Review: lemonade 10.3.0-1
New Package Report
.changes
| Version | 10.3.0-1 |
|---|---|
| Changed-By | Mario Limonciello |
| Architecture | source all amd64 |
| Distribution | unstable |
| Date | Tue, 28 Apr 2026 12:26:33 -0500 |
| Source | lemonade |
Changelog
lemonade (10.3.0-1) unstable; urgency=medium
.
* New upstream version.
* Drop all patches, upstream.
* Add jq to b-d
* Use new upstream build system for nodejs
* d/rules: don't allow downloading executable binaries
This uses a feature that upstream has exposed to block
the downloads..dsc
| Section | utils |
|---|---|
| Priority | optional |
| Component | main |
| Package-List | lemonade-desktop deb utils optional arch=all lemonade-server deb utils optional arch=linux-any |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/lemonade-sdk/lemonade
Upstream-Name: lemonade
Upstream-Contact: lemonade@amd.com
Files: *
Copyright: 2024-2025 Advanced Micro Devices, Inc. (AMD)
2023 Groq Inc.
Comment: Portions derived from TurnkeyML/MLAgility
License: Apache-2.0
Files: .devcontainer/reinstall-cmake.sh
Copyright: Microsoft Corporation
License: Expat
Comment: Script from Microsoft's devcontainer templates
Files: docs/assets/favicon.ico
docs/assets/logo.png
docs/assets/logo_512.png
docs/favicon.ico
src/cpp/resources/static/favicon.ico
Copyright: Microsoft Corporation
License: Expat
Comment: Icons derived from Microsoft Fluent Emoji (lemon emoji)
Source: https://github.com/microsoft/fluentui-emoji
Files: src/app/*
Copyright: 2024-2025 Advanced Micro Devices, Inc. (AMD)
License: Expat
Comment: Electron application with dependencies:
- axios (MIT)
- highlight.js (BSD-3-Clause)
- katex (MIT)
- markdown-it (MIT)
- markdown-it-texmath (MIT)
- react and react-dom (MIT)
Files: src/app/src/renderer/components/Icons.tsx
Copyright: Cole Bemis 2013-2022, Lucide Contributors 2022
License: ISC
Files: src/cpp/include/lemon/utils/aixlog.hpp
Copyright: 2017-2021 Johannes Pohl
License: Expat
Files: src/cpp/include/lemon/amdxdna_accel.h
Copyright: 2022-2024, Advanced Micro Devices, Inc.
License: GPL-2.0-with-linux-syscall-note
Files: debian/*
Copyright: 2025 Mario Limonciello <superm1@debian.org>
License: GPL-2+
License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
http://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian systems, the complete text of the Apache License,
Version 2.0 can be found in "/usr/share/common-licenses/Apache-2.0".
License: Expat
Permission is hereby granted, free of charge, to any person obtaining a
copy of this software and associated documentation files (the "Software"),
to deal in the Software without restriction, including without limitation
the rights to use, copy, modify, merge, publish, distribute, sublicense,
and/or sell copies of the Software, and to permit persons to whom the
Software is furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included
in all copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
License: ISC
Permission to use, copy, modify, and/or distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.
.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
License: GPL-2.0
This package is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; version 2 of the License.
.
This package is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>
.
On Debian systems, the complete text of the GNU General
Public License version 2 can be found in "/usr/share/common-licenses/GPL-2".
License: BSD-2-clause
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
.
1. Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
License: GPL-2+
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
.
You should have received a copy of the GNU General Public License
along with this package; if not, see https://www.gnu.org/licenses/.
.
On Debian systems, the full text of the GNU General Public License
version 2 can be found in the file '/usr/share/common-licenses/GPL-2'.
License: BSD-3-clause
Copyright (c) 2018 Machine Zone, Inc. All rights reserved.
.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:
.
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the
distribution.
.
3. Neither the name of the copyright holder nor the names of its
contributors may be used to endorse or promote products derived
from this software without specific prior written permission.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
License: GPL-2.0-with-linux-syscall-note
This package is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; version 2 of the License.
.
