Bitcoin Core

lint: pass args from lint.py to cargo run in container

lint: upgrade lint scripts for worktrees

Add a ci/lint.py script to run the linter both locally or inside the CI
(replacing .github/ci-lint-exec.py) which supports running from a
worktree.

Determines whether we are in a worktree, and mounts the real `.git`
directory as a read-only volume if we are.

log: Print warning about privacy-sensitive log info unconditionally

Also, fix whitespace in this function, while touching it. Can be
reviewed via the git option
--ignore-all-space

Squashed 'src/secp256k1/' changes from d543c0d917..14e56970cb

14e56970cb Merge bitcoin-core/secp256k1#1794: ecmult: Use size_t for array indices
c7a52400d6 Merge bitcoin-core/secp256k1#1809: release cleanup: bump version after 0.7.1
ae7eb729c0 release cleanup: bump version after 0.7.1
1a53f4961f Merge bitcoin-core/secp256k1#1808: Prepare for 0.7.1
20a209f11c release: prepare for 0.7.1
c4b6a81a60 changelog: update in preparation for the v0.7.1 release
ebb35882da Merge bitcoin-core/secp256k1#1796: bench: fail early if user inputs invalid value for SECP256K1_BENCH_ITERS
c09215f7af bench: fail early if user inputs invalid value for SECP256K1_BENCH_ITERS
471e3a130d Merge bitcoin-core/secp256k1#1800: sage: verify Eisenstein integer connection for GLV constants
29ac4d8491 sage: verify Eisenstein integer connection for GLV constants
4721e077b4 Merge bitcoin-core/secp256k1#1793: doc/bench: added help text for SECP256K1_BENCH_ITERS env var for bench_ecmult
bd5ced1fe1 doc/bench: added help text for SECP256K1_BENCH_ITERS env var for bench_ecmult
47eb70959a ecmult: Use size_t for array indices in _odd_multiplies_table
bb1d199de5 ecmult: Use size_t for array indices into tables
2d9137ce9d Merge bitcoin-core/secp256k1#1764: group: Avoid using infinity field directly in other modules
f9a944ff2d Merge bitcoin-core/secp256k1#1790: doc: include arg -DSECP256K1_USE_EXTERNAL_DEFAULT_CALLBACKS=ON for cmake
0406cfc4d1 doc: include arg -DUSE_EXTERNAL_DEFAULT_CALLBACKS=1 for cmake
8d445730ec Merge bitcoin-core/secp256k1#1783: Add VERIFY_CHECKs and documentation that flags must be 0 or 1
aa2a39c1a7 Merge bitcoin-core/secp256k1#1778: doc/bench: Added cmake build options to bench error messages
540fec8ae9 Merge bitcoin-core/secp256k1#1788: test: split monolithic ellswift test into independent cases
d822b29021 test: split monolithic ellswift test into independent cases
ae00c552df Add VERIFY_CHECKs that flags are 0 or 1
5c75183344 Merge bitcoin-core/secp256k1#1784: refactor: remove ret from secp256k1_ec_pubkey_serialize
be5e4f02fd Merge bitcoin-core/secp256k1#1779: Add ARG_CHECKs to ensure "array of pointers" elements are non-NULL
3daab83a60 refactor: remove ret from secp256k1_ec_pubkey_serialize
8bcda186d2 test: Add non-NULL checks for "pointer of array" API functions
5a08c1bcdc Add ARG_CHECKs to ensure "array of pointers" elements are non-NULL
3b5b03f301 doc/bench: Added cmake build options to bench error messages
e7f7083b53 Merge bitcoin-core/secp256k1#1774: refactor: split up internal pubkey serialization function into compressed/uncompressed variants
b6c2a3cd77 Merge bitcoin-core/secp256k1#1761: ecmult_multi: reduce strauss memory usage by 30%
f5e815f430 remove secp256k1_eckey_pubkey_serialize function
0d3659c547 use new `_eckey_pubkey_serialize{33,65}` functions in modules (ellswift,musig)
adb76f82ea use new `_eckey_pubkey_serialize{33,65}` functions in public API
fc7458ca3e introduce `secp256k1_eckey_pubkey_serialize{33,65}` functions
c8206b1ce6 Merge bitcoin-core/secp256k1#1771: ci: Use Python virtual environment in "x86_64-macos-native" job
f252da7e6e ci: Use Python virtual environment in "x86_64-macos-native" job
115b135fe8 Merge bitcoin-core/secp256k1#1763: bench: Use `ALIGNMENT` macro instead of hardcoded value
2f73e5281d group: Avoid using infinity field directly in other modules
153eea20c2 bench: Use `ALIGNMENT` macro instead of hardcoded value
26166c4f5f ecmult_multi: reduce strauss memory usage by 30%
7a2fff85e8 Merge bitcoin-core/secp256k1#1758: ci: Drop workaround for Valgrind older than 3.20.0
43e7b115f7 Merge bitcoin-core/secp256k1#1759: ci: Switch to macOS 15 Sequoia Intel-based image
8bc50b72ff ci: Switch to macOS 15 Sequoia Intel-based image
c09519f0e3 ci: Drop workaround for Valgrind older than 3.20.0

