Re: [log4j] Making commit signatures optional (Was: Requiring signed commits)

Submitted following PRs implementing this:

https://github.com/apache/logging-log4j2/pull/3989
https://github.com/apache/logging-log4j-jakarta/pull/61
https://github.com/apache/logging-log4j-jmx-gui/pull/54
https://github.com/apache/logging-log4j-kotlin/pull/142
https://github.com/apache/logging-log4j-samples/pull/383
https://github.com/apache/logging-log4j-scala/pull/95
https://github.com/apache/logging-log4j-tools/pull/209
https://github.com/apache/logging-log4j-transform/pull/242

On Fri, Nov 21, 2025 at 12:43 PM Volkan Yazıcı <[email protected]> wrote:

> We first discussed commit signatures in March 2022
> <https://lists.apache.org/thread/xpb0rzxf6ov19vdxonh2vxwfw02m26hc>, and established
> it in January 2023 via lazy census by Carter, Gary, Matt, Piotr, and myself
> <https://lists.apache.org/thread/9d53znkksfkw0rkmgb4pk1ws95m4y3nb>. Even
> though, in the PR template, we explicitly state it is obligatory and we
> share instructions on how to sign commits, users/maintainers struggle a
> lot. *I suggest dropping the requirement of commits to be signed.
> Objections?*
>
> On Sun, Jan 15, 2023 at 8:44 PM Volkan Yazıcı <[email protected]> wrote:
>
>> It sounds like we have a lazy consensus here.
>>
>> Piotr, I see your point. I think we need to point this out in a GitHub
>> Pull Request template
>> <https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/creating-a-pull-request-template-for-your-repository>,
>> which we have none right now. There I also would like to have certain
>> checks anyway:
>>
>> - Changelog entry
>> - Signed commits
>> - Tests
>> - etc.
>>
>> Created #1207 <https://github.com/apache/logging-log4j2/issues/1207> for
>> this.
>>
>> On Fri, Jan 13, 2023 at 2:42 PM Piotr P. Karwasz <[email protected]>
>> wrote:
>>
>>> Hi Volkan,
>>>
>>> On Fri, 13 Jan 2023 at 10:56, Volkan Yazıcı <[email protected]> wrote:
>>> > *Question:* Shall we require signed commits?
>>>
>>> I am obviously Ok with signing, but what should we do with unsigned
>>> PRs? I would prefer to document the requirement somewhere (in the PR
>>> template?) so that we don't have to `rebase -f` everything.
>>>
>>> Piotr
>>>
>>