btcd

rpcserver: test null getblock verbosity

In this commit, we add an RPC integration test for an explicit null
getblock verbosity parameter. The request must use the documented default
verbosity, return the verbose block result, and keep the WebSocket client
connected.

This covers the panic fixed in #2600 through the same raw JSON-RPC decoding
path that exposed it.

Merge pull request #2600 from allocz/fix_issue_2597

btcd: fix getblock panic triggered by rpc call

Merge pull request #2601 from vbrekher/fix/psbt-multi-a-finalizer

psbt: fix multi_a taproot finalization

psbt: test multi_a excess signature handling

In this commit, we cover a 2-of-3 multi_a input that contains valid signatures for all three keys. The finalizer must select exactly two script positions because NUMEQUAL rejects a witness with more successful checks than the threshold.

The expected witness also fixes the deterministic choice in script order and requires the excess key position to remain empty.

psbt: test multi_a signature input ordering

In this commit, we exercise taproot multi_a finalization with signature records in both script order and reverse script order. Both inputs must produce the same witness because PSBT record ordering does not define tapscript stack positions.

This guards against implementations that only reverse the input slice, which works for script-ordered records but assigns shuffled records to the wrong keys.

Merge pull request #2580 from Roasbeef/version-bump-v0.26.2

build: bump version to v0.26.2-beta

build: bump version to v0.26.2-beta

In this commit, we move btcd past the v0.26.1 release candidate and set
the development version to v0.26.2-beta. This keeps the daemon and RPC
server version on the next patch series as work resumes on master.

build: bump version to v0.26.1-beta.rc1

In this commit, we bump btcd from v0.26.0-beta to
v0.26.1-beta.rc1 for the next release candidate. This puts the version
reported by the daemon and RPC server in sync with the release series
prepared by this PR.

version: preserve semantic version separators

In this commit, we include periods in the alphabet accepted by
normalizeVerString. SemVer uses periods to separate pre-release identifiers,
but the old filter silently collapsed beta.rc1 into betarc1.

We add a focused test for the dotted RC suffix before using it for the next
release candidate.

build: pin tagged submodules and remove local replacements

In this commit, we pin btcutil and wire to their freshly tagged v2.0.1
releases. We also remove the root module's remaining local replace
directives now that all three in-tree modules have published versions.

This makes local builds and downstream module consumers resolve the same
btcutil, v2transport, and wire code. The regenerated checksums cover each
published module.

build: bump v2transport to v1.1.0

In this commit, we bump the root module requirement to the freshly tagged
v2transport v1.1.0 release. This exposes the responder handshake admission
APIs added in #2576 when btcd is built as a downstream module, where the
repository-local replace directive does not apply.

rpcclient: wrap DisableAuth tests to 80 columns

In this commit, we wrap the new DisableAuth regression tests to the
btcd 80-column formatting convention. We also split the nested handler
setup and assertions into logical stanzas so the tests match the
surrounding style.

rpcclient: make HTTP Basic Auth optional via DisableAuth

Add a DisableAuth field to ConnConfig that, when set to true, skips
setting the Authorization header on RPC requests.

This enables connecting to third-party RPC providers (e.g. Alchemy,
GetBlock) that authenticate via API key in the URL path and reject
requests containing an Authorization header with 401 errors.

Previously, getAuth() unconditionally set BasicAuth or attempted
cookie auth, leaving no way to disable authentication entirely.

Fixes #2505

rpcclient: add tests for DisableAuth header behavior

Add table-driven tests that verify:
- Authorization header is omitted when DisableAuth is true
- Authorization header is present when DisableAuth is false
- Default (zero value) behavior includes Authorization header

Suggested by @TechLateef in #2514.

rpcclient: harden DisableAuth transport tests

In this commit, we make the DisableAuth tests observe successful
requests instead of inferring them from an empty header. This closes a
false-positive path where credential lookup could fail before the
request reached the server.

We also cover the WebSocket handshake, cookie bypass, and
caller-provided headers across enabled and disabled auth. The public
comment now makes clear that DisableAuth only suppresses
rpcclient-generated Basic auth.

integration: stabilize pre-verack disconnect cycles

In this commit, we make the pre-verack lifecycle test count only peers that
btcd has admitted and processed through version exchange.

