Many open-source projects now require contributors to agree to a [[https://en.wikipedia.org/wiki/Developer_Certificate_of_Origin | Developer Certificate of Origin]], primarily [[https://developercertificate.org/ | this one]]. Legal departments of open-source companies are particularly fond of it.
It is sufficient to state conspicuously in CONTRIBUTING that all contributors agree to the DCO, for example:
```
## Certificate of Origin
By contributing to this project you agree to the Developer Certificate of Origin (DCO). This document was created by the Linux Kernel community and is a simple statement that you, as a contributor, have the legal right to make the contribution. See the DCO file for details.
```
And add the text of the DCO to the repository (preferably in the root directory, though in Pacemaker's case devel could be a good choice as well).
Alternatively or in addition, projects can require every commit to be "Signed-off-by" in which case github.com/apps/dco can be used to enforce the requirement.
This should be brought up with the community, particularly the users and developers lists, and if there is a consensus, then ideally all ClusterLabs projects should adopt it around the same time. Clear instructions for contributors should be posted on the ClusterLabs.org website and in the //Pacemaker Development// book.
Somewhat related, we might also want to encourage (but should not require) contributors to sign the [[https://github.com/gplcc/gplcc/blob/master/Individual/README-INDIVIDUAL.md | GPL Cooperation Commitment]].