Setup Contributors License Agreement or Project Contributors Agreement

[devernay]

CLAs are now more widespread than 5 years ago, when we tried to have Natron contributors sign up a CLA, but finally renounced. I guess we won't have as mush push-back as 5 years ago (and the push-back came from people who never contibuted anyway).

The Linux foundation now has a tool that makes this easier: EasyCLA

With EasyCLA, every contributor has to sign the CLA before their first contribution can be integrated into the main source. That way, we will make sure that the "Natron developers" group is properly identified, and that contributors agreed to be part of that group.

Please post a message here if you have reasons to believe that this is a bad idea.

Recent and active contributors are welcome to discuss this (@bonalex01dev @YakoYakoYokuYoku @rodlie).

[rodlie]

The primary reason for a CLA last time I understand, since the plan was to have a commercial version. But now? What will the CLA contain? What are the advantages to having a CLA? How much extra work will this give first-time contributors?

I'm not against a CLA, if you feel it's needed, ok.

[devernay]

Main advantage (common to a CLA and to a Project Contributor Agreement):

• Contributors recognize that what the contribute is their own work, or something for which they got permission from the copyright holder, and that it can be redistributed under the Natron license. Today, if we accept a PR that contains code that cannot be distributed with the GPL license, we are responsible.

Advantages of a CLA:

• Assign the copyright to the project (no copyright disputes)
• Allows easier contribution from employees of companies (the company can sign a Corporate CLA)
• We can easily have a CLA that doesn't allow re-licensing.

Advantages of a PCA:

• The copyright is unchanged
• Contributors can chose the license they want.
• They can have code copyrighted by others in their contribution, but distributed under a compatible license, without having to ask for any copyright transfer.
• PCA severely restrict re-licensing (for example if contributions are GPL)

I'm not saying a CLA is necessary. Here's an interesting short blurb about CLA and the Fedora PCA: https://unicef.github.io/inventory/legal-policy/contributor-license-agreement-cla/

The CLA makes bookkeeping easier. if we use something like the FPCA, we have to clearly identify the license and copyright holders of each part of the code (and each significant contribution)

Note that all GNU projects ask for a copyright waiver: https://www.gnu.org/licenses/why-assign

[YakoYakoYokuYoku]

From my standpoint I'd say to use a CLA instead of the FPCA. I hold that contributors to a project like Blender, Krita or Natron itself provide their contributions to, indeed, improve the project. And I find that this is best committed by waiving the copyright on the work. However, if the ownership over those contributions is not waived, I cannot see any guarantee that things may go smooth down the road. As a consequence of this is that I wouldn't like to see an scenario where a contribution owner decides to pull off the table cloth. In conclusion I'd go with the CLA for both pragmatism and secureness. Although I'd say that this might be a little bit early as the project at the moment hasn't received many contributors or these are active.

[devernay]

I think the biggest issues with the CLA are:

• Someone cannot contribute with code that they don't own (eg a code snippet from a MIT-licensed software)
• Some contributors feel like we are stealing their code

We tried to introduce a CLA a while ago (2016?), to that we could use the same code base for a commercial version and an open source version of Natron (at least we announced it clearly). People said it was stealing their code, which was wrong because their code would always be in the open source version. The result is that the commercial project (left-angle.com) forked a code base that didn't include any external contribution, and they stopped any contribution to the open source version at that point (around 2017).

[YakoYakoYokuYoku]

To those first two points I'd say that one, contributing using code from another software will require to take into consideration both license compatibility plus the possibility from making a derived work upon it and two, the GitHub Terms of Service mention that the content that is added to a repository must be licensed under the same terms of the notice and that if there's a separate agreement, such as a CLA or a PCA, it'll supersede (see ToS). From the latter I'd say that there cannot be a theft of work because without a PCA or similar agreements you are waiving your copyright to begin with or you are retaining it otherwise. Apart from my personal opinions plus my observations and considering the above post I'll say that I don't have any other objection between the two.

[bonalex01dev]

Sorry, I can't add to this talk. And I'm grateful you take time to consider those boring but important things. I'll watch this discussion to follow the guidelines that will ensue

[bonalex01dev]

Hi, has anything been decided that I should do before making new PRs ?