# Deploy a native Raylib program

[العربية](deployment.ar.md) · [Guide](guide.en.md) · [Contributor preparation](contributor.md) · [Evidence status](evidence.md)

The target is generic x86-64 Linux with glibc 2.34 or newer. The tool and generated
programs are ELF64 PIE with interpreter `/lib64/ld-linux-x86-64.so.2`, no GLIBC
symbol requirement newer than 2.34, RELRO, immediate binding and a non-executable
stack. Direct dependencies are exactly `libc.so.6` and `libm.so.6`; there is no
RPATH/RUNPATH. Host graphics/audio implementations can have their own dependency
closure, permissions and driver requirements. These are the supported target
requirements. Ticket 30 records actual glibc 2.34 execution and offline,
source-free deployment in its [verification handoff](../releases/0.6.0/verification/30-handoff.md).

Install the normal ASPL toolchain. Application check/build invokes no C compiler,
assembler or linker and acquires no device. A generated native program carries
its bytecode, register VM and selected private engines. Recipients need no ASPL
runtime, system Raylib, host fonts or application source.

## Acquire host facilities only when needed

Pure operations and CPU text need only the CPU/glibc baseline. An import does not
load a display/audio backend. Window initialization requires an authorized
reachable endpoint, compatible versioned libraries and OpenGL 3.3 core:

| Route | Required host libraries and facilities |
| --- | --- |
| Native X11 or XWayland | `libX11.so.6`, `libXxf86vm.so.1`, `libXi.so.6`, `libXrandr.so.2`, `libXcursor.so.1`, `libXinerama.so.1`, `libXrender.so.1`, `libXext.so.6`; GLX tries `libGLX.so.0`, then `libGL.so.1`; authorized DISPLAY and a usable OpenGL 3.3 core context. |
| Native Wayland | `libwayland-client.so.0`, `libwayland-cursor.so.0`, `libwayland-egl.so.1`, `libxkbcommon.so.0`, `libEGL.so.1`; compositor/subcompositor, xdg-shell, shared memory, keyboard/pointer, usable outputs and a cursor theme. Uses the non-libdecor path and desktop OpenGL 3.3 core. Missing EGL GL procedures try `libOpenGL.so.0`, then `libGL.so.1`. |
| PulseAudio or PipeWire's PulseAudio-compatible service | `libpulse.so.0`, a reachable playback service and usable endpoint. |
| Direct ALSA | `libasound.so.2`, a permitted usable playback device. |

Host loading uses ordinary loader search, immediate/local scope and required
symbol validation. No unversioned development symlink is needed. Only exact
`XDG_SESSION_TYPE=wayland` chooses Wayland first. Nonempty WAYLAND_DISPLAY and
DISPLAY identify candidates; other session types choose X11 first. The other
available endpoint follows on a safely released host failure. Endpoint values
keep host interpretation, including absolute Wayland socket paths.

Audio tries PulseAudio then ALSA, including playback-start failure. Safe complete
release precedes every fallback. Invalid arguments, resource refusal,
cancellation or unproved cleanup stop retries. A successful backend stays fixed
until close. No null/headless success is substituted. No candidates means
`raylib.host_unavailable`; all safely failed candidates return the final
candidate's category with attempted-backend details. See [window](../raylib-window-hosts.md)
and [audio](../raylib-audio-hosts.md) for the feature-slice evidence and limits.

## Copy assets and notices

File paths resolve from the process working directory, independently of the
source/executable directory. The examples keep exact paths such as
`docs/examples/assets/raylib-sprites.png`. Copy that relative tree or change the
source literals before building. PNG and WAV/OGG/MP3 assets and custom TrueType
fonts remain external. Keep their licenses with them. Font loads retain copied
bytes; streamed music retains owned decoder/file/buffer state.

```sh
aspl build -o build/sprites docs/examples/raylib/sprite-camera.aspl
mkdir -p build/deploy/docs/examples
cp build/sprites build/sprites.THIRD-PARTY-NOTICES build/deploy/
cp -r docs/examples/assets build/deploy/docs/examples/
cd build/deploy
./sprites --aspl-diagnostic-language=en
```

This runs the copied executable without source. The generated companion
`<program>.THIRD-PARTY-NOTICES` contains the frozen component/data/font inventory,
including FreeType credit/disclaimer. Ship it with the executable and the assets'
notices. Runtime does not read it. Build publishes it atomically first, then the
executable atomically. Notice failure prevents executable publication; a later
executable failure preserves the previous executable and reports the already
published notice. Source/module collisions use `output-is-source`; aliased
executable/companion paths use `output-path-collision`; unsafe/write/publication
failure uses `host-operation-failed` with phase/path/partial-result details.
Source runs create no companion.

## Embedded data and compatible private records

Raylib-capable programs embed pinned Raylib 6.0, HarfBuzz 14.4.0, ICU 78.3 with
full unfiltered Unicode 17.0.0 data, FreeType 2.14.3, Noto Sans Arabic Regular
2.013 and Noto Sans Regular 2.015. Controlled C++ runtime/unwind support is
private. Host locale, fonts, ICU_DATA or plugins cannot substitute the baseline.
Exact source/archive/font hashes and configuration are in the contributor page.

The entire import graph selects core profile 0, HTTP 1, Raylib 3 or combined 4,
including unused/transitive imports; tool profile 2 carries all four templates.
Core/HTTP outputs add no Raylib engines, fonts, data or device prerequisites.
Independent admission checks requirements, schemas, signatures, effects, owner
families and preparation identities before native effects.

Current private identities are bytecode version 7, incorporated record version 2,
supplied native ABI 1, reviewed contract `0x00010000`, HTTP catalog `0x00010006`,
Raylib catalog `0x0001000e` and recorded Raylib private ABI 14. The dependency
manifest's historical `http_private_abi=1` is a different identity from private
HTTP event boundary version 3; do not treat them as interchangeable. Session
owners, resumable scheduler work and snapshots obey the current matched build.
The new enums/flags/constants, owner families, HTTP state/progress and four
prepared images do not create a stable public bytecode or backend ABI. Reject
incompatible private metadata even with a recomputed checksum. Existing ordinary
unsafe C declarations and previously distributed self-contained programs keep
their own contracts and embedded identities.

The [evidence index](evidence.md) records automated deployment and available-host
receipts. Manual input/resize/window flags, glyph placement, texture flips and audible
playback observations passed on the available Wayland/XWayland/PipeWire routes.
HighDPI observations were skipped because the user has a normal-density screen.
Native X11, standalone PulseAudio and direct ALSA remain outside this evidence.
See the [0.6.0 release notes](../releases/0.6.0/README.md) for the recorded scope.