What the developer wrote
Authored by Hennadii Stepanov
depends: Update Qt download link
Replace the unreliable https://code.qt.io with the GitHub mirror link.
What changed, and why it matters
This commit simply changes where Bitcoin Core's build system downloads some Qt source files from one official Qt location (code.qt.io) to another official mirror (GitHub's raw content server). The downloaded files are still verified by fixed SHA-256 hashes, so even if the new host were malicious, the build would reject tampered files. There is no security vulnerability here.
No security action required. This is a routine build-maintenance change. Reviewers may optionally verify the new GitHub URLs resolve and that the SHA-256 hashes still match the expected Qt release files.
Security signals we found
No code logic changes
Integrity verification via SHA-256 hashes preserved
Source change is between two official Qt distribution points
Commit message does not claim security relevance
Evidence from the diff
The patch updates depends/packages/qt_details.mk to use GitHub’s raw.githubusercontent.com as the download source for Qt top-level CMake files instead of code.qt.io. The URL structure changes from a cgit query parameter (?h=version) to a GitHub refs/heads path, and the versioned query parameters are removed from individual filenames. All three downloaded files retain hardcoded SHA-256 hashes (9fb720a633c0c0a21c31fe62a34bf617726fed72480d4064f29ca5d6973d513f, 97ee8bbfcb0a4bdcc6c1af77e467a1da0c5b386c42be2aa97d840247af5f6f70, 5ac2a7159ee27b5b86d26ecff44922e7b8f319aa847b7b5766dc17932fd4a294), which means the integrity check remains in place. The commit message frames this as reliability improvement, not security.
Changed components
depends/packages/qt_details.mkQt dependency download URLs in the build systemInspect captured patch +4 / −4
diff --git a/depends/packages/qt_details.mk b/depends/packages/qt_details.mk
index 34144814..eeea2752 100644
--- a/depends/packages/qt_details.mk
+++ b/depends/packages/qt_details.mk
@@ -13,14 +13,14 @@ qt_details_qttools_sha256_hash := f03bb7df619cd9ac9dba110e30b7bcab5dd88eb8bdc9cc
qt_details_patches_path := $(PATCHES_PATH)/qt
-qt_details_top_download_path := https://code.qt.io/cgit/qt/qt5.git/plain
+qt_details_top_download_path := https://raw.githubusercontent.com/qt/qt5/refs/heads/$(qt_details_version)
qt_details_top_cmakelists_file_name := CMakeLists.txt
-qt_details_top_cmakelists_download_file := $(qt_details_top_cmakelists_file_name)?h=$(qt_details_version)
+qt_details_top_cmakelists_download_file := $(qt_details_top_cmakelists_file_name)
qt_details_top_cmakelists_sha256_hash := 9fb720a633c0c0a21c31fe62a34bf617726fed72480d4064f29ca5d6973d513f
qt_details_top_cmake_download_path := $(qt_details_top_download_path)/cmake
qt_details_top_cmake_ecmoptionaladdsubdirectory_file_name := ECMOptionalAddSubdirectory.cmake
-qt_details_top_cmake_ecmoptionaladdsubdirectory_download_file := $(qt_details_top_cmake_ecmoptionaladdsubdirectory_file_name)?h=$(qt_details_version)
+qt_details_top_cmake_ecmoptionaladdsubdirectory_download_file := $(qt_details_top_cmake_ecmoptionaladdsubdirectory_file_name)
qt_details_top_cmake_ecmoptionaladdsubdirectory_sha256_hash := 97ee8bbfcb0a4bdcc6c1af77e467a1da0c5b386c42be2aa97d840247af5f6f70
qt_details_top_cmake_qttoplevelhelpers_file_name := QtTopLevelHelpers.cmake
-qt_details_top_cmake_qttoplevelhelpers_download_file := $(qt_details_top_cmake_qttoplevelhelpers_file_name)?h=$(qt_details_version)
+qt_details_top_cmake_qttoplevelhelpers_download_file := $(qt_details_top_cmake_qttoplevelhelpers_file_name)
qt_details_top_cmake_qttoplevelhelpers_sha256_hash := 5ac2a7159ee27b5b86d26ecff44922e7b8f319aa847b7b5766dc17932fd4a294
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.