DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: lemonade 10.3.0-1

New Package Report

.changes
Version10.3.0-1
Changed-ByMario Limonciello
Architecturesource all amd64
Distributionunstable
DateTue, 28 Apr 2026 12:26:33 -0500
Sourcelemonade
Changelog
lemonade (10.3.0-1) unstable; urgency=medium
 .
   * New upstream version.
   * Drop all patches, upstream.
   * Add jq to b-d
   * Use new upstream build system for nodejs
   * d/rules: don't allow downloading executable binaries
     This uses a feature that upstream has exposed to block
     the downloads.
.dsc
Sectionutils
Priorityoptional
Componentmain
Package-Listlemonade-desktop deb utils optional arch=all
lemonade-server deb utils optional arch=linux-any
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/lemonade-sdk/lemonade
Upstream-Name: lemonade
Upstream-Contact: lemonade@amd.com

Files: *
Copyright: 2024-2025 Advanced Micro Devices, Inc. (AMD)
           2023 Groq Inc.
Comment: Portions derived from TurnkeyML/MLAgility
License: Apache-2.0

Files: .devcontainer/reinstall-cmake.sh
Copyright: Microsoft Corporation
License: Expat
Comment: Script from Microsoft's devcontainer templates

Files: docs/assets/favicon.ico
       docs/assets/logo.png
       docs/assets/logo_512.png
       docs/favicon.ico
       src/cpp/resources/static/favicon.ico
Copyright: Microsoft Corporation
License: Expat
Comment: Icons derived from Microsoft Fluent Emoji (lemon emoji)
 Source: https://github.com/microsoft/fluentui-emoji

Files: src/app/*
Copyright: 2024-2025 Advanced Micro Devices, Inc. (AMD)
License: Expat
Comment: Electron application with dependencies:
 - axios (MIT)
 - highlight.js (BSD-3-Clause)
 - katex (MIT)
 - markdown-it (MIT)
 - markdown-it-texmath (MIT)
 - react and react-dom (MIT)

Files: src/app/src/renderer/components/Icons.tsx
Copyright: Cole Bemis 2013-2022, Lucide Contributors 2022
License: ISC

Files: src/cpp/include/lemon/utils/aixlog.hpp
Copyright: 2017-2021 Johannes Pohl
License: Expat

Files: src/cpp/include/lemon/amdxdna_accel.h
Copyright: 2022-2024, Advanced Micro Devices, Inc.
License: GPL-2.0-with-linux-syscall-note

Files: debian/*
Copyright: 2025 Mario Limonciello <superm1@debian.org>
License: GPL-2+

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
     http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache License,
 Version 2.0 can be found in "/usr/share/common-licenses/Apache-2.0".

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a
 copy of this software and associated documentation files (the "Software"),
 to deal in the Software without restriction, including without limitation
 the rights to use, copy, modify, merge, publish, distribute, sublicense,
 and/or sell copies of the Software, and to permit persons to whom the
 Software is furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included
 in all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
 IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
 CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
 TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

License: ISC
 Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
 copyright notice and this permission notice appear in all copies.
 .
 THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

License: GPL-2.0
 This package is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; version 2 of the License.
 .
 This package is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this program. If not, see <http://www.gnu.org/licenses/>
 .
 On Debian systems, the complete text of the GNU General
 Public License version 2 can be found in "/usr/share/common-licenses/GPL-2".

License: BSD-2-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
 1. Redistributions of source code must retain the above copyright notice, this
    list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright notice,
    this list of conditions and the following disclaimer in the documentation
    and/or other materials provided with the distribution.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
 ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: GPL-2+
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.
 .
 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this package; if not, see https://www.gnu.org/licenses/.
 .
 On Debian systems, the full text of the GNU General Public License
 version 2 can be found in the file '/usr/share/common-licenses/GPL-2'.

