What the developer wrote
Authored by fanquake
depends: static libxcb-util-image
Co-authored-by: tobtoht <tob@featherwallet.org>
What changed, and why it matters
This commit changes how Bitcoin Core's build system handles a low-level graphics helper library called libxcb-util-image. Previously it was built as a shared library that had to be present on the user's system; now it is built as a static library that is copied directly into the Bitcoin Core executable. This is a build/packaging change, not a fix for a known vulnerability in the library itself. It mainly reduces the chance that a missing or incompatible system library prevents Bitcoin Core from running, and slightly changes the attack surface around dynamic library loading.
Treat as a routine build-system hardening change. Review the static-linking result to ensure no unintended dynamic dependencies remain, and verify that the libxcb-util-image version used is current and free of known CVEs. No urgent action is required.
Security signals we found
Build configuration change from shared to static linking of a dependency
Removal of a dynamic-library dependency from the Guix release symbol allow-list
No source-code patch to the dependency itself
No vendor statement of security relevance in commit message or diff
Evidence from the diff
The patch switches depends/packages/libxcb_util_image.mk from –disable-static to –disable-shared, so libxcb-util-image is built as a static archive and linked into the Guix-produced binaries. It also narrows the build/install to the image/ subdirectory, presumably because the static build no longer needs the full package install path. contrib/guix/symbol-check.py drops libxcb-image.so.0 from the allow-list of permitted dynamic dependencies, consistent with the library no longer being dynamically linked. There is no code change to Bitcoin Core’s logic and no patch to libxcb-util-image source.
Changed components
depends/packages/libxcb_util_image.mkcontrib/guix/symbol-check.pyGuix release build process for Bitcoin CoreInspect captured patch +3 / −4
diff --git a/contrib/guix/symbol-check.py b/contrib/guix/symbol-check.py
index f6906c17..39885178 100755
--- a/contrib/guix/symbol-check.py
+++ b/contrib/guix/symbol-check.py
@@ -101,7 +101,6 @@ ELF_ALLOWED_LIBRARIES = {
'libfontconfig.so.1', # font support
'libfreetype.so.6', # font parsing
'libdl.so.2', # programming interface to dynamic linker
-'libxcb-image.so.0',
'libxcb-shm.so.0',
'libxcb-randr.so.0',
'libxcb-render.so.0',
diff --git a/depends/packages/libxcb_util_image.mk b/depends/packages/libxcb_util_image.mk
index 2228250f..4f707b7a 100644
--- a/depends/packages/libxcb_util_image.mk
+++ b/depends/packages/libxcb_util_image.mk
@@ -6,7 +6,7 @@ $(package)_sha256_hash=cb2c86190cf6216260b7357a57d9100811bb6f78c24576a3a5bfef6ad
$(package)_dependencies=libxcb libxcb_util
define $(package)_set_vars
-$(package)_config_opts=--disable-static --disable-devel-docs --without-doxygen
+$(package)_config_opts=--disable-shared --disable-devel-docs --without-doxygen
$(package)_config_opts+= --disable-dependency-tracking --enable-option-checking
endef
@@ -19,11 +19,11 @@ define $(package)_config_cmds
endef
define $(package)_build_cmds
- $(MAKE)
+ $(MAKE) -C image
endef
define $(package)_stage_cmds
- $(MAKE) DESTDIR=$($(package)_staging_dir) install
+ $(MAKE) DESTDIR=$($(package)_staging_dir) -C image install
endef
define $(package)_postprocess_cmds
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.