Hi all, As I just mentioned in slack … just duplicating this here for archiving.
I would agree, if PLC4X was fearing being used as supply-chain attack. Currently we want to enforce review-then-merge on PRs from outsiders. I think with that in place, we’re reviewing things anyway so admittedly it wouldn’t matter if a change we approved was from someone with a signature or not. I asked some of my peers throughout the foundation and there are quite few projects actually requiring signed commits. I was told Logging requires that. But logging is in a quite unique spot here … it’s very low drive-by committers (The core team is struggling to get new people to contribute at all). But the risks of a supply-chain-attack going through is extremely high. So I agree that for some projects this is a good thing. The incubator suggests to have the setting turned off and to not require signed commits. I guess for similar reasons as I’m arguing for. Most of the new folks coming here are not senior software engineers for who such a requirement is not really an issue, but automation-engineers who never really had to deal with stuff like this. My worries are, by raising the bars for people like that, that we might be driving away or keeping away people who would have been able to provide real help. So staying with +1 for removing the requirement. I am +1 for adding a recommendation for people to start signing their commits however. Chris Von: Sebastian Rühl <[email protected]> Datum: Mittwoch, 5. August 2026 um 10:19 An: [email protected] <[email protected]> Betreff: Re: Disabling the requirement for signed commits? -1 If anything we would need a higher bar nowadays. AFAIK turned out to sign commits wasn't that hard anyway after all (according to the slack discussion). This way it at least protects us from the first wave of slop - Sebastian On 2026/08/01 15:03:55 Christofer Dutz wrote: > Hi all, > > I remember when reviewing the proposed changes to the commit/merge rules I > asked about the signature setting. > Turns out now you need to have signed commits in order to have changes go to > develop. > > That raises the bar for contributions. > > I just want to make sure this is what we want and that this change didn’t > sneak in with the approval requirement that we discussed. > > I would be in favor to accept signed contributions, but not to require them. > > > Chris >