This package is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>
.
On Debian systems, the complete text of the GNU General
Public License version 2 can be found in "/usr/share/common-licenses/GPL-2".
.
NOTE! This copyright does *not* cover user programs that use kernel
services by normal system calls - this is merely considered normal use
of the kernel, and does *not* fall under the heading of "derived work".
Also note that the GPL below is copyrighted by the Free Software
Foundation, but the instance of code that it refers to (the Linux
kernel) is copyrighted by me and others who actually wrote it.
.
Also note that the only valid version of the GPL as far as the kernel
is concerned is _this_ particular version of the license (ie v2, not
v2.2 or v3.x or whatever), unless explicitly otherwise stated.
.
Linus Torvalds
Review Information
rejected — allocated to siretart 2 days ago, started 2 days ago, completed 2 days ago.
Final Comment
Thanks for your diligence while working on this package. I've had a look
through the source, and while it's mostly there, I have to reject it for
now because several of the blockers from the previous 10.0.0-1 rejection
have only been partially addressed, and new issues have been introduced.
Critical Issues (Blockers)
-
Unresolved Runtime Downloads and Opaque Blobs (DFSG 2)
Theno_fetch_executablesoverride indebian/ruleseffectively
disables the core binary downloader, but some backends bypass this
mechanism. Specifically,WhisperServer(in
src/cpp/server/backends/whisper_server.cpp:117) still attempts to
download.raicompiled NPU caches directly viaHttpClient,
ignoring the global fetch setting. These are opaque, sourceless blobs
that cannot be inmain. Additionally,FastFlowLMServertriggers
flm pull, initiating its own external downloads that lemonade
cannot control via its internal flags. -
Licensing Contradictions in src/app/
The licensing declaration for the application subdirectory is
currently contradicting itself. Whiledebian/copyright(line 29)
claims the entiresrc/app/*tree is under theExpatlicense, the
subproject's own metadata says otherwise:src/app/package.json
(line 23) explicitly declares the license asApache-2.0. I suspect
this is an upstream oversight, but as presented, it requires
clarification to ensure the legal status of the application is
correctly documented. -
Ambiguous Licensing and Non-Free Components (FastFlowLM)
The integration of FastFlowLM is problematic formain. Documentation
indocs/assets/install-selector.js:596indicates that FLM is "free
for non-commercial use," which violates DFSG 6. Furthermore, the
copyright and licensing terms for FLM appear to be handled only
within the runtime logic (not declared in the source or
debian/copyright), which makes me quite nervous about what terms
actually apply. This situation needs to be explicitly clarified and
documented indebian/copyright.
Required Fixes
- Patch Out Opaque Blob Fetching: Completely remove the logic in
src/cpp/server/backends/whisper_server.cppthat attempts to download
compiled NPU caches (.raifiles). - Clarify src/app/ Licensing: Resolve the discrepancy between the
Expatclaim indebian/copyrightand theApache-2.0declaration
insrc/app/package.json. - Address FastFlowLM Status: Clarify the licensing terms for
FastFlowLM. If the non-commercial restriction applies, the backend
must be removed or the package moved tocontrib. - Attribution for Assets: Please ensure that all icons and banners
insrc/cpp/installer/andsrc/app/src-tauri/icons/are explicitly
listed indebian/copyrightwith their appropriate copyright and
license statements.
-rt
Other Reviews of this Package
| Version | Hash | Allocated | Completed | Reviewer | Status | Details |
|---|---|---|---|---|---|---|
| 10.0.0-1 | 87b9f6ed… | 2026-04-21 00:51 | 2026-04-29 11:39 | siretart | rejected | VIEW |
| 9.3.2-2 | 5360d5b4… | 2026-02-27 10:50 | 2026-02-27 11:20 | siretart | rejected | VIEW |
| 9.2.0-1 | ba1895f3… | 2026-02-13 11:37 | 2026-02-13 17:22 | siretart | rejected | VIEW |
| 9.0.2+dfsg-1 | 20260208 | 2026-01-30 18:38 | 2026-01-30 18:38 | siretart | rejected | VIEW |