Team Review: lemonade 10.0.0-1
Package Information
| Description | Local LLM serving with GPU and NPU acceleration server Lemonade helps users run local LLMs with the highest performance by configuring state-of-the-art inference engines for their NPUs and GPUs. Lemonade works with model providers such as huggingface. This package provides the server. |
|---|---|
| Maintainer | Mario Limonciello <superm1@debian.org> |
| Changed By | Mario Limonciello <superm1@debian.org> |
| Sponsor | superm1@debian.org |
| Distribution | experimental |
| Architecture | linux-any all |
| VCS | git: https://salsa.debian.org/debian/lemonade.git (browse) |
| Tracker | https://tracker.debian.org/pkg/lemonade |
| Uploaded | 7 days ago |
New Package Report
.changes
| Architecture | source all amd64 |
|---|---|
| Distribution | experimental |
| Date | Wed, 11 Mar 2026 13:26:19 -0500 |
| Source | lemonade |
| Version | 10.0.0-1 |
| Changed-By | Mario Limonciello |
Changelog
lemonade (10.0.0-1) experimental; urgency=medium . * New upstream version. (LP: #2142305) * d/rules: If built on Ubuntu, prefer system llama.cpp * d/postinst: Add lemonade user to correct group for systemd log access * Add a vendor'ed copy of ixwebsocket * d/control: Add recommends needed for system backend to work * Drop upstream patch * d/patches: Add a patch to use vendor'ed ixwebsocket * d/control: b-d on libdrm-dev * d/control: Correct the section to 'utils' * d/copyright: refresh to 10.0.0 release * Add README.debian
.dsc
| Component | main |
|---|---|
| Package-List | lemonade-desktop deb utils optional arch=all lemonade-server deb utils optional arch=linux-any |
| Section | utils |
| Priority | optional |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/lemonade-sdk/lemonade
Upstream-Name: lemonade
Upstream-Contact: lemonade@amd.com
Files: *
Copyright: 2024-2025 Advanced Micro Devices, Inc. (AMD)
2023 Groq Inc.
Comment: Portions derived from TurnkeyML/MLAgility
License: Apache-2.0
Files: .devcontainer/reinstall-cmake.sh
Copyright: Microsoft Corporation
License: Expat
Comment: Script from Microsoft's devcontainer templates
Files: docs/assets/favicon.ico
docs/assets/logo.png
docs/assets/logo_512.png
docs/favicon.ico
src/cpp/resources/static/favicon.ico
Copyright: Microsoft Corporation
License: Expat
Comment: Icons derived from Microsoft Fluent Emoji (lemon emoji)
Source: https://github.com/microsoft/fluentui-emoji
Files: src/app/*
Copyright: 2024-2025 Advanced Micro Devices, Inc. (AMD)
License: Expat
Comment: Electron application with dependencies:
- axios (MIT)
- highlight.js (BSD-3-Clause)
- katex (MIT)
- markdown-it (MIT)
- markdown-it-texmath (MIT)
- react and react-dom (MIT)
Files: src/app/src/renderer/components/Icons.tsx
Copyright: Cole Bemis 2013-2022, Lucide Contributors 2022
License: ISC
Files: src/cpp/include/lemon/utils/aixlog.hpp
Copyright: 2017-2021 Johannes Pohl
License: Expat
Files: src/cpp/include/lemon/amdxdna_accel.h
Copyright: 2022-2024, Advanced Micro Devices, Inc.
License: GPL-2.0
Files: debian/*
Copyright: 2025 Mario Limonciello <superm1@debian.org>
License: GPL-2+
Files: debian/ixwebsocket/ixwebsocket/IXBase64.h
debian/ixwebsocket/ixwebsocket/IXUrlParser.cpp
debian/ixwebsocket/ixwebsocket/IXUtf8Validator.h
debian/ixwebsocket/ixwebsocket/IXWebSocketTransport.cpp
Copyright: 2018 Machine Zone, Inc.
License: Expat
Comment: Vendored ixwebsocket library
Source: https://github.com/machinezone/ixwebsocket
Files: debian/ixwebsocket/ixwebsocket/IXWebSocketPerMessageDeflate.cpp
debian/ixwebsocket/ixwebsocket/IXWebSocketPerMessageDeflate.h
debian/ixwebsocket/LICENSE.txt
Copyright: 2018 Machine Zone, Inc.
