It looks like it downloads from uv's git repository, which would also solve the coordination problem under discussion, since once a version is posted there it should remain there.