libsecp256k1

ci: Replace `ilammy/msvc-dev-cmd` with manual MSVC setup

The `ilammy/msvc-dev-cmd` repository seems abandoned and should be
considered unsafe. This updates the workflow to load the MSVC
environment variables directly via `vcvars64.bat`.

See https://learn.microsoft.com/en-us/cpp/build/building-on-the-command-line.

Improve checks for scalar _get_bits methods

gha: Bump deprecated GHA workflow dependencies

Deprecation notice:
https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Changelogs (no entries relevant to us):
* https://github.com/docker/setup-buildx-action/releases/tag/v4.0.0
* https://github.com/docker/build-push-action/releases/tag/v7.0.0
* https://github.com/actions/cache#v5

ecdsa: VERIFY_CHECK result of _fe_set_b32_limit

This also avoids a spurious "-Wmaybe-uninitialized" warning emitted by
gcc 16 (snapshot) when compiling with -DDETERMINISTIC.

tests: Fix C89 function pointer initialization in ellswift tests

eckey: Call ecmult with NULL instead of zero scalar

ecmult: Document and test ng=NULL in ecmult

Add API to override SHA256 compression at runtime

This introduces `secp256k1_context_set_sha256_compression()`,
which allows users to provide their own SHA256 block-compression
function at runtime.

This is useful in setups where the fastest implementation can only
be determined dynamically based on the available CPU features, and
rebuilding the library is not possible.

The callback is installed on the `secp256k1_context` and is then used
by all operations that compute SHA256 hashes. As part of the setup,
the library performs sanity checks to ensure that the supplied
function is equivalent to the default transform.

Passing NULL to the callback setter restores the built-in
implementation.

sha256: speed up writes using multi-block compression

Multiple 64-byte blocks can now be compressed directly
from the input buffer, without copying them into the
internal buffer.

Introduce hash context to support pluggable SHA256 compression

This is purely a mechanical change with no behavior change.

It introduces a secp256k1_hash_ctx struct inside secp256k1_context
and propagates it to all SHA256-related operations.

This sets up the ability to provide a hardware-optimized SHA256
compression function at runtime in a follow-up commit.

testrand: Remove testrand_finish

This removes printing of the "random run = " at the end of the tests. I
haven't seen a single case where this proved to be useful. And as of
48789dafc2a866bbc639184f0387637c0decb8c5, this is anyway printed only at
the end of the exhaustive tests and not the normal tests, so the
probability that this will be useful in the future is very low.

hash: add midstate initializer and use it for tagged hashes

Introduce secp256k1_sha256_initialize_midstate() in the hash layer and use it at all tagged-hash midstate call sites across schnorrsig, musig, and ellswift.

Document the byte-counter contract at the declaration site in hash.h and add run_sha256_initialize_midstate_tests() to directly verify helper behavior against initialize_tagged.

Also switch the helper to take const uint32_t state[8] to reduce argument-order risk at call sites.

ci: Fix leftover use of old ECMULTGENPRECISION

Revert "ci, docker: Fix LLVM repository signature failure"

This reverts commit 0ffb1749a5811bb63902f00c9fa73b49588d0557.

util: introduce and use `ARRAY_SIZE` macro

The macro definition matches the one used in Linux, see e.g.
https://github.com/torvalds/linux/blob/9702969978695d9a699a1f34771580cdbb153b33/include/linux/array_size.h#L11
(without the additional check rejecting pointers, as we would need
GNU C for that, see e.g. https://stackoverflow.com/a/19455169)

Add tests for bad scalar inputs in ellswift XDH

ellswift: fix overflow flag handling in secp256k1_ellswift_xdh

The secp256k1_ellswift_xdh function uses overflow = secp256k1_scalar_is_zero(&s) which overwrites the overflow flag from the preceding secp256k1_scalar_set_b32 call. This means secret keys >= the curve order are silently accepted (reduced mod n) instead of being rejected.

The fix changes = to |=, matching the correct pattern already used in secp256k1_ecdh (main_impl.h, line 51).

The ECDH module's test suite explicitly tests overflow rejection (passes secp256k1_group_order_bytes as a key and checks the function returns 0). The ellswift test suite has no corresponding test, which is why this went undetected.

ci: Load Docker image by ID from builder step

bench: Update help functions in bench and bench_internal

In the bench and bench_internal help functions argv was not being
passed, in this change we pass in argv[0] and use it in the help text.

Additionally instead of passing all of argv in bench_ecmult we now
just pass argv[0] and is used as the executable_path variable.

test: add unit tests for secp256k1_scalar_check_overflow

ci: Enforce base-10 evaluation

ci: Disable Docker build summary generation

These summaries provide little practical value to the development
workflow and clutter the CI output.

refactor: remove unnecessary `malloc` result casts

It seems that there is no good reason to do this and it's even
considered bad practice, see e.g. https://stackoverflow.com/a/605858

This commit touches mostly test code, the only two functions used
in production are `secp256k1_context_{create,clone}`.

Instances were found manually via `$ git grep "malloc("`

build: Add `-Wleading-whitespace=spaces` compiler flag

build: Add `-Wtrailing-whitespace=any` compiler flag