Lemonfiber
← The specification

Sign-off & inbound licensing

Rendered from spec at76d46f3 (2026-10-25) · its source · Edit this page

Status: Accepted

Every contribution is signed off, and every contribution is made under the repo’s own licence. This page states both, because a public project under a non-OSI licence needs its inbound terms to be unambiguous.

Inbound = outbound

Contributions are licensed under the same licence as the repo they land in — Hippocratic 3.0 for code, CC BY-SA 4.0 for docs, the split for brand. By opening a PR you agree your contribution is provided under that licence.

There is no CLA (no copyright assignment). You keep your copyright; you licence the contribution inbound on the same terms the project ships outbound. This is the lightest arrangement that keeps the licensing coherent, and the one most OSS projects use.

Because the licence is ethical-source rather than OSI-approved, this is stated explicitly rather than assumed: a contributor should know, before contributing, that their work ships under Hippocratic 3.0.

The Developer Certificate of Origin

Every commit carries a DCO sign-off — a Signed-off-by line asserting you have the right to submit the work under the project’s licence:

Signed-off-by: Wessel Verheij <[email protected]>

Added automatically with git commit -s. It is the Developer Certificate of Origin 1.1 — a lightweight, well-understood assertion, not a contract you sign.

Why DCO and not a CLA

A CLA asks contributors to assign or broadly licence rights, needs storage and tracking, and deters casual contributors. The DCO asserts the one thing that matters — “I wrote this, or have the right to submit it, under this licence” — with a single trailer and no paperwork. For a project this size it is the right weight.

Enforcement

A dco check runs on every PR (project-workflow) and fails if any commit lacks a valid Signed-off-by matching its author. Like spec-check, it closes the gap between a documented rule and an enforced one.

A squash merge writes the pull request’s body, not the branch’s commits, to main, so the body carries each author’s sign-off too. squash-message holds it to that (GOV-R62). GitHub appends the merger’s own sign-off to the squash, as the organisation requires a sign-off on every commit made through the web.

The sign-off is separate from the cryptographic signature: signing (required on main) proves who authored the commit; the DCO asserts they had the right to contribute it. A commit needs both.

Interaction with the canonical-spec rule

Sign-off is orthogonal to citation. A PR must both cite a spec identifier (GOV-R2) and be signed off. Neither substitutes for the other.

Requirements

ID Requirement
GOV-R28 Contributions MUST be licensed inbound under the same licence as the repo they land in; there MUST be no CLA or copyright assignment.
GOV-R29 Every human commit MUST carry a valid DCO Signed-off-by line matching its author. Merge commits and bot-authored commits are exempt — GitHub authors them, so there is no human to attest. A pull request’s body MUST carry the sign-off of each human author of its commits, because a squash merge writes the body as the commit message on the default branch.
GOV-R30 A dco check MUST run on every PR and MUST fail when any non-exempt commit lacks a valid sign-off.
GOV-R31 The inbound licensing terms MUST be stated explicitly, given the licence is not OSI-approved.