mtgodot-poc/docs/THIRD-PARTY.md

Third-party native dependencies

The native client links four vendored libraries, all built from source by our own CMake build (the Android NDK and iOS SDK sysroots have none of them). They live under extension/third_party/ and are wired by extension/third_party/CMakeLists.txt. libsodium and zstd (the m2dev-era net/pack layers) were removed on 2026-09-29 together with those layers.

Alias	Backing target	Consumed by
mt3p::minilzo	minilzo	port_logic (EterBase/lzo, proto)
mt3p::cryptopp	cryptopp	port_logic (EterBase/cipher)
mt3p::python	mtpython	the embedded 40250 script layer
mt3p::freetype	freetype	port_platform (platform/Win32Gdi.cpp)

#include <lzo/lzo1x.h> resolves via a 1-line shim header, see below.

miniLZO — vendored source (not a submodule)

• Files: extension/third_party/minilzo/{minilzo.c,minilzo.h,lzoconf.h,lzodefs.h} copied verbatim from lzo-2.10 (minilzo.c sha1 019debb3…), plus README.LZO, COPYING, AUTHORS as required by the LZO license.
• Upstream LZO has no git repo (oberhumer.com tarball only), and miniLZO is a 4-file amalgamation, so it is copied in rather than submoduled.
• Shim: minilzo/lzo/lzo1x.h is a 1-line #include "../minilzo.h" so the ported EterBase/lzo.h keeps #include <lzo/lzo1x.h> unchanged. miniLZO's API (lzo_init, lzo1x_decompress_safe, LZO_E_OK, lzo_uint) is a strict subset of full LZO and covers everything the CLZO path uses.
• License: GPLv2. Acceptable for this internal, non-published, non-commercial project on the same footing as libgr2/src/oodle1.c — but LZO must be removed, replaced, or commercially licensed before any public release or commercial use. (item_proto/mob_proto are the only LZO consumers; a clean-room LZO1X decompressor is the eventual fix.)

Crypto++ — vendored source (not a submodule)

• Files: extension/third_party/cryptopp/ (~6.6 MB), copied from the 40250 client tree (ClientVS22/extern/include/cryptopp), CRYPTOPP_VERSION 840 = 8.4.0. The 40250 server links this exact version (Server/.../extern/cryptopp_8_4_0.tar.gz), so the version is pinned by wire compatibility, not preference.
• Why: the MT_PROTOCOL=classic backend's _IMPROVED_PACKET_ENCRYPTION_ cipher — DH2 key agreement + hint-selected block ciphers (Twofish default) in CTR mode. Only consumer is extension/src/net/classic/classic_cipher.{h,cpp}. The m2dev backend does not use it (that one is libsodium/XChaCha20).
• No upstream CMakeLists, so cryptopp/CMakeLists.txt is ours: it globs the library TUs and drops the cryptest / benchmark / adhoc / FIPS-selftest ones (adhoc, bench1..3, datatest, dlltest, fipsalgt, fipstest, pch, regtest1..4, test, validat0..10).
• ASM disabled everywhere (CRYPTOPP_DISABLE_ASM / _SSSE3 / _AESNI) so one pure-C++ build works on macOS, the Android NDK and the iOS SDK; the classic cipher needs no AES-NI / SHA-ext. Android additionally compiles the NDK's sources/android/cpufeatures/cpu-features.c in, because upstream cpu.cpp includes cpu-features.h unconditionally under __ANDROID__.
• Built with -w (upstream is not warning-clean under -Wall) and -fno-strict-aliasing.
• License: public domain — the compilation carries Wei Dai's copyright, but every individual file is placed in the public domain by its authors (extension/third_party/cryptopp/License.txt). Ship-safe; unlike miniLZO it imposes no obligation before a public or commercial release.

