Requiring Signed-off-by moving forward

As a heads up... moving forward, the project will require all contributors to explicitly sign-off on commits using the Signed-off-by: Name <Email> trailer in commits. This will be enforced by a new commit lint check.

The use of Signed-off-by is an explicit acceptance of the Developer Certificate of Origin (DCO) that attests that you have the right to submit the code under the OSS license used by the project (MIT in our case).

Why now?

This is really something that we should have been doing all along.

How?

When you create a commit, use the -s flag, e.g. git commit -s. This will automatically add the Signed-off-by trailer in your commit message using your configured named and email address.

Guidelines

The name and email used in the Signed-off-by trailer must match the name and email used in the commit author metadata. Use whatever name you want, but the email address must be a valid email.
Only people can sign off. The Signed-off-by trailer should not be added by bots or AI-agents.
If a commit has multiple authors, there should be one Signed-off-by for each author. One of those must match the author metadata for the commit.
Backport commits, release commits, dependency updates, and WPT fixtures added by bots are exempt.

What about existing PRs

Existing PRs will likely need to be updated before they can land, as the new commit message lint rule will flag commits that do not have the Signed-off-by trailer.

There may be rough edges

If the lint check flags your commits but you do not think the sign off should be necessary on that commit, add the Signed-off-by anyway and open an issue. We'll determine if the sign off is necessary or whether the lint rule needs to be adjusted.

/cc @nodejs/tsc @nodejs/collaborators

Does Node.js use the OpenJSF CLA

No. We use the DCO.

does this work with the PR comment to suggest a change out of the box?

@Flarna

@Flarna ... not sure what you're asking there.

Sorry, I try to reformulate.
If I propose a change in a PR directly in browser (e.g. some typo) and the PR author accepts that as is. Does this commit created by github via browser clicks add the correct Signed-off-by: lines?

Not automatically, as far as I recall. But it's just a description line, so can be added to the description manually.

No, for simple typos or even suggestions that rework small bits, a sign-off from the person making the suggestion is not necessary. The only time it would be necessary is if the suggestion is a substantial rework and contribution on its own.

The use of Signed-off-by is an explicit acceptance of the Developer Certificate of Origin (DCO) that attests that you have the right to submit the code under the OSS license used by the project (MIT in our case).

I assume git commit -S already does that by default right? aka signing git commits? Or do we need to also explicitly do -s (add actual --sign-off/-s) (FYI -S !== --sign-off/-s)

How?

When you create a commit, use the -s flag, e.g. git commit -s. This will automatically add the Signed-off-by trailer in your commit message using your configured named and email address.

Please add these instructions to https://github.com/nodejs/node/blob/main/doc/contributing/pull-requests.md#commit-message-guidelines

Also for macOS / Windows GitHub Desktop users, a hint about the repository-linked option "Add Signed-off by trailer" found under the gear-wheel "Configure commit options" of the Commit / Description field would be useful.

I assume git commit -S already does that by default right?

Nope, -S/--gpg-sign attaches a PGP signature to the commit, that can be used as a guarantee that the committer is who they claim they are.
-s/--signoff adds a Signed-off-by trailer, which is what this issue is about; that is used in Node.js to certify that the committer claims they have the rights to submit the work under the Developer Certificate of Origin.

Signed-off-by is about the author(s), not the committer

Signed-off-by is about the author(s), not the committer

-s signs off for the committer, not the author(s). But sure, the requirement is for the author(s) to sign off, not the committer.
In most cases, the committer and the author are the same person; it would differ when cherry-picking a commit you didn't author, e.g. when picking up an abandoned PR, or when backporting to a staging branch.

Will we be enabling this as a repository setting? https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/managing-the-commit-signoff-policy-for-your-repository

If so, should other repos within the nodejs org also enable that?

Will we be enabling this as a repository setting? https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/managing-the-commit-signoff-policy-for-your-repository

I tried that out on a test repo, and it automatically adds a sign-off to every commit without asking whether you agree or not. If it actually asked you to confirm that you're submitting according to the DCO and then added if you agreed, or didn't add it if you disagreed, then this could be useful. I believe it would be counterproductive to enable it, based on the quick test I did.

🤦 As useful as a glass hammer… I expected it would work like the requiring signed commits (where non-signed commits are blocked).

