diff --git a/Mbed-TLS/mbedtls/mbedtls-2.16.12/mbedtls_llar.gox b/Mbed-TLS/mbedtls/mbedtls-2.16.12/mbedtls_llar.gox
new file mode 100644
index 0000000..58e97bc
--- /dev/null
+++ b/Mbed-TLS/mbedtls/mbedtls-2.16.12/mbedtls_llar.gox
@@ -0,0 +1,153 @@
+import (
+	"os"
+	"path/filepath"
+	"slices"
+)
+
+const consumerSource = `#include "mbedtls/version.h"
+
+#include <stdio.h>
+
+int main(void)
+{
+    char mbedtls_version[18];
+    mbedtls_version_get_string_full(mbedtls_version);
+    printf("version: %s\n", mbedtls_version);
+    return 0;
+}
+`
+
+id "Mbed-TLS/mbedtls"
+
+fromVer "mbedtls-2.16.12"
+
+defaults {
+	"shared": "OFF",
+	"fPIC": "ON",
+	"with_zlib": "ON",
+	"enable_threading": "OFF",
+}
+
+filter => {
+	for name, values in target.options {
+		if name != "shared" && name != "fPIC" && name != "with_zlib" && name != "enable_threading" {
+			return false
+		}
+		for value in values {
+			if value != "ON" && value != "OFF" {
+				return false
+			}
+		}
+	}
+	osName := target.require["os"][0]
+	if osName == "windows" {
+		if target.options["shared"][0] == "ON" || target.options["enable_threading"][0] == "ON" {
+			return false
+		}
+	}
+	return true
+}
+
+onRequire (proj, deps) => {
+	if target.options["with_zlib"][0] == "ON" {
+		deps.require "madler/zlib", "v1.3.1"
+	}
+}
+
+onBuild ctx => {
+	installDir := ctx.outputDir
+	shared := target.options["shared"][0] == "ON"
+	fPIC := target.options["fPIC"][0] == "ON"
+	withZlib := target.options["with_zlib"][0] == "ON"
+	enableThreading := target.options["enable_threading"][0] == "ON"
+	osName := target.require["os"][0]
+
+	c := cmake.new(ctx.SourceDir, filepath.join(ctx.SourceDir, "_build"), installDir)
+	c.define "CMAKE_INSTALL_LIBDIR", "lib"
+	c.define "CMAKE_POLICY_DEFAULT_CMP0042", "NEW"
+	c.define "CMAKE_POLICY_VERSION_MINIMUM", "3.5"
+	c.defineBool "USE_SHARED_MBEDTLS_LIBRARY", shared
+	c.defineBool "USE_STATIC_MBEDTLS_LIBRARY", !shared
+	c.defineBool "CMAKE_POSITION_INDEPENDENT_CODE", fPIC
+	c.defineBool "ENABLE_ZLIB_SUPPORT", withZlib
+	c.defineBool "ENABLE_PROGRAMS", false
+	c.defineBool "ENABLE_TESTING", false
+	c.defineBool "MBEDTLS_FATAL_WARNINGS", false
+	c.defineBool "CMAKE_WINDOWS_EXPORT_ALL_SYMBOLS", true
+
+	cFlags := ""
+	if enableThreading {
+		if cFlags != "" {
+			cFlags += " "
+		}
+		cFlags += "-DMBEDTLS_THREADING_C=1 -DMBEDTLS_THREADING_PTHREAD=1"
+	}
+	if cFlags != "" {
+		c.define "CMAKE_C_FLAGS", cFlags
+	}
+
+	for dep in ctx.Proj.Deps {
+		c.use ctx.outputDir(dep)
+	}
+	c.configure
+	c.build
+	c.install
+
+	licenseDir := filepath.join(installDir, "licenses")
+	os.mkdirAll(licenseDir, 0o755)!
+	os.writeFile(filepath.join(licenseDir, "LICENSE"), os.readFile(filepath.join(ctx.SourceDir, "LICENSE"))!, 0o644)!
