fix(local): ship llama.cpp's own licence on Windows, and OpenMP's under its name by MODSetter · Pull Request #2246 · MODSetter/SurfSense

MODSetter · 2026-10-13T21:47:56Z

What

fetch-llamacpp.mjs now stages llama.cpp's licence files under their own names, with llama.cpp's own LICENSE on every platform.

scripts/llamacpp/licences.mjs copies each LICENSE-* file the archive carries under its own name. On Windows that is LICENSE-LLVM-OpenMP, for the libomp.dll beside llama-server.
It stages llama.cpp's LICENSE from the archive when the archive has one. Otherwise it uses scripts/llamacpp/llama.cpp-LICENSE, a copy taken at b11050.
An archive whose LICENSE differs from that copy stops the fetch, so the copy can't go stale when the build moves.
.gitignore anchors llamacpp/ to the staged folder, as /sdcpp/, /audiocpp/ and /opencode/ already are, so scripts/llamacpp/ is tracked.
packaging.md says what the stage carries.

Why

The script copied the first file whose name starts with LICENSE to llamacpp/LICENSE.

llama.cpp's macOS and Linux archives carry its LICENSE: its release workflow runs cp LICENSE ./build/bin/ for them.
Its Windows Vulkan zip doesn't. That zip is the Vulkan backend plus the injected CPU build, and the CPU build's only licence file is the LICENSE-LLVM-OpenMP that ggml's CMake copies next to libomp.dll (ggml/src/CMakeLists.txt, under GGML_OPENMP_FETCH).

So on Windows, llamacpp/LICENSE held LLVM's text under llama.cpp's name, and llama.cpp's MIT notice wasn't shipped at all. A Windows stage made on 22 September shows it: its LICENSE begins "The LLVM Project is under the Apache License v2.0 with LLVM Exceptions".

The kept copy is llama.cpp's LICENSE at b11050 byte for byte: git blob e7dca554, the same as upstream's.

The Windows installer still ships no LICENSE-jsonhpp. llama.cpp embeds that text, with the others, in the binary, but doesn't put the file in any archive. The third-party notices work can decide whether to carry it.

How to test

cd surfsense_local/electron
node --test scripts/llamacpp/licences.test.mjs
node scripts/fetch-llamacpp.mjs --check

licences.test.mjs passes 4 tests:
- a Windows-shaped archive gets llama.cpp's licence from the copy, and OpenMP's under its own name;
- a macOS or Linux archive's own licence is staged when it matches the copy;
- a different one stops the fetch;
- the copy is llama.cpp's MIT text.
The test sits one folder under scripts/, so the package's scripts/**/*.test.mjs picks it up under sh too.
fetch-llamacpp.mjs --check passes, which loads the new module.

Not run: a full fetch on each OS, since it downloads the archive. The release workflow runs it on all three. An electron/llamacpp/ staged before this keeps its old LICENSE until it is staged again; delete the folder to refresh it.

High-level PR Summary

This PR fixes a licensing issue in the Windows build where llama.cpp's own MIT license was not being shipped, and LLVM OpenMP's license was incorrectly named as llama.cpp's license. The changes implement proper license file staging: each license file is now copied under its own name (e.g., LICENSE-LLVM-OpenMP), and llama.cpp's LICENSE is included on all platforms. For Windows archives that lack llama.cpp's license file, a pinned copy from build b11050 is used, with validation to ensure it stays current when the build version updates.

⏱️ Estimated Review Time: 5-15 minutes

💡 Review Order Suggestion

Order	File Path
1	`surfsense_local/electron/scripts/llamacpp/llama.cpp-LICENSE`
2	`surfsense_local/electron/scripts/llamacpp/licences.test.mjs`
3	`surfsense_local/electron/scripts/llamacpp/licences.mjs`
4	`surfsense_local/electron/scripts/fetch-llamacpp.mjs`
5	`surfsense_local/electron/.gitignore`
6	`docs/architecture/packaging.md`

Summary by CodeRabbit

Bug Fixes
- Llama.cpp packages now include its license on every platform while preserving other license files under their original names.
- Packaging stops if an archive’s llama.cpp license differs from the pinned license.
Documentation
- Updated packaging guidance to describe license handling across platforms.

