Based on a core-mentoring thread, a couple more points for:
http://docs.python.org/devguide/committing.html#handling-other-s-code

Attribution:
- add to Misc/ACKS if they aren't already there (and didn't add themselves in their patch)
- mention "Patch by <x>" in the NEWS entry and the checkin message*
- If I had to substantially change or fix a patch, I'll usually amend the acknowledgement to "Initial patch by <x>"

*(If I forget to say something in the checkin message, I generally don't worry about it - ACKS and NEWS are the important ones)

Contributor Licensing Agreements
- it's unlikely bug fixes will require a CLA unless they touch a *lot* of code
- new features often get into CLA-preferred territory, as the associated comments, docstrings and documentation are far more likely to reach a copyrightable standard
- for sprints, we now just collect CLAs as a matter of course, since there isn't any real inconvenience in doing so