From b31b238fc0dd98adaa78bc43039d9b03e8770158 Mon Sep 17 00:00:00 2001 From: Christopher Pitzi Date: Mon, 17 Aug 2026 21:00:31 -0400 Subject: [PATCH] =?UTF-8?q?docs:=20decline=20required=20signed=20commits?= =?UTF-8?q?=20=E2=80=94=20decided=20rationale=20replaces=20the=20open=20qu?= =?UTF-8?q?estion?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Fable 5 (1M context) --- terraform/README.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/terraform/README.md b/terraform/README.md index 73b57fd..f630919 100644 --- a/terraform/README.md +++ b/terraform/README.md @@ -85,6 +85,29 @@ but this repo is now an **enforced surface**: whatever is on `main` is the live fleet settings, and an unrelated merge will reapply it. Phase 1 (operator-applied, fmt+validate-only CI) ended 2026-08-17. +## Signed commits — deliberately not required + +Decided 2026-08-17 (#153, raised by tf-lint's trivy gate as GIT-0004): the +`main` merge gate does **not** require signed commits, and that is a decision, +not an omission. Requiring signatures would break every unsigned merge path at +once — the runner App's squash merges, Dependabot's merges, and operator +commits from machines without signing keys — for a control whose job this +fleet's provenance story already covers by other means: + +- **`main` is unreachable except through a PR** (ruleset + push allowlist), so + every commit on it has a reviewed, attributed PR behind it — the squash + commit's authorship and its PR are the provenance record. +- **The supply-chain trust boundary that matters is attested elsewhere:** site + images carry SLSA build provenance verified against the reusable's repo, and + third-party actions are SHA-pinned. A commit signature on `main` would add + little on top of either. + +If the calculus changes (e.g. an org member base wide enough that PR authorship +stops being strong attribution), adopting means: signing keys provisioned for +every committer identity including the Apps, verified coverage confirmed, THEN +the flag — in that order. Until then, `terraform/protection.tf` carries an +inline `trivy:ignore:AVD-GIT-0004` pointing here. + ## Rails This module can create and configure repositories, so it is the highest