Skip to content

Commit 6efbcde

Browse files
CopilotCopilot
committed
Update documentation on GPG signing and DCO requirements
Signed-off-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
1 parent 5ba1928 commit 6efbcde

3 files changed

Lines changed: 165 additions & 14 deletions

File tree

‎CONTRIBUTING.md‎

Lines changed: 43 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,10 +39,17 @@ All contributions come through pull requests. To submit a proposed change, we re
3939

4040
A good way to communicate before investing too much time is to create a "Work-in-progress" PR and share it with your reviewers. The standard way of doing this is to add a "[WIP]" prefix in your PR's title and open the pull request as a draft.
4141

42-
### Developer Certificate of Origin: Signing your work
42+
### Developer Certificate of Origin and GPG Signing
4343

4444
#### Every commit needs to be signed
4545

46+
This project requires two types of signatures on all commits:
47+
48+
1. **Developer Certificate of Origin (DCO) Sign-off**: A text attestation that you have the right to submit the code
49+
2. **GPG Signature**: A cryptographic signature verifying your identity
50+
51+
**For DCO Sign-offs:**
52+
4653
The Developer Certificate of Origin (DCO) is a lightweight way for contributors to certify that they wrote or otherwise have the right to submit the code they are contributing to the project. Here is the full text of the [DCO](https://developercertificate.org/), reformatted for readability:
4754
```
4855
By making a contribution to this project, I certify that:
@@ -70,19 +77,51 @@ Git even has a `-s` command line option to append this automatically to your com
7077
git commit -s -m 'This is my commit message'
7178
```
7279

73-
Each Pull Request is checked whether or not commits in a Pull Request do contain a valid Signed-off-by line.
80+
**For GPG Signatures:**
81+
82+
GPG signatures verify the identity of the committer. To set up GPG signing:
83+
84+
1. Generate a GPG key and configure Git to use it:
85+
```sh
86+
git config --global user.signingkey YOUR_KEY_ID
87+
git config --global commit.gpgsign true
88+
```
89+
90+
2. Sign commits with the `-S` flag (or rely on the automatic signing from the above configuration):
91+
```sh
92+
git commit -S -m 'This is my signed commit message'
93+
```
94+
95+
3. For both DCO sign-off and GPG signature in one command:
96+
```sh
97+
git commit -S -s -m 'This is my signed and signed-off commit message'
98+
```
99+
100+
For detailed instructions on setting up both signature types, see [docs/dco-compliance.md](./docs/dco-compliance.md).
101+
102+
Each Pull Request is checked to ensure all commits contain valid DCO sign-offs and GPG signatures.
74103

75104
#### I didn't sign my commit, now what?!
76105

77106
No worries - You can easily replay your changes, sign them and force push them!
78107

108+
**For adding both DCO sign-off and GPG signature:**
79109
```sh
80110
git checkout <branch-name>
81-
git commit --amend --no-edit --signoff
111+
git commit --amend --no-edit -S -s
82112
git push --force-with-lease <remote-name> <branch-name>
83113
```
84114

85-
*Credit: This doc was cribbed from Dapr.*
115+
**For fixing multiple commits:**
116+
```sh
117+
git rebase -i HEAD~n # Replace n with the number of commits to fix
118+
# Change 'pick' to 'edit' for each commit
119+
# For each commit:
120+
git commit --amend --no-edit -S -s
121+
git rebase --continue
122+
```
123+
124+
For more detailed instructions on fixing commits, see [docs/dco-compliance.md](./docs/dco-compliance.md).
86125

87126
### Rust Analyzer
88127

‎README.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -279,4 +279,9 @@ See the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/main/code
279279
280280
## Development
281281
282-
All commits to this repository are signed with GPG verified signatures and include DCO sign-offs. See the [CONTRIBUTING.md](./CONTRIBUTING.md#developer-certificate-of-origin-signing-your-work) file for more information on DCO requirements.
282+
All commits to this repository require:
283+
284+
1. **GPG Verified Signatures**: Each commit must be cryptographically signed using GPG to verify the committer's identity.
285+
2. **DCO Sign-offs**: Each commit must include a Developer Certificate of Origin sign-off line.
286+
287+
For details on configuring both requirements, see [docs/dco-compliance.md](./docs/dco-compliance.md) and the [CONTRIBUTING.md](./CONTRIBUTING.md#developer-certificate-of-origin-signing-your-work) file.

