Electrum

wallet: sign_message: strip whitespaces in GUIs, do not strip in CLI

- stripping whitespaces leads to better UX for GUIs IMO, but it's counter-productive for CLI
- our previous behaviour was unintentionally inconsistent:
- qt stripped the message in both sign and verify
- qml stripped the message in verify but not in sign (until #10787)
- cli stripped the message in both sign and verify
- qml also stripped the signature in verify, which was not done anywhere else
- now this code is de-duped, and the default becomes stripping both message and signature; with the CLI explicitly opting out of that

ref https://github.com/spesmilo/electrum/issues/4327
closes https://github.com/spesmilo/electrum/pull/10787
closes https://github.com/spesmilo/electrum/pull/10788

qml: strip whitespace from message before signing, as in qt gui

The qt gui strips leading/trailing whitespace from the message (and
address) both when signing and when verifying (see #4327). The qml gui
already strips in verifyMessage (qedaemon.py), but not in signMessage:
a message with leading/trailing whitespace signed in the qml gui would
produce a signature that fails verification even in the same dialog.

Strip in signMessage too, replicating the qt gui behaviour.

related: https://github.com/spesmilo/electrum/issues/4327
related: https://github.com/btclib-org/btclib/issues/200

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

trezor: drop session after closing it

Set `TrezorClientBase._session = None` after closing a session
(e.g. after session timeout) so the next session access will prompt
for the pin on the device instead of throwing an `InvalidSessionError`
when trying to access the device.

E.g. when trying to sign a tx after the session timed out:
```
80.64 | I | plugins.trezor.clientbase.TrezorClientBase | timed out
80.64 | I | plugins.trezor.clientbase.TrezorClientBase | clear session: <electrum.plugins.trezor.clientbase.TrezorClientBase object at 0x7f24cd34f080>
80.64 | I | plugins.trezor.clientbase.TrezorClientBase | locking: <trezorlib.protocol_v1.TrezorClientV1 object at 0x7f24cd34e160>
80.90 | I | plugins.trezor.clientbase.TrezorClientBase | closing: SessionV1(id=d5e6015e501acf4b10b3a3e50f1f9307768e434330568e7d5e7b1babed066438)
112.83 | I | plugin.DeviceMgr | getting client for keystore
112.83 | I | plugin.DeviceMgr | end client for keystore
113.10 | I | plugin.DeviceMgr | getting client for keystore
113.10 | I | plugin.DeviceMgr | end client for keystore
113.11 | E | gui.qt.main_window.[trezor] | on_error
Traceback (most recent call last):
File "/var/home/user/code/code_vm/electrum/electrum/gui/common_qt/util.py", line 165, in run
result = task.task()
File "/var/home/user/code/code_vm/electrum/electrum/wallet.py", line 2822, in sign_transaction
k.sign_transaction(tmp_tx, password)
~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^
File "/var/home/user/code/code_vm/electrum/electrum/plugins/trezor/trezor.py", line 100, in sign_transaction
self.plugin.sign_transaction(self, tx, prev_tx)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^
File "/var/home/user/code/code_vm/electrum/electrum/plugin.py", line 1000, in wrapper
return run_in_hwd_thread(partial(func, *args, **kwargs))
File "/var/home/user/code/code_vm/electrum/electrum/plugin.py", line 993, in run_in_hwd_thread
return fut.result()
~~~~~~~~~~^^
File "/usr/lib64/python3.14/concurrent/futures/_base.py", line 454, in result
return self.__get_result()
~~~~~~~~~~~~~~~~~^^
File "/usr/lib64/python3.14/concurrent/futures/_base.py", line 396, in __get_result
raise self._exception
File "/usr/lib64/python3.14/concurrent/futures/thread.py", line 86, in run
result = ctx.run(self.task)
File "/usr/lib64/python3.14/concurrent/futures/thread.py", line 73, in run
return fn(*args, **kwargs)
File "/var/home/user/code/code_vm/electrum/electrum/plugins/trezor/trezor.py", line 344, in sign_transaction
signatures, _ = client.sign_tx(self.get_coin_name(),
~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^
inputs, outputs,
^^^^^^^^^^^^^^^^
...<3 lines>...
serialize=False,
^^^^^^^^^^^^^^^^
prev_txes=prev_tx)
^^^^^^^^^^^^^^^^^^
File "/var/home/user/code/code_vm/electrum/electrum/plugin.py", line 1000, in wrapper
return run_in_hwd_thread(partial(func, *args, **kwargs))
File "/var/home/user/code/code_vm/electrum/electrum/plugin.py", line 990, in run_in_hwd_thread
return func()
File "/var/home/user/code/code_vm/electrum/electrum/plugins/trezor/clientbase.py", line 356, in sign_tx
return trezorlib.btc.sign_tx(self.session, *args, **kwargs)
~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/home/user/code/code_vm/electrum/env/lib64/python3.14/site-packages/trezorlib/tools.py", line 379, in wrapper
result = self.func(session, *args, **kwargs)
File "/var/home/user/code/code_vm/electrum/env/lib64/python3.14/site-packages/trezorlib/btc.py", line 329, in sign_tx
res = session.call(signtx, expect=messages.TxRequest)
File "/var/home/user/code/code_vm/electrum/env/lib64/python3.14/site-packages/trezorlib/client.py", line 113, in call
raise exceptions.InvalidSessionError(self.id)
trezorlib.exceptions.InvalidSessionError: b'\xd5\xe6\x01^P\x1a\xcfK\x10\xb3\xa3\xe5\x0f\x1f\x93\x07v\x8eCC0V\x8e}^{\x1b\xab\xed\x06d8'
```

