DCO: AGENTS.md promises identity enforcement that neither the hook nor CI does
维护者通常 1 天内回复
@jiwenc-nv 已经在做这个了。
开始于 2026年8月25日。
评估
这个 Issue 还没有评估数据。
描述
Two things to settle: a doc claim that is currently false, and — if we want to make it true — which rule survives contact with how the repo is actually used.
The gap
AGENTS.md § Commits states:
The name and e-mail must match the committer's git identity (
git config user.name/git config user.email).A
commit-msgpre-commit hook enforces this.
Neither half is enforced:
scripts/check_dco_signoff.pymatches^Signed-off-by: \S.*<\S+>and stops. It never reads git config; the identity requirement appears only inside its own error text..github/workflows/dco.ymlchecks the trailer is present and well-formed. No identity comparison.
So Signed-off-by: Anybody <[email protected]> passes locally and in CI. That matters because a sign-off certifies that you have the right to submit the work — a trailer naming someone else certifies nothing.
Why the obvious fix is wrong
I wrote the strict version (compare against GIT_COMMITTER_IDENT, require at least one matching trailer), and it passed every case I could invent. Then I ran it against six months of real history:
| count | share | |
|---|---|---|
non-merge commits on main |
586 | |
| sign-off matches author | 155 | 26% |
| no sign-off at all | 405 | 69% |
| sign-off present, does not match | 26 | 4% |
The 405 are largely an artifact — 229 carry a (#NNN) subject, i.e. squash merges, where the message is rewritten and the trailer is dropped. What lands on main says little about what the contributor committed.
The 26 real mismatches are the problem, because they are not abuse:
author=farbod-nv <[email protected]>
signed=Farbod Motlagh <[email protected]> same address; the git name is a GitHub handle
author=rwiltz <[email protected]>
signed=Rafael Wiltz <[email protected]> GitHub noreply vs corporate address
Both are arguably more DCO-correct than the git identity is: the DCO asks for a real legal name, and git author names are routinely the GitHub handle. A strict name comparison would have blocked at least three contributors mid-workflow to close a gap nobody is exploiting. I closed #1013 for that reason.
What to decide
1. Do we want identity enforcement at all? If not, the fix is one line — stop claiming it in AGENTS.md, keep presence-only checking. That is a legitimate answer; the DCO's force comes from the act of signing, not from a machine verifying the name.
2. If yes, which rule? Candidates, roughly in order of how much they would disrupt:
| rule | catches | breaks |
|---|---|---|
| e-mail only, ignore name | wrong person entirely | noreply-vs-corporate users |
e-mail, with *[email protected] → corporate mapping |
same | nothing visible in the sample |
| warn, do not block | nothing, but surfaces it | nothing |
| full name + e-mail | everything | at least 3 current contributors |
3. Local, CI, or both? The hook is commit-msg, so --no-verify bypasses it and CI sees nothing. dco.yml is the only place a guarantee can actually hold — but that changes what CI rejects for everyone, which is why this is an issue and not a PR.
Notes
- A working strict implementation exists on
ivany-nv/dco-identity-check(d132e9a37) if a variant of it turns out to be wanted. Do not merge it as-is. - Whatever we pick,
AGENTS.mdanddco.ymlshould end up saying the same thing. Today they disagree with each other and with the hook.
cc @jiwenc — you own AGENTS.md § Commits and both DCO checks.
- 主要语言
- Python
- 星标
- 412
- 派生
- 97
- 平均合并
- 2 天 3 小时
- 30 天内合并 PR
- 141
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
NVIDIA/IsaacCapture 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 68/100
NVIDIA/IsaacCapture#910 ·
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 88/100
NVIDIA/IsaacCapture#891 ·
维护者通常 1 天内回复
-
难度 5/5 一周以上 新手友好度 35/100
NVIDIA/IsaacCapture#1319 ·
维护者通常 1 天内回复
-
Add OneRobotics A1 asset and Isaac Teleop example可能已有人在做 @WangXuechun-woan 于 5 天前认领。 未关闭
难度 5/5 一周以上 新手友好度 35/100
NVIDIA/IsaacCapture#1291 · 2 条评论 ·
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 25/100
NVIDIA/IsaacCapture#1217 ·
维护者通常 1 天内回复
查看 NVIDIA/IsaacCapture 的全部 Issue
相似的 Issue
-
难度 1/5 1 小时以内 新手友好度 72/100
slavakurilyak/awesome-ai-agents#845 ·
维护者通常 1 天内回复
-
tests: pin that the atomic writers in utils/paths.py stage the temporary file in the target's directory可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭difficulty:2 enhancement good first issue
难度 1/5 1-3 小时 新手友好度 92/100
MakazhanAlpamys/Soup#2178 ·
维护者通常 1 天内回复
-
[BUG] dcg.waggr permutation p-values are folded twice, so near-zero scores get the smallest p-values未关闭
难度 2/5 1-3 小时 新手友好度 75/100
scverse/rapids-singlecell#854 ·
维护者通常 1 天内回复
-
Slang input: int8_t4_packed and uint8_t4_packed are copied into CrossGL可能已有人在做 @ninglinLiu 今天认领。 未关闭area:frontend backend:slang bug direction:input
难度 2/5 1-3 小时 新手友好度 70/100
维护者通常 1 天内回复
-
random_elements(unique=True) on an OrderedDict: ZeroDivisionError once only zero weights remain, AssertionError with use_weighting=False可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 1-3 小时 新手友好度 85/100
维护者通常 13 天内回复