CPython 2.7.18 — vendored source (not a submodule)

• Files: extension/third_party/cpython-2.7.18/ (~25 MB), the official Python-2.7.18.tgz (sha256 b62c0e7937551d0cc02b8fd5cb0f544f9405bafc9a54d3808ed4594812edef43) trimmed of what an embedded interpreter never builds or ships: Doc Demo Tools Mac PCbuild, Modules/{_ctypes,expat,zlib,_sqlite}, the stdlib test trees and the pre-VS2010 PC/ project files. Lib/ stays: the mtpython_stdlib target packs it into <build>/python27.zip with tools/py_embed/make_stdlib_zip.py, which is what the host puts on sys.path (batch 2P step 3). Entries are stored, never deflated — the zlib module is trimmed out above, so zipimport has nothing to inflate with. The zip and its .sha256 are copied into project/ (gitignored) so the exporter packs them; on Android/iOS extension/src/python_stdlib.cpp stages the zip out of the PCK into user:// and checks that digest, because CPython opens it with its own stdio.
• Why vendored: 2.7 is end-of-life, so there is no package to fetch on the four target SDKs, and the build must keep working offline and on the cross-build machines. It is the version the 40250 scripts are written for (ScriptLib embeds 2.7), so it is pinned by the scripts, not by preference.
• Built by our own cpython-2.7.18/CMakeLists.txt, not autotools: one mtpython static library from the exact 133 objects the reference libpython2.7.a contains. The source list and the built-in module table (config/config.c, config/Setup.static, 39 entries) are shared; pyconfig.h is not — it is a probe result, so each platform keeps its own under config/<platform>/, regenerated by tools/py_embed/gen_pyconfig.sh. Off by default: -DMTGODOT_EMBED_PYTHON=ON builds it.
• Three vendor patches (everything else is verbatim upstream):
  1. configure + 2. configure.ac — add arm64) MACOSX_DEFAULT_ARCH="arm64" to both case \/usr/bin/arch`` blocks; upstream predates Apple silicon and dies with "Unexpected output of 'arch' on OSX".
  2. Modules/posixmodule.c — after the "all other compilers" block that hard-defines HAVE_SYSTEM/FORK/EXECV/WAIT/POPEN regardless of pyconfig.h, undefine them again under TARGET_OS_IPHONE: the iphoneos SDK marks system() unavailable and the sandbox forbids the rest.
• Platform notes: Android API 24 turns off HAVE_LANGINFO_H (bionic declares nl_langinfo only from API 26); iOS derives its pyconfig.h from the macOS one (2.7's configure refuses a darwin cross build) and drops process control plus <sys/random.h>/getentropy, but keeps HAVE_GETGROUPS because posixmodule.c defines MAX_GROUPS — which its setgroups path needs — only inside that #ifdef. Windows is out of scope (decided 2026-09-23, PORT-PLAN §1: the targets are macOS arm64 and Android arm64). It is also not buildable as-is: upstream supports MSVC + PC/pyconfig.h, while the mingw-w64 portability gate cross-compiles with MinGW, where PC/pyconfig.h's gnu-win32 branch leaves HAVE_UNISTD_H unset and posixmodule.c / dynload_win.c then collide with the MinGW headers. So that gate simply builds no mtpython, and port_logic / port_platform drop ScriptLib there.
• License: PSF License Agreement (cpython-2.7.18/LICENSE). Ship-safe; the only obligation is keeping the license and a change notice, which this section and the patched files' comments serve.

FreeType 2.13.3 — vendored source, trimmed (not a submodule)

• Files: extension/third_party/freetype-2.13.3/ (~5 MB): the official freetype-2.13.3.tar.xz (source URL and sha256 in the directory's CMakeLists.txt header) cut down to include/, src/{base,sfnt,truetype,smooth,raster,psnames,gzip}, LICENSE.TXT and docs/FTL.TXT.
• Build: our own CMakeLists.txt (upstream's pulls in optional deps we don't want); mt-config/freetype/config/ftmodule.h replaces the stock module list with TrueType + sfnt + the mono and gray rasterizers. No upstream file is modified.
• Why: 40250's CGraphicFontTexture / CGraphicDib render glyphs with GDI (CreateFontIndirect, TextOutW into a DIB section). platform/Win32Gdi.cpp implements that GDI subset over FreeType with GDI's cell-height, win-metric and gasp rules, so the 40250 font code stays verbatim.
• License: FreeType License (docs/FTL.TXT, BSD-style with credit clause): the shipped product's documentation must credit "Portions of this software are copyright © The FreeType Project (www.freetype.org)".

Rebuilding / fetching

There are no submodules: miniLZO, Crypto++, CPython and FreeType are vendored source and need no fetch.

Homebrew libsodium / zstd / lzo are no longer referenced by the build and can be uninstalled.