-0.5 by me. I don't think setting up commit signing will bring the entry barrier much more higher than it currently is for automation engineers.
Ideally I would say direct commits on develop requiring signature and PR without signing requirement, as it requires revision from one of us. But admittedly I do not know if that would be a possible configuration... (hence the -0.5) On Wednesday, August 5th, 2026 at 11:56 AM, ott.lukas.murena.io via dev <[email protected]> wrote: > +1 for removing the requirement and starting educating people. could we add > hints automated comment when someone opens a PR? > > Am 5. August 2026 11:09:47 MESZ schrieb Christofer Dutz > <[email protected]>: > >Hi all, > > > >As I just mentioned in slack … just duplicating this here for archiving. > > > >I would agree, if PLC4X was fearing being used as supply-chain attack. > >Currently we want to enforce review-then-merge on PRs from outsiders. I > >think with that in place, we’re reviewing things anyway so admittedly it > >wouldn’t matter if a change we approved was from someone with a signature or > >not. > > > >I asked some of my peers throughout the foundation and there are quite few > >projects actually requiring signed commits. I was told Logging requires that. > >But logging is in a quite unique spot here … it’s very low drive-by > >committers (The core team is struggling to get new people to contribute at > >all). But the risks of a supply-chain-attack going through is extremely high. > >So I agree that for some projects this is a good thing. > > > >The incubator suggests to have the setting turned off and to not require > >signed commits. I guess for similar reasons as I’m arguing for. > > > >Most of the new folks coming here are not senior software engineers for who > >such a requirement is not really an issue, but automation-engineers who > >never really had to deal with stuff like this. > >My worries are, by raising the bars for people like that, that we might be > >driving away or keeping away people who would have been able to provide real > >help. > > > >So staying with +1 for removing the requirement. > > > >I am +1 for adding a recommendation for people to start signing their > >commits however. > > > >Chris > > > > > > > >Von: Sebastian Rühl <[email protected]> > >Datum: Mittwoch, 5. August 2026 um 10:19 > >An: [email protected] <[email protected]> > >Betreff: Re: Disabling the requirement for signed commits? > > > >-1 > > > >If anything we would need a higher bar nowadays. > >AFAIK turned out to sign commits wasn't that hard anyway after all > >(according to the slack discussion). > > > >This way it at least protects us from the first wave of slop > > > >- Sebastian > > > >On 2026/08/01 15:03:55 Christofer Dutz wrote: > >> Hi all, > >> > >> I remember when reviewing the proposed changes to the commit/merge rules I > >> asked about the signature setting. > >> Turns out now you need to have signed commits in order to have changes go > >> to develop. > >> > >> That raises the bar for contributions. > >> > >> I just want to make sure this is what we want and that this change didn’t > >> sneak in with the approval requirement that we discussed. > >> > >> I would be in favor to accept signed contributions, but not to require > >> them. > >> > >> > >> Chris > >> >
