Making a CLA for Thrive

hhyyrylainen · June 4, 2021, 5:02pm

A contributor license agreement (CLA) is a legal agreement between project contributors and the legal entity maintaining the project (in our case, Revolutionary Games Studio ry), in it the contributors either grant a non-revocable very extensive license to the project or assign all copyrights related to the work to the project (and the project then provides back the non-revocable very extensive license to the contribution).

So basically by having a CLA we can consolidate the code ownership, which I think for example is necessary if we want to sue someone violating the Thrive licensing terms, and also allows re-licensing the software. That second point is why I feel like we need to have a CLA now (or a CAA).

I just today posted a poll on the community forums and it seems like more people are open to buying the game on steam for a fee instead of donating. So I think this solidifies my point that for the long-term future Thrive needs to be on Steam. And to do that we need to have a custom proprietary license for the Thrive version that is put on Steam. At least Steam’s own help page says: " Keep in mind that according to the Steam Distribution Agreement you warrant and represent that you have all necessary rights to distribute the game via Steam. If your application contains third party open source code that is incompatible with the Steamworks SDK, then YOU MUST NOT DISTRIBUTE YOUR APPLICATION VIA STEAM."

So we need a CLA and we need all source code contributors (and preferably also artists) to sign it. If we can’t get everyone to sign the CLA, then we need to rip out their contributions from our code base and ensure no existing code can be considered to be a derived work of their code, otherwise we are liable to be sued for violating the license the code is under.

As for what agreements we should go for, I found these templates by Harmony:

CLA: http://www.harmonyagreements.org/docs/ha-cla-i-v1.pdf
CAA: http://www.harmonyagreements.org/docs/ha-caa-i-v1.pdf

I think those are pretty good to use, and we could do some modifications if we want, for example to add a clause that on request we may consider removing a previously submitted contribution, but aren’t required to do so if it would inconvenience us too much.

As to the licensing options we’ll need to select the “any license” because I don’t want to have to list all the different store proprietary licenses there to future proof things. And we can also mention the Attribution-ShareAlike 3.0 Unported license for media files to finally get a grip on the asset files, because currently we rely on the weakest of affirming from the artists that we are free to use their artwork for Thrive, so someone could very easily demand we remove any of their artwork from the game…

Looks like this helper site also uses those licenses as bases: Contributor License Agreement Chooser

We might also consider using the CLA assistant licenses as a template (or amend the Harmony templates with any missing points): CLA assistant

And for instructions regarding external contributions, we could look at: https://developercertificate.org/ though that doesn’t fully cover our case, I think, but a slight modification on that to basically say you need to get the original contribution author (or co-author) to sign our CLA before submitting work.

Update: here’s some more relevant links:

Update 2: I also talked about the future of distributing Thrive on Github here: Replaced the noise library by hhyyrylainen · Pull Request #2290 · Revolutionary-Games/Thrive · GitHub which might be of interest.

For signing, I think we can get by with an electronic process where we use email and github login to verify the person signing is the one whose email is used to author the commits and submit a PR.

Thoughts, opinions? The sooner we get this done the less painful it will be in the future.

SIGNING IS NOW LIVE: https://dev.revolutionarygamesstudio.com/cla

hhyyrylainen · June 5, 2021, 10:31am

I ran out of time yesterday so I didn’t actually state my own opinion, so here’s that.

