Docs: Minimum required dependencies and current CVEs #8639

Requested by @laanwj in #8423 (which addresses some of these by upgrading packages) + #8923.

This should probably be a new file in doc/, as it is not specific to any one platform. Also checks in configure.ac would need to be added to check if these versions are present.

We don't support Qt 4 in depends/ AFAIK?

Thanks, nice initiative.

dbus, fontconfig, and expat are all built as shared libs. That means we don't distribute them, and users load their own versions at runtime. a grep in depends for "disable-static" should turn up most/all of these. Also, we no longer use qt4, that .mk should just be deleted.

It's also worth noting that we use a bunch of built-in qt libs (libjpeg/libpng/etc). If the goal is to be able to enumerate CVEs that apply to our binaries, we should probably consider building those ourselves instead.

Updated with the rest of our packages. Opened a PR to remove the Qt4 package.

Nice work! Thanks.

Oooh, nice initiative. Good job.

Thanks for making this list.

It's also worth noting that we use a bunch of built-in qt libs (libjpeg/libpng/etc). If the goal is to be able to enumerate CVEs that apply to our binaries, we should probably consider building those ourselves instead.

Image libraries are a grey area: it's hard to coerce bitcoin-qt to read resources from somewhere else than its own built-in resources (and if you manage to, it will only read from local disk). I don't think even a code execution vuln in libpng or libjpeg would be exploitable in practice.

(though it may still make sense to include them in the list for completeness, I'm not arguing against that, but we certainly don't have to do anything special for them)

Updated the top comment now that #8423 has been merged.

Cleaned up the messy list into a markdown table. Updated to reflect recent /depends/ merges.

I suggest splitting out the ones we only use as shared libs, since it doesn't matter if they have vulnerabilities, but it does potentially matter if they're too new (since that could result in incompatible ABIs).

Updated to show which are shared libraries, as well as added all the built-in Qt libraries we're using.

I've updated this to reflect recent changes to the depends system, as well as bring in minimum required dependency versions, some of which came from #8923.

@fanquake Thanks for the updates!

Hello. Regarding whether or not there's a minimum Qt5 version, based off what I know (which could easily be wrong), there is none. I did a pull request where I could've tried to code three different paths based on the version of Qt used. @theuni kinda sorta maybe said versions <5.2 could be ignored but I'm not sure how much should be invested in that statement.

Does this help in any way? Whether or not it does, it would be nice to establish a Qt5 minimum, and possibly think about whether or not Qt4 should still be supported.

Updated with latest depends changes. Added zlib now that we are building it. Updated upstream versions where required.

Updated to reflect recent depends updates and upstream releases.

Updated to reflect the latest upstream changes.

Updated to reflect current upstream versions, as well as the impending qt5+ requirement.

Updated to account for upstream changes.

This should be back up to date with all upstream changes.

Please remove OpenSSL :smile:

@fanquake can this be closed since we have a dependencies.md