Require signoff (DCO)¶

Projects that use the Developer Certificate of Origin require every commit to carry a Signed-off-by trailer. The Linux kernel and much of the CNCF work this way.

A DCO bot rejecting a pull request after the fact is a poor experience: the contributor has to rewrite history for every commit in the branch. Checking locally fixes it before it becomes a problem.

Turn it on¶

cchk.toml

[commit]
require_signed_off_by = true

This enables CC012, which is off by default.

Signing off¶

$ git commit --signoff -m "fix: handle an empty config file"

The trailer is appended automatically from your user.name and user.email:

fix: handle an empty config file

Signed-off-by: Your Name <you@example.com>

Forgot it? Fix the last commit in place:

$ git commit --amend --signoff --no-edit

Fix a whole branch:

$ git rebase --signoff main

Make it automatic

Signing off is easy to forget. Combine this rule with the pre-commit hook so a missing trailer is caught at commit time, not at review time.

Identity matters¶

The DCO is a statement about who wrote the code, so it only means something if the identity is real. CC101 and CC102 check the committer name and email, and are enabled by default when their check runs:

$ commit-check --author-name --author-email

To require a company address:

cchk.toml

[commit]
author_email_pattern = "^.+@example\\.com$"

Bots¶

Automation cannot meaningfully sign the DCO, and forcing it to produces meaningless trailers. Exempt bots instead:

cchk.toml

[commit]
require_signed_off_by = true
ignore_authors = ["dependabot[bot]", "renovate[bot]"]

ignore_authors matches the commit author and any Co-authored-by: trailers.