Create dependencies.md #10779

flack commented at 11:18 AM on July 9, 2017: contributor

As @fanquake mentioned in #8639, this should probably be a file in doc/, so I went ahead and pulled the issue text via the github API and dumped it into a file. No modifications made, except one spelling fix. This makes the info easier to find, and it will get a proper version history, too.

fanquake added the label Docs and Output on Jul 9, 2017

in doc/dependencies.md:4 in 781347f5a3 outdated

   0 | @@ -0,0 +1,36 @@
   1 | +Dependencies
   2 | +============
   3 | +
   4 | +| Dependency | Version used | Minimum Required | Latest available | CVEs? | Shared | [Bundled Qt Library](https://doc.qt.io/qt-5/configure-options.html) |

laanwj commented at 4:11 PM on July 10, 2017:

Would be useful to have somewhat of an introduction here - what is this document, what should it be used for, when is it to be updated, etc. Also that instructions for installing dependencies are in the appropriate build-*.md.

laanwj commented at 4:11 PM on July 10, 2017: member

Concept ACK Needs an entry in doc/README.md

flack commented at 5:45 PM on July 10, 2017: contributor

@laanwj where would you put it in README, under "Building" or under "Development"?

An introduction seems like a good idea, and I could write some small blurb, but it would probably better if this is done by someone who knows what he's talking about :-)

Also, do you think the link in the last line of this paragraph https://github.com/bitcoin/bitcoin/blob/master/doc/build-unix.md#dependencies (and corresponding lines in the oder build docs) should be changed to point to the new file?

laanwj commented at 4:16 PM on July 13, 2017: member

where would you put it in README, under "Building" or under "Development"?

Building, I guess. People look there sooner I think, and it's relevant to both.

Also, do you think the link in the last line of this paragraph https://github.com/bitcoin/bitcoin/blob/master/doc/build-unix.md#dependencies (and corresponding lines in the oder build docs) should be changed to point to the new file?

Yes, such a overall overview can better go into dependencies.md. Do keep the instructions for installing the dependencies in the appropriate build instructions though.

flack commented at 5:54 PM on July 14, 2017: contributor

I've added links from README and the build-* files & a small intro sentence as requested. Let me know if there's anything else I should change

in doc/dependencies.md:6 in f5dcfb63ea outdated

   0 | @@ -0,0 +1,38 @@
   1 | +Dependencies
   2 | +============
   3 | +
   4 | +These are the dependencies currently used by Bitcoin Core. You can find instructions for installing them in the `build-*.md` file for your platform.
   5 | +
   6 | +| Dependency | Version used | Minimum Required | Latest available | CVEs? | Shared | [Bundled Qt Library](https://doc.qt.io/qt-5/configure-options.html) |

luke-jr commented at 8:54 AM on July 26, 2017:

Let's not try to track latest available here...

For CVEs, rather than yes/no, it'd be more useful to link where to check for exploits.

in doc/dependencies.md:9 in f5dcfb63ea outdated

   0 | @@ -0,0 +1,38 @@
   1 | +Dependencies
   2 | +============
   3 | +
   4 | +These are the dependencies currently used by Bitcoin Core. You can find instructions for installing them in the `build-*.md` file for your platform.
   5 | +
   6 | +| Dependency | Version used | Minimum Required | Latest available | CVEs? | Shared | [Bundled Qt Library](https://doc.qt.io/qt-5/configure-options.html) |
   7 | +| --- | --- | --- | --- | --- | --- | --- |
   8 | +| openssl | 1.0.1k |  | [1.0.1u](https://www.openssl.org/source) | Yes |  |  |
   9 | +| ccache | 3.3.4 |  | [3.3.4](https://ccache.samba.org/download.html) | No |  |  |

luke-jr commented at 8:55 AM on July 26, 2017:

No indication on which dependencies are optional?

flack commented at 10:02 AM on July 26, 2017:

wouldn't that info have to be in the platform-specific files?

