bb736825c1 sync-upstream: Add automatic GitHub Actions sync script (DarkWindman)
Pull request description:
### Description
This PR introduces an automated GitHub Actions workflow (`sync.yml`) to streamline the synchronization of upstream commits from `bitcoin-core/secp256k1` into this repository. Additionally, it refactors the existing local sync helper script.
Resolves#342.
### Key Updates & Features
* **Monthly Automated Runs:** The workflow is scheduled to run on the 1st of every month. It automatically pulls the upstream `master` and creates a new branch specifically prepared for a manual merge.
* **Refactored `sync-upstream.sh`:** It now *exclusively* generates the PR title and markdown body, and prepares the `contrib/gh-pr-create.sh` helper script.
ACKs for top commit:
real-or-random:
ACK bb736825c1
Tree-SHA512: 39bca91b5e27fa677a306c44e2adf927c6e40c360bfb2cd78cc7cf8073844844d1f212e6bdff57aa532847270e801d01900711b6c5140c8c53516307d90809c1
92e61ba95f build: Add missing schnorrsig_halfagg module configuration (mllwchrry)
Pull request description:
The `schnorrsig_halfagg` module was added in 3a9b1d46 but was never configured in the CMake build system. Additionally, the autotools configuration was missing the dependency error check when `schnorrsig` is explicitly disabled.
ACKs for top commit:
real-or-random:
ACK 92e61ba95f
Tree-SHA512: f3770f6ae6c91a6ef51b633d147d8156a6ae843b6cb430deef07e7b9e6ea5f0b02cb228dbb41954620ce5560252d5dde7d85ce4114789bd5fcdff195915382dd
4359f050cc surjection: Remove test that reads out of bounds (Tim Ruffing)
78999f3a9a surjection: Fix leading whitespace (Tim Ruffing)
229e1f127a surjection: Fix read of uninitialized value in tests (Tim Ruffing)
c0a26a9c1b ci: enable surjectionproof module in CI configs (copilot-swe-agent[bot])
Pull request description:
The CI workflow enabled the ZKP experimental module set but omitted surjectionproof, so that module was never exercised in those jobs. This change wires surjectionproof into the same CI paths as the other enabled ZKP modules.
- **CI module plumbing (`ci/ci.sh`)**
- Added `SURJECTIONPROOF` to the exported/printed CI env set.
- Passed `SURJECTIONPROOF` into configure via `--enable-module-surjectionproof`.
- **Workflow env defaults and matrices (`.github/workflows/ci.yml`)**
- Added a global default: `SURJECTIONPROOF: 'no'`.
- Added `SURJECTIONPROOF: 'yes'` in every job/matrix env block that already enables the ZKP module group (`RANGEPROOF`, `WHITELIST`, `GENERATOR`, etc.).
- **Representative wiring change**
```sh
--enable-module-rangeproof="$RANGEPROOF" \
--enable-module-surjectionproof="$SURJECTIONPROOF" \
--enable-module-whitelist="$WHITELIST"
```
<!-- START COPILOT ORIGINAL PROMPT -->
<details>
<summary>Original prompt</summary>
>
> ----
>
> *This section details on the original issue you should resolve*
>
> <issue_title>ci: surjectionproof module is never enabled</issue_title>
> <issue_description>There's not even a SURJECTIONPROOF env variable in the GitHub Actions workflow... This should be enabled everywhere where the other ZKP modules are enabled.
>
> It may be better to enable all modules by default, but that's a change that could potentially benefit even upstream, so maybe let's first just fix this by enabling surjectionproof.</issue_description>
>
> <agent_instructions>Only add enabling of the surjectionproof module (no enabling of all modules by default)</agent_instructions>
>
> ## Comments on the Issue (you are @copilot in this section)
>
> <comments>
> </comments>
>
</details>
<!-- START COPILOT CODING AGENT SUFFIX -->
- FixesBlockstreamResearch/secp256k1-zkp#334
ACKs for top commit:
mllwchrry:
ACK 4359f05
Tree-SHA512: 13d776a76f73db6e74ca253099583da3d2600f424ea1f6bcbc9cd12544721477225a4190ffd34f4f1a77ab3b1d1e21d1f6d83409aa969bafe66a7978bef1b2d2
656c7cc704 sync-upstream: Clarify that we merge a *single* upstream ref (Tim Ruffing)
349a94b169 sync-upstream: Remove "select" mode and simplify (Tim Ruffing)
Pull request description:
Please see individual commit messages for details.