I think we should go for a CLA instead of a CAA because of two reasons:

I think a CLA with non-exclusivity clauses, and the grant to relicense the work further under any license is basically the same as a CAA, so we can relicense the game as needed
A CAA is basically an exclusive transfer of ownership of the code to the legal entity, which I think people may be more hesitant to sign, so a CLA is a lower barrier to entry, even if the end result is the same: Revolutionary Games Studio ry will be able to dual license to codebase for distributing on different platforms (Github vs Steam)

Some discussion I found about this: CLA, CAA, CA etc. etc. – let’s get it right - 🔮 Meta - Nextcloud community and CAA exclusivity. CLA inbound, Apache outbound. [LWN.net] and A Qualitative Study on the Adoption of Copyright Assignment Agreements (CAA) and Copyright License Agreements (CLA) within Selected FOSS Projects — jipitec

Which brings up the downside of a CLA: the project as a whole can’t sue someone for copyright infringement (due to violating our license) as the project doesn’t entirely own the copyright for all parts of the code. As a fix though, they suggest explicit wording in an CLA to allow that: “Since non-exclusive licenses do not automatically confer standing in a court of law, however, it might be recommendable to include such a right expressly in a CLA, simply to be in the position to sue should it become necessary at some point.”

So I think that a CLA that takes these extra needed additions into account is the right way to go. I would really like some feedback from other people on this. Are you ready to sign such an agreement for Thrive?

hhyyrylainen · June 8, 2021, 4:35pm

Here’s a draft of the agreement based on the Harmony Individual Contributor License Agreement (HA-CLA-I) version 1.0 Agreement Templates | Harmony Agreements

Thank you for your interest in contributing to Thrive (“We” or “Us”).

This contributor agreement (“Agreement”) documents the rights granted
by contributors to Us. To make this document effective, please sign it
electronically, following the instructions at
ThriveDevCenter. This is a legally
binding document, so please read it carefully before agreeing to
it. The Agreement may cover more than one software project managed by
Us.

1. Definitions

“You” means the individual who Submits a Contribution to Us.

“Contribution” means any work of authorship that is Submitted by You
to Us in which You own or assert ownership of the Copyright. If You do
not own the Copyright in the entire work of authorship, please follow
the instructions in ThriveDevCenter.

“Copyright” means all rights protecting works of authorship owned or
controlled by You, including copyright, moral and neighboring rights,
as appropriate, for the full term of their existence including any
extensions by You.

“Material” means the work of authorship which is made available by Us
to third parties. When this Agreement covers more than one software
project, the Material means the work of authorship to which the
Contribution was Submitted. After You Submit the Contribution, it may
be included in the Material.

“Submit” means any form of electronic, verbal, or written
communication sent to Us or our representatives, including but not
limited to electronic mailing lists, source code control systems, and
issue tracking systems that are managed by, or on behalf of, Us for
the purpose of discussing and improving the Material, but excluding
communication that is conspicuously marked or otherwise designated in
writing by You as “Not a Contribution.”

“Submission Date” means the date on which You Submit a Contribution to
Us.

“Effective Date” means the date You execute this Agreement or the date
You first Submit a Contribution to Us, whichever is earlier.

“Media” means any portion of a Contribution which is not software.

2. Grant of Rights

2.1 Copyright License

(a) You retain ownership of the Copyright in Your Contribution and
have the same rights to use or license the Contribution which You
would have had without entering into the Agreement.

(b) To the maximum extent permitted by the relevant law, You grant to
Us a perpetual, worldwide, non-exclusive, transferable, royalty-free,
irrevocable license under the Copyright covering the Contribution,
with the right to sublicense such rights through multiple tiers of
sublicensees, to reproduce, modify, display, perform and distribute
the Contribution as part of the Material; provided that this license
is conditioned upon compliance with Section 2.3.

2.2 Patent License

For patent claims including, without limitation, method, process, and
apparatus claims which You [or Your Affiliates] own, control or have
the right to grant, now or in the future, You grant to Us a perpetual,
worldwide, non-exclusive, transferable, royalty-free, irrevocable
patent license, with the right to sublicense these rights to multiple
tiers of sublicensees, to make, have made, use, sell, offer for sale,
import and otherwise transfer the Contribution and the Contribution in
combination with the Material (and portions of such combination). This
license is granted only to the extent that the exercise of the
licensed rights infringes such patent claims; and provided that this
license is conditioned upon compliance with Section 2.3.