The source handshake limit can close a rapid follow-up socket while the
previous disconnect is still unwinding. This made the client-side version
write fail with EPIPE before the intended lifecycle path ran. We now wait for
a version response from btcd, retry rejected attempts under a deadline, and
still disconnect without sending verack.

This preserves all 50 peerDone without peerAdd cycles while removing the
scheduler-dependent admission race from the test.

config: reject non-positive maxpeers

In this commit, we reject maxpeers values that cannot represent a usable
peer budget.

A zero value reached connmgr as TargetOutbound=0, where zero means to use
the default target of eight. The server then rejected every completed
peer and immediately created a replacement request. Rejecting the value
during configuration avoids that outbound reconnect loop.

server+connmgr: make outbound startup deterministic

In this commit, we define TargetOutbound as the number of automatic
connections and treat explicit Connect requests as additional peers.

Permanent requests could previously consume connection IDs before Start
sampled the shared counter. The resulting automatic count depended on
goroutine scheduling, while the listener reserved the worst-case total.
We now start the configured automatic count directly and cap it by the
peer budget left after permanent peers.

The composition test covers permanent requests on both sides of Start and
pins the same automatic+permanent total for either ordering.

integration: synchronize p2p lifecycle stress batches

In this commit, we make each stress wave establish its full set of peers
before disconnecting them together. A ping/pong barrier proves the server
processed each verack, while RPC connection-count barriers prove
registration and removal completed before the next wave starts.

We bound concurrent handshakes from the shared source, drain every worker on
failure, and wait for server-side cleanup. This keeps the test compatible
with the admission limits it exercises and makes a passing run evidence of
the intended NewPeer/DonePeer ordering.

v2transport: restore responder handshake progress

In this commit, we send the responder key as soon as the initiator diverges
from the v1 prefix. This avoids the BIP324 deadlock where both sides can wait
for the other to write before the initiator has sent its complete 64-byte
key.

We split key generation and key agreement into separate admission leases,
and release each lease before the intervening network I/O. The regression
test stops after the first mismatch, requires the responder to make
progress, then completes key agreement and verifies the resulting packet
ciphers interoperate.

server+inbound: correct inbound admission accounting

In this commit, we keep loopback and whitelisted peers inside the ordinary
pending-handshake and V2 source budgets, while preserving their existing
no-ban behavior.

We also derive the listener reservation from the configured peer mode.
Connect-only and simnet nodes now reserve just their permanent peers, while
automatic mode accounts for both its target and addpeers without exceeding
MaxPeers.

Finally, a bound V2 handshake consumes its rate budgets once, but reacquires
the concurrency slot for each CPU-bound responder phase. This keeps rate
limiting scoped to the handshake while bounding both expensive phases.

psbt: decode base64 packets incrementally

In this commit, we decode base64 PSBT packets as a stream instead of
reading the full encoded input into memory first.

The previous aggregate bound reused wire.MaxMessagePayload, even though
BIP-174 doesn't bind PSBT packet size to the P2P message limit. This made
the base64 path reject packets that the raw path accepted. We now feed
decoded bytes through the same per-field parser used for raw packets,
while retaining strict base64 and trailing-data checks.

We also add a regression test with nine individually valid 4,000,000-byte
unknown values to pin raw and base64 parsing to the same behavior.

address: reject v2-v16 segwit addresses encoded with bech32

BIP-350 requires that segregated witness outputs of version 1 through 16
use the bech32m checksum, while only version 0 uses bech32. decodeSegWitAddress
only special-cased versions 0 and 1, so a witness program with version 2-16
encoded using the legacy bech32 checksum decoded successfully, in violation of
the spec and contrary to the BIP-350 reference decoder (which rejects any
non-zero witness version that is not bech32m).

Generalize the version 1 check to cover all versions >= 1, matching the
reference decode() function. Add the relevant BIP-350 INVALID_ADDRESS vectors
(v2 and v16 encoded with bech32) as a regression test; they decoded
successfully before this change and are now rejected.

Signed-off-by: Lrifton92 <Lrifton92@users.noreply.github.com>

blockchain/indexers: propagate index drop errors

In this commit, we propagate errors returned while cataloging index
buckets, matching the bucket deletion path fixed by the preceding commit.

We also add fault-injected regression coverage for both paths so neither
error can silently report a successful index drop.

blockchain/indexers: fix dropped error