740

What's the point of the Sign Off feature in Git?

git commit --signoff

When should I use it, if at all?

0

4 Answers 4

687

Sign-off is a requirement for getting patches into the Linux kernel and a few other projects, but most projects don't actually use it.

It was introduced in the wake of the SCO lawsuit, (and other accusations of copyright infringement from SCO, most of which they never actually took to court), as a Developers Certificate of Origin. It is used to say that you certify that you have created the patch in question, or that you certify that to the best of your knowledge, it was created under an appropriate open-source license, or that it has been provided to you by someone else under those terms. This can help establish a chain of people who take responsibility for the copyright status of the code in question, to help ensure that copyrighted code not released under an appropriate free software (open source) license is not included in the kernel.

16
  • 122
    It should be noted that the described meaning is the one assigned to the Signed-off-by: commit message lines by the Linux kernel project (and the Git project itself). For other projects, however, such lines are meaningless unless the project assigns meaning to them (e.g. by describing them in the project's documentation; e.g. Linux’s SubmittingPatches or Git’s SubmittingPatches). Commented Jul 6, 2010 at 22:40
  • 62
    So why did this need to be done in the commit message? I thought that commits had an author attached to them, and they were part of the SHA1 hash? Commented Dec 31, 2010 at 17:02
  • 40
    @Leif Mere authorship information is not sufficient. I might have written a patch, but if I based it on some code from Unix, I wouldn't have permission to release it under the GPL (at least without signoff from someone higher up). Or, a patch may make it between several different maintainers before winding up in the kernel tree; the signoff indicates the chain of custody. Read the certificate of origin that I linked to; that's what it means when you add a signoff line. The "Author" header may be inaccurate, and doesn't necessarily imply agreement with everything in the certificate of origin. Commented Dec 31, 2010 at 21:43
  • 88
    Without PGP key, how can it be established that the sign-off is genuine?
    – HRJ
    Commented Dec 3, 2012 at 7:35
  • 13
    @HRJ The genuineness of a signed-off is actually on you (commiter). Not on author, neither on the signed off himself. If later someone (mainly the signed off) dispute its not valid, you better have with you a email or something that proves he agreed to it. Commiter may say he did not commit such blob IF the blob is not GPG signed (IMHO a weak defense, but...). In this case, the commiter can use -S to close the circle. Now with -S and -s you have a chain of custody based on the commiter's word, that the code written by some author is authorized to be used by some signed-off higher up.
    – DrBeco
    Commented Nov 9, 2014 at 15:08
96

Sign-off is a line at the end of the commit message which certifies who is the author of the commit. Its main purpose is to improve tracking of who did what, especially with patches.

Example commit:

Add tests for the payment processor.

Signed-off-by: Humpty Dumpty <[email protected]>

It should contain the user real name if used for an open-source project.

If branch maintainer need to slightly modify patches in order to merge them, he could ask the submitter to rediff, but it would be counter-productive. He can adjust the code and put his sign-off at the end so the original author still gets credit for the patch.

Add tests for the payment processor.

Signed-off-by: Humpty Dumpty <[email protected]>

[Project Maintainer: Renamed test methods according to naming convention.]
Signed-off-by: Project Maintainer <[email protected]>

Source: http://gerrit.googlecode.com/svn/documentation/2.0/user-signedoffby.html

6
  • 63
    Isn't that redundant by the author field of a git commit? I always thought that's why there was a separate author and committer field. The author being the patch writer and the committer being the guy who applied and pushed the patch. Commented Aug 30, 2014 at 18:38
  • 22
    Does it really certify who the author of a commit is? I mean, as much as -S (--gpg-sign) does, because I don't think so. I think anybody could add a "Signed-off-by" line with any name and e-mail, whereas a GPG signature is much more reliable, but maybe I am wrong.
    – hdl
    Commented Feb 29, 2016 at 10:21
  • 3
    “Sign-off is a line at the end of the commit message which certifies who is the author of the commit. Its main purpose is to improve tracking of who did what, especially with patches.” — That’s almost certainly wrong (specifically the first sentence). As a counter-example, see for example b2c150d3aa (linked to in VonC’s answer), which has two signed-off-by headers; one by the author, and one by the maintainer. This is common practice in the Git and Linux projects. Commented Dec 15, 2016 at 11:50
  • (Continued from previous comment.) To sign-off means that you have authored the commit under certain conditions, or that you are passing on something which has been authored by someone who have (stribed to) fulfil the aforementioned condition. So it forms something like a chain-of-certification. Commented Dec 15, 2016 at 11:54
  • Update on the above: it turns out that I missed something in my last reply, and so I underestimated this answer. The author is partially correct about “adjusting the code”, but puts the wrong emphasis on the “sign-off” trailer. The documentation says that you should add a bracketed trailer (as in the example in the answer) which informs about that. So the the sign-off in conjunction with that can be used to add small changes by people like the integrator/maintainer. But the sign-off still serves mainly as what I’ve described. Commented Dec 15, 2016 at 12:50
65

