Bitcoin Core

cmake: Skip using git when building from source tarball or as subproject

cmake: Remove unnecessary `BITCOIN_GENBUILD_NO_GIT` environment variable

This functionality is now covered by the `CMAKE_DISABLE_FIND_PACKAGE_Git`
variable.

Note for reviewers: consider reviewing with `git diff -w`.

cmake, refactor: Move `find_package(Git)` to `src/CMakeLists.txt`

This change allows the use of the `CMAKE_DISABLE_FIND_PACKAGE_Git`
variable to explicitly disable git usage.

fuzz: Fix txorphan timeout by limiting block weight

ci: Use path with spaces on windows as well

ci: Put space and non-ASCII char in scratch dir

Also, add a missing quote around -DCMAKE_INSTALL_PREFIX to avoid word
splitting.
Otherwise, cmake would warn:

```
+ cmake -S /home/runner/work/_temp -B /home/runner/work/_temp/build -DCMAKE_COMPILE_WARNING_AS_ERROR=ON -DBUILD_BENCH=ON -DBUILD_FUZZ_BINARY=ON -DCMAKE_INSTALL_PREFIX=/home/runner/work/_temp/ci/scratch_ ₿🧪_/out -Werror=dev --preset=dev-mode -DSANITIZERS=address,float-divide-by-zero,integer,undefined -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ -DCMAKE_C_FLAGS=-ftrivial-auto-var-init=pattern -DCMAKE_CXX_FLAGS=-ftrivial-auto-var-init=pattern -DCMAKE_EXE_LINKER_FLAGS=-fuse-ld=mold -DAPPEND_CXXFLAGS=-std=c++23 '-DAPPEND_CPPFLAGS=-DARENA_DEBUG -DDEBUG_LOCKORDER'
CMake Warning:
Ignoring extra path from command line:
"₿🧪_/out"
```

Also, allow spaces in the debug log file regex in a test.
Otherwise, the test would fail:

```
TestFramework (ERROR): Unexpected exception:
Traceback (most recent call last):
File "./test/functional/test_framework/test_framework.py", line 142, in main
self.run_test()
~~~~~~~~~~~~~^^
File "./test/functional/feature_logging.py", line 40, in run_test
self.nodes[0].assert_start_raises_init_error([f"-debuglogfile={invalidname}"], exp_stderr, match=ErrorMatch.FULL_REGEX)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "./test/functional/test_framework/test_node.py", line 743, in assert_start_raises_init_error
self._raise_assertion_error(
~~~~~~~~~~~~~~~~~~~~~~~~~~~^
'Expected message "{}" does not fully match stderr:\n"{}"'.format(expected_msg, stderr))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "./test/functional/test_framework/test_node.py", line 229, in _raise_assertion_error
raise AssertionError(self._node_msg(msg))
AssertionError: [node 0] Expected message "Error: Could not open debug log file \S+$" does not fully match stderr:
"Error: Could not open debug log file /Users/runner/work/bitcoin-core-with-ci/bitcoin-core-with-ci/repo_archive/ci/scratch_ ₿🧪_/test_runner/test_runner_₿_🏃_20260218_095938/feature_logging_31/node0/regtest/foo/foo.log"
```

