Docs: Minimum required dependencies and current CVEs

[fanquake]

Requested by @laanwj in #8423 (which addresses some of these by upgrading packages) + #8923.

This should probably be a new file in doc/, as it is not specific to any one platform.
Also checks in configure.ac would need to be added to check if these versions are present.

Dependancy	Version used	Minimum Required	Latest available	CVEs?	Shared	Bundled Qt Library
libevent	2.1.11-stable	2.0.22	2.1.12-stable	No
Qt	5.9.8	5.5.1	6.0.0	No
Freetype	2.7.1		2.10.4	No
Boost	1.70.0	1.58.0	1.75.0	No
Zeromq (optional)	4.3.1	4.0	4.3.3	Yes
miniupnpc (optional)	2.0.20180203		2.2.1	No
qrencode (optional)	3.4.4		4.1.1	No
berkeley-db	4.8.30	4.8.x	18.1.40	No
expat	2.2.7		2.2.10	Yes	Yes
fontconfig	2.12.1		2.13.1	No	Yes
freetype						no (linux uses system)
zlib	1.2.11		1.2.11			no
libpng						yes
PCRE						yes
xcb						yes (linux only)
xkbcommon						yes (linux only)
HarfBuzz-NG						?
Python (tests)		3.6	3.9.1
GCC		7+ (C++17)	10.2
Clang		5.0+ (C++17)	11.0.0

[luke-jr]

We don't support Qt 4 in depends/ AFAIK?

[theuni]

Thanks, nice initiative.

dbus, fontconfig, and expat are all built as shared libs. That means we don't distribute them, and users load their own versions at runtime. a grep in depends for "disable-static" should turn up most/all of these. Also, we no longer use qt4, that .mk should just be deleted.

It's also worth noting that we use a bunch of built-in qt libs (libjpeg/libpng/etc). If the goal is to be able to enumerate CVEs that apply to our binaries, we should probably consider building those ourselves instead.

[fanquake]

Updated with the rest of our packages. Opened a PR to remove the Qt4 package.

[jonasschnelli]

Nice work!
Thanks.

[droark]

Oooh, nice initiative. Good job.

[laanwj]

Thanks for making this list.

[laanwj]

It's also worth noting that we use a bunch of built-in qt libs (libjpeg/libpng/etc). If the goal is to be able to enumerate CVEs that apply to our binaries, we should probably consider building those ourselves instead.

Image libraries are a grey area: it's hard to coerce bitcoin-qt to read resources from somewhere else than its own built-in resources (and if you manage to, it will only read from local disk). I don't think even a code execution vuln in libpng or libjpeg would be exploitable in practice.

(though it may still make sense to include them in the list for completeness, I'm not arguing against that, but we certainly don't have to do anything special for them)

[fanquake]

Updated the top comment now that #8423 has been merged.

[fanquake]

Cleaned up the messy list into a markdown table. Updated to reflect recent /depends/ merges.

[luke-jr]

I suggest splitting out the ones we only use as shared libs, since it doesn't matter if they have vulnerabilities, but it does potentially matter if they're too new (since that could result in incompatible ABIs).

[fanquake]

Updated to show which are shared libraries, as well as added all the built-in Qt libraries we're using.