Package name : uv_build Version : 0.8.17 Upstream Author : Astral Software Inc. <contact@astral.sh> URL : https://github.com/astral-sh/uv License : MIT Programming Lang: Rust, Python Description : Rust-based build backend for Python packages This package provides the Rust-based build backend used by the uv project to build Python packages. It is intended for use by tools like 'pip' or 'uv' during the build process of other Python packages.
I've been trying to help out by packaging the remaining dependencies of `uv` and it looks like we're nearly there: almost all of the missing ones are in the NEW queue. The only one that seems vaguely problematic is pubgrub, which they are currently pulling from git instead of crates.io. On uv's side, the interest for a Debian package is tracked at https://github.com/astral-sh/uv/issues/13640. I've voiced there the interest in migrating pubgrub to some official version.
Upstream has now published on crates.io all of the forks they depended on. For the entire `uv` workspace, there are currently about 20 dependencies missing, but if we focus on uv-build, only astral-version-ranges and spdx seem to be needed. I'm working on both. It might make sense to make a first upload of uv without providing all of the crates in the workspace and iterate from there. Manuel, in which form do you need `uv-build`? Just as a binary package exposing the `uv_build` binary, I assume?
Hi, thanks for working on uv_build! Is there already a repository? Are there still crates missing in Debian? Cheers
Hi, I made a package here: https://salsa.debian.org/rust-team/uv For now it only exposes one binary package: python3-uv-build If anyone wants to sponsor it to experimental, that would be helpful. All its dependencies are actually in unstable already, so it could also be uploaded there directly, but I imagine there will be things to fix in the package. Cheers, Antonin
Hi Antonin, thanks for working on uv build! Very much appreciated! I'm currently busy with half a dozen of other new packages, and also "my" upstream moved from uv to hatch, so I'm not as desparate anymore. If nobody steps up in the next two weeks or so, please don't hesitate to ask me again. I might have more time at hand then. Cheers
Hi, I have just uploaded build to unstable. One of the packages I maintain has a new dependency which builds using uv_build, hence my interest in this package. Thanks a lot for your work packaging uv_build. Best wishes, Andrius
A reviewer has shared a note regarding uv 0.9.16+ds1-1:
Findings and Blockers
* Incomplete Copyright Attribution: The files in crates/uv-python/python/packaging/ are derived from the packaging project. They are copyrighted by Donald Stufft
and individual contributors and licensed under BSD-2-Clause or Apache-2.0. This needs a dedicated stanza in debian/copyright.
Sadly, `dnq author-check` did not find this
* License Mismatch: crates/uv-platform/src/libc.rs contains code from glibc-version-rs which is Apache-2.0 only. The current debian/copyright catch-all ("Expat
or Apache-2.0") is technically inaccurate for this specific file.
Request for Team Input: scripts/links
The directory scripts/links/ contains over 20 pre-compiled .whl and .tar.gz files.
* The Issue: These are binary artifacts. Under a strict interpretation of DFSG #2 and the "preferred form for modification" rule, shipping compiled wheels in the
source tarball is generally prohibited for main.
* The Counter-Argument: These files are carefully curated test data used to verify uv's behavior (e.g., hash verification, publishing, and installation of
various wheel formats). They are not intended for modification or execution in the traditional sense, but rather as static targets for the tool's logic.
* The Question: Should we treat these curated test stubs as "data" that can remain, or must we adhere to the standard policy of excluding all binary blobs? If
they must be excluded, the test suite will require significant patching to generate these stubs on the fly during the build.
I would appreciate opinions from other team members on whether these specific curated test wheels are acceptable in main or if they must be moved to
Files-Excluded.
Hi Richard, Thanks a lot for reviewing this upload! I've adjusted the debian/copyright in Salsa as indicated. Looking at the contents of the test wheels, I tend to agree with awm that those test artifacts are safe to include, but I'm happy to work on removing them if the decision comes to that. Best, Antonin
Hi Antonin, Thanks a lot for doing so! Would it be difficult to exclude the test wheels and skip the tests using them for now? It would be great to have uv in Debian already, with a possibility to enable the tests later on. Best, Andrius
7On 4/24/26 12:14, Antonin Delpeuch wrote: Awesome! So the source in the repository is now repackaged to exclude the offending test data, right? If so, I can re-upload uv shortly. Andrius
Hi Andrius Sure, I have excluded them in d/copyright as the tests which rely on them aren't run for now. I can figure out how to enable them when I package the full uv binary (from the same source package). Antonin
The Debian NEW review of uv 0.9.16+ds1-1 has been completed.
Decision: REJECTED
Reviewer: Reinhard Tartler
Review comment:
Findings and Blockers
Incomplete Copyright Attribution: The files in crates/uv-python/python/packaging/ are derived from the packaging project. They are copyrighted by Donald Stufft and individual contributors and licensed under BSD-2-Clause or Apache-2.0. This needs a dedicated stanza in debian/copyright.
License Mismatch: crates/uv-platform/src/libc.rs contains code from glibc-version-rs which is Apache-2.0 only. The current debian/copyright catch-all ("Expat or Apache-2.0") is technically inaccurate for this specific file.
Regarding the included test cases, I concur with Andrew. Please make a note in Debian/copyright along the lines "the binary files in scripts/links are carefully curated test fixtures that accompany the tests. They are easily unpacked and have trivial contents".
Thanks for working on the package, I'm looking forward to accepting the package with the issues above fixed.
