Isn't it great having people pile on Xash3D claiming it is "illegal" without knowing the actual legal status of the project.

Xash3D was never built atop "leaked GoldSrc engine code"; it started as a Quake derivative and ended up progressively gaining HL1 compatibility by taking code from Quake 2 and Quake World, both of which also serve as bases for GoldSrc, and have been GPL-licensed for decades.

Implementing GoldSrc compat isn't a tremendously hard task as the engine itself isn't that complex and the exposed API surface is fairly small, and the header files defining it, taken from the HL1 SDK, have vague legal wording which does not directly imply a non-commercial engine reimplementation is prohibited.

You'll also find claims HL2 Beta leak code was used; while true, said code (VGUI utility classes) has been replaced in FWGS (the current active branch of Xash3D) with their BSD-licensed version from Valve's GameNetworkingSockets since 2018.

So if you want to be really pedantic, Xash's legal situation is at worst questionable, but 99.9% likely fine. And I doubt Valve would even remotely care since HL1 is so old and Xash3D isn't an egregious cash-grab or trying to misrepresent what it just is: a HL1-compatible engine.