Elements

This commit changes a single line in the project's Windows CI configuration. It pins the version of 'jom'—a build tool used during automated Windows builds—to a specific release (1.1.2) instead of always downloading the latest version. There is no direct evidence in the commit or supplied references that this fixes a security vulnerability. It appears to be a build reliability or reproducibility change.

This commit is a straightforward build hygiene change. It moves a Simplicity library header include out of a widely-used header file and into the single source file that actually needs it, replacing the direct include with forward declarations. This reduces compile-time dependencies for other parts of the project and makes future build system changes easier. There is no functional change to how transactions or scripts are validated.

This commit fixes a typo in two build helper scripts. The scripts were pointing to an outdated or incorrect Git repository URL for the Guix package manager (https://codeberg.org/guix.git instead of https://codeberg.org/guix/guix.git). This is a routine maintenance fix with no security implications.

This commit fixes a missing validation check in the Elements sidechain. When creating or reissuing custom assets, the code already checked that the main asset amount was within the 21-million-coin money range, but it forgot to perform the same check on the optional 'reissuance token' amount. A user could therefore issue or carry a reissuance token whose nominal supply exceeded the normal limit. The patch adds that missing range check and includes tests showing that nodes with stricter policy now reject such out-of-range reissuance-token issuances from their memory pool.

This commit simply adds a new GPG public key file used to verify official release signatures. It is a routine trust/key-management addition with no code changes and no direct security vulnerability.

This commit simply changes the web address from which the Guix build system downloads its own source code during reproducible builds. It switches from the GNU project's Savannah server to Codeberg, a non-profit code hosting platform. There is no security vulnerability or malicious change visible in the diff.

This commit fixes a trivial typo in a documentation file. The phrase 'pops a pops a' was corrected to 'pops a'. There is no code change and no security impact.

This commit moves a network rule about unblinded asset issuances above 21 million units from a global node setting into per-chain parameters. Before the change, the default was to accept unlimited issuances globally. After the change, the default is to reject such issuances unless a chain explicitly opts in. This is a policy/consensus-adjacent change that could affect which transactions nodes accept, but it is not presented as a security fix and does not by itself create a new exploit.

This commit fixes a bug in the Elements sidechain where creating or reissuing more than 21 million units of a non-bitcoin asset was incorrectly rejected when the issuance was unblinded (publicly visible amounts). The change makes the 21-million limit apply only to the network's main pegged asset (like bitcoin), not to other custom assets, and adds a configurable policy switch so node operators can choose whether to relay/mine such large unblinded issuances. Previously, unblinded issuances over 21 million could fail validation even though they are allowed by consensus rules for non-policy assets.