Since sourcegraph was Apache2, it doesn't matter whether or not contributors signed a CLA. Apache2 only requires them to provide attribution. At any point a per

Since sourcegraph was Apache2, it doesn't matter whether or not contributors signed a CLA. Apache2 only requires them to provide attribution. At any point a permissively licensed project can go closed-source. When they distribute it, they'd provide attribution, and would provide a link off to code from the last open source version. A CLA primarily provides legal coverage for the legal entity primarily responsible for the project, as they can claim copyright on all the changes. From a project maintainer perspective, I prefer DCO over CLA, as it provides a similar style of protection, but in general lawyers at companies default to a CLA. If you want access to future changes, you need to limit yourself to contributing to copyleft licenses.