Not having your contributors sign a CLA is a huge mistake. Without a CLA, one contributors work can taint the entire project. All open source projects should be aware of this.
The Wine project has no such agreement. I'm not involved with the legal stuff myself, but I know it's been considered by the project bigwigs, and the decision was that an agreement would be too onerous and discourage contributions, especially from non-English developers.
We are, however, very careful that all submissions are accepted under the original author's name. We rarely accept patches of the form "I took someone else's half-complete patch and fixed it up." In addition, all submissions are assumed to be released under the project's license. If the original submitter doesn't have permission to release their submission under that license, then the violated party should take that up with them.
This is interesting, because I may have done this recently and I didn't think twice about it. I took someone else's patch (which had been submitted but never merged), merged it in to a newer version, fixed quite a few conflicts and tests, and committed it. Is that problematic? The original submitter's commits are intact and all the "fix-up" code is in the merge commit in my name. What if it is a rebase or cherry-pick where the commits themselves are re-written but retain the original submitter's name?
