Signing the CLA on behalf of Arm Ltd

[jimfly01]

Describe the issue

Arm Ltd has recently decided to contribute to the ONNX Runtime and has completed all its internal processes to get the correct business and legal authorisations in place. Our first contribution is intended to update the existing Arm Compute Library (ACL) Execution Provider which was originally contributed by NXP to the latest released version of ACL. The pull request is: #17672 (comment). However the developer making the request was prompted to sign the CLA by the bot that monitors PRs for CLA compliance. We in Arm (and I imagine most companies) have designated people who are authorised to sign CLAs on Arm's behalf, so we need guidance on how to proceed. Will the bot allow one of our authorised people to sign the CLA via the PR above even though it was submitted by someone else? Note we could also sign a copy of the PDF that you link from https://opensource.microsoft.com/cla/ then scan and email it back, but if this is the way forward we would need a clean copy of the PDF as that one has a watermark. Thanks in advance for your help with this. Yours Sincerely, Jim Flynn (Technology Manager Arm NN and Arm Compute Library)

To reproduce

putting this in because it is a required field :-) ... submit a PR without having signed the CLA

Urgency

We have a major customer who is interested in realising the performance uplift they would get from an updated ACL Execution Provider. Resolving this issue in a timely manner would be a great help to us.

Platform

Linux

OS Version

Ubuntu 20.04

ONNX Runtime Installation

Built from Source

ONNX Runtime Version or Commit ID

1.17.0

ONNX Runtime API

C++

Architecture

ARM64

Execution Provider

ACL

Execution Provider Library Version

No response

[baijumeswani]

cc @snnn @faxu

[faxu]

Hi @jimfly01, this is possible to set up, but is discouraged as Corporate CLAs (CCLAs) are logistically difficult to manage. We can pursue to set this up with our legal team, but I would suggest first evaluating alternative processes with your company/legal team if they are simpler.

From opensource.microsoft.com/cla:

Microsoft does not typically participate in corporate CLA agreements, given the scale and logistics challenge.

However, we recognize that some companies, especially those in highly regulated industries, need to have the ability to explicitly manage specific people who have access to participate in Microsoft projects. To enable these scenarios, an authorized individual or group from such a company can receive a special "CCLA repository" that will allow your firm to manually manage specific GitHub logins that are authorized on behalf of your company. You can also use GitHub Actions or other technology to customize and automate this list.

A CCLA repository is a bespoke process. If you feel your company is a good fit for this, please reach out to the Microsoft Open Source Programs Office at [email protected].

[jimfly01]

Thanks for the quick and to the point update @faxu, much appreciated... I will pass it on to our Open Source Office :-)

[faxu]

Thanks, keep us posted. We're very appreciative of your contributions and would like to get these in as soon as possible! :)

[faxu]

Hi @jimfly01, any update on how to proceed? Happy to have a call as well to discuss options.

[jimfly01]

Hi Faith... apologies for the delay in getting back to you... I was on leave for the first two weeks of October and there was a mountain in my inbox when I got back to the desk... didn't mean to leave this slip so long though. I am not sure we are talking about the same thing. Just to be clear we are not looking for a special Corporate CLA repository. Rather your default CLA requires one to elect between individual and corporate contributions and the corporate section specifies that you are entering into the agreement on behalf of your employer. So we want one of our authorised people from our Open Source Office to sign this and just need you to tell us the mechanism by which we can do so. Either by (a) your bot allowing someone other than Milos sign his contribution or (b) can we get a clean copy of the PDF above without the 'For Information' pasted across it which our OSO can sign and email back or (c) whatever other way you have of enabling an authorised person to sign your default CLA on behalf of a company. All the best and Thanks! Jim Flynn

[jimfly01]

Is there any update on this please? We need to resolve this rather urgently now. Thanks.

[jeffwilcox]

Hi,
Within the pull request, if the submitter, simply comments

@microsoft-github-policy-service agree company="Arm Ltd"

That will update the CLA system.

[faxu]

@jimfly01 I see this is still not resolved. The only supported way to sign the CLA is as Jeff shared above. This needs to be done by the PR submitter and is on behalf of a company. If the PR submitter is not authorized to do this based on policies at your company, we'd need to set up a Corporate CLA as I described above.

[jimfly01]

Hi Faith. We got permission off our legal department for Milos to click through on the CLA on behalf of Arm Ltd. so we have submitted our pull request https://github.com/microsoft/onnxruntime/pull/17672/commits... looks like we have one remaining issue with the TVM build https://github.com/microsoft/onnxruntime/actions/runs/7039577506/job/19159821254 before we are in a mergeable state.... but this ticket can be closed as resolved.