qml: update ConfirmTxDialog onValidChanged

Commit 2de11eac923d51befe44dcc748505714196a7f2c gated the
ConfirmTxDialog amount behind `finalizer.valid`.
When sweeping private keys from the sweep view the resulting
`ConfirmTxDialog` is not valid in the beginning, and after it
turns valid nothing causes it to update. This results in the amount
being displayed as `0` even after it finished fetching the keys balances.

wallet.check_sighash: don't assume tx.add_info_from_wallet alrdy ran

Sighash warnings/errors might in theory not be triggered for
inputs owned by the wallet but which are beyond the gap limit.
tx.add_info_from_wallet(wallet) side-effects the wallet state
so that wallet.is_mine() learns derivation paths for beyond-gap-limit addresses.

In practice both GUIs currently call tx.add_info_from_wallet before
check_sighash runs, so this was not exploitable.

exchange rate: remove CoinDesk provider

The API is non-functional and their new api requires an authorization
token, so we cannot keep using it.

hw_wallet/qt: reuse device message dialog across button requests

QtHandlerBase.message_dialog() used to tear down the current dialog
(clear_dialog -> QDialog.accept) and build a brand-new WindowModalDialog
on every device button request. A device emits one button request per
output, so signing a tx with many outputs rebuilt the dialog once per
output. On macOS a window-modal QDialog is shown as an animated "sheet",
so the popup visibly slid closed and reopened for each output, and the
GUI churn also competed with the single hardware-comms thread for the
GIL, adding latency between device prompts.

Reuse the open dialog and just update its label text when one is already
showing (title and on_cancel are stable within a signing flow). This
also smooths Ledger's repeated progress messages, which update the text
on each call.

lnmsg: add new primitive type `bip340sig`, add tlv merkle root calculation and schnorr-sign over tlvs,
implicit en/decode utf8 fields, schnorr signature verification.

Co-Authored-By: f321x <f@f321x.com>

scripts: simplify testnet usage

lnpeer: on_ping: drain out-socket buffer

might help against some memory exhaustion attacks

f321x said:
> maybe a peer could just fill up our sockets outgoing buffer by ~234mb/h
> if they stop reading from their socket and keep sending pings every second.

Co-authored-by: f321x <f@f321x.com>

ci: security review: give more permissions to claude

With `--dangerously-skip-permissions` claude can also execute
commands. I thought the `-p` flag for headless usage already
did that, but apparently not
(looking at https://code.claude.com/docs/en/headless).

As it runs in the isolated CI container this seems fine and
might make it more powerful (e.g. allowing it to run and
modify unittests to verify behavior).

tests: regtest: make test_just_in_time less flaky

The regtest just_in_time is flaky on the CI because it tries to open
two channels right after each other (mining 3 blocks in between).
If the channel opener (LSP/Bob) hasn't caught up yet and is still
on the same height as the previous channel open it will refuse to open
another channel due to the anchor channel key derivation limitation.

This adds a helper to pause the test until bob has caught up to the newly
mined 3 blocks before attempting the second open.

Upgrade `trezorlib` to 0.20.1

Trezor plugin is updated for `trezorlib` 0.20.1 release.

