sync --only-group docker --locked, then cargo auditable zigbuild --bin uv --bin uvx --release for aarch64-unknown-linux-musl or x86_64-unknown-linux-musl with AWS_LC_SYS_USE_SYSTEM=0. The runtime stage is FROM scratch with ENTRYPOINT /uv.
- CI entry is .github/workflows/ci.yml on push to main, pull_request, and workflow_dispatch. It calls plan.yml, then reusable workflows for fmt, security review, lint, docs, zizmor, publish checks, lockfile checks, cargo test, Windows trampolines, dev binaries, and smoke tests. Permissions are contents: read and UV_LOCKED=1 is set.
- uv was installed through an external package manager and cannot update itself when the self-update feature is off. ExternallyInstalledError tells the user to use the recorded InstallSource. The self-update feature is documented as enabled only for uv's cargo-dist installer.