Description:

This check verifies that commits pushed or merged into the default branch are required to be cryptographically signed. Commit signatures help verify the authenticity of commits and ensure that code changes originate from trusted contributors.


Rationale:

Unsigned commits can make it difficult to verify the identity of contributors and the integrity of code changes. Requiring signed commits strengthens software supply chain security by ensuring that commits can be traced to authenticated users and have not been tampered with after creation.


Impact:

Enforcing signed commits may:

  • Require contributors to configure GPG, SSH, or X.509 commit signing.

  • Prevent unsigned commits from being pushed or merged.

  • Increase administrative effort during initial setup.

  • Improve traceability, accountability, and code integrity.


Default Value:

By default, GitLab does not enforce signed commits on protected branches or the default branch.

Default setting:

  • Reject unsigned commits: Disabled


Remediation:

Test Plan:

  1. Log in to GitLab with Maintainer or Owner privileges.

  2. Navigate to the target project.

  3. Select Settings → Repository.

  4. Locate the Push Rules section.

  5. Review the configured push rules.

  6. Verify that commit signature verification is enforced.

  7. Confirm that unsigned commits are rejected when pushed to the default branch.


Implementation:

  1. Log in to GitLab with Maintainer or Owner privileges.

  2. Navigate to the target project.

  3. Select Settings → Repository.

  4. Expand the Push Rules section.

  1. Enable the option to reject unsigned commits (if available in your GitLab edition).

  1. Save the configuration.


Backout Plan:

  1. Log in to GitLab with Maintainer or Owner privileges.

  2. Navigate to the target project.

  3. Select Settings → Repository.

  4. Expand the Push Rules section.

  5. Disable the commit signature enforcement rule.

  1. Save the changes.


References: