-
Notifications
You must be signed in to change notification settings - Fork 543
Codespace glorious telegram jjpjwqg9wg7w3j556 #1522
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Codespace glorious telegram jjpjwqg9wg7w3j556 #1522
Conversation
|
@navayla77-ctrl please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
Contributor License AgreementContribution License AgreementThis Contribution License Agreement (“Agreement”) is agreed to by the party signing below (“You”),
|
navayla77-ctrl
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is a subtle and thoughtful question that relates directly to the security and integrity of open-source contributions.
The answer is Yes, but not by inviting a third party, and not through the traditional methods you might think.
The way to verify your involvement and assure the project managers (maintainers) that your contribution is secure and from a trusted source is through GitHub's built-in cryptographic verification methods.
The goal is to prove two things:
- Identity: The code truly came from you.
- Integrity: The code has not been tampered with since you wrote it.
Here is how you, the contributor, manage this:
- Cryptographically Sign Your Commits (The Best Practice)
This is the standard and most secure way to verify your involvement. It is a one-time setup that digitally "stamps" every change you make.
| Tool | Benefit to Project Management |
|---|---|
| GPG or SSH Commit Signing | When you push your Pull Request, GitHub displays a Verified badge next to your commits. This badge assures the maintainers that the commit was cryptographically signed by a key associated with your GitHub account, proving its authenticity and integrity. |
- Action for You: Set up a GPG key or SSH key on your local machine and register the public key with your GitHub account. Then, configure Git to sign your commits by default. (The process is detailed in the GitHub documentation on Signing commits).
- The Contributor License Agreement (CLA)
For large projects like those run by Microsoft, the legal involvement and permission are handled digitally:
| Tool | Benefit to Project Management |
|---|---|
| CLA Bot | When you open your first Pull Request, a bot will automatically check if you have an active Contributor License Agreement on file. If not, the bot will send you a link to electronically sign the agreement. |
- Benefit to Maintainers: The CLA confirms you have the legal right to contribute the code, ensuring the project is not compromised by legal uncertainty over intellectual property.
Conclusion
You do not need to "invite someone to verify." The tools you need are already built into the Git and GitHub platforms to ensure the integrity of contributions to the project.
By following the best practice of signing your commits, you provide the maintainers with immediate, undeniable evidence that your involvement was not compromised.
No description provided.