---
Here's an example session that shows why `select` doesn't make sense:
```
### Let's find some PRs to sync (master is at 5a67b63)
❯ ./contrib/sync-upstream.sh -b master range
Merging b9cb1cbf1aafe151 . Continue with y
n
### Let's look at them in the order they have been merged
❯ git show b9cb1cbf
commit b9cb1cbfd7
Merge: c0a2aba0921b9711
Author: merge-script <me@real-or-random.org>
Date: Tue Mar 3 15:31:46 2026 +0100
Merge bitcoin-core/secp256k1#1824: util: introduce and use `ARRAY_SIZE` macro
[...]
❯ git --no-pager show 1aafe151
commit 1aafe15139 (upstream/master, upstream/HEAD)
Merge: b9cb1cbf4d92a083
Author: merge-script <me@real-or-random.org>
Date: Wed Mar 4 08:43:07 2026 +0100
Merge bitcoin-core/secp256k1#1777: Make SHA256 compression runtime pluggable
[...]
### Let's assume I want to cherry-pick 1aafe151 but not sync b9cb1bcf
❯ ./contrib/sync-upstream.sh -b master select 1aafe151
-----------------------------------
Upstream PRs 1777
-----------------------------------
[bitcoin-core/secp256k1#1777]: Make SHA256 compression runtime pluggable
This PR can be recreated with `./contrib/sync-upstream.sh -b master select 1aafe151`.
[...]
### Let's check if it's really only PR #1777
❯ git diff | grep ARRAY_SIZE
+ #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
### Ah damn, we also got the other PR #1824...
```
ACKs for top commit:
mllwchrry:
ACK 656c7cc
jonasnick:
ACK 656c7cc704
Tree-SHA512: 27cdfe7c6decce840ef4f2d12fa0a5fd829b35ac24403272c4b34c0a3b0da2303cee36bcb419d0608c6b1297fd5bf8a6cd6d41672850ac092814c140638f9d83
ed985641f4 ecdsa_adaptor: Make arg order in dleq_{prove,verify} consistent (Tim Ruffing)
a7d0f246d7 ecdsa_adaptor: Simplify code (Tim Ruffing)
41a8a2a65b ecdsa_adaptor: Clarify identifiers (Tim Ruffing)
7f1c5390c2 ecdsa_adaptor: Make files more self-contained (Tim Ruffing)
dd8db2ea2b ecdsa_adaptor: Run tests with default and overflowing nonce function (Tim Ruffing)
a4af91d5b9 ecdsa_adaptor: Add test case for R1==infinity in DLEQ proof (Tim Ruffing)
Pull request description:
This module could get some more love, but I don't think it's a priority.
Closes#335.
ACKs for top commit:
mllwchrry:
ACK ed98564
Tree-SHA512: f742e2c9536f711866a1e0c614a780866d72fdd7d721c816eaec16fa7fc67c141577c604b4d76928fb0d1ec9ad5577c2460724d5b3a919b5110490c1c5488f88
Roughly speaking, this changes (assuming 3 upstream PRs)
git merge <upstream-commit1> <upstream-commit-2> <upstream-commit3>
into
git merge <upstream-commit3>
This is more intuitive. We're merging a single upstream revision, namely
<upstream-commit3>. The other two commits are simply parents of that one,
i.e., they're included anyway, and git merge ignores them.
(In fact, passing multiple refs looks like we're doing an octopus
merge. It's just that git recognizes the fact that everything is included
in the last ref anyway, and behaves as if only the last one had been passed.)
This commit also makes some further clean ups and improvements.
I believe it was introduced to cherry-pick upstream PRs, but that simply
doesn't work. Assume upstream is two PRs A and B ahead, and A has been
merged before B. Then trying to cherry-picking B by merging the state of
upstream's master after the merge-B commit won't do what we expect. In
particular, the merge result will *include A's changes* because A had
already been merged in upstream's master when B was merged.
(One could think that merging the PR branch of B instead works, but this
will yield the same result if B was rebased on master before it was
merged.)
