What the developer wrote
Authored by fanquake
depends: static libxcb-keysyms
What changed, and why it matters
This commit changes how a low-level graphical keyboard library (libxcb-keysyms) is bundled with Bitcoin Core's build system. Previously it was allowed as a shared library that had to be present on the user's system; now it is compiled directly into the Bitcoin Core binary. This is a build-hardening change that reduces external runtime dependencies and makes the release binary more self-contained, but it is not a fix for an active security vulnerability in Bitcoin Core itself.
Treat as routine build hardening. No urgent action required for node operators. Reviewers may verify that the static build does not introduce licensing or symbol-conflict issues, and that the resulting Guix release binaries no longer export a dynamic dependency on libxcb-keysyms.so.1.
Security signals we found
Build-system hardening: reduces dynamic-library attack surface for release binaries
Dependency reduction: one fewer external shared library required at runtime
No change to consensus, P2P, wallet, or cryptographic code paths
No vendor statement of security relevance or CVE in commit metadata
Evidence from the diff
The patch removes ‘libxcb-keysyms.so.1’ from the Guix symbol-check allow-list and switches the depends package from –disable-static to –disable-shared, meaning libxcb_util_keysyms is now linked statically rather than dynamically. This is a supply-chain/build-integrity hardening measure: it removes one external shared-library dependency from release binaries, reducing attack surface from library substitution or ABI drift on end-user systems. There is no code change to consensus, networking, wallet, or node logic.
Changed components
depends/packages/libxcb_util_keysyms.mkcontrib/guix/symbol-check.pyInspect captured patch +1 / −2
diff --git a/contrib/guix/symbol-check.py b/contrib/guix/symbol-check.py
index 12992605..677eda4b 100755
--- a/contrib/guix/symbol-check.py
+++ b/contrib/guix/symbol-check.py
@@ -107,7 +107,6 @@ ELF_ALLOWED_LIBRARIES = {
'libxcb-icccm.so.4',
'libxcb-image.so.0',
'libxcb-shm.so.0',
-'libxcb-keysyms.so.1',
'libxcb-randr.so.0',
'libxcb-render.so.0',
'libxcb-shape.so.0',
diff --git a/depends/packages/libxcb_util_keysyms.mk b/depends/packages/libxcb_util_keysyms.mk
index 56bc33d2..12e77904 100644
--- a/depends/packages/libxcb_util_keysyms.mk
+++ b/depends/packages/libxcb_util_keysyms.mk
@@ -6,7 +6,7 @@ $(package)_sha256_hash=0807cf078fbe38489a41d755095c58239e1b67299f14460dec2ec811e
$(package)_dependencies=libxcb xproto
define $(package)_set_vars
-$(package)_config_opts=--disable-static --disable-devel-docs --without-doxygen
+$(package)_config_opts=--disable-shared --disable-devel-docs --without-doxygen
$(package)_config_opts += --disable-dependency-tracking --enable-option-checking
endef
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.