mtgodot-poc/docs/THIRD-PARTY.md

Third-party native dependencies

The GDExtension links four native libraries that are not part of Godot or godot-cpp. Phase 1 (macOS) pulled the first three from Homebrew; that stops working the moment we cross-compile for the Android NDK or the iOS SDK (BACKLOG F1/F2), so as of 2026-08-30 they are built from source as part of our own CMake build. Crypto++ joined later (2026-09-02) with the MT_PROTOCOL=classic 40250 backend and was vendored the same way from the start.

Everything lives under extension/third_party/ and is wired by extension/third_party/CMakeLists.txt, which exposes four aliases:

Alias	Backing target	Consumed by
mt3p::sodium	sodium	mtnet, mtpack, mtproto
mt3p::zstd	libzstd_static	mtpack
mt3p::minilzo	minilzo	mtproto
mt3p::cryptopp	cryptopp	mtnet (classic backend)

No source file changed: #include <sodium.h>, #include <zstd.h>, #include <lzo/lzo1x.h> and #include <cryptopp/…> all still resolve (the LZO one via a 1-line shim header, see below).

libsodium — via robinlinden/libsodium-cmake

• Submodule: extension/third_party/libsodium-cmake @ 9b2848d
  • itself carries jedisct1/libsodium @ 93a7d0d (libsodium 1.0.20 line) as a nested submodule — clones need --recursive.
• Why the wrapper: upstream libsodium is autotools-only. This MIT-licensed wrapper is a pure CMakeLists over an untouched libsodium checkout; it generates version.h, sets CONFIGURED, and builds clean for macOS / iOS / Android / Windows. Used by many mobile projects.
• Build options we force: SODIUM_DISABLE_TESTS=ON, SODIUM_MINIMAL=OFF (we need crypto_kx, crypto_auth, crypto_aead_xchacha20poly1305, crypto_stream_xchacha20, crypto_generichash/BLAKE2b — all outside the "minimal" set).
• License: ISC (libsodium) + MIT (wrapper). Ship-safe.

libzstd — facebook/zstd

• Submodule: extension/third_party/zstd @ tag v1.5.6 (794ea1b0).
• Built through upstream build/cmake with: ZSTD_BUILD_PROGRAMS/SHARED/TESTS/CONTRIB=OFF, ZSTD_BUILD_STATIC=ON, ZSTD_LEGACY_SUPPORT=OFF, ZSTD_MULTITHREAD_SUPPORT=OFF (the eterpack path only does single-shot ZSTD_compress/ZSTD_decompress).
• Target consumed: libzstd_static (carries its own public include dir).
• License: BSD-3-Clause / GPLv2 dual. Ship-safe under BSD.

miniLZO — vendored source (not a submodule)

• Files: extension/third_party/minilzo/{minilzo.c,minilzo.h,lzoconf.h,lzodefs.h} copied verbatim from lzo-2.10 (minilzo.c sha1 019debb3…), plus README.LZO, COPYING, AUTHORS as required by the LZO license.
• Upstream LZO has no git repo (oberhumer.com tarball only), and miniLZO is a 4-file amalgamation, so it is copied in rather than submoduled.
• Shim: minilzo/lzo/lzo1x.h is a 1-line #include "../minilzo.h" so extension/src/proto/proto.cpp keeps #include <lzo/lzo1x.h> unchanged. miniLZO's API (lzo_init, lzo1x_decompress_safe, LZO_E_OK, lzo_uint) is a strict subset of full LZO and covers everything the CLZO path uses.
• License: GPLv2. Acceptable for this internal, non-published, non-commercial project on the same footing as libgr2/src/oodle1.c — but LZO must be removed, replaced, or commercially licensed before any public release or commercial use. (item_proto/mob_proto are the only LZO consumers; a clean-room LZO1X decompressor is the eventual fix.)

Crypto++ — vendored source (not a submodule)

• Files: extension/third_party/cryptopp/ (~6.6 MB), copied from the 40250 client tree (ClientVS22/extern/include/cryptopp), CRYPTOPP_VERSION 840 = 8.4.0. The 40250 server links this exact version (Server/.../extern/cryptopp_8_4_0.tar.gz), so the version is pinned by wire compatibility, not preference.
• Why: the MT_PROTOCOL=classic backend's _IMPROVED_PACKET_ENCRYPTION_ cipher — DH2 key agreement + hint-selected block ciphers (Twofish default) in CTR mode. Only consumer is extension/src/net/classic/classic_cipher.{h,cpp}. The m2dev backend does not use it (that one is libsodium/XChaCha20).
• No upstream CMakeLists, so cryptopp/CMakeLists.txt is ours: it globs the library TUs and drops the cryptest / benchmark / adhoc / FIPS-selftest ones (adhoc, bench1..3, datatest, dlltest, fipsalgt, fipstest, pch, regtest1..4, test, validat0..10).
• ASM disabled everywhere (CRYPTOPP_DISABLE_ASM / _SSSE3 / _AESNI) so one pure-C++ build works on macOS, the Android NDK and the iOS SDK; the classic cipher needs no AES-NI / SHA-ext. Android additionally compiles the NDK's sources/android/cpufeatures/cpu-features.c in, because upstream cpu.cpp includes cpu-features.h unconditionally under __ANDROID__.
• Built with -w (upstream is not warning-clean under -Wall) and -fno-strict-aliasing.
• License: public domain — the compilation carries Wei Dai's copyright, but every individual file is placed in the public domain by its authors (extension/third_party/cryptopp/License.txt). Ship-safe; unlike miniLZO it imposes no obligation before a public or commercial release.

Rebuilding / fetching

./build.sh auto-runs git submodule update --init --recursive if any of the three submodules (godot-cpp, zstd, libsodium-cmake+libsodium) is missing. miniLZO and Crypto++ are vendored source and need no fetch.

Homebrew libsodium / zstd / lzo are no longer referenced by the build and can be uninstalled.