git-subtree-dir: src/secp256k1
git-subtree-split: 14e56970cba37ffe4ee992c1e08707a16e22e345

build: Remove outdated comment about -ffile-prefix-map

The -ffile-prefix-map option is no longer used and it seems fine to
remove the warning about it possibly breaking coverage builds.

If this needs documentation, the dev notes seem like a better place,
because it also affects other places, such as depends. C.f. commit
407062f2ac93624f350e9e8a4f641c882a2aaf2f

doc: Remove outdated -fdebug-prefix-map section in dev notes

The section claims to be for ccache builds, however those are already
fixed after commit 1cc58d3a0c653ac30df04d1010a3cf84c6bc307a.

If there are still any build or debug problems after that commit,
dedicated instructions can be added back, along with exact steps to
reproduce and test.

guix: documented shasum gathering command

test: use ModuleNotFoundError in interface_ipc.py

Change this so we catch the case where the capnp shared libs have been
updated, and can no-longer be loaded by the Python module, resulting in
a skipped test, even though pycapnp is installed. i.e:
```bash
stderr:
Traceback (most recent call last):
File "/root/ci_scratch/build/test/functional/interface_ipc.py", line 20, in <module>
import capnp # type: ignore[import] # noqa: F401
^^^^^^^^^^^^
File "/usr/local/lib64/python3.14/site-packages/capnp/__init__.py", line 36, in <module>
from .version import version as __version__
File "/usr/local/lib64/python3.14/site-packages/capnp/version.py", line 1, in <module>
from .lib.capnp import _CAPNP_VERSION_MAJOR as LIBCAPNP_VERSION_MAJOR # noqa: F401
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ImportError: libcapnpc.so.1.0.1: cannot open shared object file: No such file or directory
```

Failing in this way should make it clear that `pycapnp` needs to be
reinstalled/rebuilt.

If `pycapnp` is not installed, the test still skips as expected:
```bash
Remaining jobs: [interface_ipc.py]
1/1 - interface_ipc.py skipped (capnp module not available.)

TEST | STATUS | DURATION

interface_ipc.py | ○ Skipped | 0 s
```

Fixes: #34016.

Co-authored-by: Ryan Ofsky <ryan@ofsky.org>

wallet: fix removeprunedfunds bug with conflicting transactions

removeprunedfunds removes all entries from mapTxSpends for the
inputs of the pruned tx. However, this is incorrect, because there could be
multiple entries from conflicting transactions (that shouldn't be
removed as well). This could lead to the wallet creating invalid
transactions, trying to double spend utxos.
The bug persists when the conflicting tx was mined, because
the wallet trusts its internal accounting instead of calling
AddToSpends again.

test: Verify peer usage after assumeutxo validation completes

Add test coverage to ensure peers without the snapshot block in their chain can be used for block downloads after background validation completes. The test fails without the fix in the previous commit.

