What the developer wrote
Authored by fanquake
depends: static libxcb
Co-authored-by: tobtoht <tob@featherwallet.org>
What changed, and why it matters
This commit changes how Bitcoin Core's graphical wallet (bitcoin-qt) links to a low-level Linux graphics library called libxcb. Previously, libxcb and several related extension libraries were allowed to be loaded dynamically from the operating system. Now they are built as static libraries and linked directly into the application. The main practical effect is to reduce the application's dependency on whatever versions of these libraries happen to be installed on the user's Linux distribution, which can make builds more reproducible and avoid crashes or compatibility problems caused by mismatched library versions. It is a build-system hardening change, not a fix for an active remote-attack vulnerability.
Treat this as a routine build-hardening improvement. No urgent security response is warranted. Reviewers may want to confirm that static linking of libxcb does not introduce licensing or binary-size concerns, and that all required XCB extensions remain available to Qt at runtime.
Security signals we found
Reduction in dynamic-library attack surface by removing runtime dependency on system libxcb shared objects
Potential mitigation of supply-chain or compatibility issues from distro-specific libxcb versions
No direct memory-safety, cryptographic, or consensus bug is fixed in this diff
Build-system change only; no application code paths are modified
Evidence from the diff
The patch modifies the Guix build symbol-check allowlist and the depends build recipe for libxcb. In symbol-check.py, it removes libxcb.so.1 and seven extension libraries (libxcb-shm, libxcb-randr, libxcb-render, libxcb-shape, libxcb-sync, libxcb-xfixes, libxcb-xkb) from ELF_ALLOWED_LIBRARIES. In depends/packages/libxcb.mk, it replaces –disable-static with –disable-shared, causing libxcb to be built as a static archive rather than a shared object. The stated intent is to static-link libxcb into bitcoin-qt, reducing runtime dynamic-library dependencies and improving build reproducibility across Linux distributions.
Changed components
Bitcoin Core depends build system (depends/packages/libxcb.mk)Guix release symbol-check script (contrib/guix/symbol-check.py)bitcoin-qt Linux build linkage to XCB librariesInspect captured patch +1 / −9
diff --git a/contrib/guix/symbol-check.py b/contrib/guix/symbol-check.py
index 39885178..27483aa0 100755
--- a/contrib/guix/symbol-check.py
+++ b/contrib/guix/symbol-check.py
@@ -97,17 +97,9 @@ ELF_ALLOWED_LIBRARIES = {
'ld64.so.2', # POWER64 ABIv2 dynamic linker
'ld-linux-riscv64-lp64d.so.1', # 64-bit RISC-V dynamic linker
# bitcoin-qt only
-'libxcb.so.1', # part of X11
'libfontconfig.so.1', # font support
'libfreetype.so.6', # font parsing
'libdl.so.2', # programming interface to dynamic linker
-'libxcb-shm.so.0',
-'libxcb-randr.so.0',
-'libxcb-render.so.0',
-'libxcb-shape.so.0',
-'libxcb-sync.so.1',
-'libxcb-xfixes.so.0',
-'libxcb-xkb.so.1',
}
MACHO_ALLOWED_LIBRARIES = {
diff --git a/depends/packages/libxcb.mk b/depends/packages/libxcb.mk
index c256ea65..5d5aa7fc 100644
--- a/depends/packages/libxcb.mk
+++ b/depends/packages/libxcb.mk
@@ -7,7 +7,7 @@ $(package)_dependencies=xcb_proto libXau
$(package)_patches = remove_pthread_stubs.patch
define $(package)_set_vars
-$(package)_config_opts=--disable-static --disable-devel-docs --without-doxygen --without-launchd
+$(package)_config_opts=--disable-shared --disable-devel-docs --without-doxygen --without-launchd
$(package)_config_opts += --disable-dependency-tracking --enable-option-checking
# Disable unneeded extensions.
# More info is available from: https://doc.qt.io/qt-5.15/linux-requirements.html
Why this scored 26/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.