8479eafa57 musig: always clear out secret key in `secp256k1_musig_nonce_gen_counter` (Sebastian Falbesoner)
3cca6451a2 ci: Bump GCC snapshot major version to 17 (Hennadii Stepanov)
285cb788e9 ci: Replace `ilammy/msvc-dev-cmd` with manual MSVC setup (Hennadii Stepanov)
Pull request description:
This PR has been created by a GitHub Actions workflow without human involvement.
[bitcoin-core/secp256k1#1846]: ci: Replace `ilammy/msvc-dev-cmd` with manual MSVC setup
[bitcoin-core/secp256k1#1848]: ci: Bump GCC snapshot major version to 17
[bitcoin-core/secp256k1#1849]: musig: always clear out secret key in `secp256k1_musig_nonce_gen_counter`
Tips:
* Use `git show --remerge-diff <pr-branch>` to show the conflict resolution in the merge commit.
* Use `git read-tree --reset -u <pr-branch>` to replay these resolutions during the conflict resolution stage when recreating the PR branch locally.
Be aware that this may discard your index as well as the uncommitted changes and untracked files in your worktree.
ACKs for top commit:
mllwchrry:
ACK b11340b. This sync PR can be merged as-is.
DarkWindman:
ACK b11340b3ce
Tree-SHA512: 4b311e9bfa21f00b4780202c08af9d00380f5b3df40704641764d706cfc3408615b6206c7c82ca915b56c27a354bdf24680674269a28eefe7d4e93adc06cbaa5
8479eafa57 musig: always clear out secret key in `secp256k1_musig_nonce_gen_counter` (Sebastian Falbesoner)
Pull request description:
Even though `secp256k1_musig_nonce_gen_internal` can currently only fail if the surrounding API function is misused (invalid `keypair` or `keyagg_cache` parameters, making the corresponding [seckey validation](c1a9e4fe64/src/modules/musig/session_impl.h (L391)) or [pubkey](c1a9e4fe64/src/modules/musig/session_impl.h (L397)) load calls fail), clearing out the stack memory holding the secret key as well in this case seems reasonable to follow best practices.
The issue was reported off-band by l0rinc (thanks!), in the course of analyzing the secp repository with AI tooling.
ACKs for top commit:
furszy:
ACK 8479eafa57
real-or-random:
utACK 8479eafa57
Tree-SHA512: dc15ed7518c6cd0b1b86d2e0382c546374e94a1c1fa15639ba3db27e083ce53a24ddf4d3cd3328b4dc229258d8cbb0e01f4b63f025d04254845f2bf20cfa5289
Even though `secp256k1_musig_nonce_gen_internal` can currently only fail
if the API is misused (invalid `keypair` or `keyagg_cache` parameters),
clear out the buffer holding secret key data as well in this case to
follow best practices.
The issue was found and reported by l0rinc using GPT 5.5 (Thanks!).
3cca6451a2 ci: Bump GCC snapshot major version to 17 (Hennadii Stepanov)
Pull request description:
See https://gcc.gnu.org/pipermail/gcc/2026-April/248048.html.
ACKs for top commit:
real-or-random:
utACK 3cca6451a2
Tree-SHA512: 36c975c500cb0411f20189a3b451b58268ff15be08ff444833e27ae37b53bf7581ba8a8c48b393a9b96050f8c498242ba2fb5e593caee492f1fcb1182cc948bc
baac08d207 modules, tests: Port bitcoin-core/secp256k1#1777 and bitcoin-core/secp256k1#1824 to zkp-specific code (DarkWindman)
c5cd9d6d9a gha: Bump deprecated GHA workflow dependencies (Tim Ruffing)
43fca0ff55 ecdsa: VERIFY_CHECK result of _fe_set_b32_limit (Tim Ruffing)
b84635ed3b tests: Fix C89 function pointer initialization in ellswift tests (mllwchrry)
3a403639dc eckey: Call ecmult with NULL instead of zero scalar (Tim Ruffing)
7e68c0c88b ecmult: Document and test ng=NULL in ecmult (Tim Ruffing)
4d92a083bc sha256: speed up writes using multi-block compression (furszy)
0753f8b909 Add API to override SHA256 compression at runtime (furszy)
fdb6a91a5e Introduce hash context to support pluggable SHA256 compression (furszy)
921b9711ea util: introduce and use `ARRAY_SIZE` macro (Sebastian Falbesoner)
Pull request description:
[https://github.com/bitcoin-core/secp256k1/pull/1824]: util: introduce and use ARRAY_SIZE macro
[https://github.com/bitcoin-core/secp256k1/pull/1777]: Make SHA256 compression runtime pluggable
[https://github.com/bitcoin-core/secp256k1/pull/1834]: ecmult: Document and test ng=NULL in ecmult
[https://github.com/bitcoin-core/secp256k1/pull/1837]: tests: Fix function pointer initialization C89 error in ellswift tests
[https://github.com/bitcoin-core/secp256k1/pull/1839]: ecdsa: VERIFY_CHECK result of _fe_set_b32_limit
[https://github.com/bitcoin-core/secp256k1/pull/1841]: gha: Bump deprecated GHA workflow dependencies
Tips:
Use git show --remerge-diff <pr-branch> to show the conflict resolution in the merge commit.