The proper way to cherry-pick B is to create a PR that cherry-picks all
commits that had been included in B. This could be done automatically,
but the need to cherry-pick a PR is rare enough that we don't need tool
support for it. In fact, because we want to keep cherry-picking at a
minimum, there's a good chance that we'd anyway want to pick only a
subset of the commits in a upstream PR, and that would need manual work
anyway.
48cbd78dfc modules: Port bitcoin-core/secp256k1#1825 to zkp-specific code (mllwchrry)
126501f58b modules: Port bitcoin-core/secp256k1#1815 to zkp-specific code (mllwchrry)
c49c9be504 bench: Update help functions in bench and bench_internal (kevkevinpal)
8d0eda07e9 testrand: Remove testrand_finish (Tim Ruffing)
f48b1bfa5d hash: add midstate initializer and use it for tagged hashes (w0xlt)
79e9f25237 ci: Fix leftover use of old ECMULTGENPRECISION (Tim Ruffing)
76e92cfeea Revert "ci, docker: Fix LLVM repository signature failure" (Hennadii Stepanov)
8354618e02 cmake: Set `LABELS` property for tests (Hennadii Stepanov)
29f26ec3cf cmake: Integrate DiscoverTests and normalize test names (Hennadii Stepanov)
f95b263f23 cmake: Add DiscoverTests module (Hennadii Stepanov)
4ac651144b cmake, refactor: Deduplicate test-related code (Hennadii Stepanov)
b99a94c382 Add tests for bad scalar inputs in ellswift XDH (gzJx0DuTRHytnHe7P5RmMbPf3wKy2BztweVGXTf)
307b49f1b9 ellswift: fix overflow flag handling in secp256k1_ellswift_xdh (gzJx0DuTRHytnHe7P5RmMbPf3wKy2BztweVGXTf)
ed02466d3f ci: Load Docker image by ID from builder step (Hennadii Stepanov)
f47bbc07f0 test: add unit tests for secp256k1_scalar_check_overflow (Rohit Yadav)
97b3c47849 refactor: remove unnecessary `malloc` result casts (Sebastian Falbesoner)
3ae72e7867 ci: Disable Docker build summary generation (Hennadii Stepanov)
4fb7ccf5d4 ci: Enforce base-10 evaluation (Hennadii Stepanov)
1bc74a22f8 test: show both Autotools and CMake usage for ctime_tests (8144225309)
86cae58d2f build: Add `-Wleading-whitespace=spaces` compiler flag (Hennadii Stepanov)
fb229e7602 build: Add `-Wtrailing-whitespace=any` compiler flag (Hennadii Stepanov)
13e3bee504 refactor: Remove trailing whitespace (Hennadii Stepanov)
2ccff6eb73 ci: Add weekly schedule (Hennadii Stepanov)
2f18567d24 ci: Rotate Docker cache keys every 4 weeks (Hennadii Stepanov)
0ffb1749a5 ci, docker: Fix LLVM repository signature failure (Hennadii Stepanov)
0267b65512 release process: mention the `[Unreleased]` link clearly (Jonas Nick)
748c0fdd67 Add CMake build directory patterns to `.gitignore` (Hennadii Stepanov)
7eb86bdb01 autotools: Rename `build-aux` to `autotools-aux` (Hennadii Stepanov)
47eb70959a ecmult: Use size_t for array indices in _odd_multiplies_table (Tim Ruffing)
bb1d199de5 ecmult: Use size_t for array indices into tables (Tim Ruffing)
Pull request description:
Merge bitcoin-core/secp256k1#1794: ecmult: Use size_t for array indices
Merge bitcoin-core/secp256k1#1775: Add CMake build directory patterns to `.gitignore`
Merge bitcoin-core/secp256k1#1814: release process: mention the `[Unreleased]` link clearly
Merge bitcoin-core/secp256k1#1816: ci: Rotate Docker cache keys
Merge bitcoin-core/secp256k1#1813: Remove trailing spaces and introduce `-Wtrailing-whitespace=any` compiler flag
Merge bitcoin-core/secp256k1#1804: test: show both CMake and Autotools usage for ctime_tests
Merge bitcoin-core/secp256k1#1818: ci: Enforce base-10 evaluation
Merge bitcoin-core/secp256k1#1817: ci: Disable Docker build summary generation
Merge bitcoin-core/secp256k1#1815: refactor: remove unnecessary `malloc` result casts
Merge bitcoin-core/secp256k1#1819: tests: Improve secp256k1_scalar_check_overflow tests (Issue #1812)
Merge bitcoin-core/secp256k1#1823: ci: Load Docker image by ID from builder step
Merge bitcoin-core/secp256k1#1821: ellswift: fix overflow flag handling in secp256k1_ellswift_xdh
Merge bitcoin-core/secp256k1#1760: cmake: Add dynamic test discovery to improve parallelism
Merge bitcoin-core/secp256k1#1828: Revert "ci, docker: Fix LLVM repository signature failure"
Merge bitcoin-core/secp256k1#1829: ci: Fix leftover use of old ECMULTGENPRECISION
Merge bitcoin-core/secp256k1#1825: hash: remove redundant `secp256k1_sha256_initialize` in tagged hash midstate functions
Merge bitcoin-core/secp256k1#1832: testrand: Remove testrand_finish
Merge bitcoin-core/secp256k1#1811: bench: Update help functions in bench and bench_internal
This PR can be recreated with `./contrib/sync-upstream.sh -b master range c0a2aba0`.