TLDR; Typically certifies that committer has the rights to submit this work under the same license and agrees to a Developer Certificate of Origin (see http://developercertificate.org/ for more information).


Git 2.7.1 (February 2016) clarifies that in commit b2c150d (05 Jan 2016) by David A. Wheeler (david-a-wheeler).
(Merged by Junio C Hamano -- gitster -- in commit 7aae9ba, 05 Feb 2016)

git commit man page now includes:

-s::
--signoff::

Add Signed-off-by line by the committer at the end of the commit log message.
The meaning of a signoff depends on the project, but it typically certifies that committer has the rights to submit this work under the same license and agrees to a Developer Certificate of Origin (see https://developercertificate.org for more information).


Expand documentation describing --signoff

Modify various document (man page) files to explain in more detail what --signoff means.

This was inspired by "lwn article 'Bottomley: A modest proposal on the DCO'" (Developer Certificate of Origin) where paulj noted:

The issue I have with DCO is that there adding a "-s" argument to git commit doesn't really mean you have even heard of the DCO (the git commit man page makes no mention of the DCO anywhere), never mind actually seen it.

So how can the presence of "signed-off-by" in any way imply the sender is agreeing to and committing to the DCO? Combined with fact I've seen replies on lists to patches without SOBs that say nothing more than "Resend this with signed-off-by so I can commit it".

Extending git's documentation will make it easier to argue that developers understood --signoff when they use it.


Note that this signoff is now (for Git 2.15.x/2.16, Q1 2018) available for git pull as well.

See commit 3a4d2c7 (12 Oct 2017) by W. Trevor King (wking).
(Merged by Junio C Hamano -- gitster -- in commit fb4cd88, 06 Nov 2017)

pull: pass --signoff/--no-signoff to "git merge"

merge can take --signoff, but without pull passing --signoff down, it is inconvenient to use; allow 'pull' to take the option and pass it through.


With Git 2.33 (Q3 2021), the SubmitingPatches document further (re)illustrate the intent behind signoff: DCO (prefered to CLAs for open-source projects).

See commit f003a91, commit 4523dc8 (22 Jul 2021) by Ævar Arnfjörð Bjarmason (avar).
(Merged by Junio C Hamano -- gitster -- in commit 58705b4, 04 Aug 2021)

SubmittingPatches: move discussion of Signed-off-by above "send"

Signed-off-by: Ævar Arnfjörð Bjarmason

Move the section discussing the addition of a SOB trailer above the section that discusses generating the patch itself.
This makes sense as we don't want someone to go through the process of "git format-patch"(man), only to realize late that they should have used "git commit -s"(man) or equivalent.

SubmittingPatches now includes in its man page:

[[sign-off]]

Certify your work by adding your Signed-off-by trailer

To improve tracking of who did what, we ask you to certify that you wrote the patch or have the right to pass it on under the same license as ours, by "signing off" your patch. Without sign-off, we cannot accept your patches.

If (and only if) you certify the below D-C-O:

[[dco]]

.Developer's Certificate of Origin 1.1


Note that GitHub can force you (since June 2022) to add signoff to your commit messages:

Admins can require sign off on web-based commits

Organization owners and repository admins can now require developers to sign off on commits made through GitHub's web interface, such as when editing a file or merging a pull request.

