Alexandros Mandravillis
328d879512
With PSX_NETPLAY=ON, recomp-net FetchContents libjuice v1.7.2 from GitHub at configure time. That download is outside third_party/deps.manifest, so PSX_DEPS_OFFLINE does not cover it, and a build with no network (a sealed CI job, a player behind a firewall) fails inside the FetchContent subbuild with a curl error. Commit the same archive recomp-net pins (MPL-2.0, 108 KB) and declare it before add_subdirectory(recomp-net). FetchContent keeps the first declaration of a name, so recomp-net's own FetchContent_MakeAvailable builds the vendored copy with its own options. The configure stops if recomp-net ever pins a different libjuice than the manifest. Ship the MPL-2.0 notice and source location in runtime/licenses/ and THIRD_PARTY_ATTRIBUTION.md. Two ctest cases configure a stand-in recomp-net with the network sealed: the matching pin must configure, a different pin must stop with the mismatch message.
third_party/ — vendored dependency archives
Source archives the build would otherwise download, staged here so a checkout can configure with no network at all.
deps.manifest is the single pin record — name, archive file, SHA256, upstream
URL. Both cmake/psx_dependency_archive.cmake and tools/ci/vendor_deps.sh
read it, so a vendored archive can never drift from the pin the build would
have fetched. A vendored archive is verified against the same URL_HASH as a
downloaded one; nothing here is trusted because it is local.
What is committed, and why only that
Only libchdr (libchdr-<sha>.tar.gz, ~520 KB, BSD-3-Clause) and
libjuice (libjuice-v1.7.2.tar.gz, ~110 KB, MPL-2.0) — see
../THIRD_PARTY_ATTRIBUTION.md.
runtime/runtime.cmake includes chd_dependency.cmake unconditionally, and
libchdr has no find_package path and ships in no toolchain pack — so it is
both the first network access a build makes and the only one with no local
fallback. A player building a released game behind a firewall used to fail
there, inside a FetchContent subbuild, before reaching any other dependency.
libjuice is what recomp-net's ICE transport downloads at configure time when
PSX_NETPLAY=ON. It has no local fallback either, so a sealed netplay build
failed the same way. runtime/netplay_dependency.cmake declares the vendored
copy before recomp-net asks for it, and stops the configure if recomp-net's pin
and this manifest row ever differ.
SDL3 (~15 MB) and zlib resolve from a system package or a toolchain pack first
and are not committed; .gitignore keeps them out. Stage them on demand:
tools/ci/vendor_deps.sh # every dependency in the manifest
tools/ci/vendor_deps.sh SDL3 # just one
tools/ci/vendor_deps.sh --check # verify what is staged; never downloads
Then configure with -DPSX_DEPS_OFFLINE=ON to turn any remaining download
attempt into a hard error that names the missing archive, instead of a fetch
that stalls behind a proxy and fails three CMake frames deep.
Adding a dependency
Add the row to deps.manifest, run tools/ci/vendor_deps.sh <name> to stage
and verify the archive, and resolve it in CMake through
psxrecomp_dependency_archive() / psxrecomp_dependency_source_dir() rather
than a literal URL — a literal URL is a build that cannot go offline. Commit
the archive only if the dependency has no local fallback and is small.