Doc and install: avoid security issue on Windows

[paugier]

In https://docs.astral.sh/uv/getting-started/installation/#installation-methods, the given install command is currently for Windows

powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

I was not able to run this because of a security software.

However, I was able to follow the installation instructions "Install via Scoop:" in https://pipx.pypa.io/stable/installation/ for which one needs to execute:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser
Invoke-RestMethod -Uri https://get.scoop.sh | Invoke-Expression

Therefore, I guess installation instructions for UV (or the script I don't know) could be improved to avoid such security blockage.

[zanieb]

What did your security software do? Was there an error?

[paugier]

The security software closed the terminal and reported an issue to my company 🙂 (I know that because I was told about).

[zanieb]

Do you know for what reason? This doesn't really sound like something we can fix unless we sign the installers or something (ref #10336)

[paugier]

I was finally able to install UV with the .ps1 installer with

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser
irm https://astral.sh/uv/install.ps1 -OutFile install-uv.ps1
iex .\install-uv.ps1

So it might just be that what does not like the security software is only the | iex ? However, | Invoke-Expression worked with Scoop, so I don't know.

[paugier]

It might be useful to improve the documentation. About this and also not using short Powershell aliases. I guess very few people know "irm" and "iex" so it is really "copy paste this command that you don't understand". The longer version with few steps and with a local (and checkable) install-uv.ps1 script might be better.

[OMFCP]

We have a user try to install this and our AV blocked it as well. The specific error was "The application powershell.exe attempted to execute fileless content that contains known malware. This content performs highly suspicious process injection behavior." I'm trying to figure out what specifically in there it flagged as known malware, but I don't have anything specific at this point.

[paugier]

The specific error was "The application powershell.exe attempted to execute fileless content that contains known malware.

It seems to indicate that it can be an issue with | iex (executing without file on disk).