I can certainly see the need for CLAs with a terser license like MIT or BSD, but the more verbose Apache seems to already have that type of verbiage in it. I would prefer to not add this level of complication an open source project if it is not necessary with the Apache 2.0 license.
CLAs seem to primarily grant a copyright license and a patent license from the contributor to the project, both of which are already in the text of the Apache 2.0 license (sections 2 and 3). If I am using the Apache license, do I really need to also add the extra requirement for contributors to sign a CLA? I basically want to get the general benefits of a CLA (like the non-ambiguous right to relicense, though the contributor maintains ownership) without making contributors fill out a bunch of information and sign a contract in some third-party form.
Doesn’t the act of cloning a repository, modifying code, and sending a pull request indicate agreement to the terms of the associated license? Section 5 of the Apache 2.0 License explicitly states that contributions shall also be under Apache 2.0:
Submission of Contributions: Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.
When combined with Sections 2 & 3 regarding grant of copyright license and patent license “…to reproduce, prepare Derivative Works of, sublicense…” it would seem that Apache 2.0 already covers the project’s bases regarding submissions. Or am I misunderstanding a possible difference between a “sublicense” and actually changing the license of the project?
(Since the Open Source Licensing Q&A site is still a just a proposal, I will accept IANAL answers here.)
In my (rather limited) experience a CLAs often grant the project owners permission to use the contributed code not only under the license in effect when the contribution was made, but under others as well. So if for some reason you decide to switch the whole project from Apache 2 to MIT or GPL 2 or whatever, doing so can be fine if your contributers signed a CLA which covered such scenarios, but with Apache 2 behavior you’d still have to ask each such contributor for their agreement.
IANAL but my understanding is that a CLA ensures (among other things) that the contributors have the rights to share the Intellectual Property in any contribution they make to your project.
This is especially critical if you offer commercial licences but is also important for a pure Apache project because if there is proprietary code in your project you are infringing a copyright.
A more lightweight alternative to a CLA (Contributor License Agreement) is a DCO (Developer Certificate of Origin), which still states that the contributor has the right to make the contribution and that the project has the right to distribute it under its license. However, instead of signing a legal contract to the project with a CLA, contributors sign git commits with a “Signed-off-by” line at the end of the commit log message, e.g. with the --signoff flag on git commit commands.
https://opensource.com/article/18/3/cla-vs-dco-whats-difference