Yes and no.

The code patches are open source, alongside some new classes (that are mainly interfaces, and the patches add the implementations basically, and also hooks into their event system)

Spigot themselves don't provide a link to a built .jar, their provide a link to a java tool that

- downloads the official Minecraft server - decompiles it into .java files - Applies the source code patches that are open source in spigot - Adds the spigot api files that are 100% open source - compiles all of this back to a .jar