What the developer wrote
Authored by fanquake
depends: disable Qt sbom generation
What changed, and why it matters
This commit turns off a Qt build feature called SBOM generation in Bitcoin Core's dependency build system. SBOMs are inventory lists of software components. The change is a build-hygiene measure; there is no direct evidence in the commit that it fixes an exploitable security vulnerability.
Treat as a routine build-system maintenance change. Review Qt SBOM documentation and reproducible-build policy to confirm rationale. No urgent security action is required based solely on this diff.
Security signals we found
Build-system hardening: disabling an unneeded metadata-generation feature
Potential supply-chain hygiene: SBOM files could embed environment-specific paths or hashes, affecting build reproducibility
No direct memory-safety, cryptography, or consensus code change
Evidence from the diff
The patch adds -DQT_GENERATE_SBOM=OFF to the Qt CMake options in depends/packages/qt.mk. Qt 6’s SBOM generation can produce SPDX or CycloneDX documents during the build. Disabling it likely avoids build failures, reduces non-reproducible build artifacts, or prevents inclusion of metadata that could leak build-path or environment details. The diff itself does not show a vulnerability fix.
Changed components
depends/packages/qt.mkQt dependency build configurationInspect captured patch +1 / −0
diff --git a/depends/packages/qt.mk b/depends/packages/qt.mk
index 8d5ddfb8..12997e1b 100644
--- a/depends/packages/qt.mk
+++ b/depends/packages/qt.mk
@@ -169,6 +169,7 @@ $(package)_config_env_darwin += OBJCXX="$$($(package)_cxx)"
$(package)_cmake_opts := -DCMAKE_PREFIX_PATH=$(host_prefix)
$(package)_cmake_opts += -DQT_FEATURE_cxx20=ON
+$(package)_cmake_opts += -DQT_GENERATE_SBOM=OFF
ifneq ($(V),)
$(package)_cmake_opts += --log-level=STATUS
endif
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.