Hi all … So we have 3 people who voted. 2 are in favor of disabling the requirement for signed commits (otluk, cdutz) 1 is in favor of keeping it (sruel)
So the majority is in favor of removing the requirement. Chris Von: ott.lukas.murena.io via dev <[email protected]> Datum: Mittwoch, 5. August 2026 um 11:56 An: [email protected] <[email protected]> Cc: [email protected] <[email protected]> Betreff: Re: Disabling the requirement for signed commits? +1 for removing the requirement and starting educating people. could we add hints automated comment when someone opens a PR? Am 5. August 2026 11:09:47 MESZ schrieb Christofer Dutz <[email protected]>: >Hi all, > >As I just mentioned in slack … just duplicating this here for archiving. > >I would agree, if PLC4X was fearing being used as supply-chain attack. >Currently we want to enforce review-then-merge on PRs from outsiders. I think >with that in place, we’re reviewing things anyway so admittedly it wouldn’t >matter if a change we approved was from someone with a signature or not. > >I asked some of my peers throughout the foundation and there are quite few >projects actually requiring signed commits. I was told Logging requires that. >But logging is in a quite unique spot here … it’s very low drive-by committers >(The core team is struggling to get new people to contribute at all). But the >risks of a supply-chain-attack going through is extremely high. >So I agree that for some projects this is a good thing. > >The incubator suggests to have the setting turned off and to not require >signed commits. I guess for similar reasons as I’m arguing for. > >Most of the new folks coming here are not senior software engineers for who >such a requirement is not really an issue, but automation-engineers who never >really had to deal with stuff like this. >My worries are, by raising the bars for people like that, that we might be >driving away or keeping away people who would have been able to provide real >help. > >So staying with +1 for removing the requirement. > >I am +1 for adding a recommendation for people to start signing their commits >however. > >Chris > > > >Von: Sebastian Rühl <[email protected]> >Datum: Mittwoch, 5. August 2026 um 10:19 >An: [email protected] <[email protected]> >Betreff: Re: Disabling the requirement for signed commits? > >-1 > >If anything we would need a higher bar nowadays. >AFAIK turned out to sign commits wasn't that hard anyway after all (according >to the slack discussion). > >This way it at least protects us from the first wave of slop > >- Sebastian > >On 2026/08/01 15:03:55 Christofer Dutz wrote: >> Hi all, >> >> I remember when reviewing the proposed changes to the commit/merge rules I >> asked about the signature setting. >> Turns out now you need to have signed commits in order to have changes go to >> develop. >> >> That raises the bar for contributions. >> >> I just want to make sure this is what we want and that this change didn’t >> sneak in with the approval requirement that we discussed. >> >> I would be in favor to accept signed contributions, but not to require them. >> >> >> Chris >>