Use git read-tree --reset -u <pr-branch> to replay these resolutions during the conflict resolution stage when recreating the PR branch locally.
Be aware that this may discard your index as well as the uncommitted changes and untracked files in your worktree.
ACKs for top commit:
mllwchrry:
ACK baac08d
real-or-random:
ACK baac08d207
Tree-SHA512: 082c9b52ae79716b8770fabd4956f4253ad7eeadd3242aed040178d1149e5e4c92f02af2829b110bebb14c44f8de00a9d9d51646565c9e0b25df0ba9fc148f75
285cb788e9 ci: Replace `ilammy/msvc-dev-cmd` with manual MSVC setup (Hennadii Stepanov)
Pull request description:
The `ilammy/msvc-dev-cmd` repository seems [abandoned](https://github.com/ilammy/msvc-dev-cmd/issues/103) and should be considered unsafe.
This PR updates the workflow to load the MSVC environment variables directly via [`vcvars64.bat`](https://learn.microsoft.com/en-us/cpp/build/building-on-the-command-line).
For reference, the Bitcoin Core project removed `ilammy/msvc-dev-cmd` in https://github.com/bitcoin/bitcoin/pull/32513.
**Note for Maintainers:** Once this PR is merged and other PRs are rebased on top of it, the `ilammy/msvc-dev-cmd` action should be removed from the "Action permission" settings in this repository.
ACKs for top commit:
real-or-random:
utACK 285cb788e9
Tree-SHA512: 3faa9a316438ae3f4e7352890a77baaf0bf0adda4086111344d8279dc869a42ea837269527268fad1a2dd2e1893fd8fc51e5c3b205f394926b07988579a10ad9
e371ab5df0 sync-upstream: Restore SYNC_PAT for gh commands (DarkWindman)
Pull request description:
This PR restores the `SYNC_PAT` requirement due to restrictions on opening PRs with the default 'GITHUB_TOKEN'.
Since the authorship of the PR is now linked to the user who created the PAT, a note was added to the PR body to clarify that it was created by a GitHub Actions workflow and not by a human being.
Additionally, the `permissions:` section has been removed, as `GITHUB_TOKEN` is no longer in use.
ACKs for top commit:
real-or-random:
ACK e371ab5df0
Tree-SHA512: e61fde9538edc95a049e1208894c5cafe2295180cc6d02e35a364974e04aba913c39256ac7293685919650021d97a1737075f782c11383b761f0979f8bd70e8a
43fca0ff55 ecdsa: VERIFY_CHECK result of _fe_set_b32_limit (Tim Ruffing)
Pull request description:
This also avoids a spurious `-Wmaybe-uninitialized` warning emitted by gcc 16 (snapshot) when compiling with `-DDETERMINISTIC`.
Alternative to #1838 by @mllwchrry who tried very a similar thing as this PR but couldn't convince the compiler. (The GCC snapshot is very annoying: a simple `VERIFY_CHECK(secp256k1_fe_set_b32_limit(&xr, c))` doesn't do the trick. I found this variant here with a local store rather by accident.)
ACKs for top commit:
mllwchrry:
ACK 43fca0f
theStack:
utACK 43fca0ff55
Tree-SHA512: 2550043e953675db7614f98bbdffb706721834967ef36f7c905f7cbfeee5d88189a9acfcd64865ef822bb0e3272d228440bdfb1124228afe083e025056e53212
b84635ed3b tests: Fix C89 function pointer initialization in ellswift tests (mllwchrry)
Pull request description:
Fixes a C89 pedantic compliance error in `src/modules/ellswift/tests_impl.h` where function pointer array initialization is not allowed at declaration time.
