anderseknert,
@anderseknert@hachyderm.io avatar

A surprisingly common mistake people do when contributing to #OpenSource projects is to forget the (often required) sign-off on their commit, and then close the PR only to open a new one where the sign-off is included. This isn’t needed! Next time, just:

git commit --amend --signoff
git push --force

And your signoff will be added to the commit in your PR.

#git #developer #code #devops #github

bmarwell,

@anderseknert None of the projects I contribute to require me to sign off my commits. What is it for for?

anderseknert,
@anderseknert@hachyderm.io avatar
bmarwell,

@anderseknert yeah okay. IBM and the Apache foundation do have CLAs. That's why.

castarco,
@castarco@hachyderm.io avatar

@anderseknert Better yet, it can be configured in our .gitconfig file to do it always automatically :) .

https://gist.github.com/lisawolderiksen/a7b99d94c92c6671181611be1641c733

And if possible, sign it as well with PGP (which actually makes much more sense from a legal point of view)!

https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits

anderseknert,
@anderseknert@hachyderm.io avatar

@castarco not necessarily better :) See the comment from @klausman earlier in this thread:

> as the git-config manpage rightly points out -- signing off should be a conscious act

There are many ways to automate a sign-off, but it’s arguably no longer a signoff then. I mean, not like anyone would know, just saying it wouldn’t be considered better by many, but worse.

The whole DCO thing being silly seems to me like the most rational take to me 😅

johanneskastl,
@johanneskastl@digitalcourage.social avatar

@anderseknert There is also a way to do this for multiple commits using rebase...

anderseknert,
@anderseknert@hachyderm.io avatar

@johanneskastl good point! We almost always want squashed commits in PRs in , but that’s certainly applicable to a lot of other projects 👍

johanneskastl,
@johanneskastl@digitalcourage.social avatar

@anderseknert It even works without squashed commits...

anderseknert,
@anderseknert@hachyderm.io avatar

@johanneskastl Sure! My point was mainly that most often one PR == one commit, in our project. So there's only really one commit to sign off on at the end of the day :) Other projects do things differently of course.

linux_mclinuxface,
@linux_mclinuxface@fosstodon.org avatar

@anderseknert I worked for a long time on a sign off required project. I like what it does but the workflow is terrible, especially for new contributors.

anderseknert,
@anderseknert@hachyderm.io avatar

@linux_mclinuxface totally! Just curious, what is it that it does that you like? 🙂 I work for such a project, and it just seems to cause more harm than good. But I could be missing some benefit.

linux_mclinuxface,
@linux_mclinuxface@fosstodon.org avatar

@anderseknert IANAL but sign offs connected with DCOs are non-controversial from a legal standpoint.

CLAs, on the other hand can be monstrous and should probably have counsel review before an organization starts having devs contribute.

Any time a legal review can be avoided, it's a win.

anderseknert,
@anderseknert@hachyderm.io avatar

@linux_mclinuxface uncontroversial, I’m sure, but what value do they add from a law POV? A sign off on a commit is just repeating information that was already there, and it’s not like donald@duck.com signing off on a commit helps assert an actual person is connected to that action, no?

linux_mclinuxface,
@linux_mclinuxface@fosstodon.org avatar

@anderseknert Well, the sign off by itself doesn't do anything much, but paired with item D in the DCO and the conscious act of signing gives it legs (again, IANAL)

kevinteljeur,
@kevinteljeur@mastodon.online avatar

@anderseknert This is useful generally!

anderseknert,
@anderseknert@hachyderm.io avatar

@kevinteljeur true! Also, the --no-edit option is great when amending code but don’t need to edit the commit message.

klausman,
@klausman@mas.to avatar

@anderseknert One of the problems is that -- asthe git-config manpage righlty points out -- signing off should be a conscious act, but there is no (current) mechanism that tells the user upon opening the PR (BEFORE creating the PR visibly to others) that says "Hey, if this is gonna be merged, it needs signoff, add that now?"

I suspect someone somewhere already has a hook mechanism for that :)

anderseknert,
@anderseknert@hachyderm.io avatar

@klausman for sure! I suppose any commit without a sign-off could be rejected at push, but people often work on a bunch of commits and then squash into a final one for the PR which is signed, so damned if you do, damned if you don’t 😄

  • All
  • Subscribed
  • Moderated
  • Favorites
  • opensource
  • DreamBathrooms
  • InstantRegret
  • ethstaker
  • magazineikmin
  • GTA5RPClips
  • rosin
  • modclub
  • Youngstown
  • ngwrru68w68
  • slotface
  • osvaldo12
  • kavyap
  • mdbf
  • thenastyranch
  • JUstTest
  • everett
  • cubers
  • cisconetworking
  • normalnudes
  • Durango
  • anitta
  • khanakhh
  • tacticalgear
  • tester
  • provamag3
  • megavids
  • Leos
  • lostlight
  • All magazines