Repository navigation
Requiring Signed-off-by moving forward #62577
Description
Activity
- pinned this issue
on Apr 3, 2026 If the lint check flags your commits but you do not think the sign off should be necessary on that commit
James, what does this mean? Are we enforcing this or not? Maybe just check first commit as we do? (In case of squash)
I'm +1 on this
- Only people can sign off. The Signed-off-by trailer should not be added by bots or AI-agents.
https://github.blog/changelog/2026-04-03-copilot-cloud-agent-signs-its-commits
Reacted by Pratik ShindeJames, what does this mean...
Yes, I just merged the policy update and the tooling updates. All commits moving forward need to have the
Signed-off-byattestation.@cclauss ... yes, those will be ignored. The tooling should emit a warning for detected bot commits but otherwise should not block them. We'll tweak the tooling as necessary. It might take a day or two for the tooling to start kicking in.. I don't know how often that is updated.
Reacted by Christian ClaussThe lack of a sign-off on the commit adding a requirement to sign-off amuses me slightly. 😆
But yes, adding a sign-off requirement sounds perfectly reasonable to me. 👍🏻
Reacted by Tierney Cyren, Steven, Erick Wendel, Levi Zim and Alexandre NICOLAIE - Copilot AccountThe lack of a sign-off on the commit ...
Sigh.. ha! Good catch. See, this is why we need tools to help enforce it.
Reacted by Stewart X Addison and Erick WendelReacted by Jacob Smith, Stephen Belanger and Erick WendelI like the idea.
Is it possible to get GitHub Desktop to do this automatically?Looks like yes desktop/desktop#21741Reacted by James M SnellIs it possible to GitHub Desktop to do this automatically?
I'm not sure about that as I don't use GitHub Desktop. I do know that
git commit -swill add it automatically, and vscode has a setting to always add it.- Only people can sign off. The Signed-off-by trailer should not be added by bots or AI-agents.
https://github.blog/changelog/2026-04-03-copilot-cloud-agent-signs-its-commits
This article deals with PGP signature, aka the green
Verifiedbadge; it has nothing to do with the Signed-off-by trailer, which is what this issue is about.Reacted by James M Snell and Pratik ShindeAnd to be clear, we expect hiccups. The tooling might need tweaks here and there to correct the checks. For now, do your best and call it out when things slip through. We'll iterate until we get it right
Will this allow for continued usage of GitHub's email privacy feature?
@users.noreply.github.comMine is
66998419+MikeMcC399@users.noreply.github.com
and I use this for all commits to GitHubYes, as long as the Sign off email and commit email are the same.
Reacted by Mike McCready and Vinicius LourençoDoes Node.js use the OpenJSF https://openjsf.org/cla ? I know I signed this before committing the first time to ESLint.
Reacted by Vinicius LourençoAnother way to add the sign off automatically that I have set up is:
- Create a file with two empty lines followed by the commit trailer
- Run
git config commit.template /path/to/the/file
Reacted by James M Snell, Christian Clauss and Stephen Belanger26 remaining items
Tooling doesn't like my commit addition because it's too long, being 75 characters:
Signed-off-by: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>Commit message linting allows only 72 characters.
Does linting need to be changed to allow longer e-mail addresses such as are created by GitHub private addresses? Should I log this as a separate issue?
According to https://git-scm.com/docs/git-interpret-trailers:
The may be split over multiple lines with each subsequent line starting with at least one whitespace, like the "folding" in RFC 822. Example:
key: This is a very long value, with spaces and newlines in it.It would be interesting to check whether you could use:
Signed-off-by: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>Thanks for finding that reference!
It would be interesting to check whether you could use:
Signed-off-by: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>I can try that. There is a typo that I wouldn't otherwise have raised a PR for, but I can use that as a test case.
@aduh95 PR #62738 has passed linting with a split-line
Signed-off-bysubmission as you suggested.But here's how NCU rephrase it:
doc: correct typo in PR contribution instructions <66998419+MikeMcC399@users.noreply.github.com> Signed-off-by: Mike McCready <66998419+MikeMcC399@users.noreply.github.com> PR-URL: https://github.com/nodejs/node/pull/62738Which does not pass the validation afterwards. We need to remove the assumption that trailers are always single-line
I've opened nodejs/core-validate-commit#144 and nodejs/node-core-utils#1062 to make our tooling handle longer and/or multi-line trailers. Please review!