‎docs/dco-compliance.md‎

Lines changed: 116 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,18 @@
1-
# DCO Compliance
1+
# Commit Signing Requirements
22

3-
This document explains how to ensure your commits comply with the Developer Certificate of Origin (DCO) requirements for this project.
3+
This document explains how to ensure your commits comply with both the Developer Certificate of Origin (DCO) requirements and GPG signing requirements for this project.
44

55
## What is the DCO?
66

77
The Developer Certificate of Origin (DCO) is a lightweight way for contributors to certify that they wrote or otherwise have the right to submit the code they are contributing to the project. See the full text in the [CONTRIBUTING.md](../CONTRIBUTING.md#developer-certificate-of-origin-signing-your-work) file.
88

9+
## Two Required Signature Types
10+
11+
All commits to this repository must have two types of signatures:
12+
13+
1. **DCO Sign-off**: A `Signed-off-by` line in the commit message
14+
2. **GPG Signature**: A cryptographic signature verifying the committer's identity
15+
916
## Adding DCO Sign-offs to Commits
1017

1118
All commits must include a `Signed-off-by` line in the commit message. This line certifies that you have the right to submit your contribution under the project's license.
@@ -36,22 +43,122 @@ git config --global alias.cs 'commit -s'
3643

3744
Then use `git cs` instead of `git commit` to create commits with sign-offs.
3845

39-
### Adding Sign-offs to Existing Commits
46+
## GPG Signing Your Commits
47+
48+
In addition to DCO sign-offs, all commits must be GPG signed to verify your identity.
49+
50+
### Setting Up GPG
51+
52+
1. If you don't have a GPG key, generate one:
53+
54+
```sh
55+
gpg --full-generate-key
56+
```
57+
58+
Choose RSA and RSA, 4096 bits, and an expiration date of your preference.
59+
60+
2. List your keys to get the ID:
61+
62+
```sh
63+
gpg --list-secret-keys --keyid-format=long
64+
```
65+
66+
Look for the line starting with "sec" and note the key ID after the "/".
67+
68+
3. Configure Git to use your GPG key:
69+
70+
```sh
71+
git config --global user.signingkey YOUR_KEY_ID
72+
```
73+
74+
Replace YOUR_KEY_ID with your actual GPG key ID.
4075

41-
If you forgot to sign off your commits, you can amend them:
76+
4. Configure Git to sign commits automatically:
77+
78+
```sh
79+
git config --global commit.gpgsign true
80+
```
81+
82+
### Creating GPG Signed Commits
83+
84+
With automatic signing enabled, normal commit commands will create signed commits. You can also explicitly sign with:
4285

4386
```sh
44-
git commit --amend --no-edit --signoff
87+
git commit -S -m "Your commit message"
4588
```
4689

47-
For multiple commits, you can use git rebase:
90+
To create a commit with both GPG signature and DCO sign-off:
4891

4992
```sh
50-
git rebase --signoff HEAD~n
93+
git commit -S -s -m "Your commit message"
5194
```
5295

53-
Replace `n` with the number of commits you want to sign off.
96+
### Adding Your GPG Key to GitHub
97+
98+
1. Export your public key:
99+
100+
```sh
101+
gpg --armor --export YOUR_KEY_ID
102+
```
103+
104+
2. Copy the output and add it to your GitHub account under Settings > SSH and GPG keys.
105+
106+
## Adding Both Signatures to Existing Commits
107+
108+
If you forgot to sign your commits, you can fix them:
109+
110+
### For the Last Commit
111+
112+
```sh
113+
git commit --amend --no-edit -S -s
114+
```
115+
116+
### For Multiple Commits
117+
118+
For adding both DCO sign-offs and GPG signatures to a range of commits, use interactive rebase:
119+
120+
1. Start the rebase:
121+
122+
```sh
123+
git rebase -i HEAD~n
124+
```
125+
126+
Replace `n` with the number of commits you want to sign.
127+
128+
2. In the editor, change `pick` to `edit` for each commit.
129+
130+
3. For each commit that opens during the rebase:
131+
132+
```sh
133+
git commit --amend --no-edit -S -s
134+
git rebase --continue
135+
```
136+
137+
Alternatively, for adding just DCO sign-offs to multiple commits:
138+
139+
```sh
140+
git rebase --signoff HEAD~n
141+
```
54142

55143
## Verification
56144

57-
The project uses automated checks to verify that all commits include the required DCO sign-off. If you receive a DCO failure notification, please follow the instructions above to add the required sign-offs.
145+
The project uses automated checks to verify that all commits include both the required DCO sign-off and GPG signature. If you receive a signature verification failure notification, please follow the instructions above to add the required signatures.
146+
147+
## Troubleshooting
148+
149+
### GPG Signing Issues
150+
151+
If you encounter issues with GPG signing:
152+
153+
- Ensure your GPG key is properly generated and configured with Git
154+
- Set the `GPG_TTY` environment variable: `export GPG_TTY=$(tty)`
155+
- For Git GUI tools, you may need to configure GPG agent
156+
- On Windows, you might need to specify the full path to gpg.exe
157+
158+
### DCO Sign-off Issues
159+
160+
If you encounter issues with DCO sign-offs:
161+
162+
- Ensure your Git user name and email are correctly configured
163+
- Check that the commit author email matches your configured email
164+
- For commits created through GitHub's web interface, you'll need to add the sign-off manually in the commit message

0 commit comments

Comments
 (0)