The Developer Certificate of Origin mentions a signature:

I understand and agree that this project and the contribution are public and that a record of the contribution (including all personal information I submit with it, including my sign-off...

Does this mean a cryptographic (GPG) signature?

1 Answer 1


Typically all you need is a text signature, which you can achieve with:

git commit -s

However, the signing mechanism is not defined by the DCO, but by the project. Some projects may ask for a cryptographic signature, others may ask that you use your work-based email (if submitting from work), others may ask that you send an email, or some combination.

This is based a determination by the project balancing ease-of-use and legal risk. (Similarly to a CLA.)

The DCO uses a common law technique called agency by which a person can act on behalf of an entity like a corporation... using a corporate email as a developer is [an example of] such a sign of authority. (James Bottomley, A modest proposal on the DCO)



  • The Signed-off-by metadata is only marginally more useful than the commit author. It is unlikely that this sign-off would be considered to be a legally binding signature, as it cannot be used to verify the identity of the signatory. It can also be faked easily, since it's not cryptographic. This metadata may be helpful for review workflows, but has minimal value as a reliable record of DCO acceptance.
    – amon
    Apr 9, 2018 at 12:23
  • @amon It's odd, because every reference (that I can find) treats it as valid. Despite underlining the fact that it's just text. Cargo cult practice?
    – lofidevops
    Apr 9, 2018 at 13:14
  • @amon Problem solved (I think), it's a per-project decision, not determined by the DCO itself - I found claims that even using cryptographic signatures is cargo cultish :P so this is obviously one of those things - the GitLab case study link highlights their legal assessment of text-signatures only
    – lofidevops
    Apr 9, 2018 at 17:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.