92e61ba95f build: Add missing schnorrsig_halfagg module configuration (mllwchrry)
Pull request description:
The `schnorrsig_halfagg` module was added in 3a9b1d46 but was never configured in the CMake build system. Additionally, the autotools configuration was missing the dependency error check when `schnorrsig` is explicitly disabled.
ACKs for top commit:
real-or-random:
ACK 92e61ba95f
Tree-SHA512: f3770f6ae6c91a6ef51b633d147d8156a6ae843b6cb430deef07e7b9e6ea5f0b02cb228dbb41954620ce5560252d5dde7d85ce4114789bd5fcdff195915382dd
4359f050cc surjection: Remove test that reads out of bounds (Tim Ruffing)
78999f3a9a surjection: Fix leading whitespace (Tim Ruffing)
229e1f127a surjection: Fix read of uninitialized value in tests (Tim Ruffing)
c0a26a9c1b ci: enable surjectionproof module in CI configs (copilot-swe-agent[bot])
Pull request description:
The CI workflow enabled the ZKP experimental module set but omitted surjectionproof, so that module was never exercised in those jobs. This change wires surjectionproof into the same CI paths as the other enabled ZKP modules.
- **CI module plumbing (`ci/ci.sh`)**
- Added `SURJECTIONPROOF` to the exported/printed CI env set.
- Passed `SURJECTIONPROOF` into configure via `--enable-module-surjectionproof`.
- **Workflow env defaults and matrices (`.github/workflows/ci.yml`)**
- Added a global default: `SURJECTIONPROOF: 'no'`.
- Added `SURJECTIONPROOF: 'yes'` in every job/matrix env block that already enables the ZKP module group (`RANGEPROOF`, `WHITELIST`, `GENERATOR`, etc.).
- **Representative wiring change**
```sh
--enable-module-rangeproof="$RANGEPROOF" \
--enable-module-surjectionproof="$SURJECTIONPROOF" \
--enable-module-whitelist="$WHITELIST"
```
<!-- START COPILOT ORIGINAL PROMPT -->
<details>
<summary>Original prompt</summary>
>
> ----
>
> *This section details on the original issue you should resolve*
>
> <issue_title>ci: surjectionproof module is never enabled</issue_title>
> <issue_description>There's not even a SURJECTIONPROOF env variable in the GitHub Actions workflow... This should be enabled everywhere where the other ZKP modules are enabled.
>
> It may be better to enable all modules by default, but that's a change that could potentially benefit even upstream, so maybe let's first just fix this by enabling surjectionproof.</issue_description>
>
> <agent_instructions>Only add enabling of the surjectionproof module (no enabling of all modules by default)</agent_instructions>
>
> ## Comments on the Issue (you are @copilot in this section)
>
> <comments>
> </comments>
>
</details>
<!-- START COPILOT CODING AGENT SUFFIX -->
- FixesBlockstreamResearch/secp256k1-zkp#334
ACKs for top commit:
mllwchrry:
ACK 4359f05
Tree-SHA512: 13d776a76f73db6e74ca253099583da3d2600f424ea1f6bcbc9cd12544721477225a4190ffd34f4f1a77ab3b1d1e21d1f6d83409aa969bafe66a7978bef1b2d2
c49c9be504 bench: Update help functions in bench and bench_internal (kevkevinpal)
Pull request description:
### Motivation
This change is motivated by https://github.com/bitcoin-core/secp256k1/pull/1793#pullrequestreview-3644885897
> While aligning implementation across all benchmarks, argv could be passed to the help() in bench.c and bench_internal.c.
### Description
In the `bench` and `bench_internal` `help` functions `argv` was not being passed. In this change, we pass in argv and use it in the help text.
ACKs for top commit:
real-or-random:
ACK c49c9be504
Tree-SHA512: 77184db4bf5c16827f19d888af73939f4139cc2e84ae5256d995cf61f606d5865928480fc009a0185e1a6843f3c38dd1b858d1316e524c9b165459c7367f2318
This removes printing of the "random run = " at the end of the tests. I
haven't seen a single case where this proved to be useful. And as of
48789dafc2, this is anyway printed only at
the end of the exhaustive tests and not the normal tests, so the
probability that this will be useful in the future is very low.
f48b1bfa5d hash: add midstate initializer and use it for tagged hashes (w0xlt)
Pull request description:
Each tagged hash midstate function (e.g., `secp256k1_schnorrsig_sha256_tagged`) calls `secp256k1_sha256_initialize` before immediately overwriting every field it sets: `s[0]` through `s[7]` and `bytes`. The `buf[64]` member does not need initialization either, because `bytes` is set to 64, which means the buffer position (`bytes & 0x3F`) (`= bytes % 64`) is 0, so buf is always written before being read.
Remove the 11 redundant `secp256k1_sha256_initialize` calls across the `schnorrsig`, `ellswift`, and `musig` modules.
ACKs for top commit:
real-or-random:
utACK f48b1bfa5d
theStack:
Code-review ACK f48b1bfa5d
Tree-SHA512: 769beb96f3921cc3c180ed0d17484ffa0dc78041c889a8e56603679d8eaca5fe13e63759ada78f83d8e0ff7aae392e6bcbc1a9fe8b959105ea4a3d8ef51abf15
Introduce secp256k1_sha256_initialize_midstate() in the hash layer and use it at all tagged-hash midstate call sites across schnorrsig, musig, and ellswift.
Document the byte-counter contract at the declaration site in hash.h and add run_sha256_initialize_midstate_tests() to directly verify helper behavior against initialize_tagged.
Also switch the helper to take const uint32_t state[8] to reduce argument-order risk at call sites.
The secp256k1_ellswift_xdh function uses overflow = secp256k1_scalar_is_zero(&s) which overwrites the overflow flag from the preceding secp256k1_scalar_set_b32 call. This means secret keys >= the curve order are silently accepted (reduced mod n) instead of being rejected.
The fix changes = to |=, matching the correct pattern already used in secp256k1_ecdh (main_impl.h, line 51).
The ECDH module's test suite explicitly tests overflow rejection (passes secp256k1_group_order_bytes as a key and checks the function returns 0). The ellswift test suite has no corresponding test, which is why this went undetected.
