If your open-source project requires a sign-off or DCO or CLA, **put that in your CONTRIBUTING document and explain it**.

Repeatedly I've created a PR for a large open-source project, read the docs for how to make a PR for them in the way they want, and then had CI tell me I need to sign something first.

In one case that was a Google backed CLA I wasn't comfortable signing (I was under the impression the project had no connection to Google), and I had to close the PR.

The more recent one was simply the Developer Certificate of Origin. CI very helpfully displayed a detailed set of instructions describing how to sign-off my commit correctly and which commits were missing the sign-off, and explained absolutely nothing about what the DCO was or why sign-off might be needed.

If you're asking people to do these things, the *least* you can do is to be upfront about it and make it easy for new contributors to understand.