Pikoroo runtime: source, notices and replacement

This runtime contains Wine 11.0 and published Wine patches, DXMT 0.80,
DXVK-macOS 1.10.3, MoltenVK 1.4.2 and a reduced GStreamer 1.28.7 media runtime.
It contains no Apple D3DMetal, CrossOver binaries, game files or user data.
Apple graphics can be imported separately from Apple's original download,
subject to Apple's terms. An import does not expand those terms.

Third-party components retain their own licences. The exact source archives,
patches and build scripts accompany this download as Pikoroo-runtime-sources.tar.gz.
distribution.json maps payload files to components and pins that archive.
Licence and authorship notices are in licenses/ and deps/licenses/; original
media SDK notices remain in deps/GStreamer.framework/Versions/1.0/share/licenses/.
Some retained SDK notices refer to components excluded from this smaller package.
FreeType is used under its FreeType License (FTL), copyright The FreeType Project.
GMP and Nettle use the LGPL-3.0-or-later choice of their dual licences.
FFmpeg uses the Cerbero LGPL configuration with nonfree/version3 disabled.
Codec patent rights are separate from source licences; this file grants none.

Rebuilding

Use Python 3.12+, Xcode command-line tools, make, pkg-config, bison, Meson,
Ninja and the llvm-mingw version pinned in build/source-lock.json. These are
build tools, not customer installation requirements. macOS system frameworks
and SDKs are supplied by Apple and are not part of this source distribution.

1. Unpack the accompanying source archive. Keep the pinned upstream archives
   together in a source cache. build/distribution-source-lock.json records
   their origins and hashes. The larger historical lock also describes
   components not included in this release; it is not the release inventory.
2. Run build/build-public-dependencies.py --sources <cache> --output <new-dir>.
   This builds GMP, Nettle, GnuTLS and SDL2 for x86_64, with minimum macOS 14,
   then relocates their dylibs. dependencies-build-receipt.json records the
   commands used for this distribution. GnuTLS includes its bundled libtasn1
   and unistring source; their notices are in that source archive.
3. For the media libraries, unpack cerbero-1.28.7.tar.gz. Its config files,
   recipes and patches describe the prebuilt macOS universal SDK. Use
   ./cerbero-uninstalled -c config/osx-universal.cbc bootstrap, then build the
   components listed in distribution.json. The selected upstream archives are
   provided here; Cerbero supplies matching patch series and configuration.
   The runtime selection is explicit in scripts/prepare-public-runtime.py.
   It includes Wine's dlopen libraries and resolves their native dependencies.
   It excludes the unused SDK umbrella library, tools and Rust/GPL plugins.
4. Prepare Wine using scripts/prepare-source.py --archive <wine archive>.
   Use --metal for the separate Metal hooks core, or --steam for the base
   Steam driver. build/build-wine.py, build/build-sync-core.py and
   build/relocate-wine.py contain the configure and relocation steps.
   PIKOROO_ENGINE_BUILD_OUTPUT and PIKOROO_ENGINE_WORK choose new build roots.
   Populate their deps directory with rebuilt dependencies and the media SDK
   headers, and set PIKOROO_LLVM_MINGW_BIN to the pinned toolchain's bin path.
5. steam-source.tar.gz and metalfx-ngx-source.tar.gz contain the modified
   Wine/DXMT trees and recipes actually used for the Steam driver and NGX shim.
   scripts/add-steam-client-support.py, add-msync-core.py and
   add-metalfx-provider.py record their incremental integration steps.
   DXVK and MoltenVK source archives retain upstream build instructions;
   MoltenVK's pinned external dependency archives are included separately.
6. scripts/prepare-public-runtime.py builds a NEW runtime payload. Never use
   a game environment or a user data directory as an input or output.
   Release packaging removes PE debug sections with llvm-strip --strip-debug,
   verifying that every remaining section and its address are unchanged.
   DebugSymbols/index.json maps modules to separately retained original binaries.
   Identical Windows modules and share data in the Metal core use relative
   links to the base core; the native loaders and distinct modules stay separate.
   Steam and NGX sources live in this source archive; manifest.json binds their
   hashes and the complete archive hash. For an existing verified public payload,
   scripts/optimize-public-runtime.py --package <payload> --sources <archive>
   --output <new-dir> performs the same steps without modifying its inputs.

Modification and replacement

You may modify the LGPL components and reverse engineer for debugging those
modifications as provided by their licences. No Pikoroo restriction overrides
these rights. Keep the original app and environments recoverable first.

Copy RuntimePayload to a new private development directory. Replace libraries
there, preserve required ABI names, update changed SHA-256 entries in
manifest.json criticalFiles, and remove the now-stale distribution.json.
Ad hoc sign modified native images with codesign --force --sign -; no paid
identity is needed for this local development copy. Build Pikoroo from source
with PIKOROO_RUNTIME_PACKAGE=<new payload> and PIKOROO_ALLOW_PRIVATE_RUNTIME=1,
or use the separately built controller with --package and an empty --state
directory. Use fresh test environments for changed Wine cores. Existing queued
jobs, backups and environments deliberately retain their provider identities.
Do not edit their ownership records to bypass compatibility checks.

The original unsigned download uses manual installation and updates. Its
checksums identify files but do not establish a publisher identity. Do not
disable Gatekeeper globally. macOS may require Privacy & Security > Open Anyway
for the app after its first launch attempt. Rosetta may be required on Apple
silicon. Minimum-version declarations are not acceptance on every Mac model.
