On Sat, Jun 20, 2026 at 05:11:02PM +0000, Daniel Milnes via devel wrote: > On Tue, 2026-06-16 at 12:00 +0000, Leigh Scott wrote: > > We could make gpg signed git commits mandatory as the first step, > > non signed commits could be rejected. > > I worry that we're not in a position to enforce signed commits until > our Forge(s) can sign commits themselves (e.g. for merges).
Surely that's only required if we wanted to allow merge commits ? For any repos which only accept fast-forward merges, the Forge would never be creating its own commits, so would have no need to sign anything itself. > We'd be limiting ourselves to doing everything locally, when there are > security wins to the Forge occasionally taking actions on your behalf, > like only allowing commits via Pull Request which I don't think can be > enforced if the workflow requires merging locally. Personally I'd be fine with signing combined with fast-forward only merges in pull requests, but I know fast-forward vs merge commits tends to be a bit of vim vs emacs type of preference amongst devs :-) With regards, Daniel -- |: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :| -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