This error was exposed while I was testing the improved test coverage in CI. The initial plan was to simplify the configuration of modules in CI by enabling all modules by default and testing the disabling of each module independently.
Error: src/modules/ellswift/tests_impl.h:442:110: error: initializer element is not computable at load time [-Wpedantic].
The error occurred when running the `x86_64_debian` GitHub Actions CI job, which uses GCC 16 (snapshot) with strict flags (-std=c89 -pedantic -pedantic-errors -Werror). See this action run for reference: https://github.com/mllwchrry/secp256k1/actions/runs/23301905657/job/67769464566.
The fix uses `if/else` to assign function pointers after declaration, matching the pattern already used in the same file.
While this is a minor C89 compliance issue, it blocks the potential CI simplification.
ACKs for top commit:
real-or-random:
utACK b84635ed3b
theStack:
ACK b84635ed3b
Tree-SHA512: 61e42afe9c3a215f817b1bf475ea66c103b4af6c598a9d7ee9e1a97789ac6f4e025260b4cd0e2ec219bd73706c7aa2799c58ab904916d9594626cf3c07e4b983
b96b655a82 include: fix a minor grammar mistake in the rangeproof description (Mykyta Redko)
Pull request description:
ACKs for top commit:
real-or-random:
ACK b96b655a82
Tree-SHA512: 96bfa2aaaf3779337fdc7aa8c8edefa00340ca10ee268dbc4b78cd3a14b99e3527a58c196cf29cc848617756a58b2ae34445fb44e3a8f386d9e6d3f72ad4fbc6
efa4e11b65 sync-upstream: Use GITHUB_TOKEN for gh commands (DarkWindman)
Pull request description:
Optimize token usage in the sync workflow.
**Token usage:**
- **PAT** : Used for `git push` operations that modify workflow files
- `GITHUB_TOKEN`: Used for GitHub CLI commands (`gh repo set-default`, `gh pr create`)
ACKs for top commit:
real-or-random:
ACK efa4e11b65
Tree-SHA512: 9deb68d74e69ac1a3f6785f04132aef8c3357d326e9e9efe9a86842db12972a46f81f124dd3ddda7425ebd3ddd86cfd4905006fe20ae9d9ca0f0be07bca64891
c9a623c362 sync-upstream: Pass token via checkout for git push operations (DarkWindman)
Pull request description:
Pass token via checkout step for git operations.
`git push` now uses the token from `actions/checkout`, not `GH_TOKEN` env var.
Fixes authentication error when pushing workflow file changes.
ACKs for top commit:
real-or-random:
ACK c9a623c362
Tree-SHA512: a1ff1068d421f2bc390c589a4292d4d15788afcb9c42444af7bacf67103a761f2f90532dbb852081008632cf7bb1c6b99fe145178850c29d16470483fa221d1b
3a18afd5ff sync-upstream: Allow PAT for sync workflow (DarkWindman)
Pull request description:
Add support for using a Personal Access Token in the upstream sync workflow. The workflow now uses `secrets.SYNC_PAT`.
This is necessary to push changes that include modifications to workflow files, which `GITHUB_TOKEN` cannot do due to lack of `workflow` permission.
ACKs for top commit:
real-or-random:
ACK 3a18afd5ff
Tree-SHA512: f0c786a3d769dbeab339f8687af836d2e576b778f4c6ddb6b5dd62e993ba6d8d8c427a2cd60d197283a896e415d4eea998ebb6356ee4424534cb934fac6c72ee
bb736825c1 sync-upstream: Add automatic GitHub Actions sync script (DarkWindman)
Pull request description:
### Description
This PR introduces an automated GitHub Actions workflow (`sync.yml`) to streamline the synchronization of upstream commits from `bitcoin-core/secp256k1` into this repository. Additionally, it refactors the existing local sync helper script.
Resolves#342.
### Key Updates & Features
* **Monthly Automated Runs:** The workflow is scheduled to run on the 1st of every month. It automatically pulls the upstream `master` and creates a new branch specifically prepared for a manual merge.
* **Refactored `sync-upstream.sh`:** It now *exclusively* generates the PR title and markdown body, and prepares the `contrib/gh-pr-create.sh` helper script.
