Requiring `Signed-off-by` moving forward

[jasnell]

As a heads up... moving forward, the project will require all contributors to explicitly sign-off on commits using the Signed-off-by: Name <Email> trailer in commits. This will be enforced by a new commit lint check.

The use of Signed-off-by is an explicit acceptance of the Developer Certificate of Origin (DCO) that attests that you have the right to submit the code under the OSS license used by the project (MIT in our case).

Why now?

This is really something that we should have been doing all along.

How?

When you create a commit, use the -s flag, e.g. git commit -s. This will automatically add the Signed-off-by trailer in your commit message using your configured named and email address.

Guidelines

• The name and email used in the Signed-off-by trailer must match the name and email used in the commit author metadata. Use whatever name you want, but the email address must be a valid email.

• Only people can sign off. The Signed-off-by trailer should not be added by bots or AI-agents.

• If a commit has multiple authors, there should be one Signed-off-by for each author. One of those must match the author metadata for the commit.

• Backport commits, release commits, dependency updates, and WPT fixtures added by bots are exempt.

What about existing PRs

Existing PRs will likely need to be updated before they can land, as the new commit message lint rule will flag commits that do not have the Signed-off-by trailer.

There may be rough edges

If the lint check flags your commits but you do not think the sign off should be necessary on that commit, add the Signed-off-by anyway and open an issue. We'll determine if the sign off is necessary or whether the lint rule needs to be adjusted.

/cc @nodejs/tsc @nodejs/collaborators

[juanarbol]

If the lint check flags your commits but you do not think the sign off should be necessary on that commit

James, what does this mean? Are we enforcing this or not? Maybe just check first commit as we do? (In case of squash)

I'm +1 on this

[cclauss]

• Only people can sign off. The Signed-off-by trailer should not be added by bots or AI-agents.

https://github.blog/changelog/2026-04-03-copilot-cloud-agent-signs-its-commits

[jasnell]

@juanarbol:

James, what does this mean...

Yes, I just merged the policy update and the tooling updates. All commits moving forward need to have the Signed-off-by attestation.

@cclauss ... yes, those will be ignored. The tooling should emit a warning for detected bot commits but otherwise should not block them. We'll tweak the tooling as necessary. It might take a day or two for the tooling to start kicking in.. I don't know how often that is updated.

[Qard]

The lack of a sign-off on the commit adding a requirement to sign-off amuses me slightly. 😆

But yes, adding a sign-off requirement sounds perfectly reasonable to me. 👍🏻

[jasnell]

The lack of a sign-off on the commit ...

Sigh.. ha! Good catch. See, this is why we need tools to help enforce it.

[JakobJingleheimer]

I like the idea.

Is it possible to get GitHub Desktop to do this automatically? Looks like yes desktop/desktop#21741

[jasnell]

Is it possible to GitHub Desktop to do this automatically?

I'm not sure about that as I don't use GitHub Desktop. I do know that git commit -s will add it automatically, and vscode has a setting to always add it.

[aduh95]

• Only people can sign off. The Signed-off-by trailer should not be added by bots or AI-agents.

https://github.blog/changelog/2026-04-03-copilot-cloud-agent-signs-its-commits

This article deals with PGP signature, aka the green Verified badge; it has nothing to do with the Signed-off-by trailer, which is what this issue is about.

[jasnell]

And to be clear, we expect hiccups. The tooling might need tweaks here and there to correct the checks. For now, do your best and call it out when things slip through. We'll iterate until we get it right

[MikeMcC399]

Will this allow for continued usage of GitHub's email privacy feature? @users.noreply.github.com

Mine is
66998419+MikeMcC399@users.noreply.github.com
and I use this for all commits to GitHub

[jasnell]

Yes, as long as the Sign off email and commit email are the same.

[MikeMcC399]

Does Node.js use the OpenJSF https://openjsf.org/cla ? I know I signed this before committing the first time to ESLint.

[targos]

Another way to add the sign off automatically that I have set up is:

• Create a file with two empty lines followed by the commit trailer
• Run git config commit.template /path/to/the/file