DFSG NEW Queue

DFSG, Licensing & New Packages Team

Team Review: lemonade 10.0.0-1

Package Information

DescriptionLocal LLM serving with GPU and NPU acceleration server

Lemonade helps users run local LLMs with the highest performance by configuring state-of-the-art inference engines for their NPUs and GPUs.

Lemonade works with model providers such as huggingface. This package provides the server.

MaintainerMario Limonciello <superm1@debian.org>
Changed ByMario Limonciello <superm1@debian.org>
Sponsorsuperm1@debian.org
Distributionexperimental
Architecturelinux-any all
VCSgit: https://salsa.debian.org/debian/lemonade.git (browse)
Trackerhttps://tracker.debian.org/pkg/lemonade
Uploaded7 days ago

New Package Report

.changes
Changed-ByMario Limonciello
Architecturesource all amd64
Distributionexperimental
DateWed, 11 Mar 2026 13:26:19 -0500
Sourcelemonade
Version10.0.0-1
Changelog
lemonade (10.0.0-1) experimental; urgency=medium
 .
   * New upstream version. (LP: #2142305)
   * d/rules: If built on Ubuntu, prefer system llama.cpp
   * d/postinst: Add lemonade user to correct group for systemd log access
   * Add a vendor'ed copy of ixwebsocket
   * d/control: Add recommends needed for system backend to work
   * Drop upstream patch
   * d/patches: Add a patch to use vendor'ed ixwebsocket
   * d/control: b-d on libdrm-dev
   * d/control: Correct the section to 'utils'
   * d/copyright: refresh to 10.0.0 release
   * Add README.debian
.dsc
Priorityoptional
Componentmain
Package-Listlemonade-desktop deb utils optional arch=all
lemonade-server deb utils optional arch=linux-any
Sectionutils
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/lemonade-sdk/lemonade
Upstream-Name: lemonade
Upstream-Contact: lemonade@amd.com

Files: *
Copyright: 2024-2025 Advanced Micro Devices, Inc. (AMD)
           2023 Groq Inc.
Comment: Portions derived from TurnkeyML/MLAgility
License: Apache-2.0

Files: .devcontainer/reinstall-cmake.sh
Copyright: Microsoft Corporation
License: Expat
Comment: Script from Microsoft's devcontainer templates

Files: docs/assets/favicon.ico
       docs/assets/logo.png
       docs/assets/logo_512.png
       docs/favicon.ico
       src/cpp/resources/static/favicon.ico
Copyright: Microsoft Corporation
License: Expat
Comment: Icons derived from Microsoft Fluent Emoji (lemon emoji)
 Source: https://github.com/microsoft/fluentui-emoji

Files: src/app/*
Copyright: 2024-2025 Advanced Micro Devices, Inc. (AMD)
License: Expat
Comment: Electron application with dependencies:
 - axios (MIT)
 - highlight.js (BSD-3-Clause)
 - katex (MIT)
 - markdown-it (MIT)
 - markdown-it-texmath (MIT)
 - react and react-dom (MIT)

Files: src/app/src/renderer/components/Icons.tsx
Copyright: Cole Bemis 2013-2022, Lucide Contributors 2022
License: ISC

Files: src/cpp/include/lemon/utils/aixlog.hpp
Copyright: 2017-2021 Johannes Pohl
License: Expat

Files: src/cpp/include/lemon/amdxdna_accel.h
Copyright: 2022-2024, Advanced Micro Devices, Inc.
License: GPL-2.0

Files: debian/*
Copyright: 2025 Mario Limonciello <superm1@debian.org>
License: GPL-2+

Files: debian/ixwebsocket/ixwebsocket/IXBase64.h
       debian/ixwebsocket/ixwebsocket/IXUrlParser.cpp
       debian/ixwebsocket/ixwebsocket/IXUtf8Validator.h
       debian/ixwebsocket/ixwebsocket/IXWebSocketTransport.cpp
Copyright: 2018 Machine Zone, Inc.
License: Expat
Comment: Vendored ixwebsocket library
 Source: https://github.com/machinezone/ixwebsocket

Files: debian/ixwebsocket/ixwebsocket/IXWebSocketPerMessageDeflate.cpp
       debian/ixwebsocket/ixwebsocket/IXWebSocketPerMessageDeflate.h
       debian/ixwebsocket/LICENSE.txt
Copyright: 2018 Machine Zone, Inc.
License: BSD-3-clause
Comment: Vendored ixwebsocket library
 Source: https://github.com/machinezone/ixwebsocket

Files: debian/ixwebsocket/third_party/cpp-linenoise/*
Copyright: 2015 yhirose
License: BSD-2-clause
Comment: Vendored linenoise library
 Source: https://github.com/yhirose/cpp-linenoise

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
     http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache License,
 Version 2.0 can be found in "/usr/share/common-licenses/Apache-2.0".

