psxrecomp/third_party/README.md

third_party/ — vendored dependency archives

Source archives the build would otherwise download, staged here so a checkout can configure with no network at all.

deps.manifest is the single pin record — name, archive file, SHA256, upstream URL. Both cmake/psx_dependency_archive.cmake and tools/ci/vendor_deps.sh read it, so a vendored archive can never drift from the pin the build would have fetched. A vendored archive is verified against the same URL_HASH as a downloaded one; nothing here is trusted because it is local.

What is committed, and why only that

Only libchdr (libchdr-<sha>.tar.gz, ~520 KB, BSD-3-Clause) and libjuice (libjuice-v1.7.2.tar.gz, ~110 KB, MPL-2.0) — see ../THIRD_PARTY_ATTRIBUTION.md.

runtime/runtime.cmake includes chd_dependency.cmake unconditionally, and libchdr has no find_package path and ships in no toolchain pack — so it is both the first network access a build makes and the only one with no local fallback. A player building a released game behind a firewall used to fail there, inside a FetchContent subbuild, before reaching any other dependency.

libjuice is what recomp-net's ICE transport downloads at configure time when PSX_NETPLAY=ON. It has no local fallback either, so a sealed netplay build failed the same way. runtime/netplay_dependency.cmake declares the vendored copy before recomp-net asks for it, and stops the configure if recomp-net's pin and this manifest row ever differ.

SDL3 (~15 MB) and zlib resolve from a system package or a toolchain pack first and are not committed; neither is the OpenXR SDK (psx_openxr_sdk, ~0.7 MB), which only a -DPSX_OPENXR=ON configure uses and otherwise falls back to the pinned upstream URL; .gitignore keeps them out. Stage them on demand:

tools/ci/vendor_deps.sh              # every dependency in the manifest
tools/ci/vendor_deps.sh SDL3         # just one
tools/ci/vendor_deps.sh --check      # verify what is staged; never downloads

Then configure with -DPSX_DEPS_OFFLINE=ON to turn any remaining download attempt into a hard error that names the missing archive, instead of a fetch that stalls behind a proxy and fails three CMake frames deep.

Adding a dependency

Add the row to deps.manifest, run tools/ci/vendor_deps.sh <name> to stage and verify the archive, and resolve it in CMake through psxrecomp_dependency_archive() / psxrecomp_dependency_source_dir() rather than a literal URL — a literal URL is a build that cannot go offline. Commit the archive only if the dependency has no local fallback and is small.