ACKs for top commit:
real-or-random:
ACK bb736825c1
Tree-SHA512: 39bca91b5e27fa677a306c44e2adf927c6e40c360bfb2cd78cc7cf8073844844d1f212e6bdff57aa532847270e801d01900711b6c5140c8c53516307d90809c1
3a403639dc eckey: Call ecmult with NULL instead of zero scalar (Tim Ruffing)
7e68c0c88b ecmult: Document and test ng=NULL in ecmult (Tim Ruffing)
Pull request description:
ACKs for top commit:
theStack:
re-ACK 3a403639dc
Tree-SHA512: 954928d4dfa120845c6e899c1a69ad0408072809551d42735eac491b8bc41249eb25d7c57cfa4f44763167620b5cb78639b5c396c0a342c47b0afc48a088c755
92e61ba95f build: Add missing schnorrsig_halfagg module configuration (mllwchrry)
Pull request description:
The `schnorrsig_halfagg` module was added in 3a9b1d46 but was never configured in the CMake build system. Additionally, the autotools configuration was missing the dependency error check when `schnorrsig` is explicitly disabled.
ACKs for top commit:
real-or-random:
ACK 92e61ba95f
Tree-SHA512: f3770f6ae6c91a6ef51b633d147d8156a6ae843b6cb430deef07e7b9e6ea5f0b02cb228dbb41954620ce5560252d5dde7d85ce4114789bd5fcdff195915382dd
4359f050cc surjection: Remove test that reads out of bounds (Tim Ruffing)
78999f3a9a surjection: Fix leading whitespace (Tim Ruffing)
229e1f127a surjection: Fix read of uninitialized value in tests (Tim Ruffing)
c0a26a9c1b ci: enable surjectionproof module in CI configs (copilot-swe-agent[bot])
Pull request description:
The CI workflow enabled the ZKP experimental module set but omitted surjectionproof, so that module was never exercised in those jobs. This change wires surjectionproof into the same CI paths as the other enabled ZKP modules.
- **CI module plumbing (`ci/ci.sh`)**
- Added `SURJECTIONPROOF` to the exported/printed CI env set.
- Passed `SURJECTIONPROOF` into configure via `--enable-module-surjectionproof`.
- **Workflow env defaults and matrices (`.github/workflows/ci.yml`)**
- Added a global default: `SURJECTIONPROOF: 'no'`.
- Added `SURJECTIONPROOF: 'yes'` in every job/matrix env block that already enables the ZKP module group (`RANGEPROOF`, `WHITELIST`, `GENERATOR`, etc.).
- **Representative wiring change**
```sh
--enable-module-rangeproof="$RANGEPROOF" \
--enable-module-surjectionproof="$SURJECTIONPROOF" \
--enable-module-whitelist="$WHITELIST"
```
<!-- START COPILOT ORIGINAL PROMPT -->
<details>
<summary>Original prompt</summary>
>
> ----
>
> *This section details on the original issue you should resolve*
>
> <issue_title>ci: surjectionproof module is never enabled</issue_title>
> <issue_description>There's not even a SURJECTIONPROOF env variable in the GitHub Actions workflow... This should be enabled everywhere where the other ZKP modules are enabled.
>
> It may be better to enable all modules by default, but that's a change that could potentially benefit even upstream, so maybe let's first just fix this by enabling surjectionproof.</issue_description>
>
> <agent_instructions>Only add enabling of the surjectionproof module (no enabling of all modules by default)</agent_instructions>
>
> ## Comments on the Issue (you are @copilot in this section)
>
> <comments>
> </comments>
>
</details>
<!-- START COPILOT CODING AGENT SUFFIX -->
- FixesBlockstreamResearch/secp256k1-zkp#334
ACKs for top commit:
mllwchrry:
ACK 4359f05
Tree-SHA512: 13d776a76f73db6e74ca253099583da3d2600f424ea1f6bcbc9cd12544721477225a4190ffd34f4f1a77ab3b1d1e21d1f6d83409aa969bafe66a7978bef1b2d2
656c7cc704 sync-upstream: Clarify that we merge a *single* upstream ref (Tim Ruffing)
349a94b169 sync-upstream: Remove "select" mode and simplify (Tim Ruffing)
Pull request description:
Please see individual commit messages for details.
