1

It seems like most Customer License Agreements need to be explicitly signed by the contributor. This is a bit of an inconvenience, as contributors need to retrieve the CLA document, have access to some digital signing service or even print it out, and then attach it to their contribution.

I read that signing a contract is often necessary to enforce it against the signing party. Isn't a CLA generally only granting rights to the maintainer? What would the maintainer need to enforce against the contributor?

Would it be sufficient for the maintainer to simply write "By submitting your patches to us in such and such a way, you are releasing them to us under the terms of our CLA"? How would e.g. the Harmony CLA need to be modified to allow for that?

1
  • Could you clarify whether you are asking about Contributor Assignment Agreements (CAA) which is what David Siegel covered in his answer, or about Contributor License Agreements (CLA) which do not involve a copyright transfer? The Harmony Agreements have both flavors, and the document your linked confusingly includes the text blocks of both variants.
    – amon
    Feb 20, 2022 at 11:24

1 Answer 1

1

The signature requirement is reasonable and need not be onerous

Signature requirement

Various licenses, including copyright transfers and assignments, are required by the local version of the Statute of Frauds in most jurisdictions to be in writing.

Under 17 USC 204(a)](https://www.copyright.gov/title17/92chap2.html#204)

(a) A transfer of copyright ownership, other than by operation of law, is not valid unless an instrument of conveyance, or a note or memorandum of the transfer, is in writing and signed by the owner of the rights conveyed or such owner’s duly authorized agent.

I believe there are similar requirements for patent rights.

Thus the maintainers reasonably require a signature.

A maintainer might need to establish the validity of the rights and licenses transferred from the contributor, whether against a claim of infringement by the contributor or another, or against a claim that the maintainer is not authorized to b ring a copyright suit for infringement of its rights from some third party. A signed transfer would substantially assist a maintainer in any such legal situation.

No "Signature Service" is needed

US Federal Esign Act

According to the US Federal Esign Act (found in 15 USC Chapter 96](https://www.law.cornell.edu/uscode/text/15/chapter-96)) no "digital signing service" is required for a fully valid electronic signature.

15 USC 7001 (a) provides that:

(1) a signature, contract, or other record relating to such transaction may not be denied legal effect, validity, or enforceability solely because it is in electronic form; and
(2) a contract relating to such transaction may not be denied legal effect, validity, or enforceability solely because an electronic signature or electronic record was used in its formation.

and 15 USC 7006 (5) provides:

(5) Electronic signature

The term “electronic signature” means an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record.

Under section 15 USC 7002 (subsection (a)(2)(A)(ii)) alternative procedures for electronic signatures are valid only if:

such alternative procedures or requirements do not require, or accord greater legal status or effect to, the implementation or application of a specific technology or technical specification for performing the functions of creating, storing, generating, receiving, communicating, or authenticating electronic records or electronic signatures;

In short an "electronic signature" may consist of nothing more than a text version of the signer's name, with no special cryptographic or other technical measures applied, provided that the signed included the name with intent to indicate the signer's acceptance of the document.

US Uniform Electronic Transactions Act

The Uniform Electronic Transactions Act adopted by almost all US states, has simialr provisions. In the text of the act

section 2 paragraph (8) reads:

“Electronic signature” means an electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record

The official comment on theis part of section 2 reads:

Electronic signature.” The idea of a signature is broad and not specifically defined. Whether any particular record is “signed” is a question of fact. Proof of that fact must be made under other applicable law. This Act simply assures that the signature may be accomplished through electronic means. No specific technology need be used in order to create a valid signature. One’s voice on an answering machine may suffice if the requisite intention is present. Similarly, including one’s name as part of an electronic mail communication also may suffice, as may the firm name on a facsimile. It also may be shown that the requisite intent was not present and accordingly the symbol, sound or process did not amount to a signature. One may use a digital signature with the requisite intention, or one may use the private key solely as an accessdevice with no intention to sign, or otherwise accomplish a legally binding act. In any case the critical element is the intention to execute or adopt the sound or symbol or process for the purpose of signing the related record.

The definition requires that the signer execute or adopt the sound, symbol, or process with the intent to sign the record.

