What the developer wrote
Authored by fanquake
depends: static libxkbcommon
What changed, and why it matters
This commit changes how Bitcoin Core's graphical wallet (bitcoin-qt) links a keyboard-handling library called libxkbcommon. Previously it was linked dynamically (the program loads the library from the user's system at runtime). Now it is linked statically (the library code is built into the program binary). This is a build-system hardening change that reduces the chance of runtime failures or supply-chain issues caused by incompatible system versions of that library, but it is not a fix for a known exploitable bug in Bitcoin Core itself.
No urgent action required. Treat as routine build hardening. Review whether other Qt/X11 dependencies should also be statically linked for consistency, and verify reproducible builds still pass symbol checks.
Security signals we found
Build hardening: reduces dynamic-library attack surface for release binaries
Supply-chain resilience: removes runtime dependency on a specific host library version
No direct vulnerability fix in source code
No mention of CVE, bug bounty, or security advisory in commit
Evidence from the diff
The patch modifies the Guix reproducible-build symbol checker and the depends build recipe for libxkbcommon. It removes the allowed dynamic symbols libxkbcommon.so.0 and libxkbcommon-x11.so.0 from the release binary whitelist, and switches the libxkbcommon package build from –disable-static to –disable-shared. The effect is that libxkbcommon is now statically linked into bitcoin-qt release binaries rather than loaded from the host OS. This is a build/packaging change, not a code-level vulnerability fix.
Changed components
Bitcoin Core Qt GUI release build (bitcoin-qt)depends/packages/libxkbcommon.mk build recipecontrib/guix/symbol-check.py release binary validationInspect captured patch +2 / −5
diff --git a/contrib/guix/symbol-check.py b/contrib/guix/symbol-check.py
index 3aa7929c..f6906c17 100755
--- a/contrib/guix/symbol-check.py
+++ b/contrib/guix/symbol-check.py
@@ -34,8 +34,7 @@ MAX_VERSIONS = {
lief.ELF.ARCH.AARCH64:(2,31),
lief.ELF.ARCH.PPC64: (2,31),
lief.ELF.ARCH.RISCV: (2,31),
-},
-'V': (0,5,0), # xkb (bitcoin-qt only)
+ }
}
# Ignore symbols that are exported as part of every executable
@@ -99,8 +98,6 @@ ELF_ALLOWED_LIBRARIES = {
'ld-linux-riscv64-lp64d.so.1', # 64-bit RISC-V dynamic linker
# bitcoin-qt only
'libxcb.so.1', # part of X11
-'libxkbcommon.so.0', # keyboard keymapping
-'libxkbcommon-x11.so.0', # keyboard keymapping
'libfontconfig.so.1', # font support
'libfreetype.so.6', # font parsing
'libdl.so.2', # programming interface to dynamic linker
diff --git a/depends/packages/libxkbcommon.mk b/depends/packages/libxkbcommon.mk
index bcdcf671..f3560c8a 100644
--- a/depends/packages/libxkbcommon.mk
+++ b/depends/packages/libxkbcommon.mk
@@ -11,7 +11,7 @@ $(package)_dependencies=libxcb
# a different build system (Meson)
define $(package)_set_vars
$(package)_config_opts = --enable-option-checking --disable-dependency-tracking
-$(package)_config_opts += --disable-static --disable-docs
+$(package)_config_opts += --disable-shared --disable-docs
$(package)_cflags += -Wno-error=array-bounds
endef
Why this scored 20/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.