2.3 Outbound License

Based on the grant of rights in Sections 2.1 and 2.2, if We include
Your Contribution in a Material, We may license the Contribution under
any license, including copyleft, permissive, commercial, or
proprietary licenses. As a condition on the exercise of this right, We
agree to also license the Contribution under the terms of the license
or licenses which We are using for the Material on the Submission
Date.

In addition, We may use the following licenses for Media in the
Contribution: Creative Commons Attribution-ShareAlike 3.0 Unported,
Creative Commons Attribution-NonCommercial-ShareAlike 3.0, and
GNU Free Documentation License version 1.3
(including any right to adopt any future version of a license if permitted).

2.4 Moral Rights

If moral rights apply to the Contribution, to the maximum extent
permitted by law, You waive and agree not to assert such moral rights
against Us or our successors in interest, or any of our licensees,
either direct or indirect.

2.5 Our Rights

You acknowledge that We are not obligated to use Your Contribution as
part of the Material and may decide to include any Contribution We
consider appropriate.

2.6 Reservation of Rights

Any rights not expressly licensed under this section are expressly
reserved by You.

3. Agreement

You confirm that:

(a) You have the legal authority to enter into this Agreement.

(b) You own the Copyright and patent claims covering the Contribution
which are required to grant the rights under Section 2.

(c) The grant of rights under Section 2 does not violate any grant of
rights which You have made to third parties, including Your employer.
If You are an employee, You have had Your employer approve this
Agreement or sign the Entity version of this document. If You are
less than eighteen years old, please have Your parents or guardian
sign the Agreement.

(d) You have followed the instructions in
ThriveDevCenter, if You do not own the
Copyright in the entire work of authorship Submitted.

4. Disclaimer

EXCEPT FOR THE EXPRESS WARRANTIES IN SECTION 3, THE CONTRIBUTION IS
PROVIDED “AS IS”. MORE PARTICULARLY, ALL EXPRESS OR IMPLIED WARRANTIES
INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTY OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
ARE EXPRESSLY DISCLAIMED BY YOU TO US. TO THE EXTENT THAT ANY SUCH
WARRANTIES CANNOT BE DISCLAIMED, SUCH WARRANTY IS LIMITED IN DURATION
TO THE MINIMUM PERIOD PERMITTED BY LAW.

5. Consequential Damage Waiver

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL
YOU BE LIABLE FOR ANY LOSS OF PROFITS, LOSS OF ANTICIPATED SAVINGS,
LOSS OF DATA, INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL AND
EXEMPLARY DAMAGES ARISING OUT OF THIS AGREEMENT REGARDLESS OF THE
LEGAL OR EQUITABLE THEORY (CONTRACT, TORT OR OTHERWISE) UPON WHICH THE
CLAIM IS BASED.

6. Miscellaneous

6.1 This Agreement will be governed by and construed in accordance
with the laws of Finland excluding its conflicts of law
provisions. Under certain circumstances, the governing law in this
section might be superseded by the United Nations Convention on
Contracts for the International Sale of Goods (“UN Convention”) and
the parties intend to avoid the application of the UN Convention to
this Agreement and, thus, exclude the application of the UN Convention
in its entirety to this Agreement.

6.2 This Agreement sets out the entire agreement between You and Us
for Your Contributions to Us and overrides all other agreements or
understandings.

6.3 If You or We assign the rights or obligations received through
this Agreement to a third party, as a condition of the assignment,
that third party must agree in writing to abide by all the rights and
obligations in the Agreement.

6.4 The failure of either party to require performance by the other
party of any provision of this Agreement in one situation shall not
affect the right of a party to require such performance at any time in
the future. A waiver of performance under a provision in one situation
shall not be considered a waiver of the performance of the provision
in the future or a waiver of the provision in its entirety.

