Allow signed commits to be required

[hlandau]

GitHub allows protected branches to require signed commits. This is a blocking issue for adoption of Gitea by some projects.

[lunny]

There should be an option on protected branches like below:

[clarfonthey]

It would be nice if we could also do this for releases/tags only. I don't think that signing every commit is necessary, but I want to enforce it for releases.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

[kolaente]

Anyone wanting to tacle this? I could look into it, but only in about 4 weeks.

[clarfonthey]

This feature seems like a no-brainer; could it be marked as confirmed so it doesn't become stale?

[dvn0]

No movement on this? Would anyone familiar with the relevant part of the Gitea codebase be interested in mentoring me on getting this implemented? I'm relatively new to Go, and would be happy to work on getting this feature implemented with a little bit of assistance.

[lunny]

At first, you should add an option on protected branch page to add an option deny all commits no signed which default is unchecked.

Then you should change code on cmd/serv.go or cmd/hooks.go to test if the commit unsigned allowed on that branch.

[djbrown]

Any news on this?

[lunny]

The idea is to add an option and check the signed commits on prereceive hook.

[zeripath]

This has only really become practicable since #7631 was merged.

It's not just a case of enforcing commits are signed - commits from merging PRs have to be signed and we need to indicate whether such a commit will be signed and likely indicate why it wouldn't be. We would need to add a block on attempting to merge a pr if it wouldn't be signed.

[jamesponddotco]

What would be a good bounty to help speed development on this issue?

[lafriks]

Any bounty is good ;)

[jamesponddotco]

Bounty posted:
https://www.bountysource.com/issues/59720659-allow-signed-commits-to-be-required

[zeripath]

OK so #9708 represents an implementation of this.

There are a couple of points to be made:

• Depending on your server configuration you may not be able to merge PRs into your protected branch. (Remember these have to be signed too.)
• Similarly, You may not be able merge CRUD actions into your protected branch.

There are few extension options which probably need discussion to see if there is interest:

• Allow repo admin to push unsigned
• Allow repo admin to merge unsigned