legal: add a contributor licence agreement - #46
Merged
Conversation
The project is MIT and means to stay open source. This does not change that and asks nobody to give up ownership: contributors keep the copyright in their work and grant a licence broad enough -- including the right to sublicense -- that the project can be relicensed later if it has to be. The reason it lands now is that the option has to be kept open now or not at all. Every contributor owns the copyright in their own contribution, so relicensing needs all of them to agree. At three contributors that is an afternoon of email. At fifty, spread over years, with old addresses and changed jobs, it is a permanent no. There are currently zero external contributors and the project was just publicly opened to them. Adapted from the Apache Software Foundation ICLA v2.0 rather than drafted here: a contributor should recognise what they are signing, and legal text is the worst possible place to be original. Licence grant, not copyright assignment -- asking people to sign away ownership deters them, and in several jurisdictions it is awkward to do. Signing is one comment, once, covering every later contribution. Wired into CONTRIBUTING's table of contents, the pull request process, and the PR template checklist so it is met rather than looked for. Notes explicitly that the React SDK stays permissive regardless of what the server does: an SDK is linked into its users' own applications, and copyleft there would reach into code that is not ours to license.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Keeps a door open that closes by itself.
Why now, specifically
There are zero external contributors today —
git logshows one author across both repos. And the project was just publicly opened to them.Relicensing needs every contributor's agreement, because each owns the copyright in their own work. At three contributors that is an afternoon of email. At fifty, spread over years, with old addresses and changed jobs, it is a permanent no.
Asking today costs one comment. Not asking forecloses an option that cannot be recovered — and the window is open right now for as long as nobody has contributed yet.
What it does and does not do
Flagward is MIT and means to stay open source. This does not change that.
Licence grant rather than copyright assignment is a deliberate choice. Asking people to sign away ownership deters them, and in several jurisdictions it is awkward to execute. The sublicense right achieves the same outcome without it.
Adapted, not drafted
Straight from the Apache Software Foundation ICLA v2.0, lightly adapted.
Two reasons: a contributor should be able to recognise what they are signing, and legal text is the worst possible place to be original. The document says so, and says out loud that it has not been reviewed by a lawyer for this project.
How signing works
One comment on a first pull request:
Once, not per pull request. Wired into three places so it is met rather than looked for:
CONTRIBUTING.md's table of contents, step 8 of the pull request process, and the PR template checklist.The SDK is called out on purpose
CLA.mdstates that the React SDK stays permissive regardless of what the server does.An SDK is linked into its users' own applications. A copyleft licence there would reach into code that is not ours to license — it would not protect the project, it would just make the package unusable. Flagsmith draws the same line: platform BSD-3, SDKs MIT.
Recommended follow-up, not included here
Signature collection is currently manual. CLA Assistant is the usual GitHub App for it — it comments on new pull requests, records who has signed, and blocks the merge until they have. Installing a third-party app on the repository is your call, not something to slip into a docs PR.
Verification
Docs and template only — no code.
git statusshowsCLA.md(new),CONTRIBUTING.md,.github/PULL_REQUEST_TEMPLATE.md. Relative links toLICENSEandCLA.mdresolve.pytest592 passed, unchanged.🤖 Generated with Claude Code