Tips:
* Use `git show --remerge-diff <pr-branch>` to show the conflict resolution in the merge commit.
* Use `git read-tree --reset -u <pr-branch>` to replay these resolutions during the conflict resolution stage when recreating the PR branch locally.
Be aware that this may discard your index as well as the uncommitted changes and untracked files in your worktree.
ACKs for top commit:
real-or-random:
ACK 48cbd78dfc
Tree-SHA512: 1ea96bf3b7458c02bb472ca7423eb21defe6640ea58a993ac24603d6a8d44ac9bbeab7e2ca5f993918fa1388b9e69b308dcc67277afffd55cb833ecf07051c75
dc0bda5731 bench: Port bitcoin-core/secp256k1#1796 to zkp-specific code (mllwchrry)
fe48cc9fa5 generator: Port bitcoin-core/secp256k1#1764 to zkp-specific code (mllwchrry)
d111d31293 generator: Port bitcoin-core/secp256k1#1779 to zkp-specific code (mllwchrry)
d8e87e45f3 unit_test: bump MAX_ARGS from 150 to 200 (mllwchrry)
2542b43451 modules: Port bitcoin-core/secp256k1#1774 to zkp-specific code (mllwchrry)
ae7eb729c0 release cleanup: bump version after 0.7.1 (Jonas Nick)
20a209f11c release: prepare for 0.7.1 (Jonas Nick)
c4b6a81a60 changelog: update in preparation for the v0.7.1 release (Jonas Nick)
c09215f7af bench: fail early if user inputs invalid value for SECP256K1_BENCH_ITERS (kevkevinpal)
29ac4d8491 sage: verify Eisenstein integer connection for GLV constants (Justsomebuddy)
bd5ced1fe1 doc/bench: added help text for SECP256K1_BENCH_ITERS env var for bench_ecmult (kevkevinpal)
2f73e5281d group: Avoid using infinity field directly in other modules (Tim Ruffing)
0406cfc4d1 doc: include arg -DUSE_EXTERNAL_DEFAULT_CALLBACKS=1 for cmake (kevkevinpal)
ae00c552df Add VERIFY_CHECKs that flags are 0 or 1 (John Moffett)
3b5b03f301 doc/bench: Added cmake build options to bench error messages (kevkevinpal)
d822b29021 test: split monolithic ellswift test into independent cases (furszy)
3daab83a60 refactor: remove ret from secp256k1_ec_pubkey_serialize (kevkevinpal)
8bcda186d2 test: Add non-NULL checks for "pointer of array" API functions (Sebastian Falbesoner)
5a08c1bcdc Add ARG_CHECKs to ensure "array of pointers" elements are non-NULL (Sebastian Falbesoner)
f5e815f430 remove secp256k1_eckey_pubkey_serialize function (Sebastian Falbesoner)
0d3659c547 use new `_eckey_pubkey_serialize{33,65}` functions in modules (ellswift,musig) (Sebastian Falbesoner)
adb76f82ea use new `_eckey_pubkey_serialize{33,65}` functions in public API (Sebastian Falbesoner)
fc7458ca3e introduce `secp256k1_eckey_pubkey_serialize{33,65}` functions (Sebastian Falbesoner)
26166c4f5f ecmult_multi: reduce strauss memory usage by 30% (Jonas Nick)
f252da7e6e ci: Use Python virtual environment in "x86_64-macos-native" job (Hennadii Stepanov)
153eea20c2 bench: Use `ALIGNMENT` macro instead of hardcoded value (Hennadii Stepanov)
Pull request description:
Merge bitcoin-core/secp256k1#1763: bench: Use `ALIGNMENT` macro instead of hardcoded value
Merge bitcoin-core/secp256k1#1771: ci: Use Python virtual environment in "x86_64-macos-native" job
Merge bitcoin-core/secp256k1#1761: ecmult_multi: reduce strauss memory usage by 30%
