On Mon, Jun 22, 2026 at 10:02 AM Daniel P. Berrangé <[email protected]> wrote:
> On Sat, Jun 20, 2026 at 05:11:02PM +0000, Daniel Milnes via devel wrote: > > On Tue, 2026-06-16 at 12:00 +0000, Leigh Scott wrote: > > > We could make gpg signed git commits mandatory as the first step, > > > non signed commits could be rejected. > > > > I worry that we're not in a position to enforce signed commits until > > our Forge(s) can sign commits themselves (e.g. for merges). > > Surely that's only required if we wanted to allow merge commits ? > > For any repos which only accept fast-forward merges, the Forge would > never be creating its own commits, so would have no need to sign > anything itself. > Incorrect. The forge would also (presumably) support the Rebase-and-Merge approach, which would mean that it was still rewriting the commits atop the latest HEAD. If we wanted to enforce signed commits, either the forge needs to be able to sign them or it has to be done manually by the maintainer. > > > We'd be limiting ourselves to doing everything locally, when there are > > security wins to the Forge occasionally taking actions on your behalf, > > like only allowing commits via Pull Request which I don't think can be > > enforced if the workflow requires merging locally. > > Personally I'd be fine with signing combined with fast-forward only > merges in pull requests, but I know fast-forward vs merge commits tends > to be a bit of vim vs emacs type of preference amongst devs :-) > > With regards, > Daniel > -- > |: https://berrange.com ~~ https://hachyderm.io/@berrange :| > |: https://libvirt.org ~~ https://entangle-photo.org :| > |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :| > > -- > _______________________________________________ > devel mailing list -- [email protected] > To unsubscribe send an email to [email protected] > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedoraproject.org/archives/list/[email protected] > Do not reply to spam, report it: > https://forge.fedoraproject.org/infra/tickets/issues/new >
-- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
