DCO tool does not check is the commit was actually signed

[dosmanak]

It seems to me, the tool only checks for git trailer but anybody can insert any commit message if not signed using GPG.

In current situation when someone pushes the commit without Signed-off-by trailer, the maintainer can rewrite the commit messge so it contains expected value without consent of original author.

[thompson-tomo]

Agree this would be very useful functionality.

[tykeal]

Are you asking for validation of GPG signature? If so that is not the intent of checking for Signed-off-by.

[dosmanak]

I understand the Signed-of-by marks the commit was made by a individual who agreed on contributing rules.

But without checking the GPG, you can not say who is the real author. I can put your email address and your Signed-off-by trailer into my commit and this check will be happy.