The Developer Certificate of Origin protects the codebase from legal threat by requiring that each commit is signed, indicating that the contributor is authorised to make and license the commit (for example, if submitted while working for an employer).
To offer this protection, how strictly must this be adhered to? For example:
- an automated tool squashes a series of commits into one before merging it into the codebase
- a contributor makes a series of commits, but only signs the last one