(fineract-site) 03/04: specify commit signature type

[me...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

meonkeys pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/fineract-site.git

commit 01182559065bf9cfc2c06a9122de3852ab620a32
Author: Adam Monsen <ha...@gmail.com>
AuthorDate: Thu Mar 12 14:27:40 2026 -0700

    specify commit signature type
---
 CONTRIBUTING.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 58af2d8..0a80271 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -55,6 +55,7 @@ Serve the website, open `http://localhost:1313`, and inspect:
 1. Clone/fork the repository.
 1. Create a branch off `asf-site`.
 1. Commit only source changes, not generated output.
+1. Sign commits with a PGP/GPG key.
 1. Ensure local checks pass.
 1. In the PR description include:
    - What changed (briefly)
@@ -66,6 +67,12 @@ When updating PRs with new changes, leave commits as-is/un-squashed. Try to avoi
 
 Note this methodology for source control (keeping a series of PR commits un-squashed) is a different policy than we use for [the apache/fineract repo](https://github.com/apache/fineract).
 
+Do not sign commits with SSH keys. More info:
+
+* https://stackoverflow.com/questions/51412164/gpg-vs-ssh-keys
+* https://stackoverflow.com/questions/73489997/whats-the-difference-between-signing-commits-with-ssh-versus-gpg
+* https://fineract.apache.org/docs/current/#_gpg_2
+
 ## CI Workflows
 
 On push to `asf-site`, GitHub Actions builds the site, edits a clone of the `asf-site` in-place, then commits and pushes generated files.