Xash3D is not really open-source.
The original codebase comes from leaked/decompiled code, and nowadays still requires the proprietary HLSDK to build.
HN comment from a major maintainer here : https://news.ycombinator.com/item?id=38314427
Valve has confirmed that it violates the HLSDK EULA, too. At least for the original Xash3D release.