A CLA as a GPL extension may be possible, but provides no particular advantages. This answer will only discuss GPLv3, as it includes an explicit mechanism for additional terms.
GPLv3 additional permissions
[…] are terms that supplement the terms of this License by making exceptions from one or more of its conditions. […]
When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy[… .] You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission.
[…] you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms: [of which none apply here]
All other non-permissive additional terms are considered “further restrictions” within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. […]
Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way.
Your suggested “exception” is de facto a completely separate permissive but non-free license. As you have written it it does not seem to introduce non-permissive terms. Users can strip these permissions away so GPL-compatibility is maintained.
Such an extension therefore seems to be valid, as far as the GPL is concerned.
Compatibility considerations
But license compatibility is not a symmetric relation. Let “→” (“can be used in” or “is compatible with”) be the license-compatibility relation. Then (GPLv3 + your permissions) → GPLv3 is maintained. However, GPLv3 → (GPLv3 + your permissions) is not possible. Consider for example a different GPLv3 exception: the LGPLv3. You similarly cannot use GPLv3 code in LGPLv3 code. A resulting combination must be licensed under GPLv3 without these additional permissions. Therefore:
- it would be inaccurate to describe your project as GPLv3-licensed. More precisely, it would be under a GPLv3-compatible license.
- you will be unable to benefit from the GPLv3 library ecosystem as your license is incompatible in that direction.
What would be the differences to a CLA?
None. You have just chosen an unusual legal mechanism. And just because GitHub has codified “inbound = outbound” and you have phrased the inbound license as part of the outbound license does not mean that this CLA mechanism is legally valid – neither the GPL nor the GH ToS are above the law.
You seem to think a CLA-as-GPL-extension would be opt-out rather than opt-in with these advantages:
- It reduces effort for first time contributors
- It may allow the original project to benefit from downstream bugfixes that could not otherwise be applied (i.e. if the downstream project authors haven't signed the upstream CLA)
Nope:
First of all, the GPL extension mechanism does not open new possibilities you wouldn't otherwise have with respect to CLAs. Given any other license you could also note in the license document that any contributions are understood to implicitly accept a CLA.
More importantly, a CLA is useless if not affirmed explicitly (see below)
Downstream projects are free to strip your extra permissions away, in which case you cannot include their contributions (see license compatibility discussion above). By using the GPL extra permissions mechanism, you no longer sit at the top of a licensing “food chain” like the standard GPLv3 does. (Well, technically the AGPLv3 sits highest.)
Why CLAs should be explicitly signed.
The signature of a CLA is a feature, not a bug.
You as the recipient of extra rights want to be able to demonstrate your due diligence in obtaining these rights. Anyone can say “well yeah they implicitly accepted my CLA”. But can you prove this in a court if accused of copyright infringement? Even if any infringement was accidental, reworking your software to eliminate the infringement can be costly.
These are risks, and a CLA helps minimize these risks:
By asking users to confirm that they hold the copyright for their contributions (and not e.g. their employers) you reduce the risk of accidental infringement. Here the important part is that contributors are actively alerted to the importance of this step. Hiding these requirements in a license document that looks like the GPL (but isn't!) doesn't help.
By obtaining a signature and contact information, you are creating a paper trail that you can use to prove non-infringement.
So far, a Developer Certificate of Origin could also provide these benefits, to some degree. A CLA goes further by additionally signing over some rights.
And this part is extremely tricky, because it depends on the copyright laws of the applicable jurisdictions. CLAs for international projects need professional legal advice. Thanks to the internet, every open source project is effectively international.
As an example of what could go wrong, consider what happens if I (living in Germany) were to contribute to your project, and you assumed that I implicitly accepted your special license:
As a special exception to the GPL, Joe/Jane Bloggs (the original
author of Program X) is granted permanent and irrevocable
permission to use this code for any purpose, and to modify,
distribute and sublicense it under any terms of his/her choosing.
In that license you have not exhaustively enumerated the ways in which ways you might use my contributions. This case is discussed in German copyright law in §31a UrhG (translated):
(1) A contract through which the author grants or obliges to grant rights for unknown usage categories, requires written form. The written form is not required if the author grants a nonexclusive license free of charge to the public. The author can revoke the grant of rights or the obligation thereto. The right of revocation ends three months after the other has sent them a notification of intended usage to their last known address. […]
(4) The rights in sections 1 through 3 can not be waived in advance.
So amusingly a public license like the GPL has much more legal flexibility than a non-public license, such as your CLA that only grants rights for a specific recipient. Under German law you would have to notify contributors if you want to use their contributions in an unanticipated way, and they may decline you that right (although they are required to exercise this right in good faith, under certain circumstances). This would e.g. require you to maintain contact information of all (German) contributors, which can also lead to extra requirements under the GDPR.
The term “Schriftform” (“written form”) is a specific legal term that is defined in §126 BGB (translated):
(1) If the law prescribes the written form, the document must be signed below by the signatory's own hand […]. (3) The written form can be substituted by the electronic form, if the law doesn't say otherwise.
… where the electronic form consists of a name plus a qualified electronic signature.
Similar requirements would exist if you want to obtain exclusive rights from the contributors.
The consequence of all of this is that contributions from a German contributor under a kind of CLA or pseudo-CLA would be effectively toxic for your project unless
- your CLA was carefully crafted to avoid these problems, and
- you have collected any required contact information and signatures.
An implicit CLA is unlikely to be sufficient, but in fact makes it likely that you would accidentally perform copyright infringement.
Other jurisdictions will likely also have copyright laws that are non-trivial to navigate.
Conclusion
Licensing is difficult, even more so in an international context. Your idea to use the GPLv3 exception mechanism for a CLA might be fine regarding the GPL, but does not give you any benefits of an explicitly signed CLA. In particular this doesn't give you a paper trail to demonstrate that you hold the necessary licenses, and may be unsuitable to grant you additional rights.
