What the developer wrote
Authored by fanquake
depends: static libxcb_cursor
Modern Ubuntu isn't shipping with this library installed by default.
Staticly link it to remove the need for end-users to install it.
Closes #33432.
What changed, and why it matters
This change makes Bitcoin Core's graphical wallet link a small X11 cursor helper library statically instead of relying on the operating system to provide it. That removes a runtime installation step for users on recent Ubuntu and other Linux distributions. It is a build/packaging convenience change, not a fix for an exploitable security bug.
No security action required. Treat as a normal build-system improvement. If auditing release binaries, confirm libxcb-cursor symbols are no longer dynamically imported and the static library is included only in the GUI build path.
Security signals we found
No application code changed; only build configuration and documentation
Change removes a dynamic-library runtime dependency by statically linking it
No mention of vulnerability, CVE, researcher, or security issue in commit or diff
No memory corruption, input validation, or cryptographic signals present
Evidence from the diff
The commit switches libxcb_util_cursor from shared to static in the depends build system, removes libxcb-cursor.so.0 from the Guix release symbol-check allow-list, and deletes documentation telling users to install the library at runtime. The goal is to avoid a missing-dependency failure when running the Qt GUI on systems that no longer ship libxcb-cursor by default. There is no patch to application logic, no memory-safety fix, and no cryptographic change.
Changed components
depends/packages/libxcb_util_cursor.mkcontrib/guix/symbol-check.pydoc/build-unix.mdInspect captured patch +1 / −8
diff --git a/contrib/guix/symbol-check.py b/contrib/guix/symbol-check.py
index d808ef6b..79ab6b0f 100755
--- a/contrib/guix/symbol-check.py
+++ b/contrib/guix/symbol-check.py
@@ -112,7 +112,6 @@ ELF_ALLOWED_LIBRARIES = {
'libfontconfig.so.1', # font support
'libfreetype.so.6', # font parsing
'libdl.so.2', # programming interface to dynamic linker
-'libxcb-cursor.so.0',
'libxcb-icccm.so.4',
'libxcb-image.so.0',
'libxcb-shm.so.0',
diff --git a/depends/packages/libxcb_util_cursor.mk b/depends/packages/libxcb_util_cursor.mk
index b3088906..288afeaa 100644
--- a/depends/packages/libxcb_util_cursor.mk
+++ b/depends/packages/libxcb_util_cursor.mk
@@ -6,7 +6,7 @@ $(package)_sha256_hash=0e9c5446dc6f3beb8af6ebfcc9e27bcc6da6fe2860f7fc07b99144dfa
$(package)_dependencies=libxcb libxcb_util_render libxcb_util_image
define $(package)_set_vars
-$(package)_config_opts = --disable-static
+$(package)_config_opts = --disable-shared
$(package)_config_opts += --disable-dependency-tracking --enable-option-checking
endef
diff --git a/doc/build-unix.md b/doc/build-unix.md
index bfb3bd35..d9bbb350 100644
--- a/doc/build-unix.md
+++ b/doc/build-unix.md
@@ -81,8 +81,6 @@ the necessary parts of Qt, the libqrencode and pass `-DBUILD_GUI=ON`. Skip if yo
sudo apt-get install qt6-base-dev qt6-tools-dev qt6-l10n-tools qt6-tools-dev-tools libgl-dev
-For Qt 6.5 and later, the `libxcb-cursor0` package must be installed at runtime.
-
Additionally, to support Wayland protocol for modern desktop environments:
sudo apt install qt6-wayland
@@ -133,8 +131,6 @@ the necessary parts of Qt, the libqrencode and pass `-DBUILD_GUI=ON`. Skip if yo
sudo dnf install qt6-qtbase-devel qt6-qttools-devel
-For Qt 6.5 and later, the `xcb-util-cursor` package must be installed at runtime.
-
Additionally, to support Wayland protocol for modern desktop environments:
sudo dnf install qt6-qtwayland
@@ -182,8 +178,6 @@ the necessary parts of Qt, the libqrencode and pass `-DBUILD_GUI=ON`. Skip if yo
apk add qt6-qtbase-dev qt6-qttools-dev
-For Qt 6.5 and later, the `xcb-util-cursor` package must be installed at runtime.
-
The GUI will be able to encode addresses in QR codes unless this feature is explicitly disabled. To install libqrencode, run:
apk add libqrencode-dev
Why this scored 20/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.