Files
psxrecomp/third_party/README.md
T
Matthew Stanley 4684409516 openxr: fetch SDK as SHA256-pinned archive via deps.manifest; scope SDK options
Replaces the git FetchContent and the global BUILD_TESTS cache override; same vendored/URL/offline resolution as libchdr. OFF stays network-free.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-10-04 11:07:14 -07:00

51 lines
2.5 KiB
Markdown

# third_party/ — vendored dependency archives
Source archives the build would otherwise download, staged here so a checkout
can configure with no network at all.
`deps.manifest` is the single pin record — name, archive file, SHA256, upstream
URL. Both `cmake/psx_dependency_archive.cmake` and `tools/ci/vendor_deps.sh`
read it, so a vendored archive can never drift from the pin the build would
have fetched. A vendored archive is verified against the same `URL_HASH` as a
downloaded one; nothing here is trusted because it is local.
## What is committed, and why only that
Only **libchdr** (`libchdr-<sha>.tar.gz`, ~520 KB, BSD-3-Clause) and
**libjuice** (`libjuice-v1.7.2.tar.gz`, ~110 KB, MPL-2.0) — see
`../THIRD_PARTY_ATTRIBUTION.md`.
`runtime/runtime.cmake` includes `chd_dependency.cmake` unconditionally, and
libchdr has no `find_package` path and ships in no toolchain pack — so it is
both the *first* network access a build makes and the only one with no local
fallback. A player building a released game behind a firewall used to fail
there, inside a FetchContent subbuild, before reaching any other dependency.
libjuice is what recomp-net's ICE transport downloads at configure time when
`PSX_NETPLAY=ON`. It has no local fallback either, so a sealed netplay build
failed the same way. `runtime/netplay_dependency.cmake` declares the vendored
copy before recomp-net asks for it, and stops the configure if recomp-net's pin
and this manifest row ever differ.
SDL3 (~15 MB) and zlib resolve from a system package or a toolchain pack first
and are **not** committed; neither is the OpenXR SDK (`psx_openxr_sdk`, ~0.7 MB),
which only a `-DPSX_OPENXR=ON` configure uses and otherwise falls back to the pinned upstream URL; `.gitignore` keeps them out. Stage them on demand:
```sh
tools/ci/vendor_deps.sh # every dependency in the manifest
tools/ci/vendor_deps.sh SDL3 # just one
tools/ci/vendor_deps.sh --check # verify what is staged; never downloads
```
Then configure with `-DPSX_DEPS_OFFLINE=ON` to turn any remaining download
attempt into a hard error that names the missing archive, instead of a fetch
that stalls behind a proxy and fails three CMake frames deep.
## Adding a dependency
Add the row to `deps.manifest`, run `tools/ci/vendor_deps.sh <name>` to stage
and verify the archive, and resolve it in CMake through
`psxrecomp_dependency_archive()` / `psxrecomp_dependency_source_dir()` rather
than a literal `URL` — a literal URL is a build that cannot go offline. Commit
the archive only if the dependency has no local fallback and is small.