Require signed commits and protected-ref updates

tovio policy signing

With no options this is read-only: it prints the repository's current signature requirements. Two things can be required, independently.

Requiring commit signatures

tovio policy signing --require-commits

tovio policy signing --require-commits false

Newly authored commits must carry a valid signature. Each boolean option can be given as a bare flag (meaning true) or explicitly as true / false.

Requiring signed ref updates

tovio policy signing --require-protected-ref-updates

Lanes covered by branch protection require a signed update envelope. The flag is --require-protected-ref-updates — in full. --require-protected-refs is not a real flag and will be rejected as an unknown argument.

Both at once

tovio policy signing --require-commits --require-protected-ref-updates

Turning it off

tovio policy signing --reset

Removes the declaration entirely and restores the legacy-compatible optional-signing posture. That is different from setting both options to false, which records an explicit decision that signatures are not required.

When it bites

A commit or push that cannot satisfy the declared posture is refused with TVO-CRYPTO-015. The usual cause is a machine with no signing identity — a Simple repository, or a CI runner whose keystore is not wired up. tovio identity show tells you whether a signing key is available.

It is repository state

The declaration lives in the authenticated policy manifest, so commit and push it. A requirement that only exists on your laptop is not enforcing anything for anyone else.