---
Here's an example session that shows why `select` doesn't make sense:
```
### Let's find some PRs to sync (master is at 5a67b63)
❯ ./contrib/sync-upstream.sh -b master range
Merging b9cb1cbf1aafe151 . Continue with y
n
### Let's look at them in the order they have been merged
❯ git show b9cb1cbf
commit b9cb1cbfd7
Merge: c0a2aba0921b9711
Author: merge-script <me@real-or-random.org>
Date: Tue Mar 3 15:31:46 2026 +0100
Merge bitcoin-core/secp256k1#1824: util: introduce and use `ARRAY_SIZE` macro
[...]
❯ git --no-pager show 1aafe151
commit 1aafe15139 (upstream/master, upstream/HEAD)
Merge: b9cb1cbf4d92a083
Author: merge-script <me@real-or-random.org>
Date: Wed Mar 4 08:43:07 2026 +0100
Merge bitcoin-core/secp256k1#1777: Make SHA256 compression runtime pluggable
[...]
### Let's assume I want to cherry-pick 1aafe151 but not sync b9cb1bcf
❯ ./contrib/sync-upstream.sh -b master select 1aafe151
-----------------------------------
Upstream PRs 1777
-----------------------------------
[bitcoin-core/secp256k1#1777]: Make SHA256 compression runtime pluggable
This PR can be recreated with `./contrib/sync-upstream.sh -b master select 1aafe151`.
[...]
### Let's check if it's really only PR #1777
❯ git diff | grep ARRAY_SIZE
+ #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
### Ah damn, we also got the other PR #1824...
```
ACKs for top commit:
mllwchrry:
ACK 656c7cc
jonasnick:
ACK 656c7cc704
Tree-SHA512: 27cdfe7c6decce840ef4f2d12fa0a5fd829b35ac24403272c4b34c0a3b0da2303cee36bcb419d0608c6b1297fd5bf8a6cd6d41672850ac092814c140638f9d83
ed985641f4 ecdsa_adaptor: Make arg order in dleq_{prove,verify} consistent (Tim Ruffing)
a7d0f246d7 ecdsa_adaptor: Simplify code (Tim Ruffing)
41a8a2a65b ecdsa_adaptor: Clarify identifiers (Tim Ruffing)
7f1c5390c2 ecdsa_adaptor: Make files more self-contained (Tim Ruffing)
dd8db2ea2b ecdsa_adaptor: Run tests with default and overflowing nonce function (Tim Ruffing)
a4af91d5b9 ecdsa_adaptor: Add test case for R1==infinity in DLEQ proof (Tim Ruffing)
Pull request description:
This module could get some more love, but I don't think it's a priority.
Closes#335.
ACKs for top commit:
mllwchrry:
ACK ed98564
Tree-SHA512: f742e2c9536f711866a1e0c614a780866d72fdd7d721c816eaec16fa7fc67c141577c604b4d76928fb0d1ec9ad5577c2460724d5b3a919b5110490c1c5488f88
Roughly speaking, this changes (assuming 3 upstream PRs)
git merge <upstream-commit1> <upstream-commit-2> <upstream-commit3>
into
git merge <upstream-commit3>
This is more intuitive. We're merging a single upstream revision, namely
<upstream-commit3>. The other two commits are simply parents of that one,
i.e., they're included anyway, and git merge ignores them.
(In fact, passing multiple refs looks like we're doing an octopus
merge. It's just that git recognizes the fact that everything is included
in the last ref anyway, and behaves as if only the last one had been passed.)
This commit also makes some further clean ups and improvements.
I believe it was introduced to cherry-pick upstream PRs, but that simply
doesn't work. Assume upstream is two PRs A and B ahead, and A has been
merged before B. Then trying to cherry-picking B by merging the state of
upstream's master after the merge-B commit won't do what we expect. In
particular, the merge result will *include A's changes* because A had
already been merged in upstream's master when B was merged.
(One could think that merging the PR branch of B instead works, but this
will yield the same result if B was rebased on master before it was
merged.)
The proper way to cherry-pick B is to create a PR that cherry-picks all
commits that had been included in B. This could be done automatically,
but the need to cherry-pick a PR is rare enough that we don't need tool
support for it. In fact, because we want to keep cherry-picking at a
minimum, there's a good chance that we'd anyway want to pick only a
subset of the commits in a upstream PR, and that would need manual work
anyway.
