Lesson 8 · governance

CLA, DCO and contributor authority

A sign-off and copyright assignment are different acts.

A Developer Certificate of Origin sign-off certifies the contributor has a basis to submit the work under the indicated license. It is not a transfer of copyright ownership. The identity in the sign-off must correspond to the contributor.

A Contributor License Agreement can grant additional rights, and its exact wording matters. Some agreements allow broad relicensing; some address patents; some assign copyright. The acronym alone tells you none of those details.

Before changing a project license, identify who owns the relevant contributions and which permissions were granted. An authorized maintainer cannot invent rights that another contributor never supplied.

This exercise supplies an author and a contribution license. Record their sign-off and the incoming grant as evidence, without claiming copyright assignment.

Read the primary terms and guidance ↗

Try it: Signed off by whom?

The patch author is Alex Example <[email protected]>. A DCO is a certification, not copyright assignment. Include the author's sign-off in COMMIT.txt and a declaration that the contribution stays under MIT.

Before inspecting the result

What does this supplied release need before its modeled requirements are met?

Already meets the requirementsA concrete repairAdditional evidence or a license choice

Project boundary

2 components

Dependency relationships
From → to	Connection	Semantics
app → library	bundle	intimate

Supplied facts

Distribution: binary
Network interaction: No
Intended use: internal
Evaluation date: 2026-10-24
Policy: learning

These facts define the simulation. Evidence declarations stand in for actual corresponding source, relinkable objects and release materials.

Components

Inspect component

Declared license: LicenseRef-Proprietary
Modified files: None
Artifact: code

Third-party grants remain fixed unless this scenario supplies authority to change them.

Project artifacts

Format library 1.0.0

MIT License

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
associated documentation files (the "Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial
portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.

Evidence artifact format

Source offers contain “component: id” and “source: https://…” on separate lines. Covered-file offers also list the covered paths. Relinking declarations contain “replace-compatible-library” for dynamic linking or “relink-object-files” for static linking, and “reverse-engineering-permitted”. These declarations model supplied release artifacts.

License reference

permissions: commercial-use, modifications, distribution, private-use
conditions: include-copyright, include-license
limitations: liability, warranty

Read authoritative terms ↗

Expression builder

SPDX expression

Each row is one selectable alternative. AND retains every term in a row.
Alternative	Required licenses
1	MIT AND LGPL-3.0-only
2	Apache-2.0 AND LGPL-3.0-only

Results appear after submission.