Commit signing

[thalin]

Hey folks,

First off, I don't mean to call anyone out here, so please don't take this as anything more than a request to figure out what I am missing - be it how to understand what Github is showing me or what the repo policies are.

Maybe I am misunderstanding how the Github commit log works to show commit signing, but it appears that of the last 10 commits in the log, 3 show as Verified, 2 as Unverified, and the remaining 5 seem to be unsigned.

Is this an indication that some commits got through unsigned? If not, what do I need to do to make sure I can see that the commits are in fact verified?

I have been told in pull requests that this repo requires signed commits, but I don't actually see that in the contribution guidelines, so I am unclear on what the rules are. If this is a rule, it would be great for it to be in the contribution guidelines so that any future folks can know up front that they need to set up commit signing.

Can we get some clarification here as to what the rules actually are, and if they actually apply to everyone or not? If the rules are that we require commit signing, shouldn't the Github feature to enforce that be applied to the main branch so that unsigned and unverified commits can't make it into main?

Thanks!