Contributor License Agreement

Why Handsoncode asks for a CLA, what it covers, and how the check on your pull request works.

Sign the CLA

Why it is required

Handsoncode publishes the code it merges — in open-source releases and in commercial products. To do that, it needs the right to use, relicense, and distribute every contribution. The CLA is the record of that permission. Without it, the ownership of a merged pull request is unclear, which blocks releases and creates attribution problems years later.

You keep the copyright to your work. The CLA grants Handsoncode a licence to it; it does not transfer ownership.

What it covers

One signature, all projects. The agreement is recorded against your GitHub account, not against a repository, so it applies to every Handsoncode open-source project:

• handsontable/handsontable
• handsontable/hyperformula

If you have already signed for one of them, you are done — the check on a pull request in the other passes automatically.

How the check works

1. You open a pull request.
2. A GitHub App looks up your GitHub login in the signature database and sets the cla/signed status check on your commit.
3. If no signature is found, the check fails and a bot comments with your personal signing link.
4. You open the link, authenticate with GitHub, read the agreement, and submit the form.
5. The check flips to green on every open pull request you have, in all covered repositories, and the bot confirms it.

Members of the handsontable GitHub organization and known bots are exempt — their contributions are covered by other agreements.

Reviewers: how a signature is verified

There is nothing to verify by hand. The cla/signed status check is a required check on the default branch of every covered repository, so an unsigned pull request cannot be merged — the merge button stays blocked. Do not merge a pull request whose CLA check is red, and do not attempt to work around it.

Where the records live

Item	Detail
Current CLA version	1.0
Agreement text	https://cla.handsontable.com/sign
Signature records	Cloudflare D1, EU West region
Stored per signature	GitHub login, name, email, optional company, CLA version, timestamp, originating pull request
Retention	Kept indefinitely as a legal record

Questions and data requests

For anything about the agreement, a correction to your record, or an erasure request, email support@handsontable.com.