Information about "Corporate Contributor License Agreement"

[anajsana]

Question raised at TODO Slack by @jsmanrique:

Hi everyone. I was looking for information about "Corporate Contributor License Agreement" like templates, topics to have into account, typical procedures... is there any guide or reference to look at? Of course, there are several CCLA sites around, but I would like to learn more about the rationale behind the CCLA and how it benefits or helps companies to contribute to OSS projects. Thank you!

[anajsana]

@gyehuda replied:

Some resources:

• https://yahoo.github.io/oss-guide/docs/resources/what-is-cla.html
• https://soundcloud.com/ydn/dash-open-15-the-virtues-and-pitfalls-of-contributor-license-agreements

Basically, the CLA protects a project that receives code (though not so strongly). The CCLA was created because many contributors don’t actually have rights to their code. — they work for a company that does. At the end of the day, many people have realized they are not super protective and have many pitfalls. But many foundation-based projects still use them.

The apache text is the most common. Non-Apache text-based CCLAs are often CAAs (copyright assignment agreements — which are very different). Do note that small changes to the Apache text can have a significant impact on the scope of the agreement.

[anajsana]

@caniszczyk replied:

https://opensource.google/documentation/reference/cla/policy

[anajsana]

@anajsana replied:

Some folks from the Europe chapter are working on an Outbound OSS guide. They have documented a process that describes good practices on how to handle CLAs which are required by OSS projects where employees wish to contribute to. It might be useful 🙂 See the WIP here: https://github.com/todogroup/outbound-oss/blob/main/content/02-contributions-to-existing-projects.md#general-structure-and-scope-of-the-process

@OliverFendt is working on that: todogroup/outbound-oss#3

[jlprat]

Some counterargument data point: https://ben.balter.com/2018/01/02/why-you-probably-shouldnt-add-a-cla-to-your-open-source-project/

[jsmanrique]

Thank you very much to everyone. Just to clarify about the resources and information I am looking for.

AFAIK, CLA is an agreement between the contributor and "the open source project". And I know there are several pros and cons about them.

But, I am looking for information about how companies manage how their employees contribute to open source projects. AFAIK, CCLA (Corporate Contributor License Agreement) is an agreement between a corporation and the employee that wants to contribute to a certain project. By this "tool", the corporation tries to be aware of who contributes and to which projects, but also from a legal point of view tries to ensure they are covered.

[jlprat]

I can explain how we do it at Aiven. Teams working in product development are encouraged to contribute to OpenSource, but when they are required to sign any kind of extra agreement (CLA, CCLA, DCO¹...) they need to check if said extra agreement has been already approved before (we have a wiki page for this). If it hasn't been approved yet, they are to contact the OSPO team. We, the OSPO team, then does a quick review on the agreement and we contact our legal team to make sure there is no hidden or dangerous clause. Once this is done, documents are signed and contributor can successfully contribute to the upstream project.
In some cases, some Open Source projects only offer an Individual CLA. When this happens we approach said companies and we ask for a Corporate one.

I agree that this process works at a smaller scale, and for bigger corporations where the contributor pool is in the several hundreds it might not be that useful. Having more automated tools in this area needs to be done with care, as it may be too easy to invade people's privacy (what's done on free time vs work time, same GitHub for personal and work?...).

Let me know if you want to know more.

Footnotes

1. https://opensource.com/article/18/3/cla-vs-dco-whats-difference ↩

[jsmanrique]

Thank you very much @jlprat!

In the case of no kind of extra agreement is required, how do you manage code intellectual property?

I am trying to ease how our developers contribute to OSS without concerns from our security (due to the contribution content) and legal (due to potential IP issues) teams.

Of course, I am not a lawyer. But a minimal documentation/guide would be very helpful.

[jlprat]

That is a good question @jsmanrique.
In our case Aiven, is more than happy to contribute back to OSS projects that are crucial to our stack, so there is no intention from the company to claim any IP on contributed code.
Also our case is a bit special, so we can rely on a blanket approval on OSS projects of relevance to Aiven. These are the ones we offer as a managed service and projects in their ecosystem and/or their dependencies.

Regarding more documentation, I hope todogroup/todogroup.org#285 will partly cover your needs.

I am trying to ease how our developers contribute to OSS without concerns from our security (due to the contribution content) and legal (due to potential IP issues) teams.

What do you mean by "concerns from our security team"?

[gyehuda]

At my last OSPO we had set up a process to identify and manage CCLAs. For example, we had a team of people who were active contributors to OpenStack, and that project required an ICLA and CCLA. I managed a process where I would reach out to the development team on a quarterly basis and confirm if anyone joined or left the team. I'd then update the Appendix and resubmit the names to OpenStack. I did this with a bunch of other projects that had CCLAs. Google's process was actually very simple to follow since we just had to add them to an email list. This means that when the person left the company, they'd automatically be removed.

CCLA management is a bit of a hassle, but it's not that onerous. It required me to know who was working on what project, and that's actually good to know. But it's very challenging at larger companies where one person can't easily ask "all developers" to disclose.

Thankfully many projects are beginning to move away from CCLAs. They don't do a great job of what they set out to do, and for the most part create hassles and not nearly enough value to justify them. But if you seek to contribute to a project that requires a CCLA, then your OSPO will want to get a legal review of the text, keep the signed copy in an easy to find location, and periodically update the Appendix with the names of contributors (since most CCLAs require you to do so).