Full review details: https://dfsg-new-queue.debian.org/reviews/uv
We believe that the bug you reported is fixed in the latest version of uv, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1115616@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Andrius Merkys <merkys@debian.org> (supplier of updated uv package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) Format: 1.8 Date: Wed, 20 May 2026 12:16:14 +0300 Source: uv Binary: python3-uv-build python3-uv-build-dbgsym Architecture: source amd64 Version: 0.9.17+ds1-1 Distribution: unstable Urgency: medium Maintainer: Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net> Changed-By: Andrius Merkys <merkys@debian.org> Description: python3-uv-build - Build backend of the uv Python package manager Closes: 1115616 Changes: uv (0.9.17+ds1-1) unstable; urgency=medium . * Initial release. (Closes: #1115616) Checksums-Sha1: 7af956e045e07dc2887d6631ffc5228a80c43618 11215 uv_0.9.17+ds1-1.dsc 38a0ec3b9d4aa83353558b0e00168d902aa116f5 2855124 uv_0.9.17+ds1.orig.tar.xz 692ff62e72951b492da5d2a566990d4cbd00926d 40856 uv_0.9.17+ds1-1.debian.tar.xz acce3f889c0fe0cda42fdba59d4d975da888dafc 11947012 python3-uv-build-dbgsym_0.9.17+ds1-1_amd64.deb 8edcb063ba0f709db926f3aaf6cd134579eb4386 1554332 python3-uv-build_0.9.17+ds1-1_amd64.deb 050d1d7351236d6676befaf9f322c578787ed6d9 41286 uv_0.9.17+ds1-1_amd64.buildinfo Checksums-Sha256: ab0935ed0bfd54c8c3c69db1399d98e06c11be8ab1ec6e27e24f8d229600ef35 11215 uv_0.9.17+ds1-1.dsc 2697ccdb0aadaedc09bd387545f9a30a18851d997e60ab5d8dcef0a055902a4a 2855124 uv_0.9.17+ds1.orig.tar.xz fcca2012a45d57bc4622d6d4fa38694e03e9f1d46ab0f0e4e159b5626770b16e 40856 uv_0.9.17+ds1-1.debian.tar.xz 2ce5224fb1294753d99b72a79a752056838d7dcf38b0d15007e07f25d89c6c28 11947012 python3-uv-build-dbgsym_0.9.17+ds1-1_amd64.deb 170af431fcd67cb9f7da3de37d71aa6666d1595492f02132348167fdf31f61a9 1554332 python3-uv-build_0.9.17+ds1-1_amd64.deb 0afeeae293563111b0c543165b89771035491f18eb4d1f20daa675ec6f18209d 41286 uv_0.9.17+ds1-1_amd64.buildinfo Files: 17f57e5ce6e08a6a7a5f4de5ab15c95b 11215 utils optional uv_0.9.17+ds1-1.dsc fa0c9a77ffa9624811339ba66fafec01 2855124 utils optional uv_0.9.17+ds1.orig.tar.xz a49579717cf51bbe6b235984c9243b7e 40856 utils optional uv_0.9.17+ds1-1.debian.tar.xz 54fe8603b631a95db9ccd7a16a4ea1fa 11947012 debug optional python3-uv-build-dbgsym_0.9.17+ds1-1_amd64.deb 63c7143ef127898609aac795e12df4d1 1554332 python optional python3-uv-build_0.9.17+ds1-1_amd64.deb 4962086356bce1d9c45a74dcbd010950 41286 utils optional uv_0.9.17+ds1-1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQJGBAEBCgAwFiEEdyKS9veshfrgQdQe5fQ/nCc08ocFAmoNfeYSHG1lcmt5c0Bk ZWJpYW4ub3JnAAoJEOX0P5wnNPKHgMMP/10H90T7I5rfhCWj6njoGIRBnq6hxse5 wgER3d4djDS9KRNJTxYwiEtwSVZgtiKtPh2yCmFTkYZX99YL6Wk0V5wukzkphRyC S0FcGMWtbZq7ht4/By6znruBah9GBEXbdlc6FejZRqU9ADXqWoNOUJf6+CfGI6gf VJif1kTWiQcF336r2zreaqsvOo41J/Ke51d9UJ69gVHXFpsYX22eTGEeXjD9goOj 3VA/+TZtW+J9gGR5z8vcAlec2PcVX4+osCvs5pVF+kAI9mH2PL44emk9yx8sh1vX SR5URO6O7eX7xyc8x1c9HpFLYGCj6XJfg6Khz3nNXa4YW3TcLbFqS+r2uDgbkXZV UB5/sCUo2C/ltOd4+ldTTwadv0T3fC9XYwWei8XffWH4/t6zIhLsj4sPC8xpKf4U kOO4dW3OD+vB1FsF80DctIt3ipXz2w4UtaFhZR1YejMeY+HZuBQBShUIKjrpVOiK 1ndgwc+HMXOKJwacaoq2iQ4kNPCd7HuKbXrpPf0nKiq60zkfIoBJRkR2bh86aV7O FZh8sXUsCvDvnVXFbVsWOSsW1Y6LJ+6dmtNTuyC6MVARfRXTFoZ7ZPCfyeYC9Mis SwOjxlm2yMmgtPbj8DBq0p6e5KJ+79AwDiun+nAaajdXeD9uz7bYRg29OlEcaSsZ 0LV01k///aPW =mtHy -----END PGP SIGNATURE-----
Closing as uv package is now in unstable.