Sign and notarize the macOS ToolHive CLI (thv) binary

[r3motecontrol]

The macOS thv binary ships ad-hoc signed, so it carries no Developer ID signature (and therefore no Team ID to allowlist). In enterprise and managed macOS environments, this can make deployment difficult. Organizations that enforce binary allowlisting (for example, with Santa) typically trust binaries by their code-signing identity, so an ad-hoc signed binary like thv can't be allowlisted by Team ID.

The remaining options: approving each release by CDHash (which changes with every build) or allowing execution from a user-writable install path are generally less scalable and more operationally fragile. As a result, thv may be blocked in managed environments.

Would you be open to shipping a Developer ID signed (and ideally notarized) macOS thv binary? ToolHive Studio already appears to be signed with Developer ID Application: Stacklok, Inc, so extending the same approach to the CLI would make deployment much easier in enterprise-managed macOS environments.

codesign -dv --verbose=4 /opt/homebrew/bin/thv 2>&1 | grep -E 'Signature|TeamIdentifier'                                                         
Signature=adhoc
TeamIdentifier=not set

[eleftherias]

That makes sense @r3motecontrol, we'll plan to get the signing prioritised. In the meantime, if you're using the ToolHive Studio that ships with a version of the thv CLI that is already signed.