@JakobJingleheimer

From @JakobJingleheimer's comment

If so, should other repos within the nodejs org also enable that?

I was also wondering this. It makes me wonder if a tool like https://github.com/cncf/dco2 is our mechanism or something else.

Heads up: dependabot is now including this commit tag (our doc says humans should assert this).

Yep, dependabot has been including it for a while. Our tooling check accounts for that and ignores it. When we say that only humans should assert it what we mean is that bots shouldn't add it but if they do it's meaningless and will be ignored.

Tooling doesn't like my commit addition because it's too long, being 75 characters:

Signed-off-by: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>

Commit message linting allows only 72 characters.

Does linting need to be changed to allow longer e-mail addresses such as are created by GitHub private addresses? Should I log this as a separate issue?

There's a dedicated repo within the org for the commit linter. It has a sort of allow-list for lines starting with certain commit tags; this probably needs to get added.

Erroneous failures on email length happens quite frequently. Perhaps a more universal "if the line contains an email address longer than the line limit, just ignore it" exception would be better.

Does that mean I can just ignore the linting error and my PR can get merged anyway?

Nope

nodejs/core-validate-commit#142 will update the tooling to ignore the trailer for the line length rule.

Only people can sign off. The Signed-off-by trailer should not be added by bots or AI-agents.

I'm seeing an AI-generated typo correction PR using:

Signed-off-by: Codex <codex@openai.com>

~~It passes linting, since commit and Signed-off-by are identical, even though it violates the rule about AI-agents.~~ Edit: apparently not yet the case, see below.

The committer / signer is OpenAI's GitHub user https://github.com/codex

Although the PR is only for a one-word typo correction, the precedent of allowing AI to sign off and be passed through as conforming to rules probably should not be ignored.

Only people can sign off. The Signed-off-by trailer should not be added by bots or AI-agents.

The documentation https://github.com/nodejs/node/blob/main/doc/contributing/pull-requests.md#step-8-opening-the-pull-request should spell out that the Signed-off-by metadata must refer to a person (and not a bot or an AI agent).

It passes linting, since commit and Signed-off-by are identical

It passes linting because Signed-off-by trailers are not enforced yet; nodejs/core-validate-commit#141 has not made it into a release – because the commit message doesn't follow the Conventional Commits guidelines, the tooling was not able to pick it up to prepare a release.

It passes linting, since commit and Signed-off-by are identical

It passes linting because Signed-off-by trailers are not enforced yet; nodejs/core-validate-commit#141 has not made it into a release – because the commit message doesn't follow the Conventional Commits guidelines, the tooling was not able to pick it up to prepare a release.

I fixed that with an override (https://github.com/googleapis/release-please#how-can-i-fix-release-notes): nodejs/core-validate-commit#143

Tooling doesn't like my commit addition because it's too long, being 75 characters:
Signed-off-by: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
Commit message linting allows only 72 characters.

Does linting need to be changed to allow longer e-mail addresses such as are created by GitHub private addresses? Should I log this as a separate issue?

According to https://git-scm.com/docs/git-interpret-trailers:

The may be split over multiple lines with each subsequent line starting with at least one whitespace, like the "folding" in RFC 822. Example:
key: This is a very long value, with spaces and
  newlines in it.

It would be interesting to check whether you could use:

Signed-off-by: Mike McCready
  <66998419+MikeMcC399@users.noreply.github.com>

@aduh95

@aduh95

https://git-scm.com/docs/git-interpret-trailers:

Thanks for finding that reference!

It would be interesting to check whether you could use:
Signed-off-by: Mike McCready
  <66998419+MikeMcC399@users.noreply.github.com>

I can try that. There is a typo that I wouldn't otherwise have raised a PR for, but I can use that as a test case.

@aduh95

@aduh95 PR #62738 has passed linting with a split-line Signed-off-by submission as you suggested.

@aduh95 PR #62738 has passed linting with a split-line Signed-off-by submission as you suggested.

But here's how NCU rephrase it:

doc: correct typo in PR contribution instructions

  <66998419+MikeMcC399@users.noreply.github.com>

Signed-off-by: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/62738

Which does not pass the validation afterwards. We need to remove the assumption that trailers are always single-line

I've opened nodejs/core-validate-commit#144 and nodejs/node-core-utils#1062 to make our tooling handle longer and/or multi-line trailers. Please review!

