Adds link to community repo

[danehans]

Adds a readme link to the community repo.

Fixes #10356

[timflannagan]

@danehans Is this PR still relevant after the force push to main last month? I took a quick glance at the README and didn't see any references to the community GH repo anywhere.

[danehans]

@timflannagan this PR is still applicable. I rebased so PTAL.

[ilrudie]

lgtm

[jenshu]

@danehans merging is blocked due to your commits not being signed https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification

[danehans]

The PR contains 1 commit that is signed. Let me try rebasing.

[danehans]

My commit is signed. The issue appears to be the base branch has unsigned commits.

[timflannagan]

You might need the commits to be GPG signed unfortunately.

[ilrudie]

yeah, the issue is cryptographic signature not sign-off. We did not enable DCO (sign-off requirement) for this repo.

you could use gpg or ssh to sign commits technically speaking so gpg isn't strictly required

[danehans]

@timflannagan @ilrudie thanks for the clarification. I have only used DCO sign-off before. I have setup PGP commit/tag signing and the PR is now passing signing verification. Why is the project using PGP signing instead of DCO?

[timflannagan]

I'm +1 on DCO only. I'd have to defer to others on why we need GPG commit signing as well. Maybe it's a requirement for CNCF 🤷

[ilrudie]

The requirement for commit cryptographic signing is not being used as a replacement for sign-off/DCO. The two are entirely orthogonal but the names are too similar. FWIW, I think DCO without a cryptographic signature is basically meaningless but AFAIK the lawyers are cool with it so the topics may safely remain completely separate.

AFAIK cryptographic signing is a recommendation from the CNCF, but not a strict requirement yet. I turned on the check for a verified signature at the org level because I figured it would not be controversial since everyone I'd ever talked to about it directly considered it basic hygiene for any open source project. If folks feel strongly that we really don't want to require cryptographic signing we should seek community consensus that the project doesn't care about this and then we can turn it off.

[danehans]

If folks feel strongly that we really don't want to require cryptographic signing we should seek community consensus that the project doesn't care about this and then we can turn it off.

+1 to remove this requirement.

[ilrudie]

If folks feel strongly that we really don't want to require cryptographic signing we should seek community consensus that the project doesn't care about this and then we can turn it off.

+1 to remove this requirement.

I added a topic to the community meeting for commit verification and one for DCO vs CLA. At any rate, this is not the venue to discuss either so I say merge away and we'll take up the signing and sign-off stuff in the meeting. Thanks for GPG signinging your commit in the mean time though.

[timflannagan]

The MQ should be back online now. @ilrudie @jenshu can one of you requeue when you get a second?