bryan-minimal · Oct 23, 2026 · Oct 15, 2026 · Oct 22, 2026 · Oct 22, 2026 · Oct 22, 2026
@@ -21,6 +21,16 @@ let version = "b10357" in
       extract = true,
       strip_prefix = "llama.cpp-%{version}",
     } | Source,
+    {
+      # llama-server's web UI for this build number, mirrored from
+      # https://huggingface.co/buckets/ggml-org/llama-ui/resolve/%{version}/dist.tar.gz
+      # (sha256 matches upstream's dist.tar.gz.sha256). build.sh unpacks it into
+      # tools/ui/dist so the build doesn't fetch the moving `latest` UI.
+      # Bump with `version`.
+      url = "gs://minimal-staging-archives/ggml-org/llama-ui/%{version}-dist.tar.gz",
+      sha256 = "68f883c9592b049e696a0837359a46f59ac3236188510bf92b477917a76f6dbc",
+      extract = false,
+    } | Source,
     base,
     git,
     make,
@@ -34,6 +44,9 @@ let version = "b10357" in
     subsetOf gcc ["libgcc", "libstdcpp", "libgomp"],
   ],
   cmd = "./build.sh",
+  build_args = {
+    include version,
+  },
   outputs = {
     llama-server = { glob = "usr/bin/llama-server" } | OutputBin,
     llama-cli = { glob = "usr/bin/llama-cli" } | OutputBin,
@@ -44,7 +57,20 @@ let version = "b10357" in
   attrs =
     {
       upstream_version = version,
-      license_spdx = "MIT",
+      # llama.cpp itself is MIT. What ships also carries:
+      # - vendor/ C++: cpp-httplib, nlohmann/json (MIT); miniaudio, stb,
+      #   sheredom/subprocess.h (public domain or Unlicense).
+      # - The embedded web UI (llama-ui dist for this build, in
+      #   libllama-server-impl.so): 402 npm packages per tools/ui's
+      #   package-lock.json. Mostly MIT and ISC, plus BSD-3-Clause (d3 modules,
+      #   highlight.js), Apache-2.0 (pdfjs-dist, dexie, @internationalized/date,
+      #   @swc/helpers, @chevrotain/types, aria-query, axobject-query),
+      #   BSD-2-Clause (entities, json-schema-typed), DOMPurify
+      #   (MPL-2.0 OR Apache-2.0; Apache-2.0 taken), robust-predicates
+      #   (Unlicense), tslib (0BSD). The KaTeX fonts embedded in its CSS are MIT.
+      # The minified bundle keeps only pdf.js's Apache-2.0 header and ships no
+      # license texts or NOTICE files: tracked in pkgs#994.
+      license_spdx = "MIT AND Apache-2.0 AND BSD-3-Clause AND BSD-2-Clause AND ISC AND 0BSD AND Unlicense",
       source_provenance = {
         category = 'GithubRepo,
         owner = "ggml-org",

@@ -10,7 +10,28 @@ export CFLAGS="$MARCH -O2 -pipe -gno-record-gcc-switches -ffile-prefix-map=$(pwd
 export LDFLAGS="-Wl,--build-id=none"
 export CXXFLAGS="${CFLAGS}"
 
-cmake -B build
+# The embedded web UI (llama-ui, linked into libllama-server-impl.so). Left to
+# itself, scripts/ui-assets.cmake downloads dist.tar.gz from Hugging Face at build
+# time, and with no .git in the tarball the build number is 0, so it falls back to
+# the moving `latest` tag: a different UI got embedded as upstream published new
+# ones, which was the 2026-10 prod-pair diff (31% of libllama-server-impl.so,
+# identical symbols). Instead, the b10357 UI is a pinned Source, unpacked where the
+# script looks first (tools/ui/dist), and both fetch paths are off. The script
+# gzips each asset without -n, so the gzip header carries the file's mtime: pin
+# the mtimes too. Not to SOURCE_DATE_EPOCH: the sandbox's is 0, which gzip can't
+# store ("file timestamp out of range", exit 2), so 1980-01-01 instead.
+mkdir -p tools/ui/dist
+tar -xof "${MINIMAL_ARG_VERSION}-dist.tar.gz" -C tools/ui/dist
+test -s tools/ui/dist/index.html || {
+  echo "ERROR: pinned llama-ui dist has no index.html" >&2
+  exit 1
+}
+find tools/ui/dist -exec touch -h -d @315532800 {} +
+
+# GGML_NATIVE=OFF is a guard: ggml already defaults it OFF when SOURCE_DATE_EPOCH is
+# set (the sandbox sets it), and -march=native would make the code follow the build
+# host's CPU instead of the explicit $MARCH in CFLAGS.
+cmake -B build -DGGML_NATIVE=OFF -DLLAMA_BUILD_UI=OFF -DLLAMA_USE_PREBUILT_UI=OFF
 cmake --build build --config Release -j $(nproc)
 
 mkdir -pv $OUTPUT_DIR/usr/{bin,lib}