From 9b7b9913e4ab60b9c57fa4be56b8da308e76d06e Mon Sep 17 00:00:00 2001
From: patchzyy <64382339+patchzyy@users.noreply.github.com>
Date: Wed, 30 Sep 2026 09:14:48 +0200
Subject: [PATCH] Handle extra Mbed TLS archives (#275)

---
 Launcher/Prepare-NativePrebuilt.sh       |  2 +-
 runtime/cmake/NativePrebuiltExport.cmake | 21 +++++++++++++++------
 2 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/Launcher/Prepare-NativePrebuilt.sh b/Launcher/Prepare-NativePrebuilt.sh
index 004fce8..095539f 100755
--- a/Launcher/Prepare-NativePrebuilt.sh
+++ b/Launcher/Prepare-NativePrebuilt.sh
@@ -372,7 +372,7 @@ while IFS='|' read -r name linkerfile; do
     [[ -n "$ref" ]] || fail "Mbed TLS archive was not harvested: $name ($linkerfile)"
     mbedtls_refs+=("$ref")
 done < "$mbedtls_txt"
-[[ ${#mbedtls_refs[@]} -eq 3 ]] || fail "Expected three Mbed TLS archives, got ${#mbedtls_refs[@]}"
+[[ ${#mbedtls_refs[@]} -ge 3 ]] || fail "Expected at least three Mbed TLS archives, got ${#mbedtls_refs[@]}"
 mbedtls_source_dir=$(get_meta mbedtls_source_dir)
 assert_dir "$mbedtls_source_dir/include/mbedtls" "Mbed TLS headers"
 mkdir -p "$output_dir/include/mbedtls"
diff --git a/runtime/cmake/NativePrebuiltExport.cmake b/runtime/cmake/NativePrebuiltExport.cmake
index 25904ec..e81b3c4 100644
--- a/runtime/cmake/NativePrebuiltExport.cmake
+++ b/runtime/cmake/NativePrebuiltExport.cmake
@@ -88,12 +88,21 @@ mkw_collect_buildsystem_targets("${_mkw_np_aurora_dir}" _mkw_np_all_targets)
 # checks below still apply to it.
 list(APPEND _mkw_np_all_targets "mkw_cryptopp")
 if(NOT MKW_PLATFORM_WINDOWS)
-    list(APPEND _mkw_np_all_targets mbedtls mbedx509 mbedcrypto)
-    # Keep the TLS archives separate from aurora's aggregate link interface.
-    string(CONCAT _mkw_np_mbedtls_lines
-        "mbedtls|$<TARGET_LINKER_FILE:MbedTLS::mbedtls>\n"
-        "mbedx509|$<TARGET_LINKER_FILE:MbedTLS::mbedx509>\n"
-        "mbedcrypto|$<TARGET_LINKER_FILE:MbedTLS::mbedcrypto>\n")
+    set(_mkw_np_mbedtls_targets mbedtls mbedx509 mbedcrypto)
+    # mbedcrypto links these third-party archives when upstream defines them.
+    # Keep dependencies after mbedcrypto for static linking on the consumer side.
+    foreach(_t everest p256m)
+        if(TARGET ${_t})
+            list(APPEND _mkw_np_mbedtls_targets ${_t})
+        endif()
+    endforeach()
+    list(APPEND _mkw_np_all_targets ${_mkw_np_mbedtls_targets})
+    # Keep the complete TLS archive set separate from aurora's aggregate link interface.
+    set(_mkw_np_mbedtls_lines "")
+    foreach(_t IN LISTS _mkw_np_mbedtls_targets)
+        string(APPEND _mkw_np_mbedtls_lines
+            "${_t}|$<TARGET_LINKER_FILE:${_t}>\n")
+    endforeach()
     file(GENERATE OUTPUT "${MKW_NATIVE_PREBUILT_EXPORT_DIR}/mbedtls.txt"
         CONTENT "${_mkw_np_mbedtls_lines}")
 endif()