DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: lemonade 9.3.2-2

New Package Report

.changes
Version9.3.2-2
Changed-ByMario Limonciello
Architecturesource all amd64
Distributionexperimental
DateFri, 13 Feb 2026 12:18:37 -0600
Sourcelemonade
Changelog
lemonade (9.3.2-2) experimental; urgency=medium
 .
   * d/copyright: move favicon and correct copyright for Groq Inc.
.dsc
Sectionpython
Priorityoptional
Componentmain
Package-Listlemonade-desktop deb python optional arch=all
lemonade-server deb python optional arch=linux-any
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/lemonade-sdk/lemonade
Upstream-Name: lemonade
Upstream-Contact: lemonade@amd.com

Files: *
Copyright: 2024-2025 Advanced Micro Devices, Inc. (AMD)
           2023 Groq Inc.
Comment: Portions derived from TurnkeyML/MLAgility
License: Apache-2.0

Files: .devcontainer/reinstall-cmake.sh
Copyright: Microsoft Corporation
License: Expat
Comment: Script from Microsoft's devcontainer templates

Files: docs/assets/favicon.ico
       docs/assets/logo.png
       docs/favicon.ico
       src/cpp/resources/static/favicon.ico
Copyright: Microsoft Corporation
License: Expat
Comment: Icons derived from Microsoft Fluent Emoji (lemon emoji)
 Source: https://github.com/microsoft/fluentui-emoji

Files: src/app/*
Copyright: 2024-2025 Advanced Micro Devices, Inc. (AMD)
License: Expat
Comment: Electron application with dependencies:
 - axios (MIT)
 - highlight.js (BSD-3-Clause)
 - katex (MIT)
 - markdown-it (MIT)
 - markdown-it-texmath (MIT)
 - react and react-dom (MIT)

Files: debian/*
Copyright: 2025 Mario Limonciello <superm1@debian.org>
License: GPL-2+

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
     http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache License,
 Version 2.0 can be found in "/usr/share/common-licenses/Apache-2.0".

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a
 copy of this software and associated documentation files (the "Software"),
 to deal in the Software without restriction, including without limitation
 the rights to use, copy, modify, merge, publish, distribute, sublicense,
 and/or sell copies of the Software, and to permit persons to whom the
 Software is furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included
 in all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
 IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
 CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
 TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

License: GPL-2+
 This package is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.
 .
 This package is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this program. If not, see <https://www.gnu.org/licenses/>
 .
 On Debian systems, the complete text of the GNU General
 Public License version 2 can be found in "/usr/share/common-licenses/GPL-2".

Review Information

rejected — allocated to siretart 19 days ago, started 19 days ago, completed 19 days ago.

Final Comment

Sorry for the many repeated rejects. This is a hard package to review and get right. Thanks for your hard work and attention to detail on this package!
Unfortunately, I found some additional issues:

docs/assets/logo_512.png and docs/favicon.ico are missing from debian/copyright

The debian/copyright file lists the following files under the Microsoft/Expat stanza:

Files: docs/assets/favicon.ico
       docs/assets/logo.png
       src/cpp/resources/static/favicon.ico

Inspecting docs/assets/logo.png and docs/assets/logo_512.png visually confirms they are the same Microsoft Fluent Emoji lemon image at different resolutions (128×128 and 512×512 respectively). NOTICE.md line 37 explicitly confirms: "TurnkeyML uses the Microsoft lemon emoji as an icon for the lemonade tool." Since logo.png is already attributed to Microsoft Corporation under the Expat license, logo_512.png must receive the same attribution — it is the same artwork. It is currently covered only by the catch-all AMD/Apache-2.0 stanza, which is a misrepresentation.

docs/favicon.ico is likewise absent from the Microsoft/Expat stanza (the stanza lists docs/assets/favicon.ico but not docs/favicon.ico, which is a distinct file). Given the consistent use of the Fluent Emoji lemon as the project icon, this file almost certainly has the same provenance.

Add both docs/assets/logo_512.png and docs/favicon.ico to the existing Microsoft/Expat stanza.

docs/assets/logo_512.png and docs/favicon.ico are missing from debian/copyright

docs/self_hosted_runners.md contains the following footer (lines 154–159):

# License

[Apache 2.0 License](../LICENSE)

Copyright(C) 2024-2025 Advanced Micro Devices, Inc. All rights reserved.
SPDX-License-Identifier: MIT

The file simultaneously references the Apache 2.0 license and carries an SPDX-License-Identifier: MIT tag. The debian/copyright catch-all stanza claims it is Apache-2.0. All three cannot be correct. Clarify the intend with upstream and document the responses/conversation.

Section and Priority

You chose Section: python; This is questionable. The binary packages lemonade-server and lemonade-desktop are not Python libraries; lemonade-server is an Architecture: linux-any compiled C++ daemon, and lemonade-desktop is a web application. The python section is intended for Python packages. A more appropriate section would be utils or net. Per Debian Policy §2.4, the section must accurately reflect the package's nature.

Other Reviews of this Package

VersionHashAllocatedCompletedReviewerStatusDetails
10.0.0-1 87b9f6ed… 2026-03-17 10:14 siretart team VIEW
9.2.0-1 ba1895f3… 2026-02-13 11:37 2026-02-13 17:22 siretart rejected VIEW
9.0.2+dfsg-1 20260208 2026-01-30 18:38 2026-01-30 18:38 siretart rejected VIEW

Back to Dashboard | View all reviews for this package