About the Apache Contributor License Agreement
We occasionally have to ask for a "Contributor License Agreement" from someone who sends in a patch or code that we want to include in the SpamAssassin codebase. This is a legal requirement (a similar situation applies in other projects, such as other ASF projects or the Linux kernel). It doesn't apply in all cases, just for "big" patches.
it's now possible to file CLAs via email:
'CLAs can be filed electronically now. You can send PGP/GPG-signed emails with the scanned PDFs of the signed CLA form to secretary AT apache.org and legal-archive AT apache.org. This removes the need to fax or send physical mails of the CLA.'
The list of people for whom a CLA has been received, and has been noted by the ASF's secretary, is kept here: http://people.apache.org/committer-index.html
If there's a delay via the ASF's secretary, you can also send it to (or cc) the SpamAssassin PMC to escalate. The PMC chair is an officer of the ASF and can legally record it and allow the patch to be applied if the issue is time-sensitive.