depends: apply Qt patches to fix static libxcb use

Bitcoin Core/Bitcoin Core

6848ed56 View source ↗

Public commit record

What the developer wrote

Authored by fanquake

65/100 · Adequate

depends: apply Qt patches to fix static libxcb use

Co-authored-by: tobtoht <tob@featherwallet.org>

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body

The short version

What changed, and why it matters

This commit adds a patch to Bitcoin Core's build system so that when Qt is built statically for Linux, it correctly links several helper libraries from the XCB (X11 client communication) family. The patch itself comes from upstream Qt bug reports and fixes missing dependency declarations that could cause build failures or incomplete linking. It is a build-system correctness fix rather than a runtime code change, and there is no direct evidence it fixes an exploitable vulnerability.

Recommended action

Treat as a routine build-system maintenance patch. No urgent security action is indicated. If distributing static Linux binaries, verify the build succeeds and links the newly declared XCB libraries. Monitor upstream Qt bugs QTBUG-86287 and QTBUG-137004 for any future security advisories.

Security signals we found

Build-system dependency fix for static linking

References upstream Qt bugs QTBUG-86287 and QTBUG-137004

No runtime code or cryptographic logic changed

No vendor security disclosure or CVE referenced in commit

Technical analysis

Evidence from the diff

The change introduces depends/patches/qt/static_fixes.patch and applies it during Qt preprocessing. The patch modifies Qt’s CMake files to declare additional XCB component dependencies (xcb-util, xcb-aux, Xau) that are needed when libxcb and its companion libraries are linked statically. Without these declarations, static builds can fail to link or produce binaries missing required symbols. The patch references Qt upstream bugs QTBUG-86287 and QTBUG-137004.

Changed components

depends/packages/qt.mkdepends/patches/qt/static_fixes.patchQt static build configuration for Linux/X11

Inspect captured patch +82 / −0

diff --git a/depends/packages/qt.mk b/depends/packages/qt.mk
index ad958b7b..ef904b3e 100644
--- a/depends/packages/qt.mk
+++ b/depends/packages/qt.mk
@@ -18,6 +18,7 @@ $(package)_patches += qtbase_plugins_cocoa.patch
 $(package)_patches += qtbase_skip_tools.patch
 $(package)_patches += rcc_hardcode_timestamp.patch
 $(package)_patches += qttools_skip_dependencies.patch
+$(package)_patches += static_fixes.patch
 
