Skip to main content
Share Your Experience: Take the 2024 Developer Survey
8 votes
Accepted

Is "Signed-off-by" really needed for a GitHub hosted project?

The signed-off line does not indicate the author but who authorized the commit to enter the project's repository. It has primarily nothing to do with who committed or pushed the commit. Commonly it's ...
planetmaker's user avatar
  • 11.2k
7 votes
Accepted

What additional benefits does the DCO provide?

"inbound=outbound" might not require any extra procedures. If a someone contributes to a project that is clearly under some license, you can assume in good faith that they have the right to publish ...
amon's user avatar
  • 39k
7 votes
Accepted

Is it in line with the DCO that a github sign-off needs and publishes full name + an email "that matches the commit author"?

Some projects such as Linux ask for the DCO to be signed in order to do due diligence, and ultimately to protect downstream users. The DCO does not forbid projects from establishing individual ...
amon's user avatar
  • 39k
5 votes

Can DCO be used in BSL?

I would strongly recommend against using the DCO for anything involving the BSL - the DCO makes references to "open source licence(s)" and the BSL is not an open source license, even if code ...
Philip Kendall's user avatar
4 votes

Must I retro-actively DCO-sign my sole author commits for a work project?

First, consider why you want to mandate signed commits. They are not a best practice for most open-source projects because they represent a significant barrier to entry – you need to set up GPG, ...
amon's user avatar
  • 39k
3 votes

What additional benefits does the DCO provide?

Case study: GitLab GitLab had MIT and Apache codebases both covered by a CLA. They switched to the DCO for both, citing ease-of-use and honouring contributor rights as the primary concern (as ...
lofidevops's user avatar
  • 1,990
2 votes

How strictly should I enforce DCO-signing for complete legal protection?

There is no complete legal protection. DCOs make it easy to prove that all contributors have agreed to the licensing conditions. But if the contributors do not actually follow the conditions in the ...
amon's user avatar
  • 39k
1 vote
Accepted

Does the DCO require a cryptographic signature?

Typically all you need is a text signature, which you can achieve with: git commit -s However, the signing mechanism is not defined by the DCO, but by the project. Some projects may ask for a ...
lofidevops's user avatar
  • 1,990

Only top scored, non community-wiki answers of a minimum length are eligible