veraison / go-cose

go library for CBOR Object Signing and Encryption (COSE)
Mozilla Public License 2.0
50 stars 26 forks source link

Remove DCO #194

Closed SteveLasker closed 2 months ago

SteveLasker commented 3 months ago

Implementing DCO is great, in concept. Unfortunately the productive github tools to accept suggestions fights with DCO making the process broken for accepting suggestions.

Maintainers have the responsibility to accept or decline suggestions and/or PRs from individuals.

We will still follow the process for knowing who made what commits, and they should sign their commits.

Please 👍 if you agree, or comment if you disagree

SteveLasker commented 3 months ago

@yogeshbdeshpande, @setrofim, @qmuntal, @thomas-fossati, @shizhMSFT, @roywill Can you please provide your perspective to ⬆️

shizhMSFT commented 3 months ago

DCO is important to open-source projects and more details can be found in https://github.com/apps/dco

I know people are struggling with web-based commits such as no sign-off when accepting suggestions. For example, image

However, this can be easily mitigated by toggling Require contributors to sign off on web-based commits in the repository setting. Detailed doc can be found at https://docs.github.com/en/organizations/managing-organization-settings/managing-the-commit-signoff-policy-for-your-organization

image

After applying the above setting, the web UI on GitHub will become image image It shows Sign off and commit suggestion.

image As you can see, the commit is properly signed off.

SteveLasker commented 3 months ago

Thanks, @shizhMSFT, We don't object to signing, rather the alignment of the tools. I've enabled "Require contributors to sign off on web-based commits " and will do some testing shortly. If that solves the usability problem for contributors and authors to use the github tools, I don't mind keeping the DCO capability.

SteveLasker commented 2 months ago

Closing, until it bites us again...