Also, it is now easier for developers to complete a signoff in the web interface, resulting in fewer commits being blocked from merging and less time spent resolving blocked commits.

https://i0.wp.com/user-images.githubusercontent.com/1767415/172388117-920c9043-c616-49cf-962f-6947c049adcb.png?ssl=1

When the setting is enabled, the web interface will inform developers that their action of committing will also constitute signing off, as shown below.
Like using Git's --signoff option on the command line, signing off in the web interface will automatically append the Signed-off-by: text to the commit message.

https://i0.wp.com/user-images.githubusercontent.com/1767415/166171381-b70438c7-928a-4429-8947-610e74178eec.png?ssl=1

2
  • 4
    Even with the git commit documentation (at last) referencing the document the -s flag is intending to indicate knowledge and agreement/assent/??? to, I believe the SOB is legally very weak. SOB was, I think at least, invented by Linus to solve a social problem in that others were advocating for high-overhead bureaucracy. Linus didn't want anything, but came up with that to shut them up. As far as I can tell, lawyers would not advise you to invest much, if any, faith in it. (I am 'paulj' on LWN).
    – paulj
    Commented Dec 5, 2016 at 1:56
  • 11
    VonC, you’re a real Git curator. You always have such well-structured, informative, and nicely cross-referenced answers on questions like this — tracing the history of Git development to eventual user-facing tools and documentation. So thank you for that. Commented Dec 15, 2016 at 10:53
28

There are some nice answers on this question. I’ll try to add a more broad answer, namely about what these kinds of lines/headers/trailers are about in current practice. Not so much about the sign-off header in particular (it’s not the only one).

Headers or trailers (↑1) like “sign-off” (↑2) is, in current practice in projects like Git and Linux, effectively structured metadata for the commit. These are all appended to the end of the commit message, after the “free form” (unstructured) part of the body of the message. These are token–value (or key–value) pairs typically delimited by a colon and a space (:␣).

Like I mentioned, “sign-off” is not the only trailer in current practice. See for example this commit, which has to do with “Dirty Cow”:

 mm: remove gup_flags FOLL_WRITE games from __get_user_pages()
 This is an ancient bug that was actually attempted to be fixed once
 (badly) by me eleven years ago in commit 4ceb5db9757a ("Fix
 get_user_pages() race for write access") but that was then undone due to
 problems on s390 by commit f33ea7f404e5 ("fix get_user_pages bug").

 In the meantime, the s390 situation has long been fixed, and we can now
 fix it by checking the pte_dirty() bit properly (and do it better).  The
 s390 dirty bit was implemented in abf09bed3cce ("s390/mm: implement
 software dirty bits") which made it into v3.9.  Earlier kernels will
 have to look at the page state itself.

 Also, the VM has become more scalable, and what used a purely
 theoretical race back then has become easier to trigger.

 To fix it, we introduce a new internal FOLL_COW flag to mark the "yes,
 we already did a COW" rather than play racy games with FOLL_WRITE that
 is very fundamental, and then use the pte dirty flag to validate that
 the FOLL_COW flag is still valid.

 Reported-and-tested-by: Phil "not Paul" Oester <[email protected]>
 Acked-by: Hugh Dickins <[email protected]>
 Reviewed-by: Michal Hocko <[email protected]>
 Cc: Andy Lutomirski <[email protected]>
 Cc: Kees Cook <[email protected]>
 Cc: Oleg Nesterov <[email protected]>
 Cc: Willy Tarreau <[email protected]>
 Cc: Nick Piggin <[email protected]>
 Cc: Greg Thelen <[email protected]>
 Cc: [email protected]
 Signed-off-by: Linus Torvalds <[email protected]>

In addition to the “sign-off” trailer in the above, there is:

  • “Cc” (was notified about the patch)
  • “Acked-by” (acknowledged by the owner of the code, “looks good to me”)
  • “Reviewed-by” (reviewed)
  • “Reported-and-tested-by” (reported and tested the issue (I assume))

Other projects, like for example Gerrit, have their own headers and associated meaning for them.

See: https://git.wiki.kernel.org/index.php/CommitMessageConventions

Moral of the story

It is my impression that, although the initial motivation for this particular metadata was some legal issues (judging by the other answers), the practice of such metadata has progressed beyond just dealing with the case of forming a chain of authorship.

[↑1]: man git-interpret-trailers
[↑2]: These are also sometimes called “s-o-b” (initials), it seems.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.