Could submitting a Pull Request ever constitute accepting a Contributor Licence Agreement? [closed]

Question

Some software projects have a Contributor Licence Agreement. The agreement could, for instance, assign copyright of 3rd-party contributions to the original project creator. Could submitting a Pull Request on github ever constitute accepting such an agreement?

Answer 1

Contribution license agreements, are, for the most part, contracts. A contract is binding only if a party assents (i.e. agrees) as indicated by any reasonable means. Those means can include traditional approaches like signing a paper agreement, but also a "click-to-accept" mechanisms, sending an email saying "I agree," or, as mentioned here, submitting a pull request -- but only if it is reasonable in the circumstances to conclude that you actually agreed. If the notice that you agree by submitting a pull request is buried somewhere and you shouldn't be expected to have seen it, or you don't have the opportunity to see it prior to making the request, you might be able to avoid being bound to the contract. But if you were informed (such as by a prominent notice on the site) that submitting a pull request constituted agreement, and it's reasonable to expect that you would understand that the agreement applied, then yes, you would be bound. This is a common sense question -- there is not much magic to it.

I am a lawyer practicing in IP licensing, but if you have questions about your specific case you should talk to a lawyer who represents you -- I am only talking about the general case.

I would be interested to know -- assuming this string is not too old at this point -- the examples you are referring to. I found this string while searching for an example of a site that says a pull request constitutes agreement to a CLA.

I note that the question of what is a "work for hire" or a transfer of IP rights is a different question. Most CLAs are neither.

Answer 2

I am not a lawyer, and if you want an answer to rely on, consult a lawyer who specializes in copyright law, ideally with a focus on Open Source / Free Software.

That said, copyright is seldom transferred implicitly - a notable exception is work-for-hire, which is the default in some countries and a standard clause in employment agreements in others. With Open Source software, it is usually considered the project maintainer's responsibility to ensure that the distribution of the project meets the law, and that distributing it under a certain license does not violate any copyright nor any existing agreements and licences. There are two standard ways of going about this:

a) Only accept contributions that have been released under a compatible license by their respective authors; this approach requires no paperwork, but some diligence, because the project maintainer can be held liable if anything gets included and republished in a way that violates the original license (e.g., including GPL code in a project released under an MIT license). b) Make the contributor sign an explicit copyright transfer agreement, usually in exchange for a promise to release it under a free license. Sometimes, copyright is not transferred, but an irrevocable license is granted instead that gives the project maintainer close to the same rights as a copyright transfer would have; it does, however, allow the original author to release their own code (but only that!) under a different license outside the main project.

This leads me to believe that unless you explicitly agree to a copyright transfer, you still retain full copyright. I would also expect though that sending a pull request could be interpreted as an implicit agreement for your contribution to be distributed under the same terms as the main project, i.e., if you submit patches to a GPL project, it can be assumed that you do so with the intent of having them included and distributed as part of the project.

Nonetheless, whenever I receive a contribution for any of my projects, I explicitly ask whether they agree to me including and redistributing their work.

Answer 3

A few alternatives which might be safer:

• make first time committers write an "I agree to the CLA" line on a CLA.md file. Commit message then identifies the person.
• https://github.com/clahub/clahub

Answer 4

If you need an actual answer, as in "this could have real legal consequences", you need to ask an actual lawyer, not some people you've never met on the other side of the internet.

Shrinkwrap licences (where they give you a wad of text at install time and make you press "I accept the license" to install) have been held legally valid, but I believe a part of the reason for that is that they make sure you see (and press) the "agree" button. Unless there is a similar action required of the person submitting the pull request, I suspect it might not be legally binding, since the contributor could stand up in court and say, "I had no idea they were using license foo" or something similar.

If it were me running a small project that needed some legal thing from contributors, I'd make sure they sent an email formally accepting the legal thing before accepting their contribution.

Answer 5

Under UK law, a contract exists where one party makes an offer, and the other party accepts that offer. So, to answer your question, yes, there are situations where a judge would decide that by making their software available for people to access, and publishing license terms for doing so, they are making a contractual offer. Then when you choose to access the source code you have demonstrated your acceptance of the contract that grants you the legal access to the source code.

However, the exact circumstances matter considerably. Its hard to enter into a legally binding agreement with a 12 year old child, likewise, its hard to argue that a professional software developer would not expect the source code to be licensed.