Checkpoint 1: implement native subsystems and begin the gameplay manual

tools/fetch_dependencies.py

@@ -0,0 +1,41 @@
+#!/usr/bin/env python3
+"""Download pinned source archives once; CMake reuses them without network access."""
+import argparse
+import concurrent.futures
+import hashlib
+import json
+from pathlib import Path
+import urllib.request
+
+ROOT = Path(__file__).resolve().parents[1]
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--verify-only", action="store_true")
+    args = parser.parse_args()
+    lock = json.loads((ROOT / "dependencies.lock.json").read_text())
+    directory = ROOT / ".cache" / "downloads"
+    directory.mkdir(parents=True, exist_ok=True)
+
+    def fetch(item):
+        name, dep = item
+        path = directory / f"{name}-{dep['commit']}.tar.gz"
+        if not path.exists():
+            if args.verify_only:
+                raise RuntimeError(f"Missing archive: {path}")
+            with urllib.request.urlopen(dep["url"], timeout=180) as response:
+                content = response.read()
+            if hashlib.sha256(content).hexdigest() != dep["sha256"]:
+                raise RuntimeError(f"Checksum mismatch: {name}")
+            temporary = path.with_suffix(".download")
+            temporary.write_bytes(content)
+            temporary.replace(path)
+        if hashlib.sha256(path.read_bytes()).hexdigest() != dep["sha256"]:
+            raise RuntimeError(f"Checksum mismatch: {name}")
+        print(f"Verified {name}: {dep['commit']}", flush=True)
+
+    with concurrent.futures.ThreadPoolExecutor(max_workers=4) as pool:
+        list(pool.map(fetch, lock["dependencies"].items()))
+
+if __name__ == "__main__":
+    main()