Record each contributor's right to submit

How to do it

Without a record, someone can later claim that code was taken from an employer or another project. The Developer Certificate of Origin 1.1 is a short statement a contributor accepts by adding Signed-off-by: Name <email> to each commit, which git commit -s does. A contributor licence agreement is a signed contract instead. Some agreements hand the copyright to the project, which allows a later licence change, as Changing the licence without every copyright holder's consent explains. Many contributors refuse those, so say why you need one. Accept the record from a bot only for the bot's own commits.

Examples

JavaScript example

import { execFileSync } from 'node:child_process';

const log = execFileSync('git', ['log', '--format=%H%x00%ae%x00%B%x1e', 'origin/main..HEAD'], { encoding: 'utf8' });
const unsigned = log.split('\x1e').filter(entry => entry.trim()).map(entry => entry.trim().split('\0'))
  .filter(([, email, body]) => !body.includes('Signed-off-by:') || !body.includes(`<${email}>`))
  .map(([hash]) => hash.slice(0, 12));
if (unsigned.length) throw new Error(`Commits without a matching sign-off: ${unsigned.join(', ')}`);

Python example

import subprocess

log = subprocess.run(["git", "log", "--format=%H%x00%ae%x00%B%x1e", "origin/main..HEAD"],
                     capture_output=True, text=True, check=True).stdout
entries = [entry.strip().split("\0") for entry in log.split("\x1e") if entry.strip()]
unsigned = [commit[:12] for commit, email, body in entries if "Signed-off-by:" not in body or f"<{email}>" not in body]
assert not unsigned, f"Commits without a matching sign-off: {unsigned}"

How to check

A required CI check fails a pull request with any commit whose message lacks a Signed-off-by: line matching the commit author's email. With a contributor agreement, the check fails for an author who has not signed it.

Sources

• Developer Certificate of Origin 1.1
• git commit --signoff
• OpenSSF OSPS Baseline (OSPS-LE-01)

Related rules

• OSS-6 Changing the licence without every copyright holder's consent in Open source maintenance
• OSS-7 Write a contributing guide in Open source maintenance
• OSS-11 State your rules for changes written with AI in Open source maintenance