From 44120029d086bb48a2572ff5119614f082f26ace Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= Date: Fri, 22 May 2026 15:54:42 +0200 Subject: [PATCH] Add cursor rule requiring -s -S on every commit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The contrib/claude/commit.md guideline already required signing, but relying on local git config (format.signoff, commit.gpgsign) silently produced unsigned commits on machines without that config. Make the requirement explicit so agents always pass both flags. Signed-off-by: Émile Ré --- .cursor/rules/git-commit-signing.mdc | 35 ++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 .cursor/rules/git-commit-signing.mdc diff --git a/.cursor/rules/git-commit-signing.mdc b/.cursor/rules/git-commit-signing.mdc new file mode 100644 index 000000000..4e644e97c --- /dev/null +++ b/.cursor/rules/git-commit-signing.mdc @@ -0,0 +1,35 @@ +--- +description: Always sign commits with -s -S (DCO trailer + GPG/SSH signature) +alwaysApply: true +--- + +# Git Commit Signing + +All commits in this repository **must** be signed with both `-s` and `-S`: + +- `-s` adds a `Signed-off-by` trailer (DCO). +- `-S` creates a GPG/SSH signature. + +Pass both flags every time, even when the user's `git` config already sets `format.signoff` or `commit.gpgsign` — relying on local config silently fails on machines where it isn't set. + +```bash +# GOOD +git commit -s -S -m "$(cat <<'EOF' +Subject line in imperative mood + +Body explaining what and why, wrapped at 72 chars. +EOF +)" + +# BAD — missing -S, signature absent even if Signed-off-by trailer is present +git commit -s -m "..." + +# BAD — neither flag +git commit -m "..." +``` + +The same applies to `git commit --amend`: pass `-s -S` (or `--amend --no-edit -s -S` when keeping the message). The commit author must remain the human responsible for the change — do not add `Co-Authored-By` trailers crediting bots. + +Verify with `git log -1 --show-signature` after committing; the output should show a valid signature **and** the `Signed-off-by:` trailer. + +See [`contrib/claude/commit.md`](../../contrib/claude/commit.md) for full commit conventions.