refactor: use transparent comparator for setBlockIndexCandidates lookups

This allows checking for existence in setBlockIndexCandidates using a const CBlockIndex* without casting away constness, replacing a legacy const_cast check in validation.cpp.

doc: fix invalid arg name hints for bugprone validation

The extra leading `=` or missing trailing `=` prevented clang-tidy's `bugprone-argument-comment` check from validating the parameter name, as it only matches comments formatted strictly as `/*arg=*/` (see https://clang.llvm.org/extra/clang-tidy/checks/bugprone/argument-comment.html).

fuzz: Return chrono point from ConsumeTime(), Add ConsumeDuration()

A chrono time point is a bit more type-safe than a raw i64.

Also, add a dedicated helper for plain chrono durations.

test: verify node state after restart in assumeutxo

Replace the TODO comment in wallet_assumeutxo.py with actual test
assertions that verify node and wallet behavior after a restart
during assumeutxo background sync.

The new tests verify:
- Two chainstates exist (background validation not complete)
- Background chainstate is still at START_HEIGHT
- Snapshot chainstate has synced to at least PAUSE_HEIGHT
- Wallets cannot be loaded after restart (expected behavior during
background sync because blocks before snapshot are unavailable
for rescanning)
- Wallet backup from before snapshot height cannot be restored

This documents the expected behavior that wallets cannot be loaded
after a node restart during assumeutxo background sync, which is
an important edge case for users to be aware of.

refs #28648

subprocess: Fix `-Wunused-private-field` for `Child` class on Windows

When compiling with clang-cl on Windows, `src/util/subprocess.h` emits
`-Wunused-private-field` warnings about unused private fields in the
`Child` class.

subprocess: Fix `-Wunused-private-field` for `Popen` class on Windows

When compiling with clang-cl on Windows, `src/util/subprocess.h` emits
`-Wunused-private-field` warnings about unused private fields in the
`Popen` class.

doc: Explain that low-effort pull requests may be closed

test: allow overriding tar in get_previous_releases

Facilitate use on distros that might have 'tar' as something else, such
as 'gtar', i.e Chimera.

wallet, test: update `gethdkeys` functional test

Update the `test_ranged_multisig` test case to verify the partial
xprv fix in the `gethdkeys` RPC. Also, update some existing variable
names.

wallet: fix `gethdkeys` RPC for descriptors with partial xprvs

A non-watch-only wallet allows to import descriptors with partial
private keys, eg: a multisig descriptor with one private key and
one public key. In case an xpub is imported in any such descriptors
whose private key the wallet doesn't have, then the `gethdkeys` RPC
throws an unhandled error like below when the private keys are
requested.

This fix ensures that such calls are properly handled by conditionally
finding the corresponding xprv. Some related documentation of this RPC
is also updated.

```
➜ bitcoincli -named gethdkeys private=true
error code: -1
error message:
map::at: key not found
```

Remove unused epochguard.h

Rework CTxMemPool::GetChildren() to not use epochs

This is likely slightly slower, but this was the last place we were using
epochs instead of sets to deduplicate, and this is only used by the RPC code
and in tests, and should not be CPU-performance critical. Eliminating this
allows us to save 8 bytes in CTxMemPoolEntry.

Co-Authored-By: Pieter Wuille <bitcoin-dev@wuille.net>

scripted-diff: refactor: CWallet::Create() -> CreateNew()

Aside from being more legible, changing the name of `CWallet::Create()`
also validates that every instance where a new wallet is `Create()`'ed
is handled in this branch.

-BEGIN VERIFY SCRIPT-
sed -i 's|\bCreate(|CreateNew(|g' src/wallet/wallet.cpp src/wallet/wallet.h src/wallet/test/util.cpp src/wallet/test/wallet_tests.cpp
-END VERIFY SCRIPT-

refactor: Wallet stats logging in its own function

This will avoid repetition when wallet creation and loading are
separated.

refactor: Split out wallet argument loading

This section is necessarily repetitive, makes CWallet::Create() easier
to read, and splits out functionality that will be useful when wallet
creation and loading are separated.

Review with `-color-moved=dimmed-zebra`