{
  "schemaVersion": 1,
  "methodology": "https://ionbin.com/interfaces/methodology/#evaluations",
  "evaluation": {
    "id": "uv",
    "testedOn": "2026-10-18",
    "coverage": "local-runtime",
    "summary": "An offline virtual environment installed and imported a synthetic wheel with the correct hash. A wrong hash and an uncached offline package were rejected.",
    "identity": {
      "version": "0.13.1 (62faed335, x86_64-pc-windows-msvc)",
      "target": "Official uv Windows x64 release archive",
      "integrity": "SHA-256 3b2661a463a5baea7f5076ea2b25ab71d77f36a6c0d809e5350651792f80a672 of the official downloaded uv.zip artifact."
    },
    "environment": [
      "Windows 11 x64; Python 3.12.10 harness. Raw timestamps UTC.",
      "Fresh per-tool home/config/cache; child environment constructed from OS/runtime paths, explicit isolation variables and no inherited credentials. Synthetic fixtures only; no user account sign-in.",
      "UV_OFFLINE=1, UV_NO_SYSTEM_CONFIG=1 and UV_PYTHON_DOWNLOADS=never; explicit fixture interpreter and private cache."
    ],
    "checks": [
      {
        "id": "uv-version",
        "name": "Downloaded version",
        "method": "<evaluation>\\downloads\\cli\\uv\\uv.exe --version",
        "expected": "Print the pinned binary version.",
        "observed": "Exit 0. uv 0.13.1 (62faed335 2026-10-13 x86_64-pc-windows-msvc)",
        "outcome": "pass"
      },
      {
        "id": "uv-venv",
        "name": "Create offline virtual environment",
        "method": "<evaluation>\\downloads\\cli\\uv\\uv.exe venv --python <python-install>\\python.exe <evaluation>\\runs\\cli\\uv\\fixture\\.venv --offline",
        "expected": "Create a fixture venv using the existing Python interpreter.",
        "observed": "Exit 0. Created the fixture .venv with CPython 3.12.10; Python downloads were disabled.",
        "outcome": "pass"
      },
      {
        "id": "uv-bad-hash",
        "name": "Reject mismatching package hash",
        "method": "Author a ZIP wheel named ionbin_fixture-0.0.1-py3-none-any.whl containing ionbin_fixture.py with VALUE = \"synthetic-only\"; ionbin_fixture-0.0.1.dist-info/METADATA with Metadata-Version: 2.1, Name: ionbin-fixture, Version: 0.0.1 (each on its own line); WHEEL with Wheel-Version: 1.0, Generator: IonBin synthetic fixture, Root-Is-Purelib: true, Tag: py3-none-any (each on its own line); and an empty RECORD. The tested wheel SHA-256 was d375a7e7cd1cdee145e6f347603d4c99a15de1a180db406cbd5e577c9aeda737. ZIP timestamps can change a regenerated archive hash; calculate its actual SHA-256 for the matching-hash case. bad.txt contains one line: <absolute-fixture-wheel-path> --hash=sha256:0000000000000000000000000000000000000000000000000000000000000000. Use the fixture .venv created by the preceding venv check. Command: <evaluation>\\downloads\\cli\\uv\\uv.exe pip install --python <evaluation>\\runs\\cli\\uv\\fixture\\.venv\\Scripts\\python.exe --require-hashes --offline -r <evaluation>\\runs\\cli\\uv\\fixture\\bad.txt",
        "expected": "Fail a wheel whose required SHA-256 is deliberately all zeroes.",
        "observed": "Exit 1. Hash mismatch for ionbin-fixture; the expected all-zero digest did not match the locally generated wheel.",
        "outcome": "pass"
      },
      {
        "id": "uv-valid-hash",
        "name": "Install the matching wheel",
        "method": "Author a ZIP wheel named ionbin_fixture-0.0.1-py3-none-any.whl containing ionbin_fixture.py with VALUE = \"synthetic-only\"; ionbin_fixture-0.0.1.dist-info/METADATA with Metadata-Version: 2.1, Name: ionbin-fixture, Version: 0.0.1 (each on its own line); WHEEL with Wheel-Version: 1.0, Generator: IonBin synthetic fixture, Root-Is-Purelib: true, Tag: py3-none-any (each on its own line); and an empty RECORD. The tested wheel SHA-256 was d375a7e7cd1cdee145e6f347603d4c99a15de1a180db406cbd5e577c9aeda737. ZIP timestamps can change a regenerated archive hash; calculate its actual SHA-256 for the matching-hash case. valid.txt contains one line: <absolute-fixture-wheel-path> --hash=sha256:d375a7e7cd1cdee145e6f347603d4c99a15de1a180db406cbd5e577c9aeda737. Use the fixture .venv created by the preceding venv check. Command: <evaluation>\\downloads\\cli\\uv\\uv.exe pip install --python <evaluation>\\runs\\cli\\uv\\fixture\\.venv\\Scripts\\python.exe --require-hashes --offline -r <evaluation>\\runs\\cli\\uv\\fixture\\valid.txt",