 $(package)_qttranslations_file_name=$(qt_details_qttranslations_file_name)
 $(package)_qttranslations_sha256_hash=$(qt_details_qttranslations_sha256_hash)
@@ -259,6 +260,7 @@ define $(package)_preprocess_cmds
   patch -p1 -i $($(package)_patch_dir)/qtbase_avoid_qmain.patch && \
   patch -p1 -i $($(package)_patch_dir)/qtbase_platformsupport.patch && \
   patch -p1 -i $($(package)_patch_dir)/qtbase_plugins_cocoa.patch && \
+  patch -p1 -i $($(package)_patch_dir)/static_fixes.patch && \
   patch -p1 -i $($(package)_patch_dir)/qtbase_skip_tools.patch && \
   patch -p1 -i $($(package)_patch_dir)/rcc_hardcode_timestamp.patch
 endef
diff --git a/depends/patches/qt/static_fixes.patch b/depends/patches/qt/static_fixes.patch
new file mode 100644
index 00000000..f4e6e8f0
--- /dev/null
+++ b/depends/patches/qt/static_fixes.patch
@@ -0,0 +1,80 @@
+commit 203148b1ed6d8f4bad8030ef64f0bc4083309010
+Author: fanquake <fanquake@gmail.com>
+Date:   Sat Oct 4 01:00:25 2025 +0100
+
+    static fixes
+
+    See: https://bugreports.qt.io/browse/QTBUG-86287
+    See: https://bugreports.qt.io/browse/QTBUG-137004
+
+diff --git a/cmake/3rdparty/extra-cmake-modules/find-modules/FindXCB.cmake b/cmake/3rdparty/extra-cmake-modules/find-modules/FindXCB.cmake
+index 26b9bf89633..0c546d09a8b 100644
+--- a/qtbase/cmake/3rdparty/extra-cmake-modules/find-modules/FindXCB.cmake
++++ b/qtbase/cmake/3rdparty/extra-cmake-modules/find-modules/FindXCB.cmake
+@@ -145,7 +145,7 @@ endforeach()
+ set(XCB_XCB_component_deps)
+ set(XCB_COMPOSITE_component_deps XCB XFIXES)
+ set(XCB_DAMAGE_component_deps XCB XFIXES)
+-set(XCB_IMAGE_component_deps XCB SHM)
++set(XCB_IMAGE_component_deps XCB SHM AUX)
+ set(XCB_RENDERUTIL_component_deps XCB RENDER)
+ set(XCB_XFIXES_component_deps XCB RENDER SHAPE)
+ set(XCB_XVMC_component_deps XCB XV)
+diff --git a/src/gui/configure.cmake b/src/gui/configure.cmake
+index 99c517e3581..a2e644f77d9 100644
+--- a/qtbase/src/gui/configure.cmake
++++ b/qtbase/src/gui/configure.cmake
+@@ -80,10 +80,14 @@ if((X11_SUPPORTED) OR QT_FIND_ALL_PACKAGES_ALWAYS)
+     qt_find_package(XCB 0.3.9 COMPONENTS ICCCM PROVIDED_TARGETS XCB::ICCCM MODULE_NAME gui QMAKE_LIB xcb_icccm)
+ endif()
+ qt_add_qmake_lib_dependency(xcb_icccm xcb)
++if((X11_SUPPORTED) OR QT_FIND_ALL_PACKAGES_ALWAYS)
++    qt_find_package(XCB 0.3.8 COMPONENTS UTIL PROVIDED_TARGETS XCB::UTIL MODULE_NAME gui QMAKE_LIB xcb_util)
++endif()
++qt_add_qmake_lib_dependency(xcb_util xcb)
+ if((X11_SUPPORTED) OR QT_FIND_ALL_PACKAGES_ALWAYS)
+     qt_find_package(XCB 0.3.9 COMPONENTS IMAGE PROVIDED_TARGETS XCB::IMAGE MODULE_NAME gui QMAKE_LIB xcb_image)
+ endif()
+-qt_add_qmake_lib_dependency(xcb_image xcb_shm xcb)
++qt_add_qmake_lib_dependency(xcb_image xcb_shm xcb_util xcb)
+ if((X11_SUPPORTED) OR QT_FIND_ALL_PACKAGES_ALWAYS)
+     qt_find_package(XCB 0.3.9 COMPONENTS KEYSYMS PROVIDED_TARGETS XCB::KEYSYMS MODULE_NAME gui QMAKE_LIB xcb_keysyms)
+ endif()
+@@ -488,6 +492,7 @@ qt_config_compile_test(xcb_syslibs
+     LIBRARIES
+         XCB::CURSOR
+         XCB::ICCCM
++        XCB::UTIL
+         XCB::IMAGE
+         XCB::KEYSYMS
+         XCB::RANDR
+@@ -503,6 +508,7 @@ qt_config_compile_test(xcb_syslibs
+ "// xkb.h is using a variable called 'explicit', which is a reserved keyword in C++
+ #define explicit dont_use_cxx_explicit
+ #include <xcb/xcb.h>
++#include <xcb/xcb_util.h>
+ #include <xcb/xcb_image.h>
+ #include <xcb/xcb_keysyms.h>
+ #include <xcb/xcb_cursor.h>
+diff --git a/src/plugins/platforms/xcb/CMakeLists.txt b/src/plugins/platforms/xcb/CMakeLists.txt
+index e8fb442dd43..e964138115c 100644
+--- a/qtbase/src/plugins/platforms/xcb/CMakeLists.txt
++++ b/qtbase/src/plugins/platforms/xcb/CMakeLists.txt
+@@ -52,6 +52,7 @@ qt_internal_add_module(XcbQpaPrivate
+         Qt::GuiPrivate
+         XCB::CURSOR
+         XCB::ICCCM
++        XCB::UTIL
+         XCB::IMAGE
+         XCB::KEYSYMS
+         XCB::RANDR
+--- a/qtbase/src/gui/configure.cmake
++++ b/qtbase/src/gui/configure.cmake
+@@ -504,6 +504,7 @@ qt_config_compile_test(xcb_syslibs
+         XCB::XFIXES
+         XCB::XKB
+         XCB::XCB
++        X11::Xau
+     CODE
+ "// xkb.h is using a variable called 'explicit', which is a reserved keyword in C++
+ #define explicit dont_use_cxx_explicit

Risk score

Why this scored 20/100

Our methodology →

Potential impact 3/30

Exploitability 2/25

Stealth signal 2/15

Affected reach 4/15

Confidence 6/10

Evidence quality 3/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 20/100

Community notes

Related watches

Merge bitcoin/bitcoin#35928: doc: mention -DWITH_ZMQ=ON in macOS build guide

Merge bitcoin/bitcoin#35482: fuzz: exercise the transaction-handling path in process_message(s)

Merge bitcoin/bitcoin#35914: test, fuzz: Remove unused variables