Can the GitHub pull request process constitute an electronic signature of a CLA?

Question

I appreciate the need for a Contributor License Agreement (CLA) in open source software projects and even understand that some tools are starting to make this process easier (like the low-friction CLAHub for GitHub and Project Harmony). However, rather than requiring a third-party form submission for an electronic signature, would adding an extra sentence and the CLA itself to CONTRIBUTING.md, which GitHub links to when a contributor files a pull request (displayed as "Please review the guideline for contributing to this repository"), allow for a valid electronic signature (e.g. "Submitting a pull request to this repository on GitHub with your name and email constitutes your agreement to and electronic signature of the following Contributor License Agreement...")? Perhaps that argument hinges on the definition of "electronic signature" (ESIGN, UETA, etc.):

"Electronic signature" means an electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record.

And I would like to propose that the GitHub pull request "process" is "logically associated" with the CONTRIBUTING.md/CLA "record" and that the contributor has the "intent to sign" by adopting the process...

(Since the Open Source Licensing Q&A site is still a just a proposal, I will accept IANAL answers here.)

Answer 1

Probably not. A pull request is just an automated "please take this and use it" communication, rather than a real electronic signature. While you can definitely state that a pull request consituttes agreement to your site's CLA, you won't be able to say that it's been "signed."

This matters because you may want to do what the FSF does, and have your contributors actually transfer their copyright to you so you don't have to chase them down and get a signature when you want to sue someone for taking your work and using it against the terms of your project's license. Transfers of copyright, as per the US Copyright Office, have to be "in writing and signed."

Any or all of the copyright owner’s exclusive rights or any subdivision of those rights may be transferred, but the trans fer of exclusive rights is not valid unless that transfer is in writing and signed by the owner of the rights conveyed or such owner’s duly authorized agent.

If you care about tracking electronic signatures, you probably want to go with something explicit. (And if you're not tracking sig's and just being implicit, there's no reason to track anything.)

Answer 2

No. You need to have contributors explicitly sign a CLA, as GitHub themselves do.