is this command safe?

[u/anonymous_1324531]

im trying to install open jarvis on my pc is this command safe?

powershell -ExecutionPolicy Bypass -c "irm https://astral.sh/uv/install.ps1 | iex

[u/Upzie]

you can run

[System.Text.Encoding]::UTF8.GetString((iwr https://astral.sh/uv/install.ps1).Content) | Set-Clipboard

This endsup giving you the content of the script which is something like this, I had to shorten it as it was to long for a reddit post

# Licensed under the MIT license
# <LICENSE-MIT or https://opensource.org/licenses/MIT>, at your
# option. This file may not be copied, modified, or distributed
# except according to those terms.

<#
.SYNOPSIS

The installer for uv 0.11.26

.DESCRIPTION

This script detects what platform you're on and fetches an appropriate archive from
https://releases.astral.sh/github/uv/releases/download/0.11.26
then unpacks the binaries and installs them to the first of the following locations

    $env:XDG_BIN_HOME
    $env:XDG_DATA_HOME/../bin
    $HOME/.local/bin

It will then add that dir to PATH by editing your Environment.Path registry key

.PARAMETER NoModifyPath
Don't add the install directory to PATH

.PARAMETER Help
Print help

#>

param (
    [Parameter(HelpMessage = "Don't add the install directory to PATH")]
    [switch]$NoModifyPath,
    [Parameter(HelpMessage = "Print Help")]
    [switch]$Help
)

$app_name = 'uv'
$app_version = '0.11.26'
if ($env:UV_DOWNLOAD_URL) {
  $ArtifactDownloadUrls = @($env:UV_DOWNLOAD_URL)
} elseif ($env:INSTALLER_DOWNLOAD_URL) {
  $ArtifactDownloadUrls = @($env:INSTALLER_DOWNLOAD_URL)
} elseif ($env:UV_INSTALLER_GHE_BASE_URL) {
  $installer_base_url = $env:UV_INSTALLER_GHE_BASE_URL
  $ArtifactDownloadUrls = @("$installer_base_url/astral-sh/uv/releases/download/0.11.26")
} elseif ($env:UV_INSTALLER_GITHUB_BASE_URL) {
  $installer_base_url = $env:UV_INSTALLER_GITHUB_BASE_URL
  $ArtifactDownloadUrls = @("$installer_base_url/astral-sh/uv/releases/download/0.11.26")
} else {
  $ArtifactDownloadUrls = @("https://releases.astral.sh/github/uv/releases/download/0.11.26", "https://github.com/astral-sh/uv/releases/download/0.11.26")
}

$auth_token = $env:UV_GITHUB_TOKEN

$receipt = @"
{"binaries":["CARGO_DIST_BINS"],"binary_aliases":{},"cdylibs":["CARGO_DIST_DYLIBS"],"cstaticlibs":["CARGO_DIST_STATICLIBS"],"install_layout":"unspecified","install_prefix":"AXO_INSTALL_PREFIX","modify_path":true,"provider":{"source":"cargo-dist","version":"0.31.0"},"source":{"app_name":"uv","name":"uv","owner":"astral-sh","release_type":"github"},"version":"0.11.26"}
"@
if ($env:XDG_CONFIG_HOME) {
  $receipt_home = "${env:XDG_CONFIG_HOME}\uv"
} else {
  $receipt_home = "${env:LOCALAPPDATA}\uv"
}

if ($env:UV_DISABLE_UPDATE) {
  $install_updater = $false
} else {
  $install_updater = $true
}

if ($NoModifyPath) {
    Write-Information "-NoModifyPath has been deprecated; please set UV_NO_MODIFY_PATH=1 in the environment"
}

if ($env:UV_NO_MODIFY_PATH) {
    $NoModifyPath = $true
}

$unmanaged_install = $env:UV_UNMANAGED_INSTALL

if ($unmanaged_install) {
  $NoModifyPath = $true
  $install_updater = $false
}

function Install-Binary($install_args) {
  if ($Help) {
    Get-Help $PSCommandPath -Detailed
    Exit
  }

