Squid: the README is a license notice, a support directory, and nothing else

The README is 184 words and describes no feature at all

The top level file is named README, with no extension, and it is short. Its first line is the project name and the site address, followed by a copyright line reading 1996-2026 The Squid Software Foundation and contributors. Then come four mailing list addresses, a pointer to the support page, and the full text of the GNU General Public License notice. There is no description of what a caching proxy does, no list of protocols, no configuration example, no benchmark and no build command. The description in the repository metadata says Squid Web Proxy Cache - Source Code, and that pair of words, source code, is doing the work that a paragraph of overview would do elsewhere.

Security reports get a private address while public bugs get a tracker

Support is split four ways, and one of the splits matters. General help goes to [email protected] and development discussion to [email protected]. Public bug reports are not sent to a mail list at all but filed at https://bugs.squid-cache.org/. Security bug reports go to a third address, [email protected], kept separate from the public tracker. Subscription instructions, maintainer contact information and a pointer to commercial services all sit behind http://www.squid-cache.org/Support/ rather than in the repository. A SECURITY.md file is also present at the root, so a reporter holding a vulnerability has two places to look and only one of them is named in the text most readers will see first.

The license text says GPLv2+ while the license field says GPL-2.0

The body of the README states that Squid software is distributed under GPLv2+ license and includes contributions from numerous individuals and organizations, and it sends readers to the COPYING and CONTRIBUTORS files for details. The license notice underneath is the standard one, offering either version 2 of the License or, at your option, any later version. The license field in the packaging data for the repository reads GPL-2.0, which names version 2 and drops the or later part. Anyone auditing this project from metadata alone sees a narrower grant than the text grants, and anyone grepping for the license inside the tree has to open COPYING to learn which version is actually stated there.

A git checkout has no configure script, only the inputs that generate one

The build is the autotools layout: configure.ac at the root, an acinclude directory holding the macros, a Makefile.am, and a bootstrap.sh script that is the only shell file at the top level. There is no generated configure script or config.h.in in the tree, so what a checkout from version control gives you is the input to the build system rather than the build system itself. The source directories follow the older Unix arrangement, with src, lib, include and a compat directory for portability, and there is no CMakeLists file or Dockerfile anywhere at the root. The Makefile.am sits next to a tree whose primary language is recorded as C++, which is a reminder of how long the build tooling has outlived the language standard it was written for.

Release tags are spelled SQUID_7_5 and the titles are spelled v7.5

Three releases sit at the top of the record. The tag is SQUID_7_5 and the release title is v7.5, published 2026-03-13. Next comes tag SQUID_7_6 titled v7.6 on 2026-06-08, then SQUID_7_7 titled v7.7 on 2026-08-24. So the git tag and the human readable release name use different conventions in the same repository, upper case with underscores against a dotted version, and any script that pins a Squid dependency has to match one or the other. The gaps run a little under three months from 7.5 to 7.6 and a little under eleven weeks from 7.6 to 7.7, a cadence on which a new minor number arrives several times a year rather than on a fixed calendar date.

A thirty year copyright line and three separate credit files

The copyright line runs from 1996 to 2026 and names an organization rather than an individual, The Squid Software Foundation, followed by the word contributors. Credit is then handled by three files at the root that the tree never explains: CONTRIBUTORS, CREDITS and SPONSORS.list. The README points only at the first of them, saying that details are in the COPYING and CONTRIBUTORS files. So a contributor reading the project's own instructions is pointed at one of the three, and the difference between a contributor, a credit and a sponsor is left to whoever maintains those lists. The year at the end of the copyright line matches the year of the most recent commit, which means the notice is edited as the calendar moves rather than standing still.

Error pages, translations and generated docs are part of the payload

Some entries in this tree exist because the software serves people rather than libraries. The errors directory holds the pages a proxy returns when it refuses or cannot complete a request, which makes user facing wording part of the source. The po4a.conf file configures the translation tooling that carries those pages and the interface into other languages, and the icons directory holds the artwork. Alongside them sit squid.dox as the configuration for generated documentation, a doc directory, a scripts directory, a contrib directory for contributed additions, and a tools directory. Testing has its own shape here: test-builds.sh at the root and a test-suite directory, so build verification is part of the repository rather than a separate project.

Editorial conclusion

This repository is for people who already know what a caching proxy is and want to build, audit or contribute to it, not for someone looking for a way to install a proxy. Anyone picking Squid up should read INSTALL and QUICKSTART rather than the README, expect a git checkout to need bootstrap.sh before a configure script exists, and treat the license field as narrower than the license text. Operators should route vulnerability reports to the security address rather than the public tracker, and should not read the absence of configuration guidance in the README as a sign that the defaults are safe.

Frequently asked questions

Official sources

1. License: GPL-2.0
2. Project website
3. README
4. Releases
5. squid-cache/squid on GitHub