Requiring signed commits

[MrBrain295]

To be in accordance Yari I think the content repository should require signed commits and I wanted feedback. If this change is agreed upon I will be willing to make the changes in content.

[teoli2003]

To discuss this, we should have the following information:

• What would this bring to the content and to our users?
• What problem would this solve?
• Will this prevent some people to contribute?

[MrBrain295]

This change would help prevent some malicious commits which would overall help the content repo. The problem this will help solve is the risk of malicious commits. This won’t prevent many people from contributing as most commits are made through GitHub.

[wbamberg]

I'm in favour of this. If I understand correctly, commits made through the GitHub UI are signed automatically? (I think you implied that in #133 (reply in thread)).

I think people using the CLI are likely to be set up for this already. At this point signing commits is such a common requirement that it's reasonable to expect it.

[MrBrain295]

The GitHub CLI does sign commits automatically (see here).

[OnkarRuikar]

The GitHub CLI does sign commits automatically

The GitHub CLI has no command for commit. To auto sign commits while using git, i.e. to avoid using -S flag on every commit, we need to explicitly configure it:

git config --global commit.gpgsign true

[teoli2003]

I am a bit afraid of the extra work that would come out of this.

There are three cases:

1. If a PR is created via the GitHub UI, no extra work.
2. If a PR is created using git and commits in it are signed, no extra work.
3. If a PR is created using git and one commit in it is not signed, a reviewer will need to explain to the author what to do it.

We have about 50 PRs a day and struggle to cope with them, so even only 3 can be a significant amount of additional work for reviewers.

[OnkarRuikar]

I agree. mdn/content has a lot of newbie contributors. And setting GPG for the first time can be a difficult task. And explaining the process will be even harder for the reviewers.

But it's a very basic good to have requirement. Everyone has to do the setup one day. Perhaps we can have a video on Mozilla Youtube channel about entire mdn/content dev environment setup. And provide the link/embed in README.md and in the default text when we create a PR. @schalkneethling wdyt?

[yin1999]

GitHub is just supported SSH commit verification. I think it's an easier way to sign commits.

Steps to setup: https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification#ssh-commit-signature-verification

[schalkneethling]

I agree that the only way we can enforce this is if we have a very clear guide of how to set this up. I would also not make this a requirement from the first PR as not everyone would necessarily know about this depending on how they found the project. Once they do contribute, we can enforce signed commits but, as just mentioned, only if we have a clear and easy to follow guide.

This is part of the work I will be doing in Q3 so, thank you for starting this discussion.