I love uv. But the post starts with a simple install using a oneliner curl piping to sh, which is such a big attack surface area… I would much rather have a much longer one liner that increases safety.
In reality, nobody checks checksums of binaries they download, so piping curl into bash makes no difference.
Piping curl to bash, especially a copy/paste from a random blog is way too easy to exploit. Most people might not realize if the unicode they copied from a website silently translates to a different location than what they thought they read in the screen.
But you don't have to. Brew and other package managers hold uv in their registries.
It’s really excellent stuff