I understand that there are benefits to CLA for some licenses (as well as drawbacks and tradeoffs), however the Apache 2.0 License already has section 5 stating the following:
- Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.
Assuming pull requests are accepted through public channels, what benefit does a CLA actually provide beyond what is provided for in this license clause? More to the point, what sort of legal issues or court cases could arise?
Many CLAs require a lot of personal information that is a burden on the contributor and the licensor (contributor may want to stay anonymous and licensor may not want to deal with PII storage requirements).
It seems like the project could be made up of unidentifiable users contributing code directly to the project and that the license would cover this. Why would the provenance of code ever need to be called into question or a CLA explicitly signed?
Why would the contributor or their estate ever be allowed to back down from clause five and if they did why would having previous record of their real identity be necessary? The contributor would need to appear in court as a real entity to bring their case. If they can't prove in court that they are the anonymous contributor, then they do not have a case to begin with and if they can prove that link then it should be reasonable for the licensor to prove that any contributor was or should have been aware of the contribution guidelines which already act as a passive CLA.
Furthermore, can an Apache 2.0 licensed project without CLAs change it's license in the future? It seems like clause five combined with the sub-licensing allowances in the license would make this legally allowable.
I understand that from a lawyer's perspective, the more legal body armor the better, but I can't think of an actual example in which the CLA as well as contributor PII collection would somehow end up being necessary in court (once again given Apache 2.0 clause five as well as public channels for pull request review). Do courts ever ask someone to provide a record of all copyright holding contributors?