depends: native_protobuf: don't include debug symbols in protoc binary
What the developer wrote
Authored by tobtoht
depends: native_protobuf: don't include debug symbols in protoc binary
What changed, and why it matters
This commit changes how the Monero build system compiles the protocol buffer compiler (protoc), a developer-only tool used during the build process. It adds a compiler flag to strip debug symbols from the protoc binary. This is a build-hygiene change: it makes the resulting tool smaller and avoids shipping unnecessary debugging information. It does not fix a vulnerability in Monero's runtime code, nor does it change how Monero nodes or wallets behave. At most, it removes a minor information-leakage path (debug symbols could reveal build paths or function names) from a build-time tool, and slightly reduces attack surface by making the binary smaller and simpler.
No urgent action required. Treat as routine build maintenance. If distributing pre-built protoc binaries, ensure this change is included to avoid shipping debug symbols. No runtime upgrade or advisory is warranted based on this commit alone.
Security signals we found
Build-hardening: removal of debug symbols from a native build tool
Potential minor information disclosure reduction (debug symbols may contain source paths and symbol names)
No vulnerability fix, no memory-safety, cryptographic, or consensus change
Evidence from the diff
The patch adds $(package)_cxxflags+=-g0 to contrib/depends/packages/native_protobuf.mk. This tells the native protobuf build to compile the protoc binary without generating DWARF/stabs debug symbols (-g0 is the GCC/Clang option for no debug info). Protoc is a native build tool used to generate C++ source files from .proto definitions; it is not part of the shipped Monero daemon/wallet runtime. The change affects only the build-time toolchain in the depends system. There is no code change to Monero consensus, networking, wallet, or cryptography.
Changed components
contrib/depends/packages/native_protobuf.mknative protoc build in the depends build systemInspect captured patch +1 / −0
diff --git a/contrib/depends/packages/native_protobuf.mk b/contrib/depends/packages/native_protobuf.mk
index 0ec5444..cb14e56 100644
--- a/contrib/depends/packages/native_protobuf.mk
+++ b/contrib/depends/packages/native_protobuf.mk
@@ -8,6 +8,7 @@ $(package)_sha256_hash=4eab9b524aa5913c6fffb20b2a8abf5ef7f95a80bc0701f3a6dbb4c60
define $(package)_set_vars
$(package)_config_opts=--disable-shared --prefix=$(build_prefix)
$(package)_config_opts_linux=--with-pic
+ $(package)_cxxflags+=-g0
endef
define $(package)_config_cmds
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.