RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Repository coverage

2070 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

459security candidates448second-pass queue2070AI analyses
181commits · 30 days
400commits · 60 days
1282commits · 180 days
2052commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

64/100 average clarity
311Strong · 80–100
1054Adequate · 60–79
555Thin · 40–59
150Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot640192640068
Tobin C. Harding40965409063
jrakibi944994068
Nick Johnson18920189059
Andrew Poelstra512051075
Jamil Lambert, PhD11418114061
Fmt Bot311431045
Trevor Arjeski111111069
Shing Him Ng31731056
Ismail Daif22622050
satsfy (Renato Britto)17617066
Martin Habovstiak27527069
Analysis record

Published AI watches

Last scanned 15 minutes ago

Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6671: units: reword docs from height to count in relative locktime

This commit only changes documentation comments and variable names in the rust-bitcoin library. It rewords references to 'block height' as 'block count' for relative locktime, because a relative locktime measures elapsed blocks since a coi…

6ea4ff92by Andrew Poelstra+20−172 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6670: ci: fix labeller permissions

This is a routine GitHub Actions workflow fix. The change gives the automated PR labeler workflow permission to download artifacts and explicitly tells the GitHub CLI which repository to act on. It does not change the Bitcoin library code,…

CI workflow permission fixNo source code changesNo cryptographic or consensus changes
276e0a61by Andrew Poelstra+5−01 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6657: Release tracking PR: `base58ck 0.5.0`

This commit is a routine version bump for the base58ck crate from 0.4.0 to 0.5.0. It only updates version numbers in package manifests, lock files, and adds a changelog entry. There are no code changes and no security relevance.

9deb5de1by Andrew Poelstra+22−168 files
No security note in commit
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6440: base58: Introduce `decode_check_to_array` for alloc-less decoding

This commit is a routine feature addition to the rust-bitcoin base58 crate. It adds a new no-allocator function to decode short base58-check strings into fixed-size byte arrays, and renames the existing error type while keeping a deprecate…

No security-relevant bug fix is described in the commit message or diff.New decoding path uses a fixed 128-byte scratch buffer (`ArrayVec`) and rejects oversized inputs.Checksum verification and invalid-character handling are preserved from the existing alloc implementation.
c5fd1832by Andrew Poelstra+330−775 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6646: hashes: add several methods to `Midstate` and release 1.2.0

This commit is a routine feature release for the bitcoin_hashes crate. It adds new public methods and a constant to the SHA-256 Midstate type so developers can compute SHA-256 midstates in const contexts. There is no indication of a securi…

0f68fcb3by Andrew Poelstra+157−4210 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

units: reword docs to block count in relative locktime

This commit only rewords documentation comments and variable names in the codebase. It changes references from 'block height' to 'block count' for relative lock times, which is a terminology correction with no functional code changes. Ther…

8867fe2eby satsfy (Renato Britto)+20−172 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6667: Make the `WitnessesEncoder