What is a Contributor License Agreement (CLA)?

A CLA is a legal document in which a contributor states that they are entitled to contribute the code/documentation/translation to the project and are willing to have it used in distributions and derivative works. Should there be any kind of legal issue in the future regarding the origins and ownership of any particular piece of code, the project will have the necessary forms on file from the contributor(s) saying they were permitted to make this contribution. 

The CLA also ensures that once a contributor has provided a contribution, they cannot try to withdraw permission for its use at a later date. People and companies can therefore use that software, confident that they will not be asked to stop using pieces of the code at a later date.

Why does ONF have a CLA?

Whenever a non-ONF contributor wants to submit a contribution to an ONF open source project, they must first sign a CLA. This allows the contributor to retain their ownership in the code submitted while granting ONF the necessary legal rights to use and re-license that contribution. The CLA only needs to be signed once and it covers all unrestricted* Apache 2.0 ONF projects. 

* Some ONF projects may place restrictions on the use of source code and may require a more restrictive CLA to be signed. In this case it is possible a second CLA will need to be signed agreeing to those restrictions.

ONF CLA allows open source projects administered by ONF to safely accept code and documentation from external contributors. It helps to protect:

• Contributors, in that they retain their rights under contributions;
• ONF, so that it may redistribute contributions legally; and
• Consumers, in that they have confidence in using the software in products and operational systems.

There are many good sources of information about CLAs. Some we recommend for further information are:

• The Apache foundation; and
• Google Alphabet’s CLA policy which also uses Apache 2.0.

Two types of CLAs

Contributors can manage their agreements and sign new ones at the ONF CLA Manager. The first step is verifying your email address - this is important to complete, otherwise the sync will not work and you won't be able to submit pull requests or access member-only resources. Make sure to use your ONF member company email address for all steps. All contributors should direct their users to this site in their CONTRIBUTING file.

After you verify your email address, you'll need to sign a CLA in order to submit contributions. There are two versions of the ONF CLA. The version that needs to be signed depends on who owns the contribution being made. 

Individual CLA

If the individual owns the contribution themselves, they should sign the Individual CLA and add the email and/or GitHub user identities they use to contribute source code. Individual CLA is a simple click-through agreement that is accepted immediately. As soon as a contributor signs the agreement, ONF will be able to accept their contributions. 

Institutional CLA

If the contribution is owned by the contributor’s employer, they need to have their employer sign an Institutional CLA (pdf document here). It is up to the contributor to know whether their work is owned by their employer or not. The ONF CLA Manager suggests a sample email the contributor should send to the person with signing authority. Institutional CLA must be signed by someone with a signing authority for the corporation (typically a director or higher, or a company lawyer). Just as the Individual CLA, the Institutional CLA is a simple click-through agreement that is accepted immediately. Typically, the Institutional CLA is signed only once per corporation, but it is really up to the corporation, for example, in case they want to sign different CLAs for different departments. When signing the Institutional CLA, the authorized person (signatory) can also add managers to the CLA.  Managers are people who can add and remove other managers and contributors to/from the agreement. All contributors' email and/or GitHub user identities must be added to to the Institutional CLA, so that ONF will be able to accept their contributions. 

Verifying CLAs

Ultimately, it is the responsibility of the ONF project lead (or Technical Steering Team lead) to ensure that all contributors have signed the CLA before accepting their contributions.  ONF has implemented an automated system to check that all contributors have a valid CLA in place before accepting their contributions.

Exception - manual process for CLA signing in case the CLA Manager is not accessible (i.e., China)

In cases where the CLA Manager is not accessible, you may use the following manual process:

1. Download and save the MS Word version of either the Individual CLA or Institutional CLA (note that MS Word is necessary to open and fill these documents, Google Docs doesn't work)
2. Open the document and fill in all the fields including the list of emails and GitHub IDs of all contributors
3. Print, sign, scan, and email the signed agreement to help@opennetworking.org 
4. ONF will enter your CLA information to the CLA Manager manually based on the signed agreement and will confirm with you when completed

FAQ

Q: What is the ONF CLA? Why are you asking me to give up my rights?

A: The ONF CLA is designed to protect ONF projects as well as users of those projects from future litigation, including copyright and patent lawsuits. This gives users increased confidence and protection when they choose to use and deploy ONF solutions. The ONF CLA does not transfer or reassign ownership of your copyrights or patents to ONF; you or your company continue to own your intellectual property along with right, title, and interest in that property. The ONF CLA is written so that ONF and users of ONF software are granted a license to use your work.

Q: Besides code contributions, does the CLA apply to GitHub comments/open issues as well as contributions to the mailing list/wiki/conference calls?

