29

Say I'm maintaining a GPLv3 project on GitHub with a LICENSE file, code headers and all. Now, a few folks made some code enhancements and sent me a pull-request. Does that automatically mean that they agree to contribute under GPLv3 terms, or, do I have to do make some kind of separate agreement with each contributor? The latter is not only cumbersome, but practically impossible as projects become large. What is the usual practice in this regard for projects like WordPress, Drupal, Debian, Linux kernel, etc.? Do they all make formal agreements with the devs?

I had a look at this recently posted question which explored this same area, but didn't answer this exact question I have.

Most importantly, if today I accept someone's pull-request, can they come back five years down the line saying, "Hey, I didn't intend this to be GPLed all those years ago, so I want to assert my rights now."?

6
  • 2
    Great question! The Apache license has a clause saying contributions have to be under apache as well, but not so sure about the GPL. I would assume that since the pull request would have the original license file, the fork would be under that license too. Regardless, there contributions would have to be under the GPL as well, as it could be viewed that it was distributed publicly on GitHub. Mind you, most large projects will have things known as contributor agreements, that need to be signed for this kind of issue. Either they license, or assign copyright to the original devs.
    – Zizouz212
    Mar 6, 2016 at 21:46
  • 2
    I just found that Gihub has recently started a default CLA (Contributor License Agreement) for each PR that is submitted. This includes a patent grant and a irrevocable copyright license to reproduce to both project maintainers and Github! Here is relevant discussion link. But you are right, Apache's way is even better as it sets the CLA terms explicitly in the main license itself. I hope there is something similar for GPL too. Mar 6, 2016 at 22:00
  • As per this comment, A GNU contributor is required to sign an actual dead-tree paper and send it by snail mail. In light of that, the GitHub CLA process is quite smooth.. I hope that is an exaggeration! Mar 6, 2016 at 22:06
  • @PrahladYeri, that is for people who want to contribute to the FSF owned projects, where the FSF wants to retain all copyrights. To ask for the copyright is quite different than what OP is asking about.
    – vonbrand
    Mar 7, 2016 at 1:42
  • @vonbrand, Indeed. Similarly, it also seems that the Github CLA I mentioned in the earlier comment applies to Github's own enterprise projects, not just all projects on Github. But someone needs to confirm that. Mar 8, 2016 at 15:41

3 Answers 3

11

Some GPL projects require explicit copyright assignment, not merely licensing, of contributions. Copyright assignment is a bigger deal that licensing, and perhaps can't be arranged by an Apache style 'if you contribute it you are X'ing it' clause, where Apache fills in 'license' for X and a hypothetical alternative fills in 'assign'.

According to the Why Assign page at gnu.org, the reason is that it permits the project owner/master/community to actually take legal action against violations of the license. Only the copyright holder can do that.

Keep in mind that when someone makes a derived work (a patch), they are required under the GPL to license it under ... the GPL. So as far as straight licensing is concerned, you're fine.

3
  • I don't think it requires copyright assignment - but you're argument for cases of infringement are probably universal for all licenses.
    – Zizouz212
    Mar 7, 2016 at 1:19
  • This is the FSF, who wants to retain all copyright on the GNU project pieces. Many GPL projects don't do this (e.g. the Linux kernel doesn't). Others (e.g Ubuntu) ask to assign rights or a wide license to the project's owner under the name of Contributor License Agreement CLA. This is something completely separate from contributions as such.
    – vonbrand
    Mar 7, 2016 at 1:57
  • 1
    I find your first paragraph misleading. The Apache style does not 'assign' - you seem to imply that by contributing work to an Apache licensed project, that the copyright is then transferred to the maintainer/owner/project. That clause simply states that any contributions to the project shall be licensed under the same license.
    – Zizouz212
    Mar 8, 2016 at 23:29
13

Update, based on new Terms of Service:

If a GitHub repository specifies a license, that's the default license for contributions.

Here's Section D.6 from GitHub's current Terms of Service:

6. Contributions Under Repository License

Whenever you make a contribution to a repository containing notice of a license, you license your contribution under the same terms, and you agree that you have the right to license your contribution under those terms. If you have a separate agreement to license your contributions under different terms, such as a contributor license agreement, that agreement will supersede.

Isn't this just how it works already? Yep. This is widely accepted as the norm in the open-source community; it's commonly referred to by the shorthand "inbound=outbound". We're just making it explicit.

This rule has been in effect since GitHub revised its Terms of Service on February 28, 2017.

6

In case of doubt, you should state clearly that you only accept contributions under GPLv3 (or whatever license you select), and that the constributor must make sure they are allowed to contribute under the given terms. If it is redundant, it does no harm; if required, you need it to avoid getting into hot water. For a detailed example see e.g. the Linux document Documentation/SubmittingPatches. Probably any large software project has something similar.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.