Almost all paid programmers in North America (and probably the whole world?) have signed an agreement with their employer which assigns all inventions, copyright, patents, and intellectual property they create to that employer, whether such creations happen on the clock or not (see this article by Stack Exchange co-founder Joel Spolsky: https://www.joelonsoftware.com/2016/12/09/developers-side-projects/).

Given that premise, it would stand to reason that all contributions from paid programmers who have signed such an agreement, and who don't have a specific signed release/permission to contribute to the open source project in question, are illegally contributed and cannot validly carry a Free or Open Source license.

Which gets to the title of this question: Do Open Source/Free Software projects require submitters to submit proof of authorization to contribute? If not, it seems certain that the legal status of their openness is on very questionable legal grounds.

  • "Almost all paid programmers in North America (and probably the whole world?) have signed" - among the work contracts I was offered during my latest application phase in Germany, only a minority included a clause that the employer might lay claim to something created during the employee's spare time if it happens to be interesting. (It was a reason for me to decline the respective offers.) So, no, I wouldn't say that "almost all paid programmers" have signed such a thing everywhere. – O. R. Mapper Nov 28 '17 at 16:06
  • I’m in the US and work none of the company’s I’ve worked for included any such clause in the employment documentation. If some one did try this, it’s likely I would turn down the offer. Always ask to see all documents you’ll be asked to sign before accepting the position. – RubberDuck Dec 1 '17 at 19:52

Virtually all major open source projects require contributors to agree to a contributor licensing agreement that includes language asserting that their contributions are able to be legally contributed to the project.

For example, Apache's Individual Contributor License Agreement says

  1. You represent that you are legally entitled to grant the above license. If your employer(s) has rights to intellectual property that you create that includes your Contributions, you represent that you have received permission to make Contributions on behalf of that employer, that your employer has waived such rights for your Contributions to the Foundation, or that your employer has executed a separate Corporate CLA with the Foundation.
  2. You represent that each of Your Contributions is Your original creation (see section 7 for submissions on behalf of others). You represent that Your Contribution submissions include complete details of any third-party license or other restriction (including, but not limited to, related patents and trademarks) of which you are personally aware and which are associated with any part of Your Contributions.

Google's Individual Contributor CLA has virtually identical language (only the corporate names are changed). Other major open source entities probably have very similar terms.

This is a defense mechanism for the project: if someone sues the project for copyright infringement, they can easily deflect legal responsibility to the specific responsible contributor(s). Of course, despite this protection from legal liability, any infringing parts will still need to be removed or rewritten, or a compatible license must be acquired from the actual copyright holder.

As for "proof", though, proving the negative that a creative work does not infringe any copyright is an intractable problem. Not only does it require comparisons against the entire set of all copyrighted works (many of which are not publicly available), but the one-to-one comparison to decide that one work is a derivative of another is itself intractable. This problem is not unique to open source; it is a general problem with copyright law. Any time anyone offers you a creative work, for free or at cost, under FLOSS or non-FLOSS terms, you have no way to reliably determine that the distribution of that work does not infringe copyright.

However, in some jurisdictions (at least the United States) there is a legal notion of innocent infringement which may reduce or (rarely) eliminate liability for an infringer who had no reasonable expectation that they were committing infringement: for example, by distributing a contribution in an open source project from a contributor who had formally asserted that their work was not infringing.

If by "proof" you mean something like, "Contributor prompts their employer to assert that the contributor has permission to make contributions," I don't expect this to produce substantially better results than making the contributor sign and submit a legal document that asserts the same, and that plan would require a great deal of extra effort. It would be trivial for a bad or lazy contributor to say they have no employer, so this plan does not afford perfect protection, and the level effort involved (requiring both a cooperating contributor and a cooperating employer, even when no broad IP agreement even exists between employer and employee) would scare off even more potential contributors than requiring a signed CLA already does. Furthermore, it would allow an employer to unfairly block an employee's contributions in jurisdictions where broad employment IP assignments are not enforceable: the project would be waiting for the employer's say-so in accepting the contribution, but the contributor's local contract/IP law would not require them to do so.

Perhaps you underestimate (or I overestimate) the responsibility of contributors in making arrangements with their employers. I have signed a similar agreement, but my company has a well-defined exemption process, which I have used every time I made open source contributions.

Also, many projects offer corporate CLAs (e.g., here is Google's) so that a company can authorize all its employees to contribute to particular open source projects. In the particular case of open source contributions done by the employees major corporations for major open source projects (e.g., consider the extensive list of the corporate Linux Foundation members) where a corporate CLA exists, this is a non-issue.

  • While projects with a company behind them may enforce an agreement to be signed or agreed to during submission or acceptance, smaller projects usually only rely on an implied agreement that the submitter is able to submit in agreement with the terms of the license used by the project. – sambler Nov 28 '17 at 5:55

Do Open Source/Free Software projects require submitters to submit proof of authorization to contribute?

Many projects have such requirement to sign a contributor license agreement (CLA) or a DCO; some licenses such as Apache have this baked in. The latest GitHub terms of service even go further as the license is implicitly the same as the project license you contribute to.

But only some organizations require to submit a "proof". Apache and Eclipse do. The Linux kernel relies on the simpler DCO. I do the same on my projects and this works fine in practice.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.