3

Suppose my GitHub project requires DCO.
In case of DCO, for a "proof" of origin it's usually enough to add a commit message that includes Signed-off-by line.

But in case of GitHub it's very easy to identify the committer anyway, assuming all commits are done by GitHub users. In such case, is there any legal benefit to a "Signed-off-by" line in the commit, vs simply identifying the GitHub account related to that commit?

Improve this question
6

The signed-off line does not indicate the author but who authorized the commit to enter the project's repository. It has primarily nothing to do with who committed or pushed the commit.

Commonly it's used to indicate who did the review (that doesn't mean being the author, just the person who allows the commit to enter the repo or endorse the pull request.) Usually that's done by the more senior developers or maintainers.

Improve this answer
  • 1
    The meaning of Signed-offvaries by project, but in the DCO sense its meaning is "who claims to have copyright permission to publish it", not "who thinks it is good enough to merge into repository". – jpa Jun 20 '20 at 13:05
  • 2
    Going by the linked DCO text, the DCO ensures that you hold copyright or that you are allowed to submit the patch as you are given the permission by the copyright holders. That's IMHO on the same line as I explained: if you sign-off on a patch, you certify that the patch can go into the repo. As such it still can be that the person signing-off and comitting might differ (clause c of the DCO). – planetmaker Jun 20 '20 at 13:43
  • They might differ. But from a practical point of view - in this case 99% of the users who open a Pull Request or have a push credentials are individual contributors. That means that in 99% of the cases the person who opens the PR / pushes the change is the same person who "signs off". When applying DCO in such case, does it still make sense to require every contributor the hassle of a sign-off commit message (where the committer == signed-off-by), for some legal reasons? – Amir Gonnen Jun 20 '20 at 20:05
  • That is a question which heavily depends on your legal situation, thus in particular the business environment and jurisdiction you operate in. Personally I'd consider it too much, but YMMV - and there probably is a reason in the project's history it was introduced. It's not a question which IMHO can be answered on a general basis but depends on the actual project and situation. – planetmaker Jun 20 '20 at 20:27
  • See also this question and answers: stackoverflow.com/questions/1962094/… - it may thus make sense, if used to have another line which states that the author has the rights to submit the code... IMHO twice the same, if it is the same person. Alas. – planetmaker Jun 20 '20 at 20:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.