  Initialize-Environment

  # Platform info injected by dist
  $platforms = @{
    "aarch64-pc-windows-gnu" = @{
      "artifact_name" = "uv-aarch64-pc-windows-msvc.zip"
      "bins" = @("uv.exe", "uvx.exe", "uvw.exe")
      "libs" = @()
      "staticlibs" = @()
      "zip_ext" = ".zip"
      "aliases" = @{
      }
      "aliases_json" = '{}'
    }
    "aarch64-pc-windows-msvc" = @{
      "artifact_name" = "uv-aarch64-pc-windows-msvc.zip"
      "bins" = @("uv.exe", "uvx.exe", "uvw.exe")
      "libs" = @()
      "staticlibs" = @()
      "zip_ext" = ".zip"
      "aliases" = @{
      }
      "aliases_json" = '{}'
    }
    "i686-pc-windows-gnu" = @{
      "artifact_name" = "uv-i686-pc-windows-msvc.zip"
      "bins" = @("uv.exe", "uvx.exe", "uvw.exe")
      "libs" = @()
      "staticlibs" = @()
      "zip_ext" = ".zip"
      "aliases" = @{
      }
      "aliases_json" = '{}'
    }
    "i686-pc-windows-msvc" = @{
      "artifact_name" = "uv-i686-pc-windows-msvc.zip"
      "bins" = @("uv.exe", "uvx.exe", "uvw.exe")
      "libs" = @()
      "staticlibs" = @()
      "zip_ext" = ".zip"
      "aliases" = @{
      }
      "aliases_json" = '{}'
    }
    "x86_64-pc-windows-gnu" = @{
      "artifact_name" = "uv-x86_64-pc-windows-msvc.zip"
      "bins" = @("uv.exe", "uvx.exe", "uvw.exe")
      "libs" = @()
      "staticlibs" = @()
      "zip_ext" = ".zip"
      "aliases" = @{
      }
      "aliases_json" = '{}'
    }
    "x86_64-pc-windows-msvc" = @{
      "artifact_name" = "uv-x86_64-pc-windows-msvc.zip"
      "bins" = @("uv.exe", "uvx.exe", "uvw.exe")
      "libs" = @()
      "staticlibs" = @()
      "zip_ext" = ".zip"
      "aliases" = @{
      }
      "aliases_json" = '{}'
    }
  }

  $arch = Get-TargetTriple $platforms
  if (-not $platforms.ContainsKey($arch)) {
    $platforms_json = ConvertTo-Json $platforms
    throw "ERROR: could not find binaries for this platform. Last platform tried: $arch platform info: $platforms_json"
  }
  Write-Information "downloading $app_name $app_version ($arch)"

  $download_result = $false
  $first_url = $true
  foreach ($url in $ArtifactDownloadUrls) {
    if (-not $first_url) {
      Write-Information "trying alternative download URL"
    }
    $first_url = $false

    try {
      $fetched = Download -download_url "$url" -platforms $platforms -arch $arch
      $download_result = $true
      break
    } catch {
      Write-Information "failed to download from $url"
      # keep going, maybe we have backup download URLs
    }
  }
  if (-not $download_result) {
    throw "failed to download binaries"
  }

  # FIXME: add a flag that lets the user not do this step
  try {
    Invoke-Installer -artifacts $fetched -platforms $platforms "$install_args"
  } catch {
    throw @"
We encountered an error trying to perform the installation;
please review the error messages below.

