0

Someone sent me [ a translation to a new language ] of the open source software I'm developing. He attached the translation messages file to a private message in the discussion forum I've setup for the software. I asked if he could create a Pull Request at GitHub and add the line "I agree to the CLA-v2.txt" to the commit message. (CLA = Contributor License Agreement.)

Maybe he'll be okay with doing that extra work (i.e. creating a PR), because he knows about Docker and GitHub and software. However, generally, I'd like people to be able to translate the software, send me a file, and agree to the CLA — without having to create a GitHub account and spending a day reading about pull requests.

Outside Git and pull requests and Linux-style "Signed-off-by" messages or GitHub CLA plugins — then, what are okay ways to get someone to officially sign a CLA?

There're things like Adobe Forms (https://acrobat.adobe.com/uk/en/sign/free-trial-global.html). It's a bit expensive for an open source project (I think) and what if Adobe gets bought, and the new owner shuts down this little Adobe-Sign "side project" and all signatures are then lost?

Or maybe I could use Google Forms — but what if someone decides to do a prank, and submits 10 000 Google Forms replies, ... or signs the Google Forms form, pretending to be someone else.

I'd like there to be a place on the Interntet, that will be there "forever", where the contributor can publicly post his/her contribution and also at the same time clarify that s/he agrees to the CLA, or just write, together with the contribution, that s/he licenses the things to me under MIT + CC-By 4 maybe, or CC0 or something.

What would you suggest?

Improve this question
6
  • "what are okay ways to get someone to officially sign a CLA" - By okay do you mean legally enforceable? See also How to complete CLA on github
    – Brandin
    Commented Jul 5, 2018 at 13:26
  • @Brandin I think so, yes, well, not totally sure what is meant here with "legally enforceable"? I suppose writing in one's commits in one's GitHub PR that one agrees to the CLA, is "legally enforceable"? and I'm hoping there is some equally good & simple method, for non-GitHub users
    – KajMagnus
    Commented Jul 6, 2018 at 4:51
  • @Brandin I would want it to be clear & obvious to anyone who cares, that all contributors have agreed to the CLA: that the contributors have legally promised that they have the right to contribute the things, and that they're okay with how the project will use their contributions. So that those who use the software, won't need to worry about getting sued for copyright or patent problems.
    – KajMagnus
    Commented Jul 6, 2018 at 4:54
  • Just as an example, suppose in one commit I write "I agree to the CLA" but then later there is a dispute about what the CLA says. Also, what if I forgot to write "I agree to the CLA" in one or two commits? I would think it's better to have the actual document signed somewhere, and to cover all commits, not just the ones where I added a comment such as "I agree to the CLA." But ultimately, this is up to you. Read the answer I linked to for more details.
    – Brandin
    Commented Jul 6, 2018 at 5:16
  • @Brandin later on maybe a bot / commit hook could verify the commit(s) end with this "I agree ..." message. — Actually, I abbreviated a bit, when I wrote: "I agree to the CLA" — the full text is: "I, Your Full Name <your@ email.address>, agree to the Contributor License Agreement, docs/CLA-v2.txt." — and that file is included in the repo.
    – KajMagnus
    Commented Jul 6, 2018 at 5:39

1 Answer 1

Reset to default
3

A CLA is not for the contributor but is for you. It typically gives you extra permissions to the contributed work. It is therefore in your interest to keep records that convincingly show that you received the necessary rights. This will depend on your applicable jurisdiction. In particular, it is highly jurisdiction-dependent what kind of legal instrument (contract, …) you have to use, whether a signature is necessary, and what kind of electronic signature would be sufficient. E.g. a special line in a commit message may or may not be sufficient, as commits are very easy to forge. When keeping records you also have to consider GDPR compliance.

In any CLA-based workflow, you want to make sure that the person who contributes the work and the person who agrees to the CLA should be the same person. For example you could offer a form on your company website where users can submit translations. The same form would also display the CLA and required privacy notices. Only accept the contribution of they accept the CLA, and keep track of the signatures/contracts in some kind of persistent storage.

If you accept contributions through GitHub, the CLA should be signed from the same GH account as the PR. You can check the account via OAuth. Of course there are already third party services that help with this. As always, consider GDPR compliance when using such services. The services should only be used to collect the CLA signatures, but not be the only storage place – these signatures are far too valuable for your company. Export them and back them up regularly. It is then not important if the service you are using goes out of business in the future.

Improve this answer
5
  • 1
    Thanks! Minor comment: A CLA is also for the contributor — it protects him/her by stating that s/he won't be liable, if his/her contributions are buggy and broken.
    – KajMagnus
    Commented Jul 8, 2018 at 1:10
  • 1
    About this: "as commits are very easy to forge", and this: "you could offer a form on your company website where users can submit translations" — this form is equally easy to forge? Still, that's what many companies do, right, e.g. Google and GitHub have their own CLA forms. They could just update their database themselves and add whatever signatures they wanted?
    – KajMagnus
    Commented Jul 8, 2018 at 1:12
  • A combination of one's own persistent storage for signatures etc, in combination with hopefully will be there forever public records of the signatures, is maybe a good approach. E.g. people submitting PRs via GitHub, and then the GitHub PR page shows who submitted it, incl the "agree to CLA" message by that user. (Hmm I don't think one can delete one's own commits in another repo, to "revoke" the CLA, that'd break the whole repo, right, so must be ... impossible.) ...
    – KajMagnus
    Commented Jul 8, 2018 at 1:17
  • ... And, for non-tech people, the public place could maybe be a public email list / community that doesn't let people delete their emails / posts. I'll just need to find the correct email list or will be there forever place that is okay with this way of using it. (The contributor would send his/her translation file / whatever, to that community, + maybe a link to the CLA? Or the whole CLA copy-pasted? Or a hash? hmm.)
    – KajMagnus
    Commented Jul 8, 2018 at 1:20
  • @KajMagnus At lot of these ideas circle back to the question what kind of signatures are required by the copyright and contract law in your jurisdiction. Maybe if they send an email that is totally sufficient? Because being able to accept contributions under a CLA is crucial for your business model, please consult a lawyer so that they can help you design a legally solid process. Alternatively, forget about the CLA and use AGPL+DCO instead. In any case, carefully consider GDPR compliance for your scheme. Non-deletable public records might be quite problematic.
    – amon
    Commented Jul 8, 2018 at 11:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.