# System map — astral-sh/uv

> Canonical page: https://codevetter.com/unpack/uv/system-map

# System map — astral-sh/uv

Scanned commit a9e231a7e377342084d1c0b6009409bdec41acc5 (2026-09-21). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

The cargo workspace at Cargo.toml includes every crate under crates/*, except scripts and the nightly-only crates/uv-trampoline. Product version 0.12.17 is shared by the uv, uv-version, and uv-build packages; most library crates are 0.0.84. Edition is 2024 and the MSRV is rust-version 1.96.0, licensed MIT OR Apache-2.0. The user-facing process starts at crates/uv/src/bin/uv.rs, which calls the unsafe uv::main in crates/uv/src/lib.rs. That function parses clap types from uv-cli, then runs an async dispatcher on a current-thread Tokio runtime. A separate PyPI wheel is built with maturin and a small Python launcher. Deployment artifacts are musl binaries produced by the Dockerfile (cargo auditable zigbuild --release) and GitHub Actions release workflows.
- Workspace members are crates/* with resolver 2. scripts and crates/uv-trampoline are excluded because the trampoline crate needs nightly. Shared package metadata sets edition 2024, rust-version 1.96.0, and license MIT OR Apache-2.0. — [Cargo.toml#L1-L16](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/Cargo.toml#L1-L16)
- The uv library crate is version 0.12.17, default-run uv, and depends on the internal crates (uv-cli, uv-resolver, uv-lock, uv-client, uv-cache, uv-python, uv-auth, uv-publish, uv-workspace, and others). Optional features include performance-memory-allocator, self-update (axoupdater, only for the cargo-dist installer), and test-* gates. — [crates/uv/Cargo.toml#L1-L12](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv/Cargo.toml#L1-L12) [crates/uv/Cargo.toml#L160-L217](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv/Cargo.toml#L160-L217)
- crates/uv/src/bin/uv.rs is the real CLI entrypoint. When the performance-memory-allocator feature is on it links that allocator, then calls unsafe uv::main(std::env::args_os()) before any other threads exist. — [crates/uv/src/bin/uv.rs#L1-L14](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv/src/bin/uv.rs#L1-L14)
- uv::main sets the UV environment variable to std::env::current_exe, parses Cli::try_parse_from, and on failure calls suggest_subcommand. It then builds a current-thread Tokio runtime on a thread named main2 with min_stack_size, block_on(run(..., GlobalInitialization::Initialize)), and shutdown_background so leftover resolver HTTP tasks do not delay exit. — [crates/uv/src/lib.rs#L3006-L3074](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv/src/lib.rs#L3006-L3074)
- Two companion binaries share the install directory. uvx rewrites argv to uv tool uvx and execs a sibling uv (Unix CommandExt::exec, Windows uv_windows::spawn_child). uvw is a Windows GUI-subsystem binary (windows_subsystem = windows) that execs the sibling uv with the original arguments and no console. — [crates/uv/src/bin/uvx.rs#L71-L103](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv/src/bin/uvx.rs#L71-L103) [crates/uv/src/bin/uvw.rs#L1-L16](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv/src/bin/uvw.rs#L1-L16) [crates/uv/src/bin/uvw.rs#L70-L100](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv/src/bin/uvw.rs#L70-L100)
- The PyPI package uv is built by maturin (bindings = bin, manifest-path crates/uv/Cargo.toml, python-source python, requires-python >=3.8). python/uv/__main__.py locates the bundled binary via find_uv_bin, copies VIRTUAL_ENV when the interpreter is already in a venv, sets UV_INTERNAL__PARENT_INTERPRETER, and execs or subprocess-runs uv. — [pyproject.toml#L1-L49](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/pyproject.toml#L1-L49) [python/uv/__main__.py#L1-L54](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/python/uv/__main__.py#L1-L54)
- Command modules are declared in crates/uv/src/commands/mod.rs: auth, pip, project, python, tool, publish, venv, workspace, cache_*, build_frontend, build_backend, and optional self_update. ExitStatus is Success, Failure, Error, or External(u8). UvError splits user, argument, and unexpected failures so the entrypoint can pick the exit code. — [crates/uv/src/commands/mod.rs#L13-L105](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv/src/commands/mod.rs#L13-L105) [crates/uv/src/commands/mod.rs#L107-L137](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv/src/commands/mod.rs#L107-L137)
- The crate map in crates/README.md separates the PEP 517 build frontend (uv-build-frontend), Simple-API client (uv-client), wheel installer (uv-install-wheel), PubGrub-backed resolver (uv-resolver), cache (uv-cache), interpreter discovery (uv-python), and workspace layer (uv-workspace). uv-dispatch is the shared struct that resolves and builds sdists in isolated environments and implements uv-types traits. — [crates/README.md#L45-L133](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/README.md#L45-L133)
- HTTP access is centralized in base_client_builder, which constructs BaseClientBuilder from connectivity, system_certs, allow_insecure_host, preview, read/connect timeouts, retries, metadata_range_request, cache_read_concurrency, and http/https/no_proxy settings, optionally attaching custom certificates. — [crates/uv/src/lib.rs#L71-L93](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv/src/lib.rs#L71-L93)
- The Docker image is a two-stage build: ubuntu:24.04 installs a pinned rustup, uv sync --only-group docker --locked, then cargo auditable zigbuild --bin uv --bin uvx --release for aarch64-unknown-linux-musl or x86_64-unknown-linux-musl with AWS_LC_SYS_USE_SYSTEM=0. The runtime stage is FROM scratch with ENTRYPOINT /uv. — [Dockerfile#L1-L73](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/Dockerfile#L1-L73) [pyproject.toml#L111-L117](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/pyproject.toml#L111-L117)
- CI entry is .github/workflows/ci.yml on push to main, pull_request, and workflow_dispatch. It calls plan.yml, then reusable workflows for fmt, security review, lint, docs, zizmor, publish checks, lockfile checks, cargo test, Windows trampolines, dev binaries, and smoke tests. Permissions are contents: read and UV_LOCKED=1 is set. — [.github/workflows/ci.yml#L1-L120](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/.github/workflows/ci.yml#L1-L120)
- uv was installed through an external package manager and cannot update itself when the self-update feature is off. ExternallyInstalledError tells the user to use the recorded InstallSource. The self-update feature is documented as enabled only for uv's cargo-dist installer. — [crates/uv/src/lib.rs#L111-L131](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv/src/lib.rs#L111-L131) [crates/uv/Cargo.toml#L167-L169](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv/Cargo.toml#L167-L169)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)