docs(contributing): accept a known identity in the sign-off

[MiMoHo]

The "Sign your work" section asks for a real name: "Use your real name (sorry, no pseudonyms or anonymous contributions)." This PR changes that to a known identity, the way the Linux kernel and Git handle it today. Anonymous contributions are still not accepted, but a pseudonym used consistently, such as the GitHub username, is fine, and so is the GitHub no-reply address.

Whoever fixes a bug in Nextcloud is likely to run Nextcloud. With a real name in a public commit, finding that person, and their server if it runs under a personal domain, takes a few searches. Nextcloud's own security scan then rates any public server against the list of known vulnerabilities. It is meant to help admins, but it answers the same question for anyone else. The record can't be taken back either: with the sign-off, contributors agree that "a record of the contribution (including all personal information I submit with it, including my sign-off) is maintained indefinitely" (DCO, point d). Asking only for what the sign-off needs is also what data minimisation in Art. 5(1)(c) GDPR expects.

What the sign-off needs is a person you can get back to. When Linus Torvalds changed the kernel wording in 2023, he wrote that the sign-off "needed to be something we could check back with" and that "we've always accepted nicknames" (commit, acked by Greg Kroah-Hartman and Michael Dolan of the Linux Foundation). Git followed in 2025: "The goal of this policy is to allow us to have sufficient information to contact you if questions arise about your contribution" (SubmittingPatches). A GitHub account gives exactly that.

Some objections I expect:

• "A real name makes the sign-off legally stronger." The DCO text doesn't ask for one. It certifies where the code comes from. Nobody checks whether a name is real, so the rule only binds honest contributors. If a dispute ever needs the person behind an account, GitHub discloses account data on a valid subpoena or court order (GitHub guidelines).
• "Pseudonyms let attackers in, look at xz." The xz backdoor shipped in release tarballs that a contributor named "Jia Tan" created and signed. A real-name rule would not have stopped that, because a made-up name looks like any other. What protects the project is review, and this PR doesn't change that.
• "We need to reach contributors, for example for relicensing." A GitHub account can always be reached with a mention. An email address in an old commit is no guarantee of reaching someone either.

Ten repositories still carry their own copy of this sentence: server, spreed, deck, talk-android, all-in-one, appstore, cms_pico, context_chat, context_chat_backend and profiler. This file was added in 2021 as a global CONTRIBUTING.md for all repositories of the organisation, but GitHub only shows it where a repository has no file of its own (docs). In context_chat and context_chat_backend the file is a copy of this one, only the copyright year differs, so removing it there would be enough. The other repositories could link to this section instead of repeating it. Then a change here reaches all of them without a separate PR for each.

@AndyScherzinger, you added the AI policy check to notes and brought it up to date in server. Would it make sense to handle these copies the same way?

🤖 AI (if applicable)

• The content of this PR was assisted using AI

Assisted-by: Claude Opus 5.5 (xhigh)

The model helped me collect the sources and draft the change. I reviewed and edited everything. The commit carries the same line as a trailer.

[AndyScherzinger]

I checked back with @schiessle and this is actually not okay (and something we will be having to add a check for). The point is it needs to be reachable. So a no-reply address does disqualify.

It is clear that in practice we can't be fully enforce or check this, else we would need to check the email to be active/reply-able and it could also be that an address gets abandoned after years.

So:

is fine, and so is your [GitHub no-reply address][noreply].

Is the opposite of what the DCO demands (!)

[MiMoHo]

Thanks for checking with @schiessle. I read the DCO differently, though: its points (a) to (d) mention neither a name nor an address, only the example sign-off line has one. What it needs is a person you can get back to, or as the CNCF puts it, "sufficient enough to contact you". The ID-based no-reply address belongs to exactly one GitHub account, even after a username change, and that account can be reached with an @mention, which GitHub delivers to the inbox, the mobile app or by email.

It is also common practice here. In nextcloud/server, 678 of the 5,294 non-merge commits from the last twelve months are signed off with a no-reply address: 435 from the Nextcloud Command Bot, 243 from 36 accounts, several of them Nextcloud members. .github, server, notes and spreed require sign-off on web commits, and with email privacy enabled GitHub uses the no-reply address for those. A check would block all of them.

As you say, nobody can tell whether an address works short- or long-term. A rule that asks for one mostly stops the people who keep theirs private.