Also, add missing quotes in a test. Otherwise, the test would fail:

```
455/455 - feature_notifications.py failed, Duration: 402 s
stdout:
TestFramework (INFO): Initializing test directory /home/runner/work/_temp/ci/scratch_ ₿🧪_/test_runner/test_runner_₿_🏃_20260218_113529/feature_notifications_128
TestFramework (INFO): test -blocknotify
TestFramework.utils (ERROR): wait_until() failed. Predicate: ''''
self.wait_until(lambda: len(os.listdir(self.blocknotify_dir)) == block_count, timeout=10)
'''

ci: Require $FILE_ENV

The ci fails when $FILE_ENV is not set, so fail early with a clearer
error message by setting nounset:

> bash: FILE_ENV: unbound variable

Remove opt-in RBF

Remove the option to signal or not signal for BIP 125 (Opt-in Full Replace-By-Fee).
By removing the option in the GUI it will fallback to the wallet configuration which by default is
true unless the user changed it using CLI.

doc: Document minimum versions for Xcode CLT and MSVC

test: Check that MuSig2 signing does not reuse nonces

Run each MuSig2 operation twice to check that new nonces are generated
and used throughout signing.

mining: only pad with OP_0 at heights <= 16

Drop the include_dummy_extranonce branch from the OP_0 padding
condition in CreateNewBlock(), so that the dummy extraNonce is
only appended when consensus actually requires it (heights <= 16,
where the BIP34 height push alone would yield a 1-byte scriptSig
and trigger bad-cb-length).

The include_dummy_extranonce option struct field is now unused by
the miner and is removed in the next commit. Callers still set it,
so that this commit compiles.

Regenerate the hardcoded coinbase / block hashes throughout the
unit and functional test suites and update the regtest assumeutxo
snapshot in chainparams.

Additional side-effects:

- Without the dummy extranonce, coinbase scriptSigs are 1 byte
shorter at heights > 16, making every block 1 byte smaller.
This shifts where block files wrap and therefore where pruning
boundaries land.

- feature_assumeutxo malleation cases:
- case 1: error message changes due to UTXO reordering, similar
to 8f2078af6a55448c003b3f7f3021955fbb351caa
- case 4: the corruption byte is swapped from \x82 to \x83
because \x82 happened to be the actual value at that
offset in the new snapshot.

mining: drop unused include_dummy_extranonce option

The previous commit made CreateNewBlock() ignore the
include_dummy_extranonce flag (OP_0 is now appended only at heights
<= 16 to satisfy bad-cb-length, regardless of caller-supplied options).

Remove the now-unused field from BlockCreateOptions and clean up all
the call sites that still set it (RPC, bench, fuzz, test setups).

mining: pad coinbase to fix createNewBlock at heights <=16

Since #32420, createNewBlock has thrown `bad-cb-length` errors when called at
low block heights because `OP_0` padding stopped being added to coinbase
transactions. (#32420 did add an `include_dummy_extranonce` option which could
bypass this, but it was not exposed to IPC clients.) Fix the problem by padding
coinbase transactions with `OP_0` when necessary to produce valid blocks.

Additionally this commit stops adding `OP_0` padding to the template
`script_sig_prefix` field when `include_dummy_extranonce` is true. This is safe
because non-IPC clients don't use this field, and IPC clients could never set
the option to true, and are expected to add their own nonces in any case.

This also improves documentation about the `script_sig_prefix` field and
`getCoinbaseTx` method.

fuzz: use ImmediateBackgroundTaskRunner to silence DEBUG_LOCKORDER

DEBUG_LOCKORDER was reporting a false positive deadlock with the
cmpctblock fuzz harness when using ImmediateTaskRunner. Since it is
single-threaded, ImmediateTaskRunner callbacks added LockOrders that
could never happen outside of a fuzz test.

First a block would get connected:
* LOCK(mempool.cs)
* BlockConnected (fuzz test runs in same thread)
* LOCK(m_tx_download_mutex)

Then a later iteration of the LIMITED_WHILE would send a TX:
* LOCK(m_tx_download_mutex)
* LOCK(mempool.cs)

causing a false positive deadlock. Normally, the BlockConnected
callback would run in a different thread and no deadlock is reported.

Fix this by launching a thread that runs the callback and is
immediately joined.

doc: mention -DWITH_ZMQ=ON in BSD build guides

The FreeBSD, NetBSD, and OpenBSD build guides state that ZMQ support is compiled in when the package is installed. Since WITH_ZMQ defaults to OFF, update the wording to mention the required CMake option.

test: bad-cb-length for createNewBlock() at low heights

On new regtest / signet chains (heights <= 16), createBlock() fails
internally with bad-cb-length. Since mining.capnp does not expose
include_dummy_extranonce, IPC clients can't work around this.

Add a functional test to illustrate this issue and use RPC to
work around it. The next commit introduces a fix.

test: refactor IPC mining test to use script_BIP34_coinbase_height

Needed in a later commit to correctly derive the BIP34 prefix
for heights <= 16.

Add a padding parameter to script_BIP34_coinbase_height() that
controls whether the OP_0 dummy extranonce is appended for
heights <= 16.

Use this helper with padding=False in the IPC mining test's
build_coinbase_test().

refactor, key: move `CreateMuSig2PartialSig` to `musig.{h,cpp}` module

Compared to `CreateMuSig2Nonce`, creating a partial signature
has a stronger link to the secret key used, but for consistency
reasons it still makes sense to move all functionality that call
the secp256k1 musig API functions to the `musig.{h,cpp}` module
for consistency.

Can be reviewed via the git option `--color-moved=dimmed-zebra`.

refactor, key: move `CreateMuSig2Nonce` to `musig.{h,cpp}` module

Nonce creation is mainly derived by randomness, and the secret
key merely serves as (optional) additional data for increasing
misuse-resistance, rather than being a central part that would
justify an own CKey method, so move it to the musig.cpp module.

Can be reviewed via the git option `--color-moved=dimmed-zebra`.

key: add `GetSecp256k1SignContext` access function

This is needed in order to move the `CreateMuSig2{Nonce,PartialSig}`
functions to the musig.cpp modules, see next two commits.

doc: clarify libfuzzer-nosan preset uses build_fuzz_nosan dir

The fuzzing quickstart documents the libfuzzer preset with build_fuzz
as the build directory, then mentions libfuzzer-nosan as an alternative
without noting that this preset uses a different binary directory
(build_fuzz_nosan, per CMakePresets.json line 54). A reader following
the quickstart with --preset=libfuzzer-nosan and then running
'cmake --build build_fuzz' as shown will operate against the wrong
(or empty) directory.

Add a clarifying note at the first mention in the Quickstart.

psbt, test: remove address type restrictions in test

Because the corresponding Taproot fields were added in PSBT in PR 22558, so
these restrictions are no longer necessary.

refactor: Use ignore-list over verbose select-list

This refactor makes the ruff.toml easier to read, because it lists the
ignored checks instead of having to enumerate all checks to select in a
large collection of rules.

wallet: use outpoint when estimating input size

`CalculateMaximumSignedInputSize()` is passed the outpoint being sized, but that context was not used when estimating the signed input size.
Pass the outpoint through so externally selected inputs are not underestimated.

Co-authored-by: Antoine Poinsot <darosior@protonmail.com>

ci: Enable ruff ambiguous-unicode-character checks