A plea not to use uv-build

After observing multiple Python packages being compromised on Gentoo due to a single dependency switching to uv-build, a plea is raised to Gentoo users: refrain from utilizing uv-build as the build backend. This plea is not directed at uv or the other Astral tools, both of which are commendable and responsive. Rather, the focus is on the uv-build backend, which, despite its potential benefits, fails to justify its drawbacks.

The primary concerns are the size of uv-build and its Rust foundation. While Rust offers numerous advantages, these are less relevant for a build backend used for pure Python packages. The package's wheel sizes, ranging from 1.2 MiB to 1.5 MiB, are notably large. Furthermore, users are required to build uv-build from source, a process that becomes increasingly burdensome given its frequent releases (12 within the 30 days prior to writing this).

This means that for every 100 milliseconds spent installing a package version using uv-build, Gentoo users will spend significant hours rebuilding uv-build repeatedly. However, the most pressing issue is portability. Although Python is portable across various systems, Rust's support is still growing. Even if a Rust compiler can be obtained on a specific platform, uv may not function correctly.

Problems can stem from dependencies' bugs, or the resulting executable being too large to accommodate the toolchain within the address space. The Gentoo uv ebuild has already implemented two hacks to support uv on 32-bit platforms, illustrating the complexity of addressing these issues.

There are two perceived advantages to using uv-build: consistency when using uv for projects, and performance gains. Consistency, however, is a moot point as any backend can be used with any tool, adhering to the principles of PEP 517. Performance gains are equally insignificant, as the difference is minimal and executed infrequently.

Moreover, the performance boost can be overshadowed by the time taken to download the 1.5 MiB wheel for uv-build. Regular users, who consume source distributions, are the most affected group, and the performance gains are negated by the time spent building uv-build.