+
+	libs := ["-L$${libdir}", "-lmbedtls", "-lmbedx509", "-lmbedcrypto"]
+	if enableThreading && (osName == "linux" || osName == "freebsd") {
+		libs <- "-lpthread"
+	}
+	requires := []string{}
+	if withZlib {
+		requires <- "zlib"
+	}
+
+	pcDir := filepath.join(installDir, "lib", "pkgconfig")
+	os.mkdirAll(pcDir, 0o755)!
+	pc := pkgconfig.new(
+		name = "mbedtls",
+		description = "Mbed TLS is a C library that implements cryptographic primitives, X.509 certificate manipulation and the SSL/TLS and DTLS protocols.",
+		version = "mbedtls-2.16.12",
+		requires = requires,
+		libs = libs,
+		cflags = ["-I$${includedir}"],
+	)!
+	out := os.create(filepath.join(pcDir, "mbedtls.pc"))!
+	pc.writeTo(out)!
+	out.close()!
+
+	for dep in ctx.Proj.Deps {
+		pkgconfig.use ctx.outputDir(dep)
+	}
+	pkgconfig.use installDir
+	ctx.setMetadata pkgconfig.lookup("mbedtls")!
+}
+
+onTest ctx => {
+	installDir := ctx.outputDir
+	testDir := filepath.join(ctx.SourceDir, "_llar_consumer")
+	os.mkdirAll(testDir, 0o755)!
+
+	consumer := filepath.join(testDir, "consumer.c")
+	os.writeFile(consumer, []byte(consumerSource), 0o644)!
+
+	for dep in ctx.Proj.Deps {
+		pkgconfig.use ctx.outputDir(dep)
+	}
+	pkgconfig.use installDir
+	flagsFile := filepath.join(testDir, "mbedtls.flags")
+	os.writeFile(flagsFile, []byte(pkgconfig.lookup("mbedtls")!), 0o644)!
+
+	binary := filepath.join(testDir, "consumer")
+	cc! consumer, "-o", binary, "@"+flagsFile
+
+	if target.options["shared"][0] == "ON" {
+		os.setenv("LD_LIBRARY_PATH", filepath.join(installDir, "lib"))!
+		os.setenv("DYLD_LIBRARY_PATH", filepath.join(installDir, "lib"))!
+	}
+	exec! binary
+}
diff --git a/Mbed-TLS/mbedtls/mbedtls-3.0.0/mbedtls_llar.gox b/Mbed-TLS/mbedtls/mbedtls-3.0.0/mbedtls_llar.gox
new file mode 100644
index 0000000..948a78d
--- /dev/null
+++ b/Mbed-TLS/mbedtls/mbedtls-3.0.0/mbedtls_llar.gox
@@ -0,0 +1,135 @@
+import (
+	"os"
+	"path/filepath"
+	"slices"
+)
+
+const consumerSource = `#include "mbedtls/version.h"
+
+#include <stdio.h>
+
+int main(void)
+{
+    char mbedtls_version[18];
+    mbedtls_version_get_string_full(mbedtls_version);
+    printf("version: %s\n", mbedtls_version);
+    return 0;
+}
+`
+
+id "Mbed-TLS/mbedtls"
+
+fromVer "mbedtls-3.0.0"
+
+defaults {
+	"shared": "OFF",
+	"fPIC": "ON",
+	"enable_threading": "OFF",
+}
+
+filter => {
+	for name, values in target.options {
+		if name != "shared" && name != "fPIC" && name != "enable_threading" {
+			return false
+		}
+		for value in values {
+			if value != "ON" && value != "OFF" {
+				return false
+			}
+		}
+	}
+	osName := target.require["os"][0]
+	if osName == "windows" {
+		if target.options["shared"][0] == "ON" || target.options["enable_threading"][0] == "ON" {
+			return false
+		}
+	}
+	return true