…er its name fetch-llamacpp.mjs copied the first file named LICENSE* to llamacpp/LICENSE. The Windows archives carry no llama.cpp LICENSE, only LLVM OpenMP's LICENSE-LLVM-OpenMP for their libomp.dll, so Windows shipped LLVM's text under llama.cpp's name and none of llama.cpp's own. Each licence file is now staged under its own name, and llama.cpp's LICENSE on every platform: from the archive where it has one, else from a copy taken at the pinned build. An archive whose LICENSE differs from the copy stops the fetch. The .gitignore entry is anchored like its siblings so scripts/llamacpp/ is tracked.

vercel · 2026-10-13T21:48:02Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
surf-sense-frontend	Ready	Preview	Oct 13, 2026 9:49pm UTC

coderabbitai · 2026-10-13T21:48:28Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: MODSetter/SurfSense/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: d0df7bd1-c777-41bf-b13e-29a94b76b3ce

📥 Commits

Reviewing files that changed from the base of the PR and between e9b596f and 4156eab.

📒 Files selected for processing: 6

docs/architecture/packaging.md
surfsense_local/electron/.gitignore
surfsense_local/electron/scripts/fetch-llamacpp.mjs
surfsense_local/electron/scripts/llamacpp/licences.mjs
surfsense_local/electron/scripts/llamacpp/licences.test.mjs
surfsense_local/electron/scripts/llamacpp/llama.cpp-LICENSE

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

The llama.cpp fetch process now stages license files under their original names and includes a pinned llama.cpp license on every platform. It checks archive licenses against the pinned copy and stops when they differ.

Changes: llama.cpp license staging

Layer / File(s)	Summary
Pinned license and staging behavior `surfsense_local/electron/scripts/llamacpp/licences.mjs`, `surfsense_local/electron/scripts/llamacpp/llama.cpp-LICENSE`, `surfsense_local/electron/scripts/llamacpp/licences.test.mjs`	Adds `stageLicences`, a pinned MIT license, and tests for Windows, macOS/Linux, and mismatched archive licenses. Matching is checked after line-ending normalization; staged archive license contents retain their original line endings.
Fetcher integration and packaging details `surfsense_local/electron/scripts/fetch-llamacpp.mjs`, `docs/architecture/packaging.md`, `surfsense_local/electron/.gitignore`	The fetch script calls `stageLicences`. The packaging documentation describes the platform license behavior, and the ignore rule now applies only to the repository-root `llamacpp/` directory.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 4156e

The licence staging change is mergeable after normal checks. A conflicting archive licence stops a fresh fetch without replacing an existing installation.

Security architecture risk: ⚪ Minimal · up to 4156e

The changes affect build-time licence metadata. Archive integrity checks and execution authority remain unchanged, and licence mismatch failures occur before installation replacement. No material security risk was identified as introduced or worsened.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

inferred — The changed operation is bounded to the existing build-host staging directory and the resulting Electron package. It adds licence-file reads and writes without adding tenant, identity, credential, service or agent authority.

Trust Boundaries and Controls

observed — Archive-derived licence filenames come from direct regular directory entries, not caller-supplied paths or recursive discovery. The caller supplies the server's archive directory and its existing temporary stage. The routed test helper receives literal fixture objects and registers temporary-directory cleanup.

Resilience and Maintainability Implications

inferred — A licence mismatch leaves any existing installation untouched and reaches ordinary temporary-directory cleanup. Publication retains its existing Windows rename retries and backup restoration. Concurrent publication and hard interruption between backup and replacement remain inherited recovery limitations, not security conditions introduced or worsened by this licence transition.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 3 files. (3 skipped: 3…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: staging llama.cpp's license on Windows and preserving OpenMP's license under its own name.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 3 files. (3 skipped: 3 unsupported.)

Fix all pre-merge checks with AI

✨ Finishing Touches: 💡 2

📝 Generate docstrings: 💡

Commit to this branch
Create a new PR

🛠️ Fix failing CI checks: 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

MODSetter requested review from AnishSarkar22 and CREDO23 as code owners October 13, 2026 21:47

vercel Bot deployed to Preview October 13, 2026 21:49

View deployment

MODSetter mentioned this pull request Oct 13, 2026

feat(local): generate third-party notices at build time #2185

Merged

MODSetter merged commit e9b8062 into dev Oct 13, 2026
30 of 31 checks passed

Navigation Menu

Repository navigation

fix(local): ship llama.cpp's own licence on Windows, and OpenMP's under its name - #2246

fix(local): ship llama.cpp's own licence on Windows, and OpenMP's under its name#2246
MODSetter merged 1 commit into
devfrom
fix/llamacpp-licence

MODSetter commented Oct 13, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

vercel Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

MODSetter commented Oct 13, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why

How to test

High-level PR Summary

Summary by CodeRabbit

Uh oh!

vercel Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

MODSetter commented Oct 13, 2026 •

edited by coderabbitai Bot

Loading

vercel Bot commented Oct 13, 2026 •

edited

Loading

coderabbitai Bot commented Oct 13, 2026 •

edited

Loading