CLAs

[advayDev1]

I know we're operating very fast here possibly without formal CLAs, so I'm just going to leave this here. It's not legal advice to anyone else.

I, Advay Mengle, license all of my original software contributions in this repository to the World Health Organization and to the public at large, under the terms of the MIT License:

MIT License

Copyright (c) 2020 Advay Mengle

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

[myire]

http://web2py.com/init/static/web2py_contributor_agreement.pdf is an example of a contributor agreement to a project which i know is commercially friendly and developer friendly.

Disclaimer: Massimo, web2py creator, is my mentor.

[SamMousa]

https://help.github.com/en/github/site-policy/github-terms-of-service#6-contributions-under-repository-license

Having a CLA creates a barrier for entry, as well as administrative load. We need to track who has and who hasn't signed it.

[hspinks]

Closing for now given the above comment and https://github.com/WorldHealthOrganization/app/blob/master/LICENSE

Will note this as an outstanding item in the Legal Review ticket

[advayDev1]

Per offline thread.

[nightlark]

Before deciding to go with a CLA, make sure that it is actually 1500% needed, and see if the GitHub inbound=outbound policy is sufficient. This guide from GitHub looks at some of the issues: https://opensource.guide/legal/#does-my-project-need-an-additional-contributor-agreement

From my own experience with other projects using a CLA, it can make it virtually impossible for some people to contribute to a project depending on their company (or terms imposed by the government on the company or federal employees). For example, I wanted to contribute a package to https://github.com/microsoft/vcpkg, but my company is unable to sign the corporate CLA because the contract with the United States DOE requires an indemnity clause for the government. I asked if I could sign the individual CLA to submit a package made on my own time, and the answer was no because it is too closely related to things that I am paid to work on. This same issue has come up with the CLAs used by other non-Microsoft open source projects.

I would strongly urge not adding a CLA -- it can add insurmountable legal barriers to contribution, and there are other much larger open source projects than this one that have figured out how to make things work without a CLA.

[nightlark]

Other resources on the issues with CLAs:
https://ben.balter.com/2018/01/02/why-you-probably-shouldnt-add-a-cla-to-your-open-source-project/
https://opensource.com/article/19/2/cla-problems