search

dcoapp / app

GitHub App that enforces the Developer Certificate of Origin (DCO) on Pull Requests
https://github.com/apps/dco
ISC License
299 stars 75 forks source link

Read sign-offs in PR comments #105

Closed itayd closed 5 years ago

itayd commented 5 years ago

(This is an alternative suggestion for https://github.com/probot/dco/issues/74)

To my understanding, the legal requirement is that each commit must be signed to prove that the authors themselves signed these off, and that's the only authenticated way to do so. I am wondering if a GitHub comment that is from the commit author could fulfill the same requirement? That way a simpler way for signing off contributions could be implemented.

In essence, a committer would comment something like "/dco-approve" and it'll make the bot consider all previous commits as signed off.

This functionality will be enabled by a config file field.

Would be happy to implement this if this makes sense.

hiimbex commented 5 years ago

I'm not a lawyer and don't really use the DCO on my projects so I'm fine with this. I think enabling via conifg option (which is by default disabled) should satisfy those from the Linux Foundation who have lawyers decide these things.

PRs welcome!

hiimbex commented 5 years ago

Also duplicate of https://github.com/probot/dco/issues/83

stale[bot] commented 5 years ago

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?