> After all, that's a problem already solved: CLAs for open source.

With CLA's in place contributors usually sign away their copyright, often to get rug-pulled when an open source project reaches a certain maturity and popularity, and the commercial plans are activated by the company behind it. Better look for community-driven projects that come with a DCO [0] instead.

[0] https://en.wikipedia.org/wiki/Developer_Certificate_of_Origi...