License: BSD-3-clause
Comment: Vendored ixwebsocket library
Source: https://github.com/machinezone/ixwebsocket
Files: debian/ixwebsocket/third_party/cpp-linenoise/*
Copyright: 2015 yhirose
License: BSD-2-clause
Comment: Vendored linenoise library
Source: https://github.com/yhirose/cpp-linenoise
License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
http://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian systems, the complete text of the Apache License,
Version 2.0 can be found in "/usr/share/common-licenses/Apache-2.0".
License: Expat
Permission is hereby granted, free of charge, to any person obtaining a
copy of this software and associated documentation files (the "Software"),
to deal in the Software without restriction, including without limitation
the rights to use, copy, modify, merge, publish, distribute, sublicense,
and/or sell copies of the Software, and to permit persons to whom the
Software is furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included
in all copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
License: ISC
Permission to use, copy, modify, and/or distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.
.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
License: GPL-2.0
This package is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; version 2 of the License.
.
This package is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>
.
On Debian systems, the complete text of the GNU General
Public License version 2 can be found in "/usr/share/common-licenses/GPL-2".
License: BSD-2-clause
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
.
1. Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
License: GPL-2+
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
.
You should have received a copy of the GNU General Public License
along with this package; if not, see https://www.gnu.org/licenses/.
.
On Debian systems, the full text of the GNU General Public License
version 2 can be found in the file '/usr/share/common-licenses/GPL-2'.
License: BSD-3-clause
Copyright (c) 2018 Machine Zone, Inc. All rights reserved.
.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:
.
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the
distribution.
.
3. Neither the name of the copyright holder nor the names of its
contributors may be used to endorse or promote products derived
from this software without specific prior written permission.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Review Information
team TEAM — allocated to siretart 1 day ago, started 1 day ago.
Other Reviews of this Package
| Version | Hash | Allocated | Completed | Reviewer | Status | Details |
|---|---|---|---|---|---|---|
| 9.3.2-2 | 5360d5b4… | 2026-02-27 10:50 | 2026-02-27 11:20 | siretart | rejected | VIEW |
| 9.2.0-1 | ba1895f3… | 2026-02-13 11:37 | 2026-02-13 17:22 | siretart | rejected | VIEW |
| 9.0.2+dfsg-1 | 20260208 | 2026-01-30 18:38 | 2026-01-30 18:38 | siretart | rejected | VIEW |
Public Notes
I belive the lemonade package is currently UNACCEPTABLE for inclusion in any section of the Debian archive (main, contrib, or non-free).
1. Runtime Download of Executable Binaries
The most critical blocker is the implementation of the "Backend Manager" in src/cpp/server/backends/backend_utils.cpp. The software contains logic to automatically download, extract, and execute pre-compiled binaries from GitHub (specifically from github.com/ggml-org/ and github.com/lemonade-sdk/).
- Policy Violation: Debian requires all software to be built from source within the Debian infrastructure to ensure auditability and security.
- Security Risk: The
BackendUtils::install_from_githubfunction fetches executables (llama-server,whisper-server, etc.) at runtime. This bypasses APT, prevents security patching by the Debian Security Team, and introduces a significant attack vector (remote execution of untrusted third-party binaries).
2. Copyright and Licensing Failures
The debian/copyright file is incomplete and contains factual inaccuracies:
- License Incompatibility and Mislabeling: The file
src/cpp/include/lemon/amdxdna_accel.his licensed underGPL-2.0 WITH Linux-syscall-note, butdebian/copyrightincorrectly labels it (via a wildcard) asApache-2.0. Apache-2.0 is generally considered incompatible with GPL-2.0. While theLinux-syscall-noteexception is designed to allow linking with userspace, misrepresenting the license of a core header file is a critical failure in the copyright review process. - Missing Attributions: The vendored
ixwebsocketlibrary (included indebian/ixwebsocket) contains code from numerous authors not listed indebian/copyright(e.g.,Alex Hultman,Bjoern Hoehrmann,Salvatore Sanfilippo). - Inaccurate Claims:
debian/copyrightattributesIXBase64.hto Machine Zone, Inc., but the file header clearly statesCopyright (c) 2016 tomykaira. - Wildcard Over-reach: The
Files: *declaration claimingApache-2.0for the entire tree is invalidated by the presence ofGPL-2.0,MIT,ISC, andBSD-3-Clausefiles throughout thesrc/anddebian/directories that are not properly scoped.
3. Missing Source for Generated Files (DFSG 2)
The source tarball contains several Windows-specific bitmap files used for installers:
src/cpp/installer/installer_banner_wix.bmpsrc/cpp/installer/top_banner.bmp
These files are provided without their "preferred form for modification" (e.g., GIMP/Photoshop source files or SVG templates). Under DFSG 2, every component of the source package must include its source code. These are currently "sourceless blobs.".