[jaytaylor]

GitHub is attempting to standardize a commit message formatting convention for this. Kind of has a certain odor to it.

Can we get cryptographically signed commit integrity into the mainstream instead?

[enzanki_ars]

There is already a convention for signed-off by. I don’t understand either why GitHub is pushing for this, though I have seen this feature before on some repositories before the post.

Edit: Now that I think about it, can see why. I have seen merges where is was good enough to merge, but needed som slight adjustments. Rebase/merge with minor changes would be a good use for this, and would allow for better crediting of both authors.

[jwilk]

It's not clear to me what the semantics of Signed-off-by is supposed to be, but at least for some projects (e.g. the Linux kernel), it doesn't imply that you are a co-author.

[WorldMaker]

That's what I've seen. Some projects, including the Linux kernel, use Signed-off-by for Developer Certificate of Origin legal processes.

https://elinux.org/Developer_Certificate_Of_Origin

It makes sense that GitHub would use something new to avoid stepping on toes, and GitHub's mirrors Signed-off-by in implementation as a git commit message trailer.

[brianmario]

The Co-authored-by trailer isn't actually new. In fact it was already being used by over ~1M commits on GitHub before we launched the feature! :)

The git-core commit message conventions docs mention it (https://git.wiki.kernel.org/index.php/CommitMessageConventio...) as do the OpenStack commit message convention docs (https://wiki.openstack.org/wiki/GitCommitMessages#Including_...).

[brianmario]

Using the Co-authored-by trailer is also really useful when pairing, where there is actually more than one author for the content.

This is especially useful when using https://teletype.atom.io :)