GitHub puts a licence label on every repository. It reads it from the LICENSE file and
normalises it to an SPDX identifier — MIT, BSD-3-Clause, Apache-2.0. When it cannot,
the API returns NOASSERTION and the web UI quietly says "Other".
I checked twelve popular proxy, VPN and mesh-networking repositories through the GitHub API
on 20 August 2026. Three came back NOASSERTION. Here is what each of the three actually
ships — because "Other" is not one situation, it is three very different ones.
The measurement
| Repository | SPDX from the API | Stars |
|---|---|---|
| SagerNet/sing-box | NOASSERTION | 37,141 |
| XTLS/Xray-core | MPL-2.0 | 41,121 |
| juanfont/headscale | BSD-3-Clause | 43,009 |
| tailscale/tailscale | BSD-3-Clause | 35,368 |
| v2fly/v2ray-core | MIT | 34,491 |
| wireguard/wireguard-go | MIT | 4,347 |
| apernet/hysteria | MIT | 22,355 |
| EAimTY/tuic | GPL-3.0 | 3,261 |
| cloudflare/cloudflared | Apache-2.0 | 15,304 |
| netbirdio/netbird | NOASSERTION | 28,520 |
| zerotier/ZeroTierOne | NOASSERTION | 17,029 |
| slackhq/nebula | MIT | 17,630 |
Three out of twelve. Now the interesting part.
1. sing-box — GPLv3, plus a clause of its own
The LICENSE file opens with the standard GPL version 3 or later grant. Then it adds:
In addition, no derivative work may use the name or imply association with this
application without prior consent.
That sentence is why the label cannot be GPL-3.0: the text is no longer the unmodified
licence. The grant is still copyleft, with a naming restriction bolted on.
2. netbird — BSD-3-Clause, except where it is AGPLv3
Its LICENSE file says it plainly in the first two lines:
This BSD-3-Clause license applies to all parts of the repository except for the
directories [...] Those directories are licensed under the GNU Affero General Public
License version 3.0.
A permissive licence for most of the tree, and the strongest network copyleft there is for
part of it. One SPDX identifier cannot express that, and picking the friendlier of the two
is exactly the mistake the label would encourage.
3. ZeroTier — MPL, and a nonfree/ directory
LICENSE.txt is three lines, and the second one is the one that matters:
See nonfree/LICENSE.md for all non-free ("source available") portions of this repository.
Source-available is not open source. A repository can be mostly MPL and still contain a
directory you may read but not freely reuse.
What to take from this
NOASSERTION does not mean "no licence" and it does not mean "unclear". It means GitHub
declined to summarise this one in a single word, and in all three cases it was right to
decline. An extra clause, a per-directory split, and a non-free carve-out are all things
that matter the moment you ship something built on top.
The practical rule is boring and holds up: if you are redistributing, open the LICENSE
file. The badge is a convenience, not a statement of terms. Two minutes of reading, and
the three repositories above stop being surprises.
I went down this road while comparing two of these cores in detail — the licence turned out
to be the sharpest difference between them, well ahead of the protocol lists everyone else
compares:
sing-box vs Xray: the differences that actually decide it.
All figures read from the GitHub REST API on 20 August 2026; star counts move, the licence
files are the stable part.
Top comments (0)