Christian Sass aeb8065807 docs: contribution terms, and a check that enforces them

Vitals takes contributions under MIT, inbound equal to outbound, with a
Developer Certificate of Origin instead of a CLA. That is the same shape
Nextcloud uses on the project this tool was written to watch, so nobody
contributing here is being asked for paperwork they would not sign
upstream.

tools/check-dco.sh verifies both presence and identity of the sign-off,
and fails the pull request if either is wrong. Tested against three
cases: unsigned, correctly signed, and signed by someone other than the
author.

Signed-off-by: Christian Sass <csass@binaryranch.com>

2026-10-21 13:46:29 -05:00

2.3 KiB

Raw Blame History

Contributing to Vitals

Thanks for looking. This is a small tool and the bar is simple: it must stay readable, it must stay dependency-free, and it must not lie about what it measures.

License of contributions

Vitals is MIT licensed. Contributions are accepted under MIT, inbound equal to outbound. There is no CLA to sign and no paperwork.

You keep the copyright on what you write. You are licensing it to everyone under MIT, which is the same thing everyone else already gets.

Sign your commits

Every commit needs a Signed-off-by line. That is the Developer Certificate of Origin: a one-line statement that you wrote the change, or have the right to submit it, and that you are contributing it under this project's license.

Git adds it for you:

git commit -s -m "your message"

Which produces:

Signed-off-by: Your Name <you@example.com>

A pull request whose commits lack the sign-off will fail the check. That is not distrust, it is provenance: it is what protects the project if a contribution later turns out to belong to someone's employer.

If you contribute as part of your job, confirm with your employer first. The sign-off asserts you have that permission.

What gets merged

Fixes with a reproduction. A bug report that names the machine and the measurement is worth more than a patch that guesses.
New identity resolvers for the sampler, especially for desktops that are not this one. The resolver model is documented in the README.
Documentation corrections, including corrections to this file.

What does not get merged

Dependencies. The whole point is that this runs on a bare Python with nothing installed. If a change needs a package, it needs a very good argument.
Client code, customer data, credentials, hostnames, or anything taken from a machine that is not yours. Scrub before you paste.
Claims in the UI that the sampler cannot back with a number.
Anything that requires root.

Reporting a problem

Open an issue. Include the workload row or the verdict line you saw, and the output of python3 server.py --demo if the problem is in the interface.

For anything that looks like a security problem, mail csass@binaryranch.com rather than opening a public issue.

Authorship

Contributors are credited in AUTHORS.md. Add yourself when your first change lands.

2.3 KiB Raw Blame History