The advantages and disadvantages of CLAs

[Andrew]

I wanted to have a discussion on the benefits and drawbacks of a project using contributor license agreements. For anyone not in the know a CLA reassigns the copyright of the contributor to whoever is stated in the agreement.

A lot of big projects use them including the free software foundation so I wanted to discuss them and what people think.

The advantages that I can think of

• Easier to go after gpl violations in court if you own 100% of the copyright
• Gives the community more control over the code with the possibility to switch to a different open source license.

The only disadvantage I can think of is that it might put off a few contributors.

What's everyone else's take on this? Also if you have any links on the subject please share them.

[qubodup]

Also if you have any links on the subject please share them.

From the GPL FAQ: Why does the FSF require that contributors to FSF-copyrighted programs assign copyright to the FSF? If I hold copyright on a GPL'ed program, should I do this, too? If so, how?

[Sindwiller]

The only disadvantage I can think of is that it might put off a few contributors.

Actually, the fear issued by some contributors of suddenly seeing their contributions put into something they don't want or even used to gain money (unlikely though) is somewhat justified - however solely in the case of "possessive" CLA's. It is just a matter of time until someone knows how to exploit that.

I surely haven't dived into the matter, yet I still agree that a CLA is pretty much the way to go in a bigger project, especially if it's a potential target of GPL violation or a long-term project whose basic development model and licensing is volatile.

That said, does anybody know whether CLA's usually lawfully assure that the contributions will stay under a particular scope of FOSS licenses?

[andrewj]

There is another disadvantage: it is a major PITA for a contributor to have to fill out and sign the paperwork for the copyright re-assignment.

Plus it means giving up their anonymity, some people would balk at that.

So imho a sure way to kill a fledging FOSS game project would be to require copyright re-assignment from all contributors.

[Sindwiller]

So imho a sure way to kill a fledging FOSS game project would be to require copyright re-assignment from all contributors.

Hence why it should be done in the very beginning? Otherwise, you can still replace contributions of people who refuse to sign the CLA with CLA-friendly contributions, i.e. in the hypothetical case of a game project. Projects with code only are doomed for that matter.

[Andrew]

Plus it means giving up their anonymity, some people would balk at that.

So imho a sure way to kill a fledging FOSS game project would be to require copyright re-assignment from all contributors.

Why would you EVER let anonymous contributions into your project?!

• No idea who owns the code
• If it's malicous you have no idea who did it
• Someone could put patented code into you project then sue you.

If a contributor is too ashamed to put their name to their code then it simply doesn't belong in the repo in the first place.

There is another disadvantage: it is a major PITA for a contributor to have to fill out and sign the paperwork for the copyright re-assignment.

I don't think so if someone invests time in your codebase then taking 5 minutes to send a form isn't going to stop them.

[amuzen]

Why would you EVER let anonymous contributions into your project?!

• No idea who owns the code
• If it's malicous you have no idea who did it
• Someone could put patented code into you project then sue you.

I don't think it makes a big difference whether the contributor has a credible looking name or not because it could still be a fake name, and probably is in the case of a malicious contribution. Being able to hold Donald Duck or one of his more obscure friends accountable for any damage caused isn't terribly useful in my opinion. Since, as far as I know, copyright also applies normally to works by pseudonymous authors, I don't see how the name of the author is as necessary or useful as you imply.

There is another disadvantage: it is a major PITA for a contributor to have to fill out and sign the paperwork for the copyright re-assignment.

This depends on how you implement it. If you require a piece of paper to be snail mailed to you, well, that's madness. Just having to paste the CLA text to the email containing the patch would be relatively painless, however.

This article might be relevant to the discussion: http://www.oss-watch.ac.uk/resources/cla.xml

[Sindwiller]

...and probably is in the case of a malicious contribution.

And that's when we step into the morbidly stupid world of conspiracy theories - most projects are managed with a benevolent dictator in mind, i.e., contributions signed by "Scroodge McDuck" with potentially malicious content will be filtered out. Obviously, CLA's aren't made in case that some contributor might have caused damage with his contribution. That's also very unlikely anyway. It has never occured as far as I know - not even in the Linux kernel project, if we want to believe Linus.

I don't see how the name of the author is as necessary or useful as you imply.

So anybody with the internet nick "coolguy", for example, may claim copyright on some contribution some other guy named "coolguy", too, actually submitted? That's rubbish.

[amuzen]

So anybody with the internet nick "coolguy", for example, may claim copyright on some contribution some other guy named "coolguy", too, actually submitted? That's rubbish.

No, actually even the original author might be unable to do it. However, what I'm trying to say is that it doesn't really matter who owns the contribution as long as the author went through the necessary steps to give you the permission to use it. If the contributor agrees with your CLA that gives you an irrevocable permission to use the work, or releases the work under an irrevocable license like the GPL, the ownership of the work becomes irrelevant because of the said irrevocable rights granted to you.

As for malice, true, that is extremely rare. I have only ever heard of one malicious patch submitted to the Linux kernel, for example, and even that was caught by a simple patch review. I don't remember if the patch was submitted by someone with a credible looking name, but I don't think it matters much in the end. Reviewing is easier and more reliable than doing background checks, and most likely you wouldn't be able to do anything even if you knew the identity of the contributor.

I don't personally mind submitting patches under my own name, but if I had used a contribution policy that requires people to reveal their names when they contribute to my projects, I'd have rejected most of the contributions I have received. Those were mainly artwork, but I don't think contributing code is different enough to justify a different policy. If the code and the license are good, it's good enough for me.

In any case, I don't think rejecting anonymous and pseudonymous contributions would cause especially serious damage to a project. I don't think accepting them is preposterous enough to warrant caps and extra punctuation either, however. Both are legally and strategically sound policies as far as I know. IANAL, though.

[sfb]

I have to admit that I only skimmed the replies to this topic but most of them seemed around contributions in general (malicious contributions popped out.) I have to say that the CLAs are rarely about binding contributors for damages or non-senese like this. Most projects who want you to sign a CLA are interested in ownership of that code for one reason or another.

As far as open source software is concerned a lot of community developers don't understand the need for a CLA. I own the copyright but it's still under GPL so everyone has it. What's the big deal? The big deal comes down when someone violates the license of a project using your code. Litigating a GPL violation when no single entity owns the code is a challenge to say the least. One project I've had the privilege of working with has a variant of Sun's contributor agreement but that wasn't enough since portions of their code were still owned by other entities so despite being GPL they couldn't seek damages or any other legal recourse unless all involved parties were, well, involved.

One of the founders of this project, OpenNMS (I know, not game related) has spoken at length in speeches and on his blog. Recently he rehashed the topic in response to an article by Michael Meeks. I suggest taking a look at what Tarus has to say about contributor agreements and ownership of a projects code. His comments and reasoning are thorough and reasonable.

sfb
/s

[qubodup]

http://code.google.com/p/hummstrumm/wiki/Contributors does use a license that allows "the authors of Humm and Strumm (as listed in the AUTHORS file of the current Subversion revision or online at the Authors page on the Official Wiki)" to re-license at will. This is definitely more attractive than *giving up* rights.

[Julius]

I doubt it will have legal standing though, but IANAL.

[qubodup]

I got a link to this video about making money with foss ("SCALE 8x Keynote")
At 22 minutes, the speaker mentions that the alternative to transferring copyright is using dual-licensing. He claims Sun did that.