From 285cb788e9da2a965178cc8e0769e4821ff0c799 Mon Sep 17 00:00:00 2001 From: Hennadii Stepanov <32963518+hebasto@users.noreply.github.com> Date: Mon, 13 Apr 2026 11:54:22 +0100 Subject: [PATCH 1/3] ci: Replace `ilammy/msvc-dev-cmd` with manual MSVC setup The `ilammy/msvc-dev-cmd` repository seems abandoned and should be considered unsafe. This updates the workflow to load the MSVC environment variables directly via `vcvars64.bat`. See https://learn.microsoft.com/en-us/cpp/build/building-on-the-command-line. --- .github/workflows/ci.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 152f9a1f..9b836cd6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -604,11 +604,10 @@ jobs: steps: - *CHECKOUT - - name: Add cl.exe to PATH - uses: ilammy/msvc-dev-cmd@v1 - - name: C++ (public headers) + shell: cmd run: | + call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat" cl.exe -c -WX -TP include/*.h cxx_fpermissive_debian: From 3cca6451a2521e3cfe353b3787ea9f86d6caee2f Mon Sep 17 00:00:00 2001 From: Hennadii Stepanov <32963518+hebasto@users.noreply.github.com> Date: Mon, 27 Apr 2026 06:28:45 +0100 Subject: [PATCH 2/3] ci: Bump GCC snapshot major version to 17 See https://gcc.gnu.org/pipermail/gcc/2026-April/248048.html. --- ci/linux-debian.Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci/linux-debian.Dockerfile b/ci/linux-debian.Dockerfile index a575d9b1..e743cda8 100644 --- a/ci/linux-debian.Dockerfile +++ b/ci/linux-debian.Dockerfile @@ -40,7 +40,7 @@ RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install --no-instal apt-get clean && rm -rf /var/lib/apt/lists/* # Build and install gcc snapshot -ARG GCC_SNAPSHOT_MAJOR=16 +ARG GCC_SNAPSHOT_MAJOR=17 RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y \ wget libgmp-dev libmpfr-dev libmpc-dev flex && \ mkdir gcc && cd gcc && \ From 8479eafa5720421d4b7f4b524a35e0a7edf291c7 Mon Sep 17 00:00:00 2001 From: Sebastian Falbesoner Date: Tue, 28 Apr 2026 22:58:11 +0200 Subject: [PATCH 3/3] musig: always clear out secret key in `secp256k1_musig_nonce_gen_counter` Even though `secp256k1_musig_nonce_gen_internal` can currently only fail if the API is misused (invalid `keypair` or `keyagg_cache` parameters), clear out the buffer holding secret key data as well in this case to follow best practices. The issue was found and reported by l0rinc using GPT 5.5 (Thanks!). --- src/modules/musig/session_impl.h | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/src/modules/musig/session_impl.h b/src/modules/musig/session_impl.h index 6a37bfdf..510ee89f 100644 --- a/src/modules/musig/session_impl.h +++ b/src/modules/musig/session_impl.h @@ -483,11 +483,9 @@ int secp256k1_musig_nonce_gen_counter(const secp256k1_context* ctx, secp256k1_mu (void) ret; #endif - if (!secp256k1_musig_nonce_gen_internal(ctx, secnonce, pubnonce, buf, seckey, &pubkey, msg32, keyagg_cache, extra_input32)) { - return 0; - } + ret = secp256k1_musig_nonce_gen_internal(ctx, secnonce, pubnonce, buf, seckey, &pubkey, msg32, keyagg_cache, extra_input32); secp256k1_memclear_explicit(seckey, sizeof(seckey)); - return 1; + return ret; } static int secp256k1_musig_sum_pubnonces(const secp256k1_context* ctx, secp256k1_gej *summed_pubnonces, const secp256k1_musig_pubnonce * const* pubnonces, size_t n_pubnonces) {