+}
+
+onBuild ctx => {
+	installDir := ctx.outputDir
+	shared := target.options["shared"][0] == "ON"
+	fPIC := target.options["fPIC"][0] == "ON"
+	enableThreading := target.options["enable_threading"][0] == "ON"
+	osName := target.require["os"][0]
+
+	c := cmake.new(ctx.SourceDir, filepath.join(ctx.SourceDir, "_build"), installDir)
+	c.define "CMAKE_INSTALL_LIBDIR", "lib"
+	c.defineBool "USE_SHARED_MBEDTLS_LIBRARY", shared
+	c.defineBool "USE_STATIC_MBEDTLS_LIBRARY", !shared
+	c.defineBool "CMAKE_POSITION_INDEPENDENT_CODE", fPIC
+	c.defineBool "ENABLE_PROGRAMS", false
+	c.defineBool "ENABLE_TESTING", false
+	c.defineBool "MBEDTLS_FATAL_WARNINGS", false
+	c.defineBool "CMAKE_WINDOWS_EXPORT_ALL_SYMBOLS", true
+
+	cFlags := ""
+	if enableThreading {
+		if cFlags != "" {
+			cFlags += " "
+		}
+		cFlags += "-DMBEDTLS_THREADING_C=1 -DMBEDTLS_THREADING_PTHREAD=1"
+	}
+	if cFlags != "" {
+		c.define "CMAKE_C_FLAGS", cFlags
+	}
+
+	_, err := os.stat(filepath.join(ctx.SourceDir, ".gitmodules"))
+	if err == nil {
+		git! "submodule", "update", "--init", "--recursive"
+	} else if !os.isNotExist(err) {
+		panic err
+	}
+
+	c.configure
+	c.build
+	c.install
+
+	licenseDir := filepath.join(installDir, "licenses")
+	os.mkdirAll(licenseDir, 0o755)!
+	os.writeFile(filepath.join(licenseDir, "LICENSE"), os.readFile(filepath.join(ctx.SourceDir, "LICENSE"))!, 0o644)!
+
+	libs := ["-L$${libdir}", "-lmbedtls", "-lmbedx509", "-lmbedcrypto"]
+	if enableThreading && (osName == "linux" || osName == "freebsd") {
+		libs <- "-lpthread"
+	}
+
+	pcDir := filepath.join(installDir, "lib", "pkgconfig")
+	os.mkdirAll(pcDir, 0o755)!
+	pc := pkgconfig.new(
+		name = "mbedtls",
+		description = "Mbed TLS is a C library that implements cryptographic primitives, X.509 certificate manipulation and the SSL/TLS and DTLS protocols.",
+		version = "mbedtls-3.0.0",
+		libs = libs,
+		cflags = ["-I$${includedir}"],
+	)!
+	out := os.create(filepath.join(pcDir, "mbedtls.pc"))!
+	pc.writeTo(out)!
+	out.close()!
+
+	pkgconfig.use installDir
+	ctx.setMetadata pkgconfig.lookup("mbedtls")!
+}
+
+onTest ctx => {
+	installDir := ctx.outputDir
+	testDir := filepath.join(ctx.SourceDir, "_llar_consumer")
+	os.mkdirAll(testDir, 0o755)!
+
+	consumer := filepath.join(testDir, "consumer.c")
+	os.writeFile(consumer, []byte(consumerSource), 0o644)!
+
+	pkgconfig.use installDir
+	flagsFile := filepath.join(testDir, "mbedtls.flags")
+	os.writeFile(flagsFile, []byte(pkgconfig.lookup("mbedtls")!), 0o644)!
+
+	binary := filepath.join(testDir, "consumer")
+	cc! consumer, "-o", binary, "@"+flagsFile
+
+	if target.options["shared"][0] == "ON" {
+		os.setenv("LD_LIBRARY_PATH", filepath.join(installDir, "lib"))!
+		os.setenv("DYLD_LIBRARY_PATH", filepath.join(installDir, "lib"))!
