uv 0.12.12 signs and notarizes its macOS and Windows binaries

Astral released uv 0.12.12 with code signing and notarization for its release binaries. macOS executables now carry an Apple Developer ID signature and go through Apple's notarization process. Windows binaries get timestamped Authenticode signatures from Azure Artifact Signing, covering the release archives plus the uv and uv_build wheels.

Astral's stated goals are publisher verification, publisher-based allowlisting, and fewer antivirus false positives. That last one is the practical stakes: unsigned binaries are a common trigger for security software, and signing is the standard way vendors get off that list.

The release also fixes a lockfile bug. uv's exclude-newer setting pins dependency resolution to a cutoff date, excluding package versions published after it. Before this fix, hash generation ignored that same cutoff. A lockfile built with exclude-newer could end up disagreeing with itself, with resolved versions matching the cutoff but hashes not consistently reflecting it. 0.12.12 makes hash generation respect the same cutoff as version resolution.