12

Someone helped with progress upstream at an open source project I really rely on. He basically did what I was not capable of and now I am waiting for his pull request to be merged and included in future releases.

However, this repository requires him to sign an CLA what he never did for reasons (like not having a Google account required for this process). Now his pull request is stale, can't be merged due to the missing CLA and other users can't resubmit the contribution without either doing this work on their own (probably from scratch) or by copy-pasting his code (and probably causing legal issues).

The repository is licensed with Apache License (Version 2.0, January 2004) and the CLA is to be signed with Google (they maintain the codebase).

Now, my question is, can I resubmit his pull request if he does not sign CLA? I would keep his copyright notice in tact, so this shouldn't be of any issue regarding the APLv2. But I'm bypassing the CLA, can I do this?

12

This depends in part on what the CLA requires, but it may be possible.

Do you have the ability to reuse the submission at all?

In general, it's understood that contributions to an open source project are offered under the same license as the project at large. In particular, the text of Apache License 2.0 makes this explicit:

  1. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. [...]

and

"Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner [...]

Since this pull request fits the definition of a Contribution (a modification of the original work, intentionally submitted to the copyright holder for inclusion in the work), the terms of the Apache license section 5 have caused this pull request to be licensed by its author under Apache 2.0 as well. Therefore, you are entitled to use the content of the abandoned pull request in your own pull request, under the terms of the Apache 2.0 license. This is roughly the same as making a contribution that includes some borrowed Apache-licensed code from elsewhere (only in this case, the borrowed code is 100% of the submission), which is to say it's legally okay.

Can you sign your own CLA and submit someone else's code?

Most likely, the CLA is in place to deflect any legal complication away from the project back to the contributors. In particular, the CLA probably requires you to assert that your contribution does not infringe anyone's copyright, and that if it turns out that it does, that's your problem, not theirs. This could bite you if it turns out that the original pull request included infringing material from some other place. If you are comfortable assuming legal responsibility for the non-infringing status of this contribution, then you may submit it yourself under a CLA that you sign.

If the CLA requires that you assert genuine copyright ownership of your submission, because the maintainer needs you to agree to the possibility of relicensing -- something like, "I agree that my submission may be offered by the repo owner under different licensing terms in the future, like GPLv3, instead of its current Apache license" -- then you can't agree to that, because your right to reuse the pull request comes from the Apache 2.0 grant, not your original copyright ownership.

  • 1
    Nice answer...! – John Jun 26 '17 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.