libsecp256k1

Introduce hash context to support pluggable SHA256 compression

This is purely a mechanical change with no behavior change.

It introduces a secp256k1_hash_ctx struct inside secp256k1_context
and propagates it to all SHA256-related operations.

This sets up the ability to provide a hardware-optimized SHA256
compression function at runtime in a follow-up commit.

Revert "ci, docker: Fix LLVM repository signature failure"

This reverts commit 0ffb1749a5811bb63902f00c9fa73b49588d0557.

util: introduce and use `ARRAY_SIZE` macro

The macro definition matches the one used in Linux, see e.g.
https://github.com/torvalds/linux/blob/9702969978695d9a699a1f34771580cdbb153b33/include/linux/array_size.h#L11
(without the additional check rejecting pointers, as we would need
GNU C for that, see e.g. https://stackoverflow.com/a/19455169)

ellswift: fix overflow flag handling in secp256k1_ellswift_xdh

The secp256k1_ellswift_xdh function uses overflow = secp256k1_scalar_is_zero(&s) which overwrites the overflow flag from the preceding secp256k1_scalar_set_b32 call. This means secret keys >= the curve order are silently accepted (reduced mod n) instead of being rejected.

The fix changes = to |=, matching the correct pattern already used in secp256k1_ecdh (main_impl.h, line 51).

The ECDH module's test suite explicitly tests overflow rejection (passes secp256k1_group_order_bytes as a key and checks the function returns 0). The ellswift test suite has no corresponding test, which is why this went undetected.

test: add unit tests for secp256k1_scalar_check_overflow

refactor: remove unnecessary `malloc` result casts

It seems that there is no good reason to do this and it's even
considered bad practice, see e.g. https://stackoverflow.com/a/605858

This commit touches mostly test code, the only two functions used
in production are `secp256k1_context_{create,clone}`.

Instances were found manually via `$ git grep "malloc("`

refactor: Remove trailing whitespace

ci, docker: Fix LLVM repository signature failure

The LLVM apt repository uses legacy SHA1 signatures which are now
rejected by the stricter Sequoia PGP policy.

This change extends the 'sha1.second_preimage_resistance' cutoff date to
9999-01-01 in the default Sequoia config. This effectively whitelists
the legacy signature algorithm, preventing "OpenPGP signature
verification failed" errors during `apt-get update`.

See https://github.com/llvm/llvm-project/issues/153385.

doc: include arg -DUSE_EXTERNAL_DEFAULT_CALLBACKS=1 for cmake

Add VERIFY_CHECKs that flags are 0 or 1

Flags for constant-time masking rely
on the values being exactly 0 or 1 rather
than 0 or true. Add VERIFY_CHECKs to enforce
in VERIFY builds as a preventative
measure and add documentation where relevant.

refactor: remove ret from secp256k1_ec_pubkey_serialize

Add ARG_CHECKs to ensure "array of pointers" elements are non-NULL

autotools: Rename `build-aux` to `autotools-aux`

This change improves separation from CMake build directories, which
typically use the "build" prefix.

Additionally, corresponding `.gitignore` entries have been refactored.

use new `_eckey_pubkey_serialize{33,65}` functions in public API

test: introduce (mini) unit test framework

Lightweight unit testing framework, providing a structured way to define,
execute, and report tests. It includes a central test registry, a flexible
command-line argument parser of the form "--key=value" / "-k=value" /
"-key=value" (facilitating future framework extensions), ability to run
tests in parallel and accumulated test time logging reports.

So far the supported command-line args are:
- "--jobs=<num>" or "-j=<num>" to specify the number of parallel workers.
- "--seed=<hex>" to specify the RNG seed (random if not set).
- "--iterations=<num>" or "-i=<num>" to specify the number of iterations.

Compatibility Note:
To stay compatible with previous versions, the framework also supports
the two original positional arguments: the iterations count and the
RNG seed (in that order).

docs: Improve API docs of _context_set_illegal_callback

docs: Clarify that callback can be called more than once

build: Fix warnings in x86_64 assembly check

This change fixes:
- `-Wuninitialized` in both Autotools and CMake;
- `-Wreturn-type` in CMake only.

doc: clarify API doc of `secp256k1_ecdsa_recover` return value

Co-authored-by: Tim Ruffing <me@real-or-random.org>

Split memclear into two versions

secp256k1_memclear has the side effect of undefining bytes for
valgrind checks. In some cases, we may want to zero bytes
but allow subsequent reads. So we split memclear into
memclear_explicit, which makes no guarantees about the content
of the buffer on return, and memzero_explicit, which guarantees
zero value on return.

Change the memset in partial_sign to use memzero_explicit.

doc: mention ctx requirement for `_ellswift_create` (not secp256k1_context_static)

doc: Recommend clang-cl when building on Windows

tests: refactor tagged hash tests

Move the sha256_tag_test_internal function out of the musig module
into tests.c. This makes it available to other modules wishing to verify tagged
hashes without needing to duplicate the function.

Change the function signature to expect a const unsigned char and update
the tagged hash tests to use static const unsigned char character
arrays (where necessary).

Add a comment for each tag. This is done as a convenience for checking
the strings against the protocol specifications, where the tags are
normally specified as strings.

Update tests in the ellswift and schnorrsig modules to use the
sha256_tag_test_internal helper function.