[log4j] Making commit signatures optional (Was: Requiring signed commits)

[Volkan Yazıcı <vo...@yazi.ci>]

We first discussed commit signatures in March 2022
<https://lists.apache.org/thread/xpb0rzxf6ov19vdxonh2vxwfw02m26hc>,
and established
it in January 2023 via lazy census by Carter, Gary, Matt, Piotr, and myself
<https://lists.apache.org/thread/9d53znkksfkw0rkmgb4pk1ws95m4y3nb>. Even
though, in the PR template, we explicitly state it is obligatory and we
share instructions on how to sign commits, users/maintainers struggle a
lot. *I suggest dropping the requirement of commits to be signed.
Objections?*

On Sun, Jan 15, 2023 at 8:44 PM Volkan Yazıcı <vo...@yazi.ci> wrote:

> It sounds like we have a lazy consensus here.
>
> Piotr, I see your point. I think we need to point this out in a GitHub
> Pull Request template
> <https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/creating-a-pull-request-template-for-your-repository>,
> which we have none right now. There I also would like to have certain
> checks anyway:
>
> - Changelog entry
> - Signed commits
> - Tests
> - etc.
>
> Created #1207 <https://github.com/apache/logging-log4j2/issues/1207> for
> this.
>
> On Fri, Jan 13, 2023 at 2:42 PM Piotr P. Karwasz <pi...@gmail.com>
> wrote:
>
>> Hi Volkan,
>>
>> On Fri, 13 Jan 2023 at 10:56, Volkan Yazıcı <vo...@yazi.ci> wrote:
>> > *Question:* Shall we require signed commits?
>>
>> I am obviously Ok with signing, but what should we do with unsigned
>> PRs? I would prefer to document the requirement somewhere (in the PR
>> template?) so that we don't have to `rebase -f` everything.
>>
>> Piotr
>>
>

Re: [log4j] Making commit signatures optional (Was: Requiring signed commits)

["Piotr P. Karwasz" <pi...@mailing.copernik.eu>]

Hi Volkan,

On 21.11.2025 12:43, Volkan Yazıcı wrote:
> I suggest dropping the requirement of commits to be signed.

+1, I agree we should drop the requirement.

The only signatures we can reliably authenticate are those from
committers (or at least PMC members), since we know each other and have
exchanged keys through separate channels. We may not have gone as far as
verifying government-issued IDs in person, but we have a high level of
confidence that the GPG keys correspond to the individuals we work with,
regardless of their legal names.

For external contributors, that assurance doesn’t exist. All we can
really say is that a commit was signed by some GPG key, and that the
associated email and key happen to be stored in their GitHub account.
Furthermore, while we can verify these signatures today, we won’t be
able to do so reliably in the future unless we start storing the GitHub
GPG keys of each contributor now.

A more reliable approach will come from in-toto attestations, which
certify that a user with a specific GitHub identity submitted a given
commit within a defined time-frame. There are already experimental
GitHub Actions that support this, such as `source-tool` [1], and they
don’t require GPG keys.

Piotr

[1] https://github.com/slsa-framework/source-tool

Re: [log4j] Making commit signatures optional (Was: Requiring signed commits)

[Volkan Yazıcı <vo...@yazi.ci>]

Submitted following PRs implementing this:

https://github.com/apache/logging-log4j2/pull/3989
https://github.com/apache/logging-log4j-jakarta/pull/61
https://github.com/apache/logging-log4j-jmx-gui/pull/54
https://github.com/apache/logging-log4j-kotlin/pull/142
https://github.com/apache/logging-log4j-samples/pull/383
https://github.com/apache/logging-log4j-scala/pull/95
https://github.com/apache/logging-log4j-tools/pull/209
https://github.com/apache/logging-log4j-transform/pull/242

On Fri, Nov 21, 2025 at 12:43 PM Volkan Yazıcı <vo...@yazi.ci> wrote:

> We first discussed commit signatures in March 2022
> <https://lists.apache.org/thread/xpb0rzxf6ov19vdxonh2vxwfw02m26hc>, and established
> it in January 2023 via lazy census by Carter, Gary, Matt, Piotr, and myself
> <https://lists.apache.org/thread/9d53znkksfkw0rkmgb4pk1ws95m4y3nb>. Even
> though, in the PR template, we explicitly state it is obligatory and we
> share instructions on how to sign commits, users/maintainers struggle a
> lot. *I suggest dropping the requirement of commits to be signed.
> Objections?*
>
> On Sun, Jan 15, 2023 at 8:44 PM Volkan Yazıcı <vo...@yazi.ci> wrote:
>
>> It sounds like we have a lazy consensus here.
>>
>> Piotr, I see your point. I think we need to point this out in a GitHub
>> Pull Request template
>> <https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/creating-a-pull-request-template-for-your-repository>,
>> which we have none right now. There I also would like to have certain
>> checks anyway:
>>
>> - Changelog entry
>> - Signed commits
>> - Tests
>> - etc.
>>
>> Created #1207 <https://github.com/apache/logging-log4j2/issues/1207> for
>> this.
>>
>> On Fri, Jan 13, 2023 at 2:42 PM Piotr P. Karwasz <pi...@gmail.com>
>> wrote:
>>
>>> Hi Volkan,
>>>
>>> On Fri, 13 Jan 2023 at 10:56, Volkan Yazıcı <vo...@yazi.ci> wrote:
>>> > *Question:* Shall we require signed commits?
>>>
>>> I am obviously Ok with signing, but what should we do with unsigned
>>> PRs? I would prefer to document the requirement somewhere (in the PR
>>> template?) so that we don't have to `rebase -f` everything.
>>>
>>> Piotr
>>>
>>