Reacted by Mike McCready and James M SnellTo clarify, bot/automations adding the Signed-off-by is something we should ignore but generate cannot prevent. The automated check applies heuristics to detect known bot patterns but they are imperfect and will require some tuning as we go.
IMO
Signed-off-byis useless. It can't prevent forgery at all. The requirement is bureaucracy that doesn't solve the underlying issue.The better way would've been actually signing commits using GPG or SSH. The cryptographic signatures can't be forged, unless private keys are stolen from developer machine. Commit signing is the basic assurance functionality which has been present in git for many years.
Reacted by Sebastian BeltranThe name and email used in the Signed-off-by trailer must match the name and email used in the commit author metadata.
Does a co-author count here?
If not, this will automatically make people obscure the fact that the contribution was mainly authored by claude
I think that information is valuable for commit historyRe-authoring commits is not nice even if the original one is by an agent
And would make this rule followed only in letter but not in spiritI suggest allowing something like this in such cases (only on condition that this is not auto-added by the agent):
Co-authored-by: human Signed-off-by: humanSee #62839 (comment)
I think that is valid under DCO.
- If a commit has multiple authors, there should be one Signed-off-by for each author. + If a commit has multiple authors, there should be one Signed-off-by for each human author.
Do not create it a requirement to obscure the fact that code was partially auto-generated.
- unpinned this issue
on Apr 23, 2026 Been open long enough!
This will be enforced by a new commit lint check.
I'm confused why this is now closed, as I would have expected that the commit link check would have been implemented before closing. That is however not yet the case.
There are plenty of new commits in https://github.com/nodejs/node/commits/main/ that have no
Signed-off-by.Additionally, the PR #62738 I submitted as a test case remains stuck and I can't use my regular identity:
Signed-off-by: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>Should those points be captured in separate new meta issues here?
I don't think #62577 (comment) was answered
Especially given thatAssisted-bydoes not even work at the momentAt the moment, this policy requires just removing Assisted-by and Co-authored-by from tools.
On a side note, I'm unsure of the reasoning behind
Signed-off-byusage at all, as on GitHub all commits going through PRs are "signed off" by default: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service#6-contributions-under-repository-licenseWhenever you add Content to a repository containing notice of a license, you license that Content under the same terms, and you agree that you have the right to license that Content under those terms. If you have a separate agreement to license that Content under different terms, such as a contributor license agreement, that agreement will supersede.
Reacted by Jordan Harband
As a heads up... moving forward, the project will require all contributors to explicitly sign-off on commits using the
Signed-off-by: Name <Email>trailer in commits. This will be enforced by a new commit lint check.The use of
Signed-off-byis an explicit acceptance of the Developer Certificate of Origin (DCO) that attests that you have the right to submit the code under the OSS license used by the project (MIT in our case).Why now?
This is really something that we should have been doing all along.
How?
When you create a commit, use the
-sflag, e.g.git commit -s. This will automatically add theSigned-off-bytrailer in your commit message using your configured named and email address.Guidelines
The name and email used in the
Signed-off-bytrailer must match the name and email used in the commit author metadata. Use whatever name you want, but the email address must be a valid email.Only people can sign off. The
Signed-off-bytrailer should not be added by bots or AI-agents.If a commit has multiple authors, there should be one
Signed-off-byfor each author. One of those must match the author metadata for the commit.Backport commits, release commits, dependency updates, and WPT fixtures added by bots are exempt.
What about existing PRs
Existing PRs will likely need to be updated before they can land, as the new commit message lint rule will flag commits that do not have the
Signed-off-bytrailer.There may be rough edges
If the lint check flags your commits but you do not think the sign off should be necessary on that commit, add the
Signed-off-byanyway and open an issue. We'll determine if the sign off is necessary or whether the lint rule needs to be adjusted./cc @nodejs/tsc @nodejs/collaborators