+	}
+	exec! binary
+}
diff --git a/Mbed-TLS/mbedtls/mbedtls-4.0.0/mbedtls_llar.gox b/Mbed-TLS/mbedtls/mbedtls-4.0.0/mbedtls_llar.gox
new file mode 100644
index 0000000..d161a35
--- /dev/null
+++ b/Mbed-TLS/mbedtls/mbedtls-4.0.0/mbedtls_llar.gox
@@ -0,0 +1,134 @@
+import (
+	"os"
+	"path/filepath"
+	"slices"
+)
+
+const consumerSource = `#include "mbedtls/version.h"
+
+#include <stdio.h>
+
+int main(void)
+{
+    const char *mbedtls_version = mbedtls_version_get_string_full();
+    printf("version: %s\n", mbedtls_version);
+    return 0;
+}
+`
+
+id "Mbed-TLS/mbedtls"
+
+fromVer "mbedtls-4.0.0"
+
+defaults {
+	"shared": "OFF",
+	"fPIC": "ON",
+	"enable_threading": "OFF",
+}
+
+filter => {
+	for name, values in target.options {
+		if name != "shared" && name != "fPIC" && name != "enable_threading" {
+			return false
+		}
+		for value in values {
+			if value != "ON" && value != "OFF" {
+				return false
+			}
+		}
+	}
+	osName := target.require["os"][0]
+	if osName == "windows" {
+		if target.options["shared"][0] == "ON" || target.options["enable_threading"][0] == "ON" {
+			return false
+		}
+	}
+	return true
+}
+
+onBuild ctx => {
+	installDir := ctx.outputDir
+	shared := target.options["shared"][0] == "ON"
+	fPIC := target.options["fPIC"][0] == "ON"
+	enableThreading := target.options["enable_threading"][0] == "ON"
+	osName := target.require["os"][0]
+
+	c := cmake.new(ctx.SourceDir, filepath.join(ctx.SourceDir, "_build"), installDir)
+	c.define "CMAKE_INSTALL_LIBDIR", "lib"
+	c.defineBool "USE_SHARED_MBEDTLS_LIBRARY", shared
+	c.defineBool "USE_STATIC_MBEDTLS_LIBRARY", !shared
+	c.defineBool "CMAKE_POSITION_INDEPENDENT_CODE", fPIC
+	c.defineBool "ENABLE_PROGRAMS", false
+	c.defineBool "ENABLE_TESTING", false
+	c.defineBool "MBEDTLS_FATAL_WARNINGS", false
+	c.defineBool "CMAKE_WINDOWS_EXPORT_ALL_SYMBOLS", true
+
+	cFlags := ""
+	if enableThreading {
+		if cFlags != "" {
+			cFlags += " "
+		}
+		cFlags += "-DMBEDTLS_THREADING_C=1 -DMBEDTLS_THREADING_PTHREAD=1"
+	}
+	if cFlags != "" {
+		c.define "CMAKE_C_FLAGS", cFlags
+	}
+
+	_, err := os.stat(filepath.join(ctx.SourceDir, ".gitmodules"))
+	if err == nil {
+		git! "submodule", "update", "--init", "--recursive"
+	} else if !os.isNotExist(err) {
+		panic err
+	}
+
+	c.configure
+	c.build
+	c.install
+
+	licenseDir := filepath.join(installDir, "licenses")
+	os.mkdirAll(licenseDir, 0o755)!
+	os.writeFile(filepath.join(licenseDir, "LICENSE"), os.readFile(filepath.join(ctx.SourceDir, "LICENSE"))!, 0o644)!
+
+	libs := ["-L$${libdir}", "-lmbedtls", "-lmbedx509", "-lmbedcrypto"]
+	if enableThreading && (osName == "linux" || osName == "freebsd") {
+		libs <- "-lpthread"
+	}
+
+	pcDir := filepath.join(installDir, "lib", "pkgconfig")
+	os.mkdirAll(pcDir, 0o755)!
+	pc := pkgconfig.new(
+		name = "mbedtls",
+		description = "Mbed TLS is a C library that implements cryptographic primitives, X.509 certificate manipulation and the SSL/TLS and DTLS protocols.",
+		version = "mbedtls-4.0.0",
+		libs = libs,
+		cflags = ["-I$${includedir}"],
+	)!
+	out := os.create(filepath.join(pcDir, "mbedtls.pc"))!
+	pc.writeTo(out)!
+	out.close()!
+
+	pkgconfig.use installDir
+	ctx.setMetadata pkgconfig.lookup("mbedtls")!
