image(uv): derive the checksum from the attested release tarball

[nozaq]

Summary

uv's committed checksum was fetched from releases.astral.sh, which serves the sum uv's release workflow wrote next to the tarball, so the build trusted whatever that release carried. uv attests every release archive with actions/attest-build-provenance, so the checksum is now derived the way pnpm's is:

• uv/checksum.sh downloads the tarball, has gh attestation verify bind its digest to uv's release workflow, and prints the sha256 line that update-material.sh commits.
• uv/build.yaml declares the materials as command entries instead of url entries.
• The Dockerfile comment and the README's Supply chain section describe the new trust anchor.

Verify flags

uv's release.yml is workflow_dispatched on main and creates the version's tag at the commit it ran on (gh release create ... --target $RELEASE_COMMIT), so the signing certificate carries refs/heads/main as the source ref rather than a tag. The script resolves the tag to its commit with git ls-remote and passes it as --source-digest, which is what ties the tarball to the pinned version. The certificate for the pinned tarballs (both architectures) names astral-sh/uv/.github/workflows/release.yml, a GitHub-hosted runner, and commit 0ebbd927, the commit tag 0.12.13 points to, so --deny-self-hosted-runners applies as well.

Deno

Deno is left on the checksum its release publishes. Its CI computes the sums with shasum and uploads them beside the archives, there is no attestation step in any of its workflows, and the Sigstore transparency log holds no entry for either pinned archive digest, so there is nothing for gh attestation verify to check. The Deno wording in the README, build.yaml, and the Dockerfile is corrected to say what that checksum actually guarantees: it comes from the same release as the archive, and pinning it protects against a later swap of the download, not against the release itself.

Verification

• shellcheck uv/checksum.sh is clean.
• scripts/update-material.sh uv with a stub gh reports both materials unchanged: sha256sum prints the same line the previous source served, so uv-amd64.sha256 and uv-arm64.sha256 are byte-identical.
• scripts/dockerhub-overview.sh renders both READMEs.
• The real gh attestation verify could not be run in this environment; the update-material.yml run on this PR exercises it, since */checksum.sh and */build.yaml changed.

🤖 Generated with Claude Code

---

Generated by Claude Code