To clarify, bot/automations adding the Signed-off-by is something we should ignore but generate cannot prevent. The automated check applies heuristics to detect known bot patterns but they are imperfect and will require some tuning as we go.

IMO Signed-off-by is useless. It can't prevent forgery at all. The requirement is bureaucracy that doesn't solve the underlying issue.

The better way would've been actually signing commits using GPG or SSH. The cryptographic signatures can't be forged, unless private keys are stolen from developer machine. Commit signing is the basic assurance functionality which has been present in git for many years.

The name and email used in the Signed-off-by trailer must match the name and email used in the commit author metadata.

Does a co-author count here?
If not, this will automatically make people obscure the fact that the contribution was mainly authored by claude
I think that information is valuable for commit history

Re-authoring commits is not nice even if the original one is by an agent
And would make this rule followed only in letter but not in spirit

I suggest allowing something like this in such cases (only on condition that this is not auto-added by the agent):

Co-authored-by: human
Signed-off-by: human

See #62839 (comment)

I think that is valid under DCO.

- If a commit has multiple authors, there should be one Signed-off-by for each author.
+ If a commit has multiple authors, there should be one Signed-off-by for each human author.

Do not create it a requirement to obscure the fact that code was partially auto-generated.

Been open long enough!

This will be enforced by a new commit lint check.

I'm confused why this is now closed, as I would have expected that the commit link check would have been implemented before closing. That is however not yet the case.

There are plenty of new commits in https://github.com/nodejs/node/commits/main/ that have no Signed-off-by.

Additionally, the PR #62738 I submitted as a test case remains stuck and I can't use my regular identity:

Signed-off-by: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>

Should those points be captured in separate new meta issues here?

I don't think #62577 (comment) was answered
Especially given that Assisted-by does not even work at the moment

At the moment, this policy requires just removing Assisted-by and Co-authored-by from tools.

On a side note, I'm unsure of the reasoning behind Signed-off-by usage at all, as on GitHub all commits going through PRs are "signed off" by default: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service#6-contributions-under-repository-license

Whenever you add Content to a repository containing notice of a license, you license that Content under the same terms, and you agree that you have the right to license that Content under those terms. If you have a separate agreement to license that Content under different terms, such as a contributor license agreement, that agreement will supersede.

Navigation Menu

Repository navigation

Requiring `Signed-off-by` moving forward #62577

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Requiring Signed-off-by moving forward #62577

Description

Activity

jasnell commented on Apr 3, 2026

Flarna commented on Apr 3, 2026

jasnell commented on Apr 3, 2026

Flarna commented on Apr 3, 2026

Qard commented on Apr 4, 2026

jasnell commented on Apr 4, 2026

ovflowd commented on Apr 4, 2026

MikeMcC399 commented on Apr 4, 2026

aduh95 commented on Apr 5, 2026

targos commented on Apr 5, 2026

aduh95 commented on Apr 5, 2026

JakobJingleheimer commented on Apr 5, 2026

MikeMcC399 commented on Apr 5, 2026

JakobJingleheimer commented on Apr 5, 2026

bmuenzenmeyer commented on Apr 7, 2026

JakobJingleheimer commented on Apr 7, 2026

jasnell commented on Apr 7, 2026

MikeMcC399 commented on Apr 10, 2026

JakobJingleheimer commented on Apr 10, 2026

MikeMcC399 commented on Apr 10, 2026

JakobJingleheimer commented on Apr 10, 2026

richardlau commented on Apr 10, 2026

MikeMcC399 commented on Apr 11, 2026

MikeMcC399 commented on Apr 13, 2026

aduh95 commented on Apr 13, 2026

targos commented on Apr 13, 2026

aduh95 commented on Apr 14, 2026

MikeMcC399 commented on Apr 14, 2026

MikeMcC399 commented on Apr 14, 2026

aduh95 commented on Apr 14, 2026

aduh95 commented on Apr 16, 2026

jasnell commented on Apr 17, 2026

paulmillr commented on Apr 18, 2026

ChALkeR commented on Apr 20, 2026

ChALkeR commented on Apr 20, 2026

jasnell commented on Apr 23, 2026

MikeMcC399 commented on Apr 23, 2026

ChALkeR commented on Apr 26, 2026

M9005 commented on Apr 26, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Requiring `Signed-off-by` moving forward #62577