# Verified 2026-09-11: astral-sh/uv publishes GitHub build-provenance
# attestations (sigstore bundle, `gh attestation verify` passes) for every
# release asset — tier 2, not the tier-4 same-origin-sha256 originally
# assumed in SPEC.md's draft example. Per-asset .sha256 files also exist
# but aren't used here since the attestation is strictly stronger.

[package.uv]
repo = "astral-sh/uv"
asset_pattern = "uv-x86_64-unknown-linux-gnu.tar.gz"

[package.uv.verification]
method = "github-attestation"

[package.uv.sanity_check]
command = "uv --version"
version_regex = 'uv (\d+\.\d+\.\d+)'