Merge bitcoin-core/secp256k1#1774: refactor: split up internal pubkey serialization function into compressed/uncompressed variants
Merge bitcoin-core/secp256k1#1779: Add ARG_CHECKs to ensure "array of pointers" elements are non-NULL
Merge bitcoin-core/secp256k1#1784: refactor: remove ret from secp256k1_ec_pubkey_serialize
Merge bitcoin-core/secp256k1#1788: test: split monolithic ellswift test into independent cases
Merge bitcoin-core/secp256k1#1778: doc/bench: Added cmake build options to bench error messages
Merge bitcoin-core/secp256k1#1783: Add VERIFY_CHECKs and documentation that flags must be 0 or 1
Merge bitcoin-core/secp256k1#1790: doc: include arg -DSECP256K1_USE_EXTERNAL_DEFAULT_CALLBACKS=ON for cmake
Merge bitcoin-core/secp256k1#1764: group: Avoid using infinity field directly in other modules
Merge bitcoin-core/secp256k1#1793: doc/bench: added help text for SECP256K1_BENCH_ITERS env var for bench_ecmult
Merge bitcoin-core/secp256k1#1800: sage: verify Eisenstein integer connection for GLV constants
Merge bitcoin-core/secp256k1#1796: bench: fail early if user inputs invalid value for SECP256K1_BENCH_ITERS
Merge bitcoin-core/secp256k1#1808: Prepare for 0.7.1
Merge bitcoin-core/secp256k1#1809: release cleanup: bump version after 0.7.1
This PR can be recreated with `./contrib/sync-upstream.sh -b master range c7a52400`.
Tips:
* Use `git show --remerge-diff <pr-branch>` to show the conflict resolution in the merge commit.
* Use `git read-tree --reset -u <pr-branch>` to replay these resolutions during the conflict resolution stage when recreating the PR branch locally.
Be aware that this may discard your index as well as the uncommitted changes and untracked files in your worktree.
ACKs for top commit:
real-or-random:
ACK dc0bda5731
Tree-SHA512: a816729a8d3ce199154a1b670172f4639b03812071fd78db8e23dfad9a88a2fef882f30c9f34e1151ad79b85201fbb7eba890a572d68bb45ca8fb05496bc34e8
c49c9be504 bench: Update help functions in bench and bench_internal (kevkevinpal)
Pull request description:
### Motivation
This change is motivated by https://github.com/bitcoin-core/secp256k1/pull/1793#pullrequestreview-3644885897
> While aligning implementation across all benchmarks, argv could be passed to the help() in bench.c and bench_internal.c.
### Description
In the `bench` and `bench_internal` `help` functions `argv` was not being passed. In this change, we pass in argv and use it in the help text.
ACKs for top commit:
real-or-random:
ACK c49c9be504
Tree-SHA512: 77184db4bf5c16827f19d888af73939f4139cc2e84ae5256d995cf61f606d5865928480fc009a0185e1a6843f3c38dd1b858d1316e524c9b165459c7367f2318
8d0eda07e9 testrand: Remove testrand_finish (Tim Ruffing)
Pull request description:
This removes printing of the "random run = " at the end of the tests. I haven't seen a single case where this proved to be useful. And as of 48789dafc2, this is anyway printed only at the end of the exhaustive tests and not the normal tests, so the probability that this will be useful in the future is very low.