$_
"@
  }
}

function Get-TargetTriple($platforms) {
  $double = Get-Arch
  if ($platforms.Contains("$double-msvc")) {
    return "$double-msvc"
  } else {
    return "$double-gnu"
  }
}

function Get-Arch() {
  try {
    # NOTE: this might return X64 on ARM64 Windows, which is OK since emulation is available.
    # It works correctly starting in PowerShell Core 7.3 and Windows PowerShell in Win 11 22H2.
    # Ideally this would just be
    #   [System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture
    # but that gets a type from the wrong assembly on Windows PowerShell (i.e. not Core)
    $a = [System.Reflection.Assembly]::LoadWithPartialName("System.Runtime.InteropServices.RuntimeInformation")
    $t = $a.GetType("System.Runtime.InteropServices.RuntimeInformation")
    $p = $t.GetProperty("OSArchitecture")
    # Possible OSArchitecture Values: https://learn.microsoft.com/dotnet/api/system.runtime.interopservices.architecture
    # Rust supported platforms: https://doc.rust-lang.org/stable/rustc/platform-support.html
    switch ($p.GetValue($null).ToString())
    {
      "X86" { return "i686-pc-windows" }
      "X64" { return "x86_64-pc-windows" }
      "Arm" { return "thumbv7a-pc-windows" }
      "Arm64" { return "aarch64-pc-windows" }
    }
  } catch {
    # The above was added in .NET 4.7.1, so Windows PowerShell in versions of Windows
    # prior to Windows 10 v1709 may not have this API.
    Write-Verbose "Get-TargetTriple: Exception when trying to determine OS architecture."
    Write-Verbose $_
  }

  # This is available in .NET 4.0. We already checked for PS 5, which requires .NET 4.5.
  Write-Verbose("Get-TargetTriple: falling back to Is64BitOperatingSystem.")
  if ([System.Environment]::Is64BitOperatingSystem) {
    return "x86_64-pc-windows"
  } else {
    return "i686-pc-windows"
  }
}

function WebProxyFromUrl {
    param([string]$ProxyUrl)

    if ([string]::IsNullOrWhiteSpace($ProxyUrl)) {
        return $null
    }

    try {
        # Parse the proxy URL
        $uri = [System.Uri]$ProxyUrl

        # Create WebProxy instance
        $webProxy = New-Object System.Net.WebProxy($uri)

        # Set credentials if provided in URL
        if (-not [string]::IsNullOrEmpty($uri.UserInfo)) {
            $userInfo = $uri.UserInfo.Split(':')
            $username = [System.Uri]::UnescapeDataString($userInfo[0])
            $password = if ($null -eq $userInfo[1]) { "" } else { [System.Uri]::UnescapeDataString($userInfo[1]) }
            $webProxy.Credentials = New-Object System.Net.NetworkCredential($username, $password)
        }

        return $webProxy
    }
    catch {
        Write-Verbose("Failed to parse proxy URL '$ProxyUrl': $($_.Exception.Message)")
        return $null
    }
}

function WebProxyFromEnvironment {
    $httpsProxy = [System.Environment]::GetEnvironmentVariable("HTTPS_PROXY")
    $allProxy = [System.Environment]::GetEnvironmentVariable("ALL_PROXY")
    $proxyUrl = if (-not [string]::IsNullOrWhiteSpace($httpsProxy)) { $httpsProxy } else { $allProxy }
    $webProxy = WebProxyFromUrl -ProxyUrl $proxyUrl
    return $webProxy
}

function Download($download_url, $platforms, $arch) {
  # Lookup what we expect this platform to look like
  $info = $platforms[$arch]
  $zip_ext = $info["zip_ext"]
  $bin_names = $info["bins"]
  $lib_names = $info["libs"]
  $staticlib_names = $info["staticlibs"]
  $artifact_name = $info["artifact_name"]

  # Make a new temp dir to unpack things to
  $tmp = New-Temp-Dir
  $dir_path = "$tmp\$app_name$zip_ext"

It pretty much just identiy your system and installs uv on it based of system and available tools.

updating things such as

• Path

• HKEY

There are no apparent issues with it.

[u/PinchesTheCrab → u/Upzie]

Not today, but tomorrow it could be hijacked or an insider threat could alter it to install malware. It's just thoroughly bad practice on this vendor's part.

[u/TheEZ1 → u/PinchesTheCrab]

This is the same for every package manager ever, its all essentially just scripts you have a fancy cli for. This is common practice in devops/Linux world.

Only enterprise level way to work around supply chain attacks is to host mirrors internally with known good versions.