What’s the right way to fork/re-use code from an open source project

Short answer: absolutely not.

Everything a person writes, whether it is software or text, is automatically under copyright. The default state of any text is that it is completely owned by the author and no one has rights to do anything with it without express permission of the author. A few decades ago, an author used to have to assert copyright in order to retain it, but this is no longer the case.

You can even see on sites like this legal text down there that states that I agree that this post I am typing is available under a certain license. If that wasn't there, I'd retain all rights under the law.

Thus, if you cannot find any license information, then you cannot copy or modify it for any reason other than personal use.

Making something "open source" is a deliberate act and for you to treat it as such, you have to have found a license that tells you explicitly what your rights to the software are. This is even true of "public domain" software. That is, something is only "public domain" if it has either expired copyright (which mostly means it was written decades ago) or if the author has explicitly placed it in the public domain in writing.

In the case you describe, your only recourse is to contact the author and request that he allow you to do what you ask. To do otherwise is flatly illegal and in theory could lead to damages. (In practice, of course, you'd have to get caught.)

Edit: IANAL. Talk to one if you intend to do this.

Now when I make the project open source and say a developer Sam does some enhancements to some existing files. Then should he be allowed to put up a copyright notice in his name as well?

Well, copyright law (in most jurisdictions) states that Sam owns copyright on any non-trivial changes that he makes to the files. He is reasonably entitled to add his Copyright notices. You have two alternatives:

• Accept his changes as is (with or without changes to the Copyright notice.)

• Require him to formally assign you the copyright as a precondition of accepting his changes. Of course, he may not agree with that, and walk away. Or he may just decide to fork your project an make his changes in his fork.

In a sense, him putting his copyright notices ... or not ... is irrelevant. If his copyright material is in the file, then he has a legal claim on part of the IP, irrespective of the copyright headers.

But the bottom line is that if you are going to run an open source project, it is not all about you getting the ownership, the credit, the glory. If you want other people to help you, you have to think about what they want to get out of it too.

However ...

Now in future if Sam is approached by some organization then he can sell the code under his copyright.

If you choose a decent open source license, that cannot happen. In a decent license, stuff properly published under the license cannot be unpublished. It is out there ... forever.

(If you are worried about this, get him to sign something to attest that 1) he is legally entitled / authorized to contribute his work, and 2) he agrees (irrevocably) to it being published under your project's open source license.)

(A bit off topic, but important nevertheless.)

There is another (practical) reason for asking people to assign copyright. If the copyright of a codebase is held variously by a number individuals, it can be difficult if you need to do something that requires the consent of all copyright holders. The classic case is if you want to change the license, you need to find all copyright holders and get them to agree. Even tracking them all down can be difficult.

But the flip-side is that if you want people to assign copyright to you, they have to trust that you are not going to abuse your position as the copyright holder; e.g. by relicensing under a closed source license.