Re: [PATCH] checkpatch: Validate committer sign-off

[Krzysztof Kozlowski <krzk@kernel.org>]

On 27/07/2026 19:59, Bjorn Andersson wrote:
> On Sat, Jul 25, 2026 at 03:47:34PM -0700, Joe Perches wrote:
>> On Fri, 2026-07-24 at 18:56 +0000, Bjorn Andersson wrote:
>>> ```
>>> checkpatch validates the Signed-off-by trailers against the patch's
>>> author, but misses the opportunity to also validate the committer when
>>> run with --git. Maintainers therefor need third-party scripts for the
>>> final Signed-off-by check.
>>
>> I don't actually see that need as an issue for checkpatch.
>>
>> checkpatch is for patches, not things that are already committed.
>>
> 
> Fair, this is only applicable for people managing/receiving/collecting
> patches - be it maintainers or people gathering patches and then resend
> them...
> 
> I didn't dig deeper, but my LLM found 32 cases in the last 90 days where
> linux-next maintainers points out missing committer sobs, so it seems
> like making this check more conveniently accessible would help more than
> me.
> 
>> If something like this is added, it should _only_ be used when
>> --git is on the command line.
> 
> The 3rd hunk (that extracts commiter, sha1 and subject) only runs "if
> $(git)", and hence $committer (from $git_committers{$filename}) will be
> '', as such signoff_match_status($1, $committer) will not be evaluated,
> and the check will be skipped.

The issue Bjorn is trying to solve is real and as he pointed out - every
second day maintainers fail to commit properly (srsly... still!). Some
of us implemented git commit hooks [1][2], but many still don't care
enough, even though installing such commit hook is basically 30 seconds.

Four reports from Mark yesterday:
https://lore.kernel.org/linux-next/?q=signed

Therefore adding verify_signedoff features to checkpatch.pl might be
useful - maybe some maintainer workflows will improve. Or maybe having
it in tree will help them. I don't have any other idea how to encourage
other people to solve it long term - my talk in 2023 did not fix it,
Steven's and Mark's emails fix only commits but not the root cause, me
mentioning the git hook convinces one maintainer per 6 months to adopt it.

Maybe checkpatch would help people to get it right...

[1] slides from https://lpc.events/event/17/contributions/1498/
[2] verify_signedoff which I recently moved to soc-tools repo:
https://web.git.kernel.org/pub/scm/linux/kernel/git/soc/soc-tools.git/tree/verify_signedoff.sh


Best regards,
Krzysztof