As @chriscool pointed out in #204, many Open Source projects have begun requiring Signed-off-by in commits, for example:

• Git: https://github.com/git/git/blob/master/Documentation/SubmittingPatches
• Docker: https://github.com/docker/docker/blob/master/CONTRIBUTING.md#sign-your-work

Additionally, we can also require commits to have a License trailer in the commit message itself. This would ensure the code is licensed appropriately.

This change would make it cumbersome to contribute (as all commits would have to bear the sign-off and license trailers), but it would ensure proper OSS hygiene. The alternative is to do what other projects also do: setup a signature-collection CLA form.

There are also tools (like git interpret-trailers, https://github.com/wking/signed-off-by) that make this much easier. We can also include github hooks that fail the build if the commit isn't signed + licensed properly (e.g. https://www.clahub.com/).

At this point I'm not certain on the path forward, just opening this for discussion + decision making.