A: Per the CLA document, "Contribution" shall mean the code, documentation, use cases, or other works of authorship, including any modifications or additions to an existing work, that are intentionally submitted by You to ONF for inclusion in, or documentation of, any of the open source software projects established, owned, or managed by ONF (the "Work"). For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to ONF or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, ONF for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by You as "Not a Contribution."

Q: What does the CLA apply to, does it apply to GitHub comments as well as contributions?

A: Yes, the CLA applies to all works of authorship sent to ONF, including on Github. However, we do not require a CLA to make comments or submit issues on Github. The ONF CLA excludes communication that is conspicuously marked or otherwise designated in writing by You as "Not a Contribution."

Q: Does the CLA apply only to ONF areas of GitHub and not to other parts?

A: An ONF CLA is required to contribute to ONF-managed repos in GitHub and Gerrit, but it may apply to contributions in other areas. The ONF CLA excludes communication that is conspicuously marked or otherwise designated in writing by You as "Not a Contribution."

Q: Does the CLA apply to meetings, Zoom sessions, webinars, etc.? Can I attend and/or submit presentations to these when I haven't signed the CLA?

A: Yes, the CLA applies to your contributions to during meetings, including the types listed in the question. However, we do not require a CLA to attend meetings or presentations. We encourage you to have a CLA on file if you are actively contributing use cases, documentation, etc. The ONF CLA excludes communication that is conspicuously marked or otherwise designated in writing by You as "Not a Contribution."

Q: Does the newly-signed CLA apply only to future contributions or also to past contributions?

A: The ONF CLA is intended to cover all submissions to any of the ONF projects.  Contributor may also be subject to certain obligations and notices for submissions made to repositories that contained notices or terms associated with such prior code contributions. This ONF CLA supersedes any prior ONF CLA that you may have signed, and work submitted under previous CLAs is covered under this one.

Q: I or my corporation already have a signed paper CLA in place, do I need to sign the new CLA?

A: Yes, the new CLA will overwrite the existing paper CLA. You need to sign the new CLA since ONF has implemented the automatic check of CLA before you can make a contribution. There is no way to check this based on your existing paper CLA.

Q: Is there a way to determine if you are currently covered by the CLA?

A: If you signed an Individual CLA, you can always check its validity by logging into the ONF CLA Manager. If someone added your identity to the Institutional CLA, that person can check the validity of the CLA. Finally, you can email to help@opennetworking.com with your request, and we will let you know.

Q: What if the CLA has been signed by your organization, are you covered?

A: You are covered only if the person who signed the Institutional CLA added your email address and/or your GitHub ID as an addendum to the CLA. Please see above question to determine if you are covered.

Q: What will specifically happen if you do not sign the CLA? What will you be barred from doing?

A: If you have not signed the CLA, you will no longer able to contribute code to any of the ONF open source projects. These checks are currently (as of April 2020) "soft", letting you know that you need to sign the CLA, and we are gradually rolling out the "hard" checks on all repos that will prevent you from contributing code in the future.

Q: Does the CLA only apply to ONF members? What if there is a contributor that is not an ONF member?

A: No, there is no difference between ONF members and non-members for the purpose of the ONF CLA.  Since ONF is an open source community, anyone can contribute and needs to have a valid CLA in place for doing so.

Q: What is the relationship of the CLA to GitHub's own licensing?

A: Contributor may be subject to certain obligations and notices for submissions made to repositories that contain notices or terms associated with such code contributions.

Q: Is the CLA applicable to a company and all its affiliates, even if those affiliates have their own corporate boards and legal departments, and for whom the affiliated company cannot legally sign?

A: The CLA provides protection to the ONF Members by ensuring that any contribution made by a Member or its affiliate is covered by the licensing obligations.  Only one company needs to sign the CLA but the IP obligation is applicable to all its Affiliates.  This is the method to ensure that the activities of the Affiliates are not used to avoid the IP obligation and protects the entire ecosystem. 

Q: Can we redline the ONF CLA and ask for a custom CLA for our company?

A: ONF needs to keep the same CLA terms for each Member and contributor to avoid any claims of unfairness or anti-competitiveness.  ONF appreciates comments and will review any requested changes with the Board as the situation dictates, however, changes are typically made across the board to apply to all Members and contributors.

Q: I linked my GitHub and ONF accounts but my contributions are still denied, why?

A: You are required to link your GitHub and ONF accounts in order to get access to the code but that does not mean that you are covered by a Contributor License Agreement. Please refer to the Individual or Institutional CLA section above.

I still need help...

Please contact ONF at help@opennetworking.org. 

--

Except as otherwise noted, the content of this document is licensed under CC-BY-4.0 license. Third-party product names and logos may be the trademarks of their respective owners.

This document is partly adapted from Google’s CLA information page.