#[Git] Signed-off-by?

32 messages · Page 1 of 1 (latest)

lilac hollow
#

Hello! I've come across the Signed-off-by line in Git commit messages and would like to better understand its purpose and how it fits into a typical dev workflow?

For example:

feat: add user auth

Signed-off-by: John Doe <[email protected]>

I understand that Git allows us to add this line using the -s flag:

git commit -s -m "feat: add user auth"
  • What does Signed-off-by actually mean? Does it simply identify the person who made the commit or what?
  • How is it different from a regular Git commit author/committer identity?
  • When should developers use it?
  • Does adding -s provide any actual verification?
    I'd appreciate some practical explanations and examples of how projects use it in real-world workflows

Thanks!

oak valleyBOT
#

<@&987246964494204979> please have a look, thanks.

proper mountain
lilac hollow
#

i don't follow

proper mountain
#

war at work happen.

lilac hollow
proper mountain
#

well some dev would introduce a leak in your name

#

or open a door

lilac hollow
#

where ? how ,

#

can u tell me a scenario

proper mountain
#

Imagine a bad actor, they copy your name + email
they commit shit code that introduce a door in the app security
that shit code is in reality made in such a perfect way that if you input a combination of input, the security is non existant.
the commit pass,
4 month later people realize that the database got stolen
they analyze where it come from, as everything is logged,
they find from where it come in the code,
who committed this?
the name and email on the commit

lilac hollow
#

u mean a collaborator can use my name for their own commits ?

proper mountain
#

yes

#

it is just a config

lilac hollow
#

and how to protect ?

proper mountain
#

signing is what make it your

#

only if you keep the signing key private

#

and never forget it

#

or lost it

lilac hollow
#

bruh this is cool

#

so in job like mine, i should be aware of this right ?

proper mountain
#

It just give me despair

lilac hollow
#

why ?

proper mountain
#

to think it is needed

#

xD

lilac hollow
#

ah

#

but it's good no ?

proper mountain
#

yes, very good

#

weird how some place never ask it of their dev

#

it make you think

lilac hollow