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a
 copy of this software and associated documentation files (the "Software"),
 to deal in the Software without restriction, including without limitation
 the rights to use, copy, modify, merge, publish, distribute, sublicense,
 and/or sell copies of the Software, and to permit persons to whom the
 Software is furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included
 in all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
 IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
 CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
 TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

License: ISC
 Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
 copyright notice and this permission notice appear in all copies.
 .
 THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

License: GPL-2.0
 This package is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; version 2 of the License.
 .
 This package is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this program. If not, see <http://www.gnu.org/licenses/>
 .
 On Debian systems, the complete text of the GNU General
 Public License version 2 can be found in "/usr/share/common-licenses/GPL-2".

License: BSD-2-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
 1. Redistributions of source code must retain the above copyright notice, this
    list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright notice,
    this list of conditions and the following disclaimer in the documentation
    and/or other materials provided with the distribution.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
 ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: GPL-2+
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.
 .
 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this package; if not, see https://www.gnu.org/licenses/.
 .
 On Debian systems, the full text of the GNU General Public License
 version 2 can be found in the file '/usr/share/common-licenses/GPL-2'.

License: BSD-3-clause
 Copyright (c) 2018 Machine Zone, Inc. All rights reserved.
 .
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
 .
 1. Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.
 .
 2. Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in the
    documentation and/or other materials provided with the
    distribution.
 .
 3. Neither the name of the copyright holder nor the names of its
    contributors may be used to endorse or promote products derived
    from this software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Review Information

team TEAM — allocated to siretart 1 day ago, started 1 day ago.

Other Reviews of this Package

VersionHashAllocatedCompletedReviewerStatusDetails
9.3.2-2 5360d5b4… 2026-02-27 10:50 2026-02-27 11:20 siretart rejected VIEW
9.2.0-1 ba1895f3… 2026-02-13 11:37 2026-02-13 17:22 siretart rejected VIEW
9.0.2+dfsg-1 20260208 2026-01-30 18:38 2026-01-30 18:38 siretart rejected VIEW

Public Notes

siretart 1 day ago REJECT ● public

I belive the lemonade package is currently UNACCEPTABLE for inclusion in any section of the Debian archive (main, contrib, or non-free).

1. Runtime Download of Executable Binaries

The most critical blocker is the implementation of the "Backend Manager" in src/cpp/server/backends/backend_utils.cpp. The software contains logic to automatically download, extract, and execute pre-compiled binaries from GitHub (specifically from github.com/ggml-org/ and github.com/lemonade-sdk/).

  • Policy Violation: Debian requires all software to be built from source within the Debian infrastructure to ensure auditability and security.
  • Security Risk: The BackendUtils::install_from_github function fetches executables (llama-server, whisper-server, etc.) at runtime. This bypasses APT, prevents security patching by the Debian Security Team, and introduces a significant attack vector (remote execution of untrusted third-party binaries).

2. Copyright and Licensing Failures

The debian/copyright file is incomplete and contains factual inaccuracies:

  • License Incompatibility and Mislabeling: The file src/cpp/include/lemon/amdxdna_accel.h is licensed under GPL-2.0 WITH Linux-syscall-note, but debian/copyright incorrectly labels it (via a wildcard) as Apache-2.0. Apache-2.0 is generally considered incompatible with GPL-2.0. While the Linux-syscall-note exception is designed to allow linking with userspace, misrepresenting the license of a core header file is a critical failure in the copyright review process.
  • Missing Attributions: The vendored ixwebsocket library (included in debian/ixwebsocket) contains code from numerous authors not listed in debian/copyright (e.g., Alex Hultman, Bjoern Hoehrmann, Salvatore Sanfilippo).
  • Inaccurate Claims: debian/copyright attributes IXBase64.h to Machine Zone, Inc., but the file header clearly states Copyright (c) 2016 tomykaira.
  • Wildcard Over-reach: The Files: * declaration claiming Apache-2.0 for the entire tree is invalidated by the presence of GPL-2.0, MIT, ISC, and BSD-3-Clause files throughout the src/ and debian/ directories that are not properly scoped.

3. Missing Source for Generated Files (DFSG 2)

The source tarball contains several Windows-specific bitmap files used for installers:

  • src/cpp/installer/installer_banner_wix.bmp
  • src/cpp/installer/top_banner.bmp

These files are provided without their "preferred form for modification" (e.g., GIMP/Photoshop source files or SVG templates). Under DFSG 2, every component of the source package must include its source code. These are currently "sourceless blobs.".

Back to Dashboard | View all reviews for this package