2

I have a relatively young private GitHub repo with 5-6 people working on it together. My understanding of a contributor agreement is that I can use this to state that:

  • Users have access to the product and can reap the benefits of using the product, as long as they don't create their own products based on this repository.
  • Users cannot share any parts of the product or derivative works without my agreement.
  • Users have no say on future plans involving the product with their contributions, e.g should I want to create a paid service exposing the benefits of the product to paying users in future, I'm free to do so.

Is that correct, as long as the CLA states this and each contributor signs it?

I was looking at the mongodb contributor agreement as an example, and it states "the agreement is entered between company name having its principle place of business at xyz and you and/or your organisation."

If I'm an individual without a legal entity, can it just be something like this?

"the agreement is entered between John Doe and you and/or your organisation"? Or does there need to be an address too?

Edit:

Also seems like I need a license in place to complement the CLA, is that correct?

3

A license is an agreement between the project's copyright holders (i.e. all contributors) and any users. The license typically discusses:

  • how the software may be used,
  • under which conditions the software may be copied,
  • and under which conditions the software may be modified.

Open-source licenses typically allow usage for any purpose, allow copies to be freely distributed, and allow modifications to be made and published. They typically impose minor restrictions like that any copyright and license notices have to be kept intact and shown to users, and sometimes that any modifications must be available under the same license. Forking is generally allowed, i.e. taking the code and starting a competing project.

When an outside contributor wants to share their modifications that they created in accordance with the license, their expectation will generally be that they license their modifications to the project under that license (inbound = outbound licensing, as e.g. formalized by the Github terms of service for public repos). So with respect to this contribution, the original project has no more privileges than other users. For open-source projects, this generally works out fine.

But some projects have additional requirements:

  • In the future, the project may be relicensed to an incompatible license. E.g. a GPLv2 project cannot be changed to GPLv3 unless all contributors consent – or the necessary rights were previously assigned as part of a CLA. GNU projects also use a CLA so that the project can defend against copyright infringements on behalf of the contributors.

  • The project may need to prove that it isn't doing any copyright infringement. This requires a “paper trail” so that you can demonstrate for each contribution that the contributor had the right to give you their modifications and gave you the necessary rights to use them in the project. A CLA is one way to do this, alternatively a “DCO” is used.

  • A project may use a dual-licensing scheme, so that the project is available (for free) under an open source license and alternatively under a (paid) proprietary license for users that do not want to comply with the open source license. This is e.g. the case for Qt, iText, or MongoDB. Without a CLA the project would not have the right to issue these proprietary licenses because they would only have received the contributions under the terms of the open-source license.

How right assignment works also depends on the jurisdiction of the contributor. E.g. here in Germany I cannot assign my copyright in its entirety, but I can issue exclusive or non-exclusive licenses for some aspects of the copyright. Some of these assignments would require a written contract.

If you think that you need a CLA, it is important to consider how these rights will be managed. It is legally fine to manage these rights as a natural person. But what happens if you die or are otherwise incapacitated? If multiple natural persons manage the rights, how do they make decisions? This is not just important for managing these rights, but also for gaining the necessary trust of potential contributors.

A legal entity such as a company or non-profit can survive its individual members. A foundation might also have clear rules on votes and project management that guarantee transparent decisions on the project's future. Aside from technical, financial, and legal support, this trust, transparency, and stability are some of the benefits that a foundation like the Apache Foundation can provide to member projects. Many larger projects start their own foundation as they mature. As an added benefit they make it easier to donate :)

But nearly all open source projects do not have special requirements that would make a CLA or foundation necessary.


Your descriptions of the rights you would like to grant to users does not sound like an open source license. You do not allow usage for any purpose (no competing projects, no commercial usage) and you do not allow the software to be shared freely. If all current copyright holders agree to this, that is legally fine but again: not open source. Even if the source code is publicly viewable. (Such a model where the source code is available but cannot be used freely is sometimes called shared source.)

If you want to accept contributions under that model, you do need to make some licensing agreement with contributors. Unless you provide the necessary rights, potential contributors would not be legally allowed to change the source code. But why would a potential contributor even agree to that if you get all the benefits of their work, and they are left with all these restrictions?

  • The more I re-read your post, the more I do think it sounds like a CLA is the right approach for this? Allow personal use for the contributors, protect the product and retain my right to commercially use the product or parts of it in a future business if desired? Did I understand that correctly? – Tiago Aug 14 '18 at 19:57
  • 1
    @Tiago Currently ownership of the project's copyright is shared among all contributors. I don't know what the laws regarding shared ownership are in your jurisdiction, but if you want to obtain some exclusive rights you should set up a contract with the other other owners. You can call that a CLA if you like. But your questions do not seem to be about open-source development. To figure out whether your approach is legally sound you should probably hire a lawyer – consider it a business investment. – amon Aug 15 '18 at 7:34
  • Hello, I was just looking for something like this as I want to start my own Open Source project. Where should I put a CLA so the contributor grants me or my future company (if ever) the copyright? Can I put this in the same LICENSE file? Should I put it as a message before the merge request or is it OK to have it in the repo only? Is it really necessary to have a paper signed? Would this be for each contribution or in general? Thanks – JorgeeFG Aug 20 '18 at 21:10
  • @JorgeeFG Honestly, open source is not a good fit for many business models. And it's difficult to first start an open source project and then move ownership to a company. When you are considering a CLA, also consider why a contributor would want to sign it – if your project is open source, it could simply be forked (and you wouldn't be able to use contributions to the fork due to your CLA). A CLA cannot be accepted implicitly, you need to collect explicit consent from each contributor (an electronic sign up form should be sufficient, but consider that this subjects you to privacy regulations). – amon Aug 22 '18 at 16:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.