What the developer wrote
Authored by fanquake
depends: static libxcb-util-wm
What changed, and why it matters
This commit changes how a low-level Linux graphics helper library (libxcb-util-wm) is bundled with Bitcoin Core. It switches the build from producing a shared library to a static library, and removes one shared library name from the list of allowed runtime dependencies. The change is a build-hardening improvement, not a fix for an active security bug. It reduces the chance that a malicious or incompatible version of that library on the user's system could affect Bitcoin Core, but it does not patch any vulnerability in Bitcoin Core itself.
No urgent action required. Treat as routine build-system hardening. Users building from source or using release binaries should ensure their depends build picks up the change; downstream packagers may note the reduced dynamic dependency on libxcb-icccm.so.4.
Security signals we found
Build hardening: reduces dynamic-library dependencies for Qt/X11 GUI builds
Supply-chain risk reduction: static linking prevents host-provided libxcb-icccm from being loaded at runtime
No patch of a memory-safety bug or cryptographic flaw in Bitcoin Core code
No mention of CVE, vulnerability, researcher, or security advisory in commit or supplied references
Evidence from the diff
The commit modifies the Guix deterministic-build symbol checker and the depends package recipe for libxcb_util_wm. In libxcb_util_wm.mk it replaces –disable-static with –disable-shared, causing the dependency to be linked statically instead of dynamically. In symbol-check.py it removes ‘libxcb-icccm.so.4’ from ELF_ALLOWED_LIBRARIES, reflecting that the binary will no longer dynamically load that shared object. This is a supply-chain/build-integrity hardening change that reduces dynamic-library attack surface for the Qt GUI build path on Linux.
Changed components
depends/packages/libxcb_util_wm.mkcontrib/guix/symbol-check.pyBitcoin Core Linux GUI build (Qt/X11 dependency chain)Inspect captured patch +1 / −2
diff --git a/contrib/guix/symbol-check.py b/contrib/guix/symbol-check.py
index 677eda4b..3aa7929c 100755
--- a/contrib/guix/symbol-check.py
+++ b/contrib/guix/symbol-check.py
@@ -104,7 +104,6 @@ ELF_ALLOWED_LIBRARIES = {
'libfontconfig.so.1', # font support
'libfreetype.so.6', # font parsing
'libdl.so.2', # programming interface to dynamic linker
-'libxcb-icccm.so.4',
'libxcb-image.so.0',
'libxcb-shm.so.0',
'libxcb-randr.so.0',
diff --git a/depends/packages/libxcb_util_wm.mk b/depends/packages/libxcb_util_wm.mk
index a68fd23f..a43b7ee2 100644
--- a/depends/packages/libxcb_util_wm.mk
+++ b/depends/packages/libxcb_util_wm.mk
@@ -6,7 +6,7 @@ $(package)_sha256_hash=038b39c4bdc04a792d62d163ba7908f4bb3373057208c07110be73c1b
$(package)_dependencies=libxcb
define $(package)_set_vars
-$(package)_config_opts=--disable-static --disable-devel-docs --without-doxygen
+$(package)_config_opts=--disable-shared --disable-devel-docs --without-doxygen
$(package)_config_opts += --disable-dependency-tracking --enable-option-checking
endef
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.