open-source-software
Does signing CLA and contributing to Apache project really grant a patent license for the entire Apache source tree?
<p>I've been going over the <a href="https://www.apache.org/licenses/cla-corporate.txt" rel="nofollow noreferrer">Apache CLA</a> recently, and while I am a layman here I see one point of concern that hopefully someone can clarify.</p>

<p>Specifically, it seems on first reading that section 3</p>

<blockquote>
  <p>You hereby grant to the Foundation and to recipients
  of software distributed by the Foundation a perpetual, worldwide,
  non-exclusive, no-charge, royalty-free, irrevocable ...
  where such license applies only to those patent claims licensable
  by You that are necessarily infringed by Your Contribution(s)
  alone or by combination of Your Contribution(s) with the Work to
  which such Contribution(s) were submitted.</p>
</blockquote>

<p>"combination of Your Contribution(s) with the Work to
which such Contribution(s) were submitted" would on its face mean that if, for instance, there was existing infringement of Foo Corp's patents buried deep within the Apache sources that Foo Corp was not aware of, and Foo Corp signed the CLA then submitted a trivial patch completely unrelated to the infringing code, that Foo Corp just gave a patent license for all existing infringing code without even knowing it existed.</p>

<p>Is this a correct reading, and if not, what am I missing?  <strong>Note that I understand patent licenses can only be granted if Foo Corp is legally allowed to do so, the question is more on the interplay between a systems patent and the CLA as detailed below.</strong></p>

<p>To add an interesting twist: the real world issue being considered here is not one of software-only patents (which I generally consider a bad idea anyway), but one of patents that claim certain functionality relying on both specific software and specific hardware components working together.  As I understand it, attempting to claim infringement against the software component alone would be near suicide as the existing grants back to Foo Corp would terminate, but it should still be possible to claim infringement against any commercial packaged system products (hardware + software) that infringe without invoking the Apache revocation clause.</p>

<p>What is not clear to me is whether a.) the grant is as I assume above and b.) whether this would then affect the ability to claim infringement against a competitor of Foo Corp that is selling infringing systems (hardware + software) that include the Apache licensed software.</p>

<p>Thanks!</p>

<p>You have misunderstood. If Foo Corp makes a contribution, and enters into an Apache Contributor License Agreement (CLA), Foo Corp grants both a copyright license and a patent license to the Apache Foundation (AF). This does not give Foo Corp any rights in return.</p>

<p>Foo Corp grants AF (and re-users of software licensed by Apache) permission to "make, have made, use, offer to sell, sell, import, and otherwise transfer the Work", but this extends only to rights which Foo is entitled to grant, and only to those rights which use of Foo's contribution would infringe in the absence of such permission. That is, if Foo has patent rights in the contribution, or in some technology which Fo has used in the contribution, Foo grants to AF sufficient rights to make use of that contribution, including rights that Foo holds which would otherwise be infringed by using Foo's contribution together with any of the various other contribution. But the only rights granted are those which Foo holds. Foo agreeing to the CLA does not grant Foo any additional rights to anyone else's patents.  </p>

<p>If Foo, or anyone else (a "re-user"), gets software lawfully from Apache,  all such re-users are granted whatever patent rights any of the contributors held as of the dates of their contributions which are needed to use that software. Basically, it means that no contributor will sue any re-user for patent infringement because of anything included in any contribution by the contributor. It soesn't purport to convey anyone else's patent rights to anyone.</p>
