DCO: AGENTS.md promises identity enforcement that neither the hook nor CI does
I maintainer di solito rispondono entro 1 giorno
@jiwenc-nv ci sta già lavorando.
Dal 25/8/2026.
Valutazione
Questa issue non è ancora stata valutata.
Descrizione
Two things to settle: a doc claim that is currently false, and — if we want to make it true — which rule survives contact with how the repo is actually used.
The gap
AGENTS.md § Commits states:
The name and e-mail must match the committer's git identity (
git config user.name/git config user.email).A
commit-msgpre-commit hook enforces this.
Neither half is enforced:
scripts/check_dco_signoff.pymatches^Signed-off-by: \S.*<\S+>and stops. It never reads git config; the identity requirement appears only inside its own error text..github/workflows/dco.ymlchecks the trailer is present and well-formed. No identity comparison.
So Signed-off-by: Anybody <[email protected]> passes locally and in CI. That matters because a sign-off certifies that you have the right to submit the work — a trailer naming someone else certifies nothing.
Why the obvious fix is wrong
I wrote the strict version (compare against GIT_COMMITTER_IDENT, require at least one matching trailer), and it passed every case I could invent. Then I ran it against six months of real history:
| count | share | |
|---|---|---|
non-merge commits on main |
586 | |
| sign-off matches author | 155 | 26% |
| no sign-off at all | 405 | 69% |
| sign-off present, does not match | 26 | 4% |
The 405 are largely an artifact — 229 carry a (#NNN) subject, i.e. squash merges, where the message is rewritten and the trailer is dropped. What lands on main says little about what the contributor committed.
The 26 real mismatches are the problem, because they are not abuse:
author=farbod-nv <[email protected]>
signed=Farbod Motlagh <[email protected]> same address; the git name is a GitHub handle
author=rwiltz <[email protected]>
signed=Rafael Wiltz <[email protected]> GitHub noreply vs corporate address
Both are arguably more DCO-correct than the git identity is: the DCO asks for a real legal name, and git author names are routinely the GitHub handle. A strict name comparison would have blocked at least three contributors mid-workflow to close a gap nobody is exploiting. I closed #1013 for that reason.
What to decide
1. Do we want identity enforcement at all? If not, the fix is one line — stop claiming it in AGENTS.md, keep presence-only checking. That is a legitimate answer; the DCO's force comes from the act of signing, not from a machine verifying the name.
2. If yes, which rule? Candidates, roughly in order of how much they would disrupt:
| rule | catches | breaks |
|---|---|---|
| e-mail only, ignore name | wrong person entirely | noreply-vs-corporate users |
e-mail, with *[email protected] → corporate mapping |
same | nothing visible in the sample |
| warn, do not block | nothing, but surfaces it | nothing |
| full name + e-mail | everything | at least 3 current contributors |
3. Local, CI, or both? The hook is commit-msg, so --no-verify bypasses it and CI sees nothing. dco.yml is the only place a guarantee can actually hold — but that changes what CI rejects for everyone, which is why this is an issue and not a PR.
Notes
- A working strict implementation exists on
ivany-nv/dco-identity-check(d132e9a37) if a variant of it turns out to be wanted. Do not merge it as-is. - Whatever we pick,
AGENTS.mdanddco.ymlshould end up saying the same thing. Today they disagree with each other and with the hook.
cc @jiwenc — you own AGENTS.md § Commits and both DCO checks.
- Lingua principale
- Python
- Stelle
- 403
- Fork
- 94
- Merge medio
- 2g 17m
- PR unite (30g)
- 121
Preparare l'ambiente
- Nessun Dockerfile né file Docker Compose
- Ha un modello di pull request
- Leggi la guida per i contributori
Come iniziare
- Leggi tutta la issue e poi la guida ai contributi del progetto.
- Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
- Fai un fork del repository e lavora su un branch.
- Apri una pull request che faccia riferimento al numero della issue.
Altre issue di NVIDIA/IsaacCapture
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 68/100
NVIDIA/IsaacCapture#910 ·
I maintainer di solito rispondono entro 1 giorno
-
Difficoltà 1/5 Meno di un'ora Idoneità per principianti 88/100
NVIDIA/IsaacCapture#891 ·
I maintainer di solito rispondono entro 1 giorno
-
Difficoltà 4/5 3-5 giorni Idoneità per principianti 25/100
NVIDIA/IsaacCapture#1217 ·
I maintainer di solito rispondono entro 1 giorno
-
Release Notes Draft: 1.5Aperta
Difficoltà 3/5 1-2 giorni Idoneità per principianti 20/100
NVIDIA/IsaacCapture#1214 · 1 commento ·
I maintainer di solito rispondono entro 1 giorno
-
Difficoltà 3/5 1-2 giorni Idoneità per principianti 50/100
NVIDIA/IsaacCapture#1181 ·
I maintainer di solito rispondono entro 1 giorno
Tutte le issue di NVIDIA/IsaacCapture
Issue simili
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 72/100
ok-oldking/ok-wuthering-waves#1785 ·
I maintainer di solito rispondono entro 1 giorno
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 76/100
healthchecks/healthchecks#1349 ·
-
deployment release-lag
Difficoltà 1/5 Meno di un'ora Idoneità per principianti 68/100
nolte/kamerplanter#2374 ·
I maintainer di solito rispondono entro 1 giorno
-
bug v1 v2
Difficoltà 2/5 1-3 ore Idoneità per principianti 72/100
modelcontextprotocol/python-sdk#3725 ·
I maintainer di solito rispondono entro 1 giorno
-
batchterms() drops queries without a similar() clause, misaligning results with inputsForse già presa @MohammadHijjawi97 l’ha presa oggi. Aperta
Difficoltà 2/5 1-3 ore Idoneità per principianti 86/100
I maintainer di solito rispondono entro 1 giorno