What can you do if you can't track down all old contributors to sign a CLA?

Question

Many FOSS projects start out without a Contributor License Agreement (CLA). Many, if they become large and successful, will want to transition to system based on CLAs. But what about if they can't track down all of the old contributors? I can think of three possibilities:

1. They can continue without the contributors signing the CLA and proceed to change the license etc with the hope that the contributors will be found in the future
2. They can rewrite all code contributed by them
3. They can keep the existing license until all contributors have signed their CLAs

Is the first option possible or do such projects need to choose between the second and third?

Answer 1

The first option is possible, but with a risk. The risk is, one of the old contributors you couldn't find anymore (or his inheritor) comes out of the hiding and sues the project for violating his copyrights. If you assume this risk is small you could proceed with option 1. Option 2 and 3 are obviously less risky and probably preferable though.

EDIT: As Philipp correctly points out in his comment, you should include in your risk-analysis that the risks of #1 are kept, even after many years. It is known that a copyright-holder may be OK with something, but if he dies his inheritor might have another opinion. It isn't kept until eternity, but 70 years after authors death (like most countries have, Berne conventions demands 50 years after authors death) feel like an eternity. Also all forks of your software get the same risk, if they don't remove the offending code. This might lead to lesser forks and therefore some see this hurdle to forking as a violation of open source principles.