        "expected": "Install the exact synthetic wheel with --require-hashes --offline.",
        "observed": "Exit 0. Resolved, prepared and installed one package: ionbin-fixture 0.0.1. Hardlinks were unavailable in this environment, so uv fell back to copying.",
        "outcome": "pass"
      },
      {
        "id": "uv-import",
        "name": "Import the installed fixture",
        "method": "<evaluation>\\runs\\cli\\uv\\fixture\\.venv\\Scripts\\python.exe -I -c \"import ionbin_fixture; print(ionbin_fixture.VALUE)\"",
        "expected": "The isolated interpreter prints the synthetic package value.",
        "observed": "Exit 0. synthetic-only",
        "outcome": "pass"
      },
      {
        "id": "uv-offline-miss",
        "name": "Reject an uncached offline dependency",
        "method": "<evaluation>\\downloads\\cli\\uv\\uv.exe pip install --python <evaluation>\\runs\\cli\\uv\\fixture\\.venv\\Scripts\\python.exe --offline ionbin-does-not-exist-12345==0.0.1",
        "expected": "Fail without fetching an invented package.",
        "observed": "Exit 1. No solution found: ionbin-does-not-exist-12345 was not in the cache, and network access was disabled.",
        "outcome": "pass"
      }
    ],
    "findings": [
      {
        "title": "Hash checking rejected the deliberately changed requirement",
        "basis": "observed",
        "severity": "informational",
        "detail": "The wrong-hash run failed, while the matching-hash wheel installed and imported. This tests artifact matching for one wheel, not whether its code is trustworthy.",
        "practicalAdvice": "Pin versions and trusted hashes, review package provenance and retain a lockfile appropriate to the workflow."
      },
      {
        "title": "Offline mode has a concrete dependency limit",
        "basis": "observed",
        "severity": "informational",
        "detail": "An invented uncached dependency failed with an offline-resolution message. A clean deployment needs all required artifacts available beforehand.",
        "practicalAdvice": "Prepare and verify the required wheels/cache in advance, then rehearse the exact offline install."
      },
      {
        "title": "Hash verification does not prevent package code execution",
        "basis": "observed",
        "severity": "medium",
        "detail": "The synthetic module executed when imported. Build backends and installed package code remain part of the trust decision; hash checks identify bytes rather than certify behavior.",
        "practicalAdvice": "Prefer reviewed artifacts and isolated environments; separately control source builds and execution."
      }
    ],
    "caveats": [
      "This fixture used a locally authored pure-Python wheel with no dependencies or build backend.",
      "The observed hardlink fallback can affect installation cost; no speed comparison was performed."
    ],
    "notTested": [
      "Public/private indexes, dependency confusion, credential handling, source builds and malicious packages.",
      "Cross-platform locking, resolver edge cases, Python downloads and real application compatibility."
    ],
    "sources": [
      {
        "label": "Official documentation",
        "url": "https://docs.astral.sh/uv/"
      },
      {
        "label": "Hash and offline options",
        "url": "https://docs.astral.sh/uv/reference/cli/"
      },
      {
        "label": "Environment selection",
        "url": "https://docs.astral.sh/uv/pip/environments/"
      }
    ],
    "reportUrl": "/interface-evaluations/uv.json"
  }
}