in doc/dependencies.md:11 in f5dcfb63ea outdated

   6 | +| Dependency | Version used | Minimum Required | Latest available | CVEs? | Shared | [Bundled Qt Library](https://doc.qt.io/qt-5/configure-options.html) |
   7 | +| --- | --- | --- | --- | --- | --- | --- |
   8 | +| openssl | 1.0.1k |  | [1.0.1u](https://www.openssl.org/source) | Yes |  |  |
   9 | +| ccache | 3.3.4 |  | [3.3.4](https://ccache.samba.org/download.html) | No |  |  |
  10 | +| libevent | 2.1.8-stable | 2.0.22 | [2.1.8-stable](https://github.com/libevent/libevent/releases) | No |  |  |
  11 | +| Qt | 5.7.1 | 4.7+ | [5.9.1](https://download.qt.io/official_releases/qt/) | No |  |  |

luke-jr commented at 8:55 AM on July 26, 2017:

Qt is typically considered as individual components. We don't need all of it.

in doc/dependencies.md:38 in f5dcfb63ea outdated

  33 | +
  34 | +### CVEs
  35 | +
  36 | +#### OpenSSL 1.0.1k
  37 | +
  38 | +[CVE-2015-0286](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0286), [CVE-2015-0287](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0287), [CVE-2015-0289](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0289), [CVE-2015-0293](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0293), [CVE-2015-0209](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0209), [CVE-2015-0288](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0288), [CVE-2015-1788](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1788), [CVE-2015-1789](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789), [CVE-2015-1790](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790), [CVE-2015-1792](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1792), [CVE-2015-1791](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1791), [CVE-2015-1793](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1793), [CVE-2015-3196](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3196), [CVE-2015-3194](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3194), [CVE-2015-3195](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3195), [CVE-2015-3197](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3197), [CVE-2016-0800](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0800), [CVE-2016-0705](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0705), [CVE-2016-0798](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0798), [CVE-2016-0797](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0797), [CVE-2016-0799](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0799), [CVE-2016-0702](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0702), [CVE-2016-2107](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2107), [CVE-2016-2105](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2105), [CVE-2016-2106](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2106), [CVE-2016-2108](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2108), [CVE-2016-2109](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2109), [CVE-2016-2176](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2176), [CVE-2016-2177](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2177), [CVE-2016-2178](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2178), [CVE-2016-2179](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2179), [CVE-2016-2180](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2180), [CVE-2016-2181](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2181), [CVE-2016-2182](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2182), [CVE-2016-6302](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6302), [CVE-2016-6303](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6303), [CVE-2016-6304](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6304), [CVE-2016-6306](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6306)

luke-jr commented at 8:56 AM on July 26, 2017:

This doesn't seem to belong here.

flack commented at 10:04 AM on July 26, 2017:

like I've written in the original PR description, for now I just took the text verbatim from #8639, but I can ofc adapt it

flack commented at 6:41 PM on July 26, 2017: contributor

I've removed the "latest available" column now as requested by @luke-jr . I can also remove the listed CVEs, since they will probably get outdated pretty quickly, too. I also like the idea of putting in links to check for vulnerabilities, but I don't really know where they should link to.

fanquake cross-referenced this on Sep 6, 2017 from issue Specify minimum compiler version requirements by laanwj

fanquake commented at 1:23 AM on September 6, 2017: member

@flack Can you update this to remove the CVEs list, and pull in the latest data from #8639 ?

flack commented at 5:05 PM on September 6, 2017: contributor

@fanquake I've removed the CVEs, and compared the data with #8639, but everything still seems to be in sync

laanwj commented at 10:09 PM on September 6, 2017: member

ACK after squashing into one commit

Create dependencies.md, and link dependencies file from README & build docs e91b961923

flack commented at 10:36 PM on September 6, 2017: contributor

squashed

laanwj merged this on Sep 7, 2017

laanwj closed this on Sep 7, 2017

laanwj referenced this in commit f65614726d on Sep 7, 2017

sickpig cross-referenced this on Jun 5, 2018 from issue [PORT] Depends cherries by sickpig

attilaaf referenced this in commit c075107209 on May 25, 2019

bitcoin locked this on Sep 8, 2021