Electrum

in GUI mode, only start a limited minimal RPC server

To limit attack surface.

Context:
- both in daemon mode and in GUI mode, we start an RPC server
- the RPC server uses HTTP basic auth, with a random password that is saved in the config file
- read access to the config file implies access to the RPC server
- the traffic is unencrypted
- by default the server listens
- on Windows, on localhost TCP
- all other platform, via unix domain sockets
- if an attacker can listen to localhost TCP traffic, and there was traffic
- they could see the plaintext RPC password and issue their own commands
- e.g. if wireshark was already installed on the system, this might not require root access
- the "ping" and "gui" commands are used by everyday operations that affect most users:
- "ping" is used when trying to launch a second instance of electrum, to contact the first instance and enforce "singleton" behaviour
- "gui" is used for URI handling (`$ xdg-open bitcoin:asdasd`)
- many other sensitive commands, that operate on wallets, require *also* the wallet password
- but note that wallet.unlock can be used by the user to bypass this and store the wallet password in memory (exposed in GUI)

I propose locking down the RPC server when running in GUI mode:
- we still start it, as it is used for "ping" and "gui" RPCs, however we disable all other RPCs
- we could opt-in enable it, using a config var, except that ofc would not help against an attacker that has filesystem write access to the config file
- so I think it's even safer to just "hardcode" disable it: however the functionality is useful for development
- I propose we branch based on `constants.net.TESTNET`
- an alternative we could branch on that is hard to fake is `is_git_clone` in run_electrum

fix: remove negative fee assert from get_tx_fee_warning

rm the `assert fee >= 0, f"{fee=!r} must be non-negative satoshis"`
from `Abstract_Wallet.get_tx_fee_warning()` to prevent an exception when
users load a psbt with negative tx fee.

daemon: forbid "setconfig" command to change rpcserver settings in-flight

It is much easier to reason about the rpcserver if we don't allow changing its basic settings while it is already running. What does it mean to change the TCP port it is listening on ("rpcport") if it's already running? It is even problematic to change the rpcpassword: care needs to be taken to already update it for the current server.
(ref https://github.com/spesmilo/electrum/issues/6762)

This commit disallows changing all of the "rpc*" config variables if the daemon is already running.

---

Simultaneously, it also ensures rpc_password is always set and auth cannot be disabled.

Previously if there was a daemon running, and the user ran
`$ electrum setconfig rpcpassword ""` that would leave the RPC unauthenticated
for the current session. However next time the daemon restarted, get_rpc_credentials would see
the unset password and generate one.

I think this was the worst of both worlds:
- we did not really allow removing the rpc password, except for the current session, and
- perhaps unexpectedly, we would generate a new password on daemon restart

Instead now we explicitly make sure the RPC server can never get into a state where it does not have a password set.

Based on a report by `Zuzana Kotásková <36777@mail.vsfs.cz>`

wizard: catch NotLegacySinglesigScriptType

Catch NetLegacySinglesigScriptType and convert it to a
UserFacingException if the user tries to import a private key for which
it is not possible to get a singlesig descriptor (e.g. p2wsh).

Fixes #10536

qt: perform 'fully spend' action with coin selection, keep separate from coin control when doing action.

Also stop timer when dialog is finished, to avoid re-generating txs with the same input coin set, which
results in an exception as these coins have signatures when the swap has started.

deps: bump libsecp256k1 version (0.7.0->0.7.1) and electrum-ecc

transaction: use dummy DER ECDSA sig from descriptor.py

We have two different dummy der signatures of varying size,
this unifies them to use a single one from descriptor.py.

wallet: rbf: estimate base tx size before stripping

Estimate the size of a base tx before stripping its signatures
so the lower bound feerate used to calculate the fee for the rbf
transaction doesn't underestimate the feerate of the base tx.

lnpeer: don't save our own channel update as remote upd

I noticed CLN is sending our own channel update to us on
reestablishment, we then assume it to be the remote nodes
update and try to verify the signature against their pubkey
which fails and throws `InvalidGossipMsg`.

This adds a check preventing us from trying to save our own
channel updates as remote update.

locale: don't translate string "Electrum", "BIP39"

locale: don't translate string "Electrum"

android: biometry: catch java import errors

Catch JavaError when trying to load the java classes of the biometry
module on startup. This can raise if the device is on an old API version
and the loaded java class depends on apis unknown to the os.

Fixes #10470

```
02-17 10:07:25.714 5254 5270 I python : 0.47 | E | __main__ | daemon.run_gui errored
02-17 10:07:25.714 5254 5270 I python : Traceback (most recent call last):
02-17 10:07:25.714 5254 5270 I python : File "app/main.py", line 514, in handle_cmd
02-17 10:07:25.714 5254 5270 I python : File "app/electrum/daemon.py", line 653, in run_gui
02-17 10:07:25.714 5254 5270 I python : File "app/electrum/gui/qml/__init__.py", line 38, in <module>
02-17 10:07:25.714 5254 5270 I python : File "app/electrum/gui/qml/qeapp.py", line 49, in <module>
02-17 10:07:25.714 5254 5270 I python : File "app/electrum/gui/qml/qebiometrics.py", line 33, in <module>
02-17 10:07:25.714 5254 5270 I python : File "jnius/reflect.py", line 243, in autoclass
02-17 10:07:25.714 5254 5270 I python : File "jnius/jnius_export_class.pxi", line 877, in jnius.jnius.JavaMethod.__call__
02-17 10:07:25.714 5254 5270 I python : File "jnius/jnius_export_class.pxi", line 964, in jnius.jnius.JavaMethod.call_method
02-17 10:07:25.714 5254 5270 I python : File "jnius/jnius_utils.pxi", line 79, in jnius.jnius.check_exception
02-17 10:07:25.714 5254 5270 I python : jnius.jnius.JavaException: JVM exception occurred: Failed resolution of: Landroid/hardware/biometrics/BiometricPrompt$AuthenticationResult; java.lang.NoClassDefFoundError
```

announcement_signatures: add more early returns

locale: don't translate URL, like wtf

please, use common sense :(
I guess it was a copy-paste error, but still, treat all _() and qsTr() calls as "scary" and as potential attack vectors. Don't blindly call _(): every call needs to be weighed separately.