Tested the following scenarios with Trezor 1 (with FW 1.14.0), T, Safe 3 and Safe 5 (with FW 2.10.0):
- create a new wallet:
- generate new seed
- recover from backup
- verify an address
- send & RBF flows
- set a PIN & a passphrase
- open an existing wallet file
- locking the device on exit
- flow cancellation

Safe 7 support will be added in a subsequent PR.

SECURITY.md: enable "private vuln reports" on GitHub

ref https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/privately-reporting-a-security-vulnerability

android: build pyqt_builder and sip ourselves, hash pin all hostpython_prerequisites

qml: additional styling updates

qml: styling updates qt6.10

qml: add workarounds for issue assigning custom types to QObject properties

- on the python side, for pyqtProperty's with a setter, the pyqtProperty should be declared as QVariant type
- on the qml side, properties should be declared 'var', not the custom type.

android: pin hostpython3 PyProjectRecipe versions,
pin android and pyjnius recipes Cython version

qml: wizard styling, password dialog styling

android: use plain 'build' dependency (using 'venv') instead of 'build[virtualenv]',
remove setuptools as its use is now pinned via hostpython_prerequisites where applicable,
update depends asserts in pyqt6sip, sip, pyqt_builder

verifier.py: fix CVE-2012-2459: reject left-sibling duplicates

Due to how the txid-commitment merkle tree used in the block headers is constructed, we need an extra check to be able to validate the *position* of a txid in a block.

I think this is low severity for us.

See https://bitcointalk.org/?topic=102395 :

> The Merkle hash implementation that Bitcoin uses to calculate the Merkle
> root in a block header is flawed in that one can easily construct multiple
> lists of hashes that map to the same Merkle root.
> For example, merkle_hash([a, b, c]) and merkle_hash([a, b, c, c]) yield
> the same result. This is because, at every iteration, the Merkle hash
> function pads its intermediate list of hashes with the last hash if the
> list is of odd length, in order to make it of even length.
>
> And so, the Merkle root function can be effectively preimaged by
> changing the input so that one of the intermediate lists is of even
> length with the last two elements equal (where originally it was
> of odd length with a last element equal to the earlier mentioned two).
> As was later noted, this extends to any input length that is
> not a power of two:
> merkle_hash([a, b, c, d, e, f]) == merkle_hash([a, b, c, d, e, f, e, f]).
> Note that to maintain the same root hash, the only flexibility that
> exists is duplication of elements.

Ported from https://github.com/Electron-Cash/Electron-Cash/commit/165146362b4cb0ad74770b36aca1f9acb2800195

Co-authored-by: bitcoincashautist <80100588+A60AB5450353F40E@users.noreply.github.com>

daemon: set restrictive permission on RPC-server unix domain socket

0600 instead of 0775.

crypto.py: replace sys.exit with ImportError

not nice to call sys.exit from inside the library
(run_electrum can do it, but the library probably should not)

in GUI mode, only start a limited minimal RPC server

To limit attack surface.

Context:
- both in daemon mode and in GUI mode, we start an RPC server
- the RPC server uses HTTP basic auth, with a random password that is saved in the config file
- read access to the config file implies access to the RPC server
- the traffic is unencrypted
- by default the server listens
- on Windows, on localhost TCP
- all other platform, via unix domain sockets
- if an attacker can listen to localhost TCP traffic, and there was traffic
- they could see the plaintext RPC password and issue their own commands
- e.g. if wireshark was already installed on the system, this might not require root access
- the "ping" and "gui" commands are used by everyday operations that affect most users:
- "ping" is used when trying to launch a second instance of electrum, to contact the first instance and enforce "singleton" behaviour
- "gui" is used for URI handling (`$ xdg-open bitcoin:asdasd`)
- many other sensitive commands, that operate on wallets, require *also* the wallet password
- but note that wallet.unlock can be used by the user to bypass this and store the wallet password in memory (exposed in GUI)

I propose locking down the RPC server when running in GUI mode:
- we still start it, as it is used for "ping" and "gui" RPCs, however we disable all other RPCs
- we could opt-in enable it, using a config var, except that ofc would not help against an attacker that has filesystem write access to the config file
- so I think it's even safer to just "hardcode" disable it: however the functionality is useful for development
- I propose we branch based on `constants.net.TESTNET`
- an alternative we could branch on that is hard to fake is `is_git_clone` in run_electrum