guix: remove libxcb-xinerama.so.0 from allowed libs
What the developer wrote
Authored by fanquake
guix: remove libxcb-xinerama.so.0 from allowed libs
What changed, and why it matters
This commit removes one library, libxcb-xinerama.so.0, from the list of shared libraries that Bitcoin Core's Guix reproducible-build process is allowed to link against. It is a build-hardening change: the release pipeline will now refuse to produce a binary that depends on that X11-related library. There is no direct evidence in the commit that this fixes an active vulnerability, only that it tightens the supply-chain/build policy.
Treat as a routine hardening/build-policy improvement. No emergency action is required. Reviewers may want to confirm that current release builds no longer link against libxcb-xinerama.so.0 and that the change does not break Qt builds on multi-monitor X11 systems. If a security advisory is later published, reassess.
Security signals we found
Reduction of dynamic library attack surface in release binaries
Build-time allow-list hardening for reproducible Guix builds
Removal of unused/unnecessary X11 dependency (libxcb-xinerama.so.0)
No runtime code change or vulnerability fix present in diff
Evidence from the diff
The patch deletes ‘libxcb-xinerama.so.0’ from ELF_ALLOWED_LIBRARIES in contrib/guix/symbol-check.py. That script is used during Guix deterministic builds to verify that produced ELF binaries only depend on an explicit allow-list of dynamic libraries. Removing a library from the list prevents future releases from accidentally linking to it. libxcb-xinerama is an X11/XCB extension for querying multi-head screen geometry; it is not part of Bitcoin Core’s core functionality and is most likely pulled in transitively through Qt. The change reduces the attack surface of the release binaries by removing an unnecessary dependency, but the commit itself does not patch any runtime code or demonstrate an exploitable bug.
Changed components
contrib/guix/symbol-check.pyBitcoin Core Guix release build pipelineELF binary dependency policy for Linux release buildsInspect captured patch +0 / −1
diff --git a/contrib/guix/symbol-check.py b/contrib/guix/symbol-check.py
index b5093f34..d808ef6b 100755
--- a/contrib/guix/symbol-check.py
+++ b/contrib/guix/symbol-check.py
@@ -123,7 +123,6 @@ ELF_ALLOWED_LIBRARIES = {
'libxcb-shape.so.0',
'libxcb-sync.so.1',
'libxcb-xfixes.so.0',
-'libxcb-xinerama.so.0',
'libxcb-xkb.so.1',
}
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.