SagerNet / SagerNet/sing-box

GPLv3 Compliance Issue Report: shtorm-7/sing-box-extended

Open
#4,265 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
38.1k
Forks
4.6k
Avg merge
19d 15h
Merged PRs (30d)
1

Description

I would like to report a potential GPL compliance issue regarding the project shtorm-7/sing-box-extended.

Repository:
https://github.com/shtorm-7/sing-box-extended

The project distributes official Android APKs (and iOS builds) while presenting itself as a GPL-licensed fork of sing-box.

However, after examining the public repository, I found that the source code required to reproduce the official mobile applications does not appear to be publicly available.

Specifically:

  • The repository publishes official Android APK releases.
  • The build workflow references clients/android, but the corresponding Android client source is not present in the public repository.
  • The repository contains no documented Android client source, no iOS client source, and no explanation that these components are proprietary or intentionally withheld.
  • The public repository is therefore insufficient to reproduce the official released APK.

The official Android application appears to be derived from the GPL-licensed sing-box Android client:

https://github.com/SagerNet/sing-box-for-android

If the distributed APK contains GPL-covered code or modifications to that project, GPL requires that the complete Corresponding Source for the distributed binaries be made available.

At present, the published repository does not appear to provide the complete source necessary to build the released mobile applications.

If additional source repositories exist, or if the mobile clients are intentionally not open-sourced, this should be clearly documented. Otherwise, this may constitute a GPL compliance issue.

I respectfully request that this repository be reviewed for compliance with the GPL license requirements applicable to the distributed binaries.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Review the build workflow references to clients/android and compare the published repository with the cited sing-box-for-android source; first establish whether the released mobile builds have corresponding source here. Done means the required mobile source is available, or its licensing and availability are clearly documented and the reproducibility concern is resolved.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, go, ios
Domain
documentation, mobile-dev, release
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.