FLOSS is not an SPDX identifier in the ordinary sense — it is what the source declares, and this register prints declarations rather than normalising them. It appears where a project describes itself as free and open-source software without resolving to a single machine-readable licence at the address that was checked.
Filed under the SPDX identifier GitHub reports for the repository,
not under what the README claims. NOASSERTION means a licence file
exists that GitHub could not match to an SPDX identifier — read it
before you depend on it.
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://www.torproject.org/download/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
The whole method here is to print the field as it was read and to name where it came from. Substituting a specific identifier because the project is well known to use one would be the register asserting a fact it did not measure, and once it does that anywhere the reader cannot trust it anywhere.
So the declaration stands as a declaration. If you need the exact terms, go to the source, read the licence file, and treat this row as a pointer rather than as an answer.
The general rule this illustrates
A field the sweep did not capture is null and is printed as an em dash; a field it captured in a form that does not reduce to an identifier is printed in that form. Neither is upgraded into a cleaner value. That policy is why the no-licence group elsewhere in this catalogue is a finding rather than a gap.
This register reads the identifier from the repository's own licence metadata at the field check, not from a README badge, and prints it exactly as the API returned it.
Questions about the FLOSS entries
Licence questions, answered from the field this register reads and from the licence texts themselves. Nothing here is legal advice.
What does FLOSS mean as a licence value here?
That the source describes itself as free and open-source software without the checked address resolving to a single machine-readable identifier. The register prints what it read rather than substituting a licence it did not verify.
Why not just look up the real licence?
Because that would be the register asserting a value it did not measure, and the entire claim of this catalogue is that its fields are read rather than assumed. The address is printed on the entry page; read the licence at the source.
How does this registry handle missing fields generally?
A field the sweep did not capture is null and prints as an em dash. It is never guessed and never inferred from a similar project, and the derivation printed on each entry page names any fallback the rubric used.
Every row above was chosen by somebody who then had to establish two
separate things — whether the code was alive, and whether it was theirs
to use. Donut Browser answers the second in its own repository: an
open-source anti-detect browser under AGPL-3.0, with the desktop
application and the sync server both in that repository, engine-level
fingerprint spoofing through the Wayfern Chromium fork rather than
injected JavaScript, a local REST API and MCP server on your own
machine, zero telemetry, and a pre-launch gate that refuses to start a
profile when the proxy's exit geography contradicts the profile's
fingerprint. Its own licence row is in
this same catalogue, read at the same
field check as everything else.