If you submit a pull request, don't forget to separately mail the company the license agreement and all associated patents
https://github.com/Nike-Inc/nike-inc.github.io/blob/master/C...
https://github.com/Nike-Inc/nike-inc.github.io/blob/master/C...
If that's the case, how do so many open source projects get away without them? Do companies individually vet patents for projects they use? (doubtful.. but maybe)
Non-trivial, inclusion-worthy patches don't just fall from the sky; certainly, if it ever were to happen, you can be sure that other developers will be doing a search for patents issued to that author. If anything were found, the patch author would be advised that the contribution could not be accepted, due to the patent.
If and when a project's developers become aware that a technique used is patented, or even just potentially infringing pending some legal outcome, whatever would have to be ripped out is ripped out. But the patent, and the potential infringement, will not be discussed publicly. Open-source projects can't work any other way - the liability is on the users, not the developers, and it's not in their interest to expose their uses to "willful infringement" liability. Even public discussion of actual or potential infringement in is toxic - you would be asked to stop (privately).
It is what it is. It's also not too problematic, in my limited experience. But that may well simply be because nobody tries to find infringement, for obvious reasons.
I wonder, in all honesty, how often do people search for patent infringement when accepting large inclusion-worthy PRs? I doubt very often, personally..
For example, I could try to submit a pull request to an audio/video project to add an H.264 decoder/encoder that I wrote myself. That is OK because I wrote the code, and therefor I own the copyright to that code.
However, anyone who tries to use this code can be sued by MPEG LA for money or they can even ask them to cease and desist outright if they wish -- because it's their patented technology! It also works the other way around, if I wrote both the code and acquired a patent for the technology.
A CLA is the only way to stay safe, as far as I understand, but most open source projects just don't use them (except very large ones, like the Linux kernel etc).
It also mentions that there is an 'implicit' patent grant provided by the revised BSD license[1] but that it has never been tested in court (which I presume means it is not advised).
I guess Apache 2.0 (or if you're a copyleft kind of guy, GPL3) is the way to go!
[1] http://en.swpat.org/wiki/Patent_clauses_in_software_licences...
Uhh ... The Linux kernel doesn't use a CLA. It uses Developer Certificates of Origin: the Signed-off-by lines.