CI: changed API key for crowdin translations, update notes

api key was previously for "SomberNight" crowdin acc, now it's for a fresh acc "SomberNight_CI_BOT".

- "SomberNight_CI_BOT" acc has fewer permissions overall
- the new api key is minimally scoped
- I can't remember what the old api key was scoped to, and crowdin does not show the settings of existing api key, one can only revoke them
- the crowdin audit log can now distinguish actions of the bot vs actions I do manually

contrib: android: Dockerfile: fix ownership of COPY

Resolves:

ERROR: Could not open requirements file: [Errno 13] Permission
denied: '/opt/deterministic-build/requirements-build-base.txt'

ignore exceptions in process_gossip

A failing signature verification should not kill the taskgroup

build: android: use Java 17, as before debian upgrade :/

When building on debian 12, we were using Java 17.
On debian 13, Java 17 is not packaged anymore, instead there is Java 21 and 25.
Ideally we should upgrade to Java 21 and just install it from apt.

However old Gradle is not compatible with new Java, so we have to upgrade Gradle for that.
- see https://docs.gradle.org/current/userguide/compatibility.html

Old Gradle is giving build errors with Java 21:
```
Could not compile build file '/home/user/wspace/electrum/.buildozer_qml/android/platform/build-arm64-v8a/dists/Electrum/build.gradle'.
> startup failed:
General error during conversion: Unsupported class file major version 65

java.lang.IllegalArgumentException: Unsupported class file major version 65
```

for our p4a fork, I tried to cherry-pick stuff from upstream:
- https://github.com/kivy/python-for-android/commit/17bf5322791ec8cec85836fbe906e63664a05445
- https://github.com/kivy/python-for-android/pull/3172
https://github.com/kivy/python-for-android/commit/a8f2ca1c5b1bb6696b47fdf2c052285e116e0ebe
- see https://github.com/SomberNight/python-for-android/compare/a01269f7799587ad74ee40e0b642d917b8db7d4e...846a1094874aeb64b623fa746222a41851245271

That seems sufficient to upgrade Gradle as far as p4a is concerned.

However that still did not work yet:
- contrib/android/make_barcode_scanner.sh fails, as
markusfisch/zxing-cpp and markusfisch/CameraView
are also using too old gradle versions for Java 21
- it seems they are intentionally doing this to maintain compat with Android 4:
see https://github.com/markusfisch/zxing-cpp/commit/d98ed5d0be513c4077b4c13d1f7873f141949839

So for now maybe the path of least resistance is to downgrade to Java 17 :(

qml: require authentication for message signing

Requests authentication when trying to sign a message if "Payment
Authentication" is enabled.

qml: protect Address Private Keys from screenshots

Address private keys weren't protected from screenshots.

qml: remove pin code authentication

Completely removes the pin code authentication from qml. The config
option in the wallet preferences has been renamed to "Payment
authentication" and now either asks for the Android system
authentication (Biometric or system pin/password) if enabled or will ask
for the wallet password as fallback.

android: implement biometric authentication

Allows to unlock the android app with the android biometric api (e.g.
fingerprint). Can be enabled in the settings.

psbt_nostr: add EventListener comment to CosignerWallet

I got confused how on_event_proxy_set can even work if CosignerWallet
doesn't inherit from EventListener until i figured out its children use
the EventListener too. To avoid this confusion i added two comments.

bug: psbt_nostr: set CosignerWallet.pending on aio loop

Fixes:
```
Traceback (most recent call last):
File "/home/user/code/electrum-fork/electrum/plugins/psbt_nostr/qt.py", line 149, in on_receive
self.mark_pending_event_rcvd(event_id)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^
File "/home/user/code/electrum-fork/electrum/plugins/psbt_nostr/psbt_nostr.py", line 254, in mark_pending_event_rcvd
self.pending.set()
~~~~~~~~~~~~~~~~^^
File "/usr/lib64/python3.14/asyncio/locks.py", line 192, in set
fut.set_result(True)
~~~~~~~~~~~~~~^^^^^^
File "/usr/lib64/python3.14/asyncio/base_events.py", line 829, in call_soon
self._check_thread()
~~~~~~~~~~~~~~~~~~^^
File "/usr/lib64/python3.14/asyncio/base_events.py", line 866, in _check_thread
raise RuntimeError(
"Non-thread-safe operation invoked on an event loop other "
"than the current one")
RuntimeError: Non-thread-safe operation invoked on an event loop other than the current one
```

qt: trustedcoin: only allow signing with broadcast

Only allow signing a transaction if it also gets broadcast by disabling
the signing and broadcast button of the preview dialog when creating a
new tx. Makes it slightly less trivial to cheat with the fees.