NumFOCUS Recommended CLAs

[Vyas Ramasubramani]

Hi all,

I'm a maintainer of the signac framework, one of NumFOCUS's affiliated projects. I recently started a new job, and in the process of getting approval to continue working on the project I encountered a minor hitch. It has since been resolved, but the upshot is that while our project's license (BSD 3-clause) was not an issue, they weren't entirely familiar or comfortable with our contributor agreement at first.

We currently employ a minor variant of the Sun Contributor Agreement. Are there any recommendations for best practices with respect to choice of CLA? I've seen that a number of projects use the Apache CLA, is that considered a better - or at least more widely accepted - choice these days? Alternatively, do most projects use a CLA at all? I appreciate any feedback or guidance.

Best,

Vyas

[Andy Terrel]

Sorry I missed your message. This group doesn't get much traffic.

Apache CLA is more widely accepted for sure, but most of the NumFOCUS communities don't use CLAs as they believe they prevent contribution. While CLAs protect organizations using the code, we have felt the risks to be minimal but contribution to be more important. 

NumFOCUS codes are contributed from numerous individuals and we prefer the sharing of the copyright among those individuals. Once a person contributes a piece of code under a specific license, their intent is pretty clear, i.e. to share the code. Thus our users are protected from copyright infringement through these intentional acts of sharing to the code.

For codes that are based out of companies, e.g. TensorFlow or React, CLAs are necessary for protecting the host company. NumFOCUS is a small non-profit so there isn't really anyone to sue for damages, so once again their isn't much risk.

-- Andy