ACKs for top commit:
sipa:
ACK 8d0eda07e9
Tree-SHA512: e0a688e2c81afbf7a11204f1be71b472eb3ec23086c7dc742a069b7ddfc837fcf9ade9e04f8c3f79e8b07d38d05bf4979f6e3ca68a480e45de0c1ecb94b0a6f5
6f7c112cc8 include: add description of range proofs focusing on the differences between the implementation and the CA paper (Mykyta)
Pull request description:
Added the description of range proofs in Confidential Assets focusing on the differences between the description in the paper and the actual implementation.
ACKs for top commit:
real-or-random:
ACK 6f7c112cc8
Tree-SHA512: c8568883648d6d1f0cbbe9a9730b08512665a90106b974733eecfc3dc628361ff54785c67c355216157af5a63b7fefa52d49df400ccaeec9cbf14d40a600707f
This removes printing of the "random run = " at the end of the tests. I
haven't seen a single case where this proved to be useful. And as of
48789dafc2, this is anyway printed only at
the end of the exhaustive tests and not the normal tests, so the
probability that this will be useful in the future is very low.
3f7a9429ad ecdsa_adaptor: batch affine conversion in dleq_pair and dleq_prove (mllwchrry)
d380549e38 ecdsa_adaptor: optimize encrypt with batch affine conversion (mllwchrry)
Pull request description:
Replace pairs of `secp256k1_ge_set_gej` calls with single `secp256k1_ge_set_all_gej[_var]` calls, saving one expensive field inversion per operation.
`secp256k1_ecdsa_adaptor_encrypt`:
- Batch convert nonce points `R'` and `R` using `secp256k1_ge_set_all_gej`.
- Add early `enckey` validation: `secp256k1_ge_set_all_gej` requires non-infinity inputs, but invalid `enckey` could cause `secp256k1_ecmult_const` to produce infinity.
- Add early return when `secp256k1_dleq_prove` fails.
`secp256k1_dleq_pair`:
- Batch convert points `p[0]` and `p[1]` using `secp256k1_ge_set_all_gej`.
`secp256k1_dleq_prove`:
- Add early return with `secp256k1_declassify` when nonce generation fails, ensuring the nonce `k` passed to `secp256k1_dleq_pair` is always non-zero (required by `secp256k1_ge_set_all_gej`).
`secp256k1_dleq_verify`:
- Batch convert using variable-time `secp256k1_ge_set_all_gej_var` (already uses variable-time operations, processes public data).
ACKs for top commit:
real-or-random:
ACK 3f7a9429ad
Tree-SHA512: 706ab9df439f0803d1ec0181caf94a6f480f8e2c9337eae966c6b7a94b5c3ad14e71fc1a223a7d0f2b8d6db0c46a059b83712adff1d74e2d63ac3fc915234698
7111d365fb modules, tests: Port bitcoin-core/secp256k1#1734 to zkp-specific code (DarkWindman)
7699fe9aa6 modules: Port bitcoin-core/secp256k1#1735 to zkp-specific code (DarkWindman)
c09519f0e3 ci: Drop workaround for Valgrind older than 3.20.0 (Hennadii Stepanov)
8bc50b72ff ci: Switch to macOS 15 Sequoia Intel-based image (Hennadii Stepanov)
2f4546ce56 test: add --log option to display tests execution (furszy)
95b9953ea4 test: Add option to display all available tests (furszy)
953f7b0088 test: support running specific tests/modules targets (furszy)
0302c1a3d7 test: add --help for command-line options (furszy)
9ec3bfe22d test: adapt modules to the new test infrastructure (furszy)
48789dafc2 test: introduce (mini) unit test framework (furszy)
9cce703863 refactor: move 'gettime_i64()' to tests_common.h (furszy)
15d014804e ci: Drop default for `inputs.command` in `run-in-docker-action` (Hennadii Stepanov)
1decc49a1f ci: Use YAML anchor and aliases for repeated "CI script" steps (Hennadii Stepanov)
dff1bc107d ci, refactor: Generalize use of `matrix.configuration.env_vars` (Hennadii Stepanov)
4b644da199 ci: Use YAML anchor and aliases for repeated "Print logs" steps (Hennadii Stepanov)
a889cd93df ci: Bump `actions/checkout` version (Hennadii Stepanov)
574c2f3080 ci: Use YAML anchor and aliases for repeated "Checkout" steps (Hennadii Stepanov)