+}
+
+onTest ctx => {
+	installDir := ctx.outputDir
+	testDir := filepath.join(ctx.SourceDir, "_llar_consumer")
+	os.mkdirAll(testDir, 0o755)!
+
+	consumer := filepath.join(testDir, "consumer.c")
+	os.writeFile(consumer, []byte(consumerSource), 0o644)!
+
+	pkgconfig.use installDir
+	flagsFile := filepath.join(testDir, "mbedtls.flags")
+	os.writeFile(flagsFile, []byte(pkgconfig.lookup("mbedtls")!), 0o644)!
+
+	binary := filepath.join(testDir, "consumer")
+	cc! consumer, "-o", binary, "@"+flagsFile
+
+	if target.options["shared"][0] == "ON" {
+		os.setenv("LD_LIBRARY_PATH", filepath.join(installDir, "lib"))!
+		os.setenv("DYLD_LIBRARY_PATH", filepath.join(installDir, "lib"))!
+	}
+	exec! binary
+}
diff --git a/Mbed-TLS/mbedtls/mbedtls_cmp.gox b/Mbed-TLS/mbedtls/mbedtls_cmp.gox
new file mode 100644
index 0000000..e2443ee
--- /dev/null
+++ b/Mbed-TLS/mbedtls/mbedtls_cmp.gox
@@ -0,0 +1,82 @@
+import (
+	"strconv"
+	"strings"
+)
+
+func releaseVersion(version string) (string, bool) {
+	if version.hasPrefix("mbedtls-") {
+		version = "v" + version.trimPrefix("mbedtls-")
+	} else if version.hasPrefix("polarssl-") {
+		version = "v" + version.trimPrefix("polarssl-")
+	} else if !version.hasPrefix("v") {
+		return "", false
+	}
+
+	if semver.isValid(version) {
+		return version, true
+	}
+
+	withoutPrefix := version[1:]
+	if i := strings.indexByte(withoutPrefix, '-'); i >= 0 {
+		core := withoutPrefix[:i]
+		parts := strings.split(core, ".")
+		if parts.len == 2 {
+			return "v" + core + ".0" + withoutPrefix[i:], true
+		}
+	}
+
+	parts := strings.split(withoutPrefix, ".")
+	if parts.len == 4 {
+		patch := strconv.atoi(parts[2])!
+		next := patch + 1
+		return "v" + parts[0] + "." + parts[1] + "." + next.string + "-" + parts[3], true
+	}
+
+	post := ""
+	if version.hasSuffix("p1") {
+		post = "1"
+	}
+	if post != "" {
+		core := version.trimSuffix("p1")
+		parts := strings.split(core[1:], ".")
+		if parts.len == 3 {
+			patch := strconv.atoi(parts[2])!
+			next := patch + 1
+			return "v" + parts[0] + "." + parts[1] + "." + next.string + "-p" + post, true
+		}
+	}
+
+	dev := ""
+	if version.hasSuffix("d0") {
+		dev = "0"
+	} else if version.hasSuffix("d1") {
+		dev = "1"
+	} else if version.hasSuffix("d2") {
+		dev = "2"
+	}
+	if dev != "" {
+		core := version.trimSuffix("d" + dev)
+		parts := strings.split(core[1:], ".")
+		if parts.len == 3 {
+			return core + "-dev." + dev, true
+		}
+	}
+
+	return "", false
+}
+
+compareVer (a, b) => {
+	aVersion, aRelease := releaseVersion(a.Version)
+	bVersion, bRelease := releaseVersion(b.Version)
+	if aRelease && bRelease {
+		cmp := semver.compare(aVersion, bVersion)
+		if cmp != 0 {
+			return cmp
+		}
+	} else if aRelease {
+		return 1
+	} else if bRelease {
+		return -1
+	}
+	return strings.compare(a.Version, b.Version)
+}
diff --git a/Mbed-TLS/mbedtls/versions.json b/Mbed-TLS/mbedtls/versions.json
new file mode 100644
index 0000000..953a4f4
--- /dev/null
+++ b/Mbed-TLS/mbedtls/versions.json
@@ -0,0 +1,4 @@
+{
+	"path": "Mbed-TLS/mbedtls",
+	"deps": {}
+}