CONTRIBUTING.md: Document that Contributor License Agreement is required

[mattflaschen]

In CONTRIBUTING.md, please document that a Contributor License Agreement is required.

[AndrewTriesToCode]

Will do. I gather you don’t agree with the CLA? Anything in particular with it that is problematic?

I appreciate your feedback.

[mattflaschen]

I made the change during work hours. The CLA bot notes that employer approval is required for such cases (which is standard for CLAs). Given I made a very small doc change, I'm not sure whether I will go through that approval process at this time. To be clear, that was my only reason for closing my pull request.

I would also link from CONTRIBUTING.md to the actual CLA people are signing (it is shown by the CLA bot/app, but it's not easy to find outside that flow).

I think the definitive version is https://raw.githubusercontent.com/dotnet-foundation/.github/main/CLA/dotnetfoundation.yml , which is linked from https://github.com/Finbuckle/.github/blob/main/policies/cla.yml .

[mattflaschen]

(Since you asked for feedback, my thoughts are below:

But first:

1. This is your project and you have the right to set up the licensing and CLA as you prefer.
2. I'm not a lawyer, and it's possible I'm partly misunderstanding.
3. My change was minimal in any event.

I do find the copyright grant in section 5.a. to be very broad.

    **a. Copyright License.** You grant .NET Foundation, and those who receive the Submission directly
    or indirectly from .NET Foundation, a perpetual, worldwide, non-exclusive, royalty-free, irrevocable
    license in the Submission to reproduce, prepare derivative works of, publicly display, publicly perform,
    and distribute the Submission and such derivative works, and to sublicense any or all of the foregoing
    rights to third parties.

Unlike section 2 of the Apache License itself, there is no "Subject to the terms and conditions of this License". It's an unconditional grant.

As I interpret it (I am not a lawyer): It says anyone (".NET Foundation, and those who receive the Submission directly or indirectly from .NET Foundation") (not just Finbuckle/you/.NET Foundation) receiving my submission can effectively do absolutely anything with it, including sublicensing it under their license of choice.

Based on checking the Apache Software Foundation CLA, and a few others, these broad grants appear to be common.

However, I did find the Project Harmony template CLA, which is much more precise about what relicensing it allows (and provides five different options here, with varying flexibility) (section 2.3, Outbound License).

I would prefer something like (purely hypothetical, not an actual grant):

• I grant Finbuckle the right to distribute my work under the Open Source Initiative-approved license(s) of their choice.
• I grant those who received the software directly or indirectly from Finbuckle the right to exercise their rights under the OSI-approved license(s) selected by Finbuckle.
• Optional addition if you want maximum commercialization potential (though Apache-licensed software can be and is commercialized in any event (and I support people and companies making a living from open source software)): I grant Finbuckle the right to distribute my work under any license, whether or not OSI-approved (this would include purely proprietary licenses).

The difference is: That wouldn't grant everyone in the world the right to sublicense it under (as I interpret it) their license of choice, just Finbuckle.)

[AndrewTriesToCode]

@mattflaschen thanks I appreciate your thoughts on this