6.5 If any provision of this Agreement is found void and
unenforceable, such provision will be replaced to the extent possible
with a provision that comes closest to the meaning of the original
provision and which is enforceable. The terms and conditions set
forth in this Agreement shall apply notwithstanding any failure of
essential purpose of this Agreement or any limited remedy to the
maximum extent possible under law.

I’m not 100% sure if this is suitable, so as long as it is reasonable priced to do so, I’ll try to get a lawyer to review that and the proposed signing process, which will be roughly:

Go to the devcenter, there’ll be a page there with the license agreement and some buttons to start the signing process
For the signing process an email address is needed that is validated with an email sent to it so that the person signing owns the email
There’ll also be a login with github button to link a github account (this will be needed to make detecting that a PR author has signed the CLA)
After that the user types in their name (and if they are under 18 or don’t have legal competence status, their guardian must sign similarly as well) and then “signs” by typing in their name again before hitting accept

I’ve seen that in one digital signing service, which hopefully means it’ll be enough. ~~If it isn’t enough then we’ll have to fallback on asking people to send in scanned documents, which will be harder to process and harder to sign.~~ Seems like a fine weak authentication process, should be enough for us

A few points / questions that need answering:

The agreement needs to apply retroactively Will be changed
Agreement needs to not grant the contribution creator any additional rights to the entire software. Probably doesn’t.
“We agree to also license the Contribution under the terms of the license or licenses which We are using for the Material on the Submission Date.” means that we need to keep the code up on github under the GPL but can license differently elsewhere. right? We’ll promise to have the source code up on Github as the outbound license (for parts that don’t have to be closed), but also can proprietary license for platforms where needed
Do we need a clause to allow us to sue on behalf of the individual contributors for copyright infringement? As it seems that maybe a basic CLA doesn’t allow that but a CAA would. Is worth adding
Should we mention online forums managed by Revolutionary Games, and our managed discord servers (or more generally instant messaging) in the CLA? Probably doesn’t hurt adding…
Do we need a separate agreement for organizations if they want their employees to contribute to Thrive? How do we fit that agreement in the above described signing process? Not worth it at this time

hhyyrylainen · June 21, 2021, 2:31pm

I guess I’ll put these here (some links on the relicensing after we get a CLA done):

hhyyrylainen · July 15, 2021, 7:35pm

So the changes to the CLA text are as follows:

Added before section 1:

For clarity, it is stated that any Contributions Submitted by You to Us also before the signature of this Agreement are governed as Contributions under this Agreement.

Replaced start of section 2.3:

As a condition on the grant of rights in Sections 2.1 and 2.2, to the extent we include Your Contribution or a part of it in a Material, We may license the Contribution under any license, including copyleft, permissive, commercial, or proprietary licenses. As a condition on the exercise of this right, We agree to also license the Contribution under the terms of any license which is approved by the Open Source Initiative (“OSI”) on or after the Effective Date, including both permissive and copyleft licenses, whether or not such licenses are subsequently disapproved (including any right to adopt any future version of a license if approved by the OSI).

Gives us permission to license proprietarily (for Steam etc.), but also requires the work to be licensed out under the GPL.

New 2.5 section inserted before “Our rights section”:

2.5 Enforcement. You, as a copyright holder to Your Contribution, hereby authorize us to enforce the OSI approved license applied by Us to a Material, but only to the extent Your Contribution has been included in a Material and always subject to Our free discretion on whether such enforcement is necessary or not.

Gives us CAA like right to sue someone who misuses the GPL licensed code of the project, without requiring contributors to hand over copyrights.

Here’s the full text again:

Thank you for your interest in contributing to Thrive (“We” or “Us”).

This contributor agreement (“Agreement”) documents the rights granted
by contributors to Us. To make this document effective, please sign it
electronically, following the instructions at
ThriveDevCenter. This is a legally
binding document, so please read it carefully before agreeing to
it. The Agreement may cover more than one software project managed by
Us.

For clarity, it is stated that any Contributions Submitted by You to
Us also before the signature of this Agreement are governed as
Contributions under this Agreement.