What the developer wrote
Authored by fanquake
depends: static libxcb-render-util
What changed, and why it matters
This commit changes how a low-level graphics helper library (libxcb-render-util) is bundled when building Bitcoin Core. It switches the build from producing a shared library to a static library, and removes that shared library from the list of files allowed in release binaries. This is a build-hardening change that reduces external runtime dependencies; it does not by itself fix a known exploitable bug in Bitcoin Core.
No immediate user action required. Treat as routine build-system hardening. Reviewers may verify that the resulting binaries no longer dynamically link libxcb-render-util.so.0 and that static linking does not introduce licensing or symbol-conflict issues.
Security signals we found
Build configuration hardening: dependency now statically linked
Reduction in allowed dynamic library surface for release binaries
No source-code vulnerability fix present in diff
No mention of CVE, bug bounty, researcher, or security advisory in commit
Evidence from the diff
The patch modifies the depends build for libxcb_util_render to pass –disable-shared instead of –disable-static, causing the package to be linked statically into Qt-dependent binaries. It also removes libxcb-render-util.so.0 from ELF_ALLOWED_LIBRARIES in contrib/guix/symbol-check.py, so Guix release builds will no longer permit a dynamic dependency on that library. This is consistent with Bitcoin Core’s policy of statically linking as many dependencies as possible to improve binary reproducibility and reduce the attack surface from host library versions.
Changed components
depends/packages/libxcb_util_render.mkcontrib/guix/symbol-check.pyBitcoin Core release build process for Qt-enabled binariesInspect captured patch +1 / −2
diff --git a/contrib/guix/symbol-check.py b/contrib/guix/symbol-check.py
index 249c53a2..12992605 100755
--- a/contrib/guix/symbol-check.py
+++ b/contrib/guix/symbol-check.py
@@ -109,7 +109,6 @@ ELF_ALLOWED_LIBRARIES = {
'libxcb-shm.so.0',
'libxcb-keysyms.so.1',
'libxcb-randr.so.0',
-'libxcb-render-util.so.0',
'libxcb-render.so.0',
'libxcb-shape.so.0',
'libxcb-sync.so.1',
diff --git a/depends/packages/libxcb_util_render.mk b/depends/packages/libxcb_util_render.mk
index ee2883fe..607288cd 100644
--- a/depends/packages/libxcb_util_render.mk
+++ b/depends/packages/libxcb_util_render.mk
@@ -6,7 +6,7 @@ $(package)_sha256_hash=55eee797e3214fe39d0f3f4d9448cc53cffe06706d108824ea37bb79f
$(package)_dependencies=libxcb
define $(package)_set_vars
-$(package)_config_opts=--disable-static --disable-devel-docs --without-doxygen
+$(package)_config_opts=--disable-shared --disable-devel-docs --without-doxygen
$(package)_config_opts += --disable-dependency-tracking --enable-option-checking
endef
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.