53585f93b7 ci: Use clang-snapshot in "MSan" job (Hennadii Stepanov)
6894c964f3 Fix Clang 21+ `-Wuninitialized-const-pointer` warning when using MSan (Hennadii Stepanov)
f163c35897 ci: Set `DEBIAN_FRONTEND=noninteractive` (Hennadii Stepanov)
70ae177ca0 ci: Bump `docker/build-push-action` version (Hennadii Stepanov)
b2a95a420f ci: Drop `tags` input for `docker/build-push-action` (Hennadii Stepanov)
122014edb3 ci: Add `scope` parameter to `cache-{to,from}` options (Hennadii Stepanov)
4d90585fea docs: Improve API docs of _context_set_illegal_callback (Tim Ruffing)
895f53d1cf docs: Clarify that callback can be called more than once (Tim Ruffing)
dfe284ed2d bench: improve context creation in ECDH benchmark (Sebastian Falbesoner)
ab560078aa build: Fix warnings in x86_64 assembly check (Hennadii Stepanov)
7321bdf27b doc: clarify API doc of `secp256k1_ecdsa_recover` return value (Jonas Nick)
0c91c56041 test: introduce group order byte-array constant for deduplication (Sebastian Falbesoner)
399b582a5f Split memclear into two versions (John Moffett)
Pull request description:
Merge bitcoin-core/secp256k1#1735: musig: Invalidate secnonce in secp256k1_musig_partial_sign
Merge bitcoin-core/secp256k1#1745: test: introduce group order byte-array constant for deduplication
Merge bitcoin-core/secp256k1#1741: doc: clarify API doc of `secp256k1_ecdsa_recover` return value
Merge bitcoin-core/secp256k1#1749: build: Fix warnings in x86_64 assembly check
Merge bitcoin-core/secp256k1#1748: bench: improve context creation in ECDH benchmark
Merge bitcoin-core/secp256k1#1727: docs: Clarify that callback can be called more than once
Merge bitcoin-core/secp256k1#1756: ci: Fix image caching and apply other improvements
Merge bitcoin-core/secp256k1#1750: ci: Use clang-snapshot in "MSan" job
Merge bitcoin-core/secp256k1#1719: ci: DRY workflow using anchors
Merge bitcoin-core/secp256k1#1734: Introduce (mini) unit test framework
Merge bitcoin-core/secp256k1#1759: ci: Switch to macOS 15 Sequoia Intel-based image
Merge bitcoin-core/secp256k1#1758: ci: Drop workaround for Valgrind older than 3.20.0
This PR can be recreated with `./contrib/sync-upstream.sh -b master range 7a2fff8`.
Tips:
* Use `git show --remerge-diff <pr-branch>` to show the conflict resolution in the merge commit.
* Use `git read-tree --reset -u <pr-branch>` to replay these resolutions during the conflict resolution stage when recreating the PR branch locally.
Be aware that this may discard your index as well as the uncommitted changes and untracked files in your worktree.
ACKs for top commit:
real-or-random:
ACK 7111d365fb
Tree-SHA512: 9f8fd21eee9ad3b7ea8d688f79783a43baffdeafb6b313372761ce368a24219a83c430c49070413f9972813ae03adde9a8660abfe4b0893b3700e241a81e5b13
f48b1bfa5d hash: add midstate initializer and use it for tagged hashes (w0xlt)
Pull request description:
Each tagged hash midstate function (e.g., `secp256k1_schnorrsig_sha256_tagged`) calls `secp256k1_sha256_initialize` before immediately overwriting every field it sets: `s[0]` through `s[7]` and `bytes`. The `buf[64]` member does not need initialization either, because `bytes` is set to 64, which means the buffer position (`bytes & 0x3F`) (`= bytes % 64`) is 0, so buf is always written before being read.
Remove the 11 redundant `secp256k1_sha256_initialize` calls across the `schnorrsig`, `ellswift`, and `musig` modules.
ACKs for top commit:
real-or-random:
utACK f48b1bfa5d
theStack:
Code-review ACK f48b1bfa5d
Tree-SHA512: 769beb96f3921cc3c180ed0d17484ffa0dc78041c889a8e56603679d8eaca5fe13e63759ada78f83d8e0ff7aae392e6bcbc1a9fe8b959105ea4a3d8ef51abf15
Introduce secp256k1_sha256_initialize_midstate() in the hash layer and use it at all tagged-hash midstate call sites across schnorrsig, musig, and ellswift.