License: BSD-3-clause
 Copyright (c) 2018 Machine Zone, Inc. All rights reserved.
 .
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
 .
 1. Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.
 .
 2. Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in the
    documentation and/or other materials provided with the
    distribution.
 .
 3. Neither the name of the copyright holder nor the names of its
    contributors may be used to endorse or promote products derived
    from this software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: GPL-2.0-with-linux-syscall-note
 This package is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; version 2 of the License.
 .
 This package is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this program. If not, see <http://www.gnu.org/licenses/>
 .
 On Debian systems, the complete text of the GNU General
 Public License version 2 can be found in "/usr/share/common-licenses/GPL-2".
 .
 NOTE! This copyright does *not* cover user programs that use kernel
 services by normal system calls - this is merely considered normal use
 of the kernel, and does *not* fall under the heading of "derived work".
 Also note that the GPL below is copyrighted by the Free Software
 Foundation, but the instance of code that it refers to (the Linux
 kernel) is copyrighted by me and others who actually wrote it.
 .
 Also note that the only valid version of the GPL as far as the kernel
 is concerned is _this_ particular version of the license (ie v2, not
 v2.2 or v3.x or whatever), unless explicitly otherwise stated.
 .
 Linus Torvalds

Review Information

rejected — allocated to siretart 2 days ago, started 2 days ago, completed 2 days ago.

Final Comment

Thanks for your diligence while working on this package. I've had a look
through the source, and while it's mostly there, I have to reject it for
now because several of the blockers from the previous 10.0.0-1 rejection
have only been partially addressed, and new issues have been introduced.

Critical Issues (Blockers)

  1. Unresolved Runtime Downloads and Opaque Blobs (DFSG 2)
    The no_fetch_executables override in debian/rules effectively
    disables the core binary downloader, but some backends bypass this
    mechanism. Specifically, WhisperServer (in
    src/cpp/server/backends/whisper_server.cpp:117) still attempts to
    download .rai compiled NPU caches directly via HttpClient,
    ignoring the global fetch setting. These are opaque, sourceless blobs
    that cannot be in main. Additionally, FastFlowLMServer triggers
    flm pull, initiating its own external downloads that lemonade
    cannot control via its internal flags.

  2. Licensing Contradictions in src/app/
    The licensing declaration for the application subdirectory is
    currently contradicting itself. While debian/copyright (line 29)
    claims the entire src/app/* tree is under the Expat license, the
    subproject's own metadata says otherwise: src/app/package.json
    (line 23) explicitly declares the license as Apache-2.0. I suspect
    this is an upstream oversight, but as presented, it requires
    clarification to ensure the legal status of the application is
    correctly documented.

  3. Ambiguous Licensing and Non-Free Components (FastFlowLM)
    The integration of FastFlowLM is problematic for main. Documentation
    in docs/assets/install-selector.js:596 indicates that FLM is "free
    for non-commercial use," which violates DFSG 6. Furthermore, the
    copyright and licensing terms for FLM appear to be handled only
    within the runtime logic (not declared in the source or
    debian/copyright), which makes me quite nervous about what terms
    actually apply. This situation needs to be explicitly clarified and
    documented in debian/copyright.

Required Fixes

  • Patch Out Opaque Blob Fetching: Completely remove the logic in
    src/cpp/server/backends/whisper_server.cpp that attempts to download
    compiled NPU caches (.rai files).
  • Clarify src/app/ Licensing: Resolve the discrepancy between the
    Expat claim in debian/copyright and the Apache-2.0 declaration
    in src/app/package.json.
  • Address FastFlowLM Status: Clarify the licensing terms for
    FastFlowLM. If the non-commercial restriction applies, the backend
    must be removed or the package moved to contrib.
  • Attribution for Assets: Please ensure that all icons and banners
    in src/cpp/installer/ and src/app/src-tauri/icons/ are explicitly
    listed in debian/copyright with their appropriate copyright and
    license statements.

-rt

Other Reviews of this Package

VersionHashAllocatedCompletedReviewerStatusDetails
10.0.0-1 87b9f6ed… 2026-04-21 00:51 2026-04-29 11:39 siretart rejected VIEW
9.3.2-2 5360d5b4… 2026-02-27 10:50 2026-02-27 11:20 siretart rejected VIEW
9.2.0-1 ba1895f3… 2026-02-13 11:37 2026-02-13 17:22 siretart rejected VIEW
9.0.2+dfsg-1 20260208 2026-01-30 18:38 2026-01-30 18:38 siretart rejected VIEW

Back to Dashboard | View all reviews for this package