docs: add GPG commit signing setup guide for team
Open
@mbiuki is already working on this.
Since Mar 12, 2026.
Area : Documentation
Doc : Documented
dotCMS : Security
OKR : Documentation
Type : Documentation
- Dominant language
- Java
- Stars
- 970
- Forks
- 486
- Avg merge
- 3d 33m
- Merged PRs (30d)
- 170
Description
Summary
Team members need a standardized guide for setting up GPG commit signing to ensure the authenticity and integrity of all commits, particularly those made via AI tools like Claude Code.
Problem
When using Claude Code or other AI tools to commit code, there is no cryptographic guarantee that the committer is who they claim to be unless GPG signing is configured. Without this, commit authorship cannot be verified.
Proposed Solution
Add a step-by-step guide at docs/claude/GPG_COMMIT_SIGNING.md covering:
- Generating a GPG key for their GitHub account
- Configuring git globally to sign all commits
- Uploading the public key to GitHub
- Testing and verifying the setup
- Troubleshooting common errors
Enforcement
All commits to dotCMS/core made via Claude Code or any automated tooling must be GPG signed. This guide ensures every team member can comply.
Related PR
#34964
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.