Apache CLA Requirement for Pull Requests

[Shad Storhaug <sh...@shadstorhaug.com>]

Team,

I have been doing a bit of research into how the CLA applies to pull requests, and ran across this 3rd party blog post (https://apetro.ghost.io/apache-contributors-no-cla/), which seems to have done some research into whether an Apache CLA is actually required to accept a pull request from a contributor. The opinion provided there is that it is not required.

However, there are also links to official Apache sources that seem to confirm this opinion, such as (https://issues.apache.org/jira/browse/LEGAL-156?focusedCommentId=13554864&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-13554864):


  *   Short answer: Of course you can.
  *   Long answer: Any contribution - in any form (patch to the mailing list, blog post, JIRA attchment, git pull request, Bugzilla attachment, scrawled on the back of a napkin) - may be included as long as two conditions are met:
  *
  *   1. As per section 5 of AL2 the person providing the patch does not explicitly state that the patch provided is not licensed under ALv2
  *
  *   2. The project's PMC is happy that the person providing the contribution has the necessary rights to do so. This should be a very low bar (although I have seen lots of projects making artificially and unnecessarily high). Apache Tomcat works on the basis that unless there is a clear indication otherwise (e.g. a copyright header on the patch or a different license on the patch) then the provider does have the right to submit the patch. I can think of one issue in 10 years where there was a problem in this area and that was actually with code that came in to the ASF via another ASF project that Tomcat re-used and it took a couple of e-mails to fix. Worst case it would have had to have been re-written.
Even a link over to commons-collection seems to provide a backup of the claim (although the blog was using it as an example of a project REQUIRING a CLA):

https://github.com/apache/commons-collections/blob/master/CONTRIBUTING.md#submitting-changes


  *   Sign and submit the Apache Contributor License Agreement<https://www.apache.org/licenses/#clas> if you haven't already.
     *   Note that small patches & typical bug fixes do not require a CLA as clause 5 of the Apache License<https://www.apache.org/licenses/LICENSE-2.0.html#contributions> covers them.
The above example seems to be covering the bases, considering "large changes" to require a CLA, but "small changes and bug fixes" not to. However, according to the prior (official) answer from Apache, even this is unnecessary.

So, apparently the information that I have been told since I started contributing to Lucene.NET that I have been simply parroting to others does not appear to be correct. However, before I change the documentation to state that PRs can be accepted without a CLA, could someone please clarify if this is indeed the case and if not, can any official documented proof be provided to back it up?

One thing is for sure, it is confusing to new contributors to have to sign and email/fax a document just to make a pull request. It is even more confusing to have to do it again when invited as a committer. It would be much more clear if the CLA were only required when invited to become a committer (which is indeed what is stated in the first blog post I linked to).

Even the statement on our README seems unnecessary:


  *   If you plan to submit multiple pull requests, please submit an Individual Contributor License<https://cwiki.apache.org/confluence/display/LUCENENET/Individual+Contributor+License>, or for individual pull requests, just submit the request and in the description state that the code is your original work and you license it under the Apache License v2<http://www.apache.org/licenses/LICENSE-2.0>.

Since JIRA ticket from legal (above) states that setting the bar at "unless another license is explicitly stated, the changes can be included", is there any reason why we shouldn't lower the bar of accepting contributions to that same level?

Thoughts?

Shad Storhaug (NightOwl888)
Project Chairperson - Apache Lucene.NET