21

For example: yeoman. It's licensed under a BSD license. The CLA form (Contributor License Agreement) isn't project specific, and it can be signed electronically.

  • How and what issues can signing out this agreement prevent?
  • Does it matter how big or minor contribution I made?
  • Why some projects require signed CLA to accept patches, while others don't? (eg. node.js vs rails)

3 Answers 3

26

CLAs generally exist to do several things:

  • They keep you from revoking your code down the road. In countries that are signatory t to the Bern convention, authors exclusively retain copyright on all original works, with others allowed to copy it only with explicit permission. A CLA makes you give that permission explicitly—and frequently in perpetuity, so you can't change your mind later. This CLA contains such a clause, so no take-backs of code after you contribute.
  • They can keep you from suing them for patent infringement. Some contributors are duplicitous, and might contribute code that they know is covered by one of their patents, hoping that they then sue everyone down the road when the code is widespread. This has happened in some major standards bodies, and has also come up in open-source software. The CLA here forbids you from pulling this stunt: when you submit code to this project, you also grant them, and their users, perpetual royalty free licenses to any patents you own that cover code you yourself submit.
  • It covers their ass if someone else sues them or claims copyright. Most CLAs, including this one, make you swear that everything you're contributing is yours to contribute. This basically serves as a way for Google (or some other upstream project), who gets sued for copyright infringement, to point at you and say, Sorry, but it wasn't us, it was him.
  • It can optionally reassign copyright, giving the parent organization some teeth to sue license violators. Finally, while the CLA you linked does not do this, many open-source projects, including all run by the FSF, have a CLA that requires outright copyright assignment, which means that any code you submit will bear the copyright of the project, and not you. This has two advantages to the parent organization: they don't need to round up all contributors ever if they want to sue for an open-source violation; and they don't need to consult with contributors if they want to change the license down the road. Most CLAs that require copyright assignment also grant a perpetual royalty free license back to the contributor and their customers in a kind of reverse of the way other CLAs work. As mentioned, this CLA does not require copyright reassignment.

Most fully volunteer projects, such as Rails and Node, do not require CLAs, if for no other reason than because there's no backing entity to require or do anything meaningful with them in the first place. (FSF-backed projects are the major exception here, as previously noted.) Most commercially backed open-source projects, such as those that are official Google/Oracle/Apple products, do require some form of CLA, both because most companies have lawyers who think about those kinds of things, and because there is a single backing entity to enforce that kind of thing.

4
  • 1
    Quite a few points so instead of my own answer an addition: Some CLAs allow the primary project-owner to change the license afterwards. i.e. some projects changed from from "GPL2 or later" to "GPL2" or do dual licensing with a commercial license. In my personal experience most CLAs try to help the project owner to point away from himself in case of issues ...
    – johannes
    Oct 8, 2012 at 21:57
  • Node requires CLA. Why CLA is required to sign even when contributing minor patches? How do they know that I signed out CLA, but nobody else?
    – NARKOZ
    Oct 9, 2012 at 6:10
  • Let's say, I submitted patches for yeoman and Angular.js. How do they know that I signed CLA not for only one project, but for both of them?
    – NARKOZ
    Oct 9, 2012 at 6:12
  • "assignment, which means that any code you submit will bear the copyright of the project, and not you" - in fact some CLAs like the Oracle Contributor Agreement "give shared" copyright ... so you still own your code but they can still do commercial versions or defend the open source license in court - oracle.com/technetwork/community/oca-486395.html
    – johannes
    Jan 18, 2013 at 21:42
4

CLA's might also (in addition to other things mentioned on this page) protect the contributors from legal issues. Have a look at this excerpt from a CLA by Google:

You are not expected to provide support for Your Contributions, except to the extent You desire to provide support. You may provide support for free, for a fee, or not at all. Unless required by applicable law or agreed to in writing, You provide Your Contributions on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON- INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE.

4
  • "You are not expected to provide support for Your Contributions, except to the extent You desire to provide support" <-- isn't that already covered by the license itself? You don't need a CLA to state this?
    – user7433
    Jul 10, 2019 at 3:41
  • 1
    @RudolfOlah Maybe sometimes (I'm not sure), but not always. Example: The contributors grant the project owners a copyright license — then the project owners can change the software license to whatever they want, e.g. [removing things that protect the contributors] from the license to end users. However if there's a CLA then the contributors are still protected.
    – KajMagnus
    Jul 10, 2019 at 4:31
  • 1
    @RudolfOlah Another example: A proprietary commercial software license, might indeed promise the software users (the software company's cusotomers) that the developers really will provide support, and pay damages for bugs. — Then, if you contribute to this software (e.g. because you use it and you want to make a quick fix), you'd want a CLA that says you won't need to do those things.
    – KajMagnus
    Jul 10, 2019 at 4:38
  • Thanks for those examples, I still see CLAs as a barrier to entry to contributing to a project though; I can understand how it makes sense for larger projects though
    – user7433
    Jul 10, 2019 at 13:56
3

Benjamin's answer was pretty clear but I'd like to emphasize a single point. CLA's protect companies using or contributing to projects. Companies, particularly large ones, are terrified of being caught off guard by legal issues. I've had corporate lawyers tell people I know that even in slam dunk cases where the law is on your side, you can only be about 60% sure that you'll win the case.

Consider the situation of a company, particularly a very large one with lots of revenue, builds a product around an open source tool. They gain customers, build out infrastructure and hire employees. If all of a sudden a contributor to the original tool sues them for patent or copyright infringment, the company is in a lot of legal hot water. If they stop providing their product, they've wasted money on infrastructure and employees they don't need and more importantly, they're pissing off customers. On the other hand, if they stop providing their project, their liability ends while the case in figured out.

Considering the current legal software landscape, CLA's are the best way to make companies feel comfortable using and contributing to open source software. It's not ideal (it'd be nice to never have to deal with any of this legal stuff) but right now it's one of the few ways of making these contributions pos

1
  • It's not only about companies with lots of revenue - Free Software foundation doesn't have lots of revenue but requires a CLA in order to be able to fight license violations in court or simply relicense it
    – johannes
    Jan 18, 2013 at 21:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.