Don’t sign a CLA

"What the CLA is actually used for is to give the project maintainers the ability to relicense your work under a more restrictive software license, up to and including making it entirely closed source."

This goes both ways. It also gives the project maintainers the ability to relicense your work under a less restrictive licence, up to and including making it even more open (eg. from GPL to MIT).

Note that what you contribute will be open source forever regardless of a CLA: as soon as it is released (the open source version your patch is based on, and your open source contribution), the open source -ness cannot be revoked by anyone. A "community fork" from the most recent open source release is always possible, as has been seen multiple times with multiple projects, including those with CLAs.

What the author is really saying is that by signing a CLA you're revoking your claim to what the project maintainers do with the project _in the future_, after they have worked on it some more.

There is, after all, a huge asymmetry here. In a project managed by a major sponsor requiring a CLA, your contribution is probably tiny compared to the work done by project sponsors. In this case, it doesn't seem unreasonable to me for the sponsors to be wanting not to encumber their project with the removal of their ability to take _future work_ on their project closed source (because they were originally the sole copyright holders), just for the sake of a tiny contribution.

Do those tiny contributions add up? I can only think of a few projects when they do, and that's where the ecosystem consists of multiple corporate sponsors (Linux and Postgres come to mind). In most cases where there is a CLA, there is a single corporate sponsor who employs full time developers, and no other developers are contributing full time so the majority of ongoing work is done by the single sponsor. If you want to argue that the CLA is enforcing this condition, then go ahead and fork the project to prove me wrong!

If you're contributing a major component, then sure, you might want to think about it, though even then you're going to get somebody else to maintain that component for you indefinitely if you contribute it.

If you're contributing a minor bugfix, then you're probably hurting yourself (by making yourself maintain that fix forever, or forcing yourself to maintain an entire fork) more than achieving out of principle.

I see. Thank you.

So the question is, are they acting in bad faith if they attempt to use a CLA to subvert the open source license?

"What the CLA is actually used for is to give the project maintainers the ability to relicense your work under a more restrictive software license, up to and including making it entirely closed source."

Actually, it serves two main purposes[1] :

1. Protect the project from people who don't actually have the necessary rights to be contributing or wish to retract contributions later.

This is the most common case, and it happens all the time (though essentially all of it is resolved privately due to CLA's).

The law is full of interesting dragons. As a random example: Most open source is also too young, but in ~10-15 years, you will start to see copyright right terminations in the US (https://www.law.cornell.edu/uscode/text/17/203) for projects that have no CLA's.

It's inevitable. (as is having to deal with the rights of people who are dead, which already happens)

Projects often need to do something to protect themselves over time (regardless of whether it's a CLA or copyright assignment or ...)

2. Protect the projects from patents in #1 when the license does not do so.

(this is also resolved privately)

It also resolves an issue that only has popped up recently, copyright trolling by folks like Patrick McHardy.

Relicensing is a very secondary concern, and mostly comes into play over time because the project screws up or grows larger than it expected.

The boogeyman of "corporation takes away my rights" is a nice boogeyman, but the infinitely more common case is "project screws up because they didn't think about licensing when they started". The number of "corporate relicensings" is vastly dwarfed by non-corporate ones.

One of the more interesting things to me is that the largest mass relicensing i'm aware of was the FSF force-relicensing projects to GPLv3 (sometimes quite against majority-contributor wishes), with no comment or discussion or allowance for dissent. So it wasn't a corporation doing it for whatever, it was a foundation doing it for ideological reasons.

The fact the article tries to make it seem like it's happening all the time is disingenuous at best, and honestly only serves to make the argument weaker (because it's unsupported by data).

I'd also point out a CLA or equivalent is also necessary to move a project from gpl-v2 only to gpl-v3 (IE not "restrictive software licenses") if the project later chose. Otherwise it is stuck in limbo forever.

The answer you usually get from anti-CLA folks is "they shouldn't do that in the first place" which is nice but doesn't actually fit with the fact that most people basically don't pay any attention to license choices in a meaningful way when they start projects. Or make mistakes. You know, one of the reasons we have version control in the first place - so we can change things we got wrong over time.

Even if you could cause them to not make mistakes, or never change viewpoints, you'd still have millions of legacy projects to deal with.

All this article tells me is that the person hasn't run a large enough open source project to have to deal with these in a meaningful way. That's okay. But i've never found someone who did who has not run into the issues above and eventually moved to CLA's or an equivalent.

I've also spent a lot of time in my life fixing smaller projects that never had one, and then became larger, and then had to clean up the mess. It usually costs foundations/etc a lot of money and time to track down contributors or pull code.

I'd actually love to live in a world where CLA's aren't necessary (and copyright was sane). But pretending we do won't get us there.

[1] bradley kuhn wrote a much better article than this one (no offense to the author here!), though i disagree with bradley's view :P - https://sfconservancy.org/blog/2014/jun/09/do-not-need-cla/

>> if you are contributing to FOSS qua FOSS, then you want it to remain FOSS

>Not necessarily.

Perhaps you missed the "qua FOSS"? This is latin for "because it is", in this context "contributing to FOSS because it is FOSS".

the osd guarantees the relevant right for an individual to change the software. if you apreciate this right, then you should work to preserve it.