Section 7(a) of the UETA provides:

A record or signature may not be denied legal effect or enforceability solely because it is in electronic form

The official comment on section 7 reads, in pertinent part:

  1. This section sets forth the fundamental premise of this Act: namely, that the medium in which a record, signature, or contract is created, presented or retained does not affect it’s legal significance. Subsections (a) and (b) are designed to eliminate the single element of medium as a reason to deny effect or enforceability to a record, signature, or contract. The fact that the information is set forth in an electronic, as opposed to paper, record is irrelevant

Section 9 of the UTEA reads:

(a) An electronic record or electronic signature is attributable to a person if it was the act of the person. The act of the person may be shown in any manner, including a showing of the efficacy of any security procedure applied to determine the person to which the electronic record or electronic signature was attributable.
(b) The effect of an electronic record or electronic signature attributed to a person under subsection (a) is determined from the context and surrounding circumstances at the time of its creation, execution, or adoption, including the parties’ agreement, if any, and otherwise as provided by law

The official comment on section 9 reads, in pertinent part:

  1. Under subsection (a), so long as the electronic record or electronic signature resulted from a person’s action it will be attributed to that person – the legal effect of that attribution is addressed in subsection (b). This section does not alter existing rules of law regarding attribution. The section assures that such rules will be applied in the electronic environment. A person’s actions include actions taken by human agents of the person, as well as actions taken by an electronic agent, i.e., the tool, of the person. Although the rule may appear to state the obvious, it assures that the record or signature is not ascribed to a machine, as opposed to the person operating or programming the machine.

In each of the following cases, both the electronic record and electronic signature would be attributable to a person under subsection (a):

  • A. The person types his/her name as part of an e-mail purchase order;
  • B. The person’s employee, pursuant to authority, types the person’s name as part of an email purchase order;
  • C. The person’s computer, programmed to order goods upon receipt of inventory information within particular parameters, issues a purchase order which includes the person’s name, or other identifying information, as part of the order.

In each of the above cases, law other than this Act would ascribe both the signature and the action to the person if done in a paper medium. Subsection (a) expressly provides that the same result will occur when an electronic medium is used.

Effect of US Laws on E-signatures

Thus under both US Federal and State law, an electronic signature need not use any particular technology, and may be simply a text name or symbol. Or a person could print out an agreement, sign it by pen, stamp, or pencil, and scan the signed document to produce an electronically signed document. A person could also generate a PGP signature of the licensee, using a previously (or subsequently) published key pair, and include the PGP signature with the electronic copy of he license. Or there are other freely available cryptographic signature protocols available. B ut use of such a cryptographic solution is not required, a simple typed name will do.

Indeed merely having the contributor type his or her name into a web form would be sufficient in most jurisdictions.

I believe that the law of electronic signatures is similar in many other countries.

Alterations to the harmony Agreement

Would it be sufficient for the maintainer to simply write "By submitting your patches to us in such and such a way, you are releasing them to us under the terms of our CLA"?

Such "click-through" agreements are often held not binding, unless the other party has been clearly informed of the details, and has then engaged in an affirmative act of acceptance. Any such altered agreement would need to include some such affirmative act of accepting the agreement, different from merely submitting the contribution. What might be required could be different in different jurisdictions. Such a change might actually make the ways in which a contributor could submit a valid contribution more limited.

5
  • 1
    I think the most important part is the last paragraph which mentions click-through agreements: without a signed agreement, it gets difficult to show that a contract about the IP has been formed. There might not be the meeting of minds, offer and acceptance, or consideration. This is disadvantageous to the maintainer who wants to rely on the rights granted through the CLA. But I don't think a CLA would necessarily require a signature to be effective, since it is only a license and not a copyright transfer.
    – amon
    Feb 20, 2022 at 11:34
  • Thank you very much! Does this mean that the traditional "Signed-off by ..." line in Linux patches is such an electronic signature?
    – Tau
    Feb 21, 2022 at 10:44
  • @Tau it might be, that will depend in part on the intent of the signer, adn of the normal use of such entries. I don't suppose those form a legal agreement? Feb 21, 2022 at 14:53
  • 1
    @Amon a signature might not be strictly required to give a CLA legal effect, but it will make any legal action easier, remove an argument, and it is reasonable for the maintainer to insist on one. Feb 21, 2022 at 14:55
  • 1
    @Tau The Signed-off-by trailer in Git commits typically relates to the Linux Developer Certificate of Origin. It is not a CLA, it merely affirms that the contributor has the right to make the contribution. But what that trailer line means depends on the project – projects other than Linux might use it for a different purpose, such as confirming that a CLA has been signed.
    – amon
    Feb 21, 2022 at 15:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .