Add a BIP-352 test vector where a taproot input is spent via the key path with an annex (2-item witness). The annex must be stripped before deciding between key-path and script-path spends, so the input is still eligible and all expected values match the plain key-path case.
The annex is 0x50 followed by the BIP341 NUMS point H, so an implementation that fails to strip it reads it as a control block with the NUMS internal key and wrongly skips the input.
* bip139: wallet metadata format
* bip139: add the Version header to the preamble
* bip139: keep a single psbts field and fix the spend status link
* bip139: fold the version section and bip field into the version value
* bip139: capitalize Bitcoin Core and clarify the change_descriptor note
* bip139: replace the three account birth time fields with birth_block
* bip139: drop descriptor_id and change_descriptor_id
* bip139: drop field aliases, keeping name and labels
* bip139: restrict descriptor and change_descriptor to a string
* bip139: make version, type, descriptor, key, txid, outpoint and tweak mandatory
* bip139: move field definitions to a companion registry
* bip139: add the wallet survey behind these decisions
* bip139: replace the wallet description field with a backup note
* bip139: add the backup date field
* bip139: add the account gap_limit field
* bip139: add the multi_bip380 account type
* bip139: give the bip352_labels range an explicit encoding
* bip139: add a general coin object
* bip139: move signers above the account
* bip139: add signer modality and device records
* bip139: add bip85 application and index
* bip139: add Bitkey to the wallet survey
* bip139: state how to derive birth_block from a creation date
* bip139: define the timestamp format once
* bip139: rename the transaction time field to block_time
* bip139: keep last_height on the account only
* bip139: state that type names the descriptor language
* bip139: drop output_type, the descriptor already states it
* bip139: replace the account active flag with a status enum
* bip139: add mutinynet and scope a backup to one network
* bip139: record that the label gap belongs to BIP-329
* bip139: record that proprietary needs no change
* bip139: make the survey annex-ready
* bip139: record that mainnet mnemonics stay out of scope
* bip139: reword the mnemonic evidence heading
* bip139: correct the birth_block evidence, Sparrow stores a height
* bip139: type and descriptor fit every surveyed wallet
* bip139: correct the addr descriptor solvability note
* bip139: re-assess every partial score against fillability
* bip139: store psbts once at wallet level, reference them per account
* bip139: store transactions once at wallet level, reference them per account
* bip139: txid is the transaction map key, not a field
* bip139: refresh the matrix after the fillability re-assessment
* bip139: electrum holds no bip39 mnemonic at all
* bip139: sp_output.label has no constituency
* bip139: collapse the survey to a two-value scale
* bip139: drop the obsolete partial-score analysis
* bip139: size the matrix field column from the data
* bip139: cut the survey down to the table and its results
* bip139: recompute liana compat against the current draft
* bip139: correct the liana breaking-change count
* bip139: make network mandatory
* bip139: network no longer breaks liana on import
* bip139: render wallet fields as a wrapped table
* bip139: render account fields as a wrapped table
* bip139: render every field section as a wrapped table
* bip139: the registry is part of the bip, not a reference to it
* bip139: drop the registration process from the registry intro
* bip139: put field rationale in the cell, not below the table
* bip139: keep code spans whole when wrapping cells
* bip139: render field tables as preformatted blocks
* bip139: drop link definitions the tables no longer use
* bip139: use a bordered grid for the field tables
* bip139: give birth_block an estimation formula and drop the enum underscore
* bip139: merge silent payment outputs into the coin object
* bip139: restore spend_status and give the sp label scalar a home
* bip139: register the transaction fee field
* bip139: rebuild the survey matrix against the current field set
* bip139: drop survey findings the draft now addresses
* bip139: bar passphrase-protected seeds from bip39_mnemonic
* bip139: record the missing-field decisions in the survey
* bip139: cut the survey down to its revision list and matrix
* bip139: reword the survey as a wallet to field mapping
* bip139: reference the wallet support annex from the spec
* bip139: list the mandatory fields in the registry tables
* bip139: point the spec at the registry as the complete field list
* bip139: spell out mandatory and optional in the registry req column
* bip139: mark only the optional fields in the registry tables
* bip139: retitle and reframe the BIP around moving between wallets
* bip139: call the artefact an export throughout
* bip139: scope the mnemonic advice to exports kept as backups
* bip139: say that most metadata cannot be recovered from the chain
* bip139: clarify account and signer metadata fields
* bip139: cut the registry cells back to the field description
* bip139: reword the registry field descriptions
* bip139: give the device record its own registry table
* bip139: keep an unknown enum value from failing the import
* bip139: define the device transports field
* bip139: point the devices row at the device object
* bip139: backup -> export in README
* bip139: clarify export fields and remove survey annex
* bip139: Drop Version header in absence of Changelog
The upgradeable rules list the to_sign version, NOPs reserved for
upgrades and segwit versions above 1. BIP341 and BIP342 also reserve
unknown leaf versions, OP_SUCCESSx, unknown public key types and the
annex for upgrades. A verifier that follows the BIP322 text calls a
signature using any of them valid. Name them, so that these give the
inconclusive state like the other upgrade mechanisms.
Bump the version to 2.1.0 and add a changelog entry.
Add 342 to Requires.
Add a vendored copy of the secp256k1lab library (master branch, commit
a265da139aea27386085a2a8760f8698e1bda64e) that the half-aggregation
reference implementation and test vector scripts depend on.
Since 977300d timestamps.json is a single JSON object whose children are
nested recursively in extensions arrays, with valid and comment only on the
leaves, but the README still described a flat array of objects with a
header_chain entry.
The example says the skipped hashes are 0x00..., 0x66... and 0x22...,
and traversal-example.dot has 0x22... as the SKIP branch of D, but the
base64 proof ended with 32 bytes of 0x44, which is one of the VERIFY
hashes. Re-encode the proof with 0x22... as the last hash. The length
(101 bytes) and the tree serialization are unchanged.
bip-0375/deps/dleq.py is adapted from the BIP-374 reference code but
predates the change that treats the challenge e as a scalar (#2262).
Reduce the challenge hash mod n and reject proofs with e >= n, so the
copy used by the BIP-375 validator matches the current BIP-374
reference.
A root selected through a derived xpub can also appear bare or as a
literal key. Once a spend reveals it, anyone could decrypt the backup.
Exclude such cases.
MuSig aggregation hides participant keys, so account xpubs do not need
individual trailing derivation.
Specify that encryption uses participant roots rather than the aggregate key.
Add MuSig2 test vectors: one for a bare aggregate and one for aggregate
derivation.
Rename keys_types.json to recipient_keys.json and generalize the format
to support multiple descriptors and multiple recipient keys:
- "key": a single key-expression string becomes "descriptors": an array
of complete descriptor strings.
- "expected": an x-only key string becomes "expected_keys": an array
containing that key; null remains null.
Convert the nine existing cases by wrapping each key expression in tr(),
except the uncompressed literal uses pk(), since tr() does not accept it.
Each case has one descriptor.
Specify that parsing stops immediately. Add a vector with an item followed
by a terminator and ignored bytes.
Clarify that TYPE 0x00 also doesn't require TYPE_LENGTH.
The six taproot input fields say "Finalizers should remove this field
after PSBT_IN_FINAL_SCRIPTWITNESS is constructed", and so does the
output field PSBT_OUT_TAP_BIP32_DERIVATION. An output has no
PSBT_IN_FINAL_SCRIPTWITNESS, the clause names no input, and its two
neighbours in the output table carry no such clause. Drop it; Bitcoin
Core does not clear output fields on finalization.
BIP 174 tells the Input Finalizer to clear all other data except the
UTXO and unknown fields from a finalized input. It was written when the
unsigned transaction was a global field. PSBTv2 moves the data that
defines the input into the input map, and a finalizer that follows the
sentence literally removes it: without PSBT_IN_PREVIOUS_TXID or
PSBT_IN_OUTPUT_INDEX the result is invalid, and without
PSBT_IN_SEQUENCE and the locktime fields the Transaction Extractor
builds a different transaction.
BIP 370 amends Creator, Updater, Signer and Transaction Extractor for
PSBTv2, adds the Constructor, and says nothing about the Input
Finalizer. Add the section: the five fields are kept. Bitcoin Core
does this today: at 19b0ff2fa0, PSBTInput::Serialize in src/psbt.h
writes them for every PSBTv2 input, finalized or not.
Record this branch's clarifications and test vectors under draft document
version 0.1.1. Keep the initial-publication entry in the shared first commit.
Jon Atack
Fabian Jahr
Novo
ViniciusCestarii
pythcoiner
Ferdinando Ametrano
fengxueweilai
Murch
Antoine Poinsot
FlashW
Shadow
Bruce0X
Sjors Provoost