In .gitroot/plugins.yml of your root repository add:
1- url: https://gitroot.dev/releases/0.4.0/stigma-0.0.1.wasm
2 checksum: sha256:5064fe4f6234ab6a30a62c4fe1e86bb85243a14bd841c917766a212fa43fb19f
Every commit no signed or with unknown user, will be reported in graft. Maintain the .gitroot/allowed_signers file.