Document the byte-counter contract at the declaration site in hash.h and add run_sha256_initialize_midstate_tests() to directly verify helper behavior against initialize_tagged.
Also switch the helper to take const uint32_t state[8] to reduce argument-order risk at call sites.
01b1b916eb modules: Port bitcoin-core/secp256k1#1725 to zkp-specific code (DarkWindman)
7ebaa134a7 check-abi: remove support for obsolete CMake library output location (src/libsecp256k1.so) (Sebastian Falbesoner)
806de38bfc doc: mention ctx requirement for `_ellswift_create` (not secp256k1_context_static) (Sebastian Falbesoner)
737912430d ci: Add more tests for clang-cl (Hennadii Stepanov)
7379a5bed3 doc: Recommend clang-cl when building on Windows (Hennadii Stepanov)
325d65a8cf Rename and clear var containing k or -k (John Moffett)
960ba5f9c6 Use size_t instead of int for RFC6979 outlen copy (John Moffett)
5153cf1c91 tests: refactor tagged hash tests (josibake)
489a43d1bf docs: fix broken link to eprint cache.pdf paper (VolodymyrBg)
0458def51e doc: Add `--gcov-ignore-parse-errors=all` option to `gcovr` invocations (Hennadii Stepanov)
1aecce5936 doc: Add `--merge-mode-functions=separate` option to `gcovr` invocations (Hennadii Stepanov)
106a7cbf41 doc: Exclude modules' `bench_impl.h` headers from coverage report (Hennadii Stepanov)
a9e955d3ea autotools, docs: Adjust help string for `--enable-coverage` option (Hennadii Stepanov)
24ba8ff168 chore(ci): Fix typo in Dockerfile comment (Maximilian Hubert)
c25c3c8a88 test: update wycheproof test vectors (josibake)
7b07b22957 cmake: Avoid contaminating parent project's cache with BUILD_SHARED_LIBS (Hennadii Stepanov)
5433648ca0 Fix typos and spellings (Adrien Ufferte)
9ea54c69b7 tests: update Wycheproof files (fanquake)
Pull request description:
Merge bitcoin-core/secp256k1#1711: tests: update Wycheproof
Merge bitcoin-core/secp256k1#1688: cmake: Avoid contaminating parent project's cache with `BUILD_SHARED_LIBS`
Merge bitcoin-core/secp256k1#1717: test: update wycheproof test vectors
Merge bitcoin-core/secp256k1#1720: chore(ci): Fix typo in Dockerfile comment
Merge bitcoin-core/secp256k1#1722: docs: Exclude modules' `bench_impl.h` headers from coverage report
Merge bitcoin-core/secp256k1#1726: docs: fix broken link to Tromer's cache.pdf paper
Merge bitcoin-core/secp256k1#1725: tests: refactor tagged hash verification
Merge bitcoin-core/secp256k1#1729: hash: Use size_t instead of int for RFC6979 outlen copy
Merge bitcoin-core/secp256k1#1731: schnorrsig: Securely clear buf containing k or its negation
Merge bitcoin-core/secp256k1#1681: doc: Recommend clang-cl when building on Windows
Merge bitcoin-core/secp256k1#1737: doc: mention ctx requirement for `_ellswift_create` (not secp256k1_context_static)
Merge bitcoin-core/secp256k1#1738: check-abi: remove support for obsolete CMake library output location (src/libsecp256k1.so)
This PR can be recreated with `./contrib/sync-upstream.sh -b master range 36e7695`.
Tips:
* Use `git show --remerge-diff <pr-branch>` to show the conflict resolution in the merge commit.
* Use `git read-tree --reset -u <pr-branch>` to replay these resolutions during the conflict resolution stage when recreating the PR branch locally.
Be aware that this may discard your index as well as the uncommitted changes and untracked files in your worktree.
ACKs for top commit:
real-or-random:
ACK 01b1b916eb
Tree-SHA512: 3d945e55313eb0afde66bd2064edd169854294f9e1e185e6199beec2a079f872cd3172d00e9c4da6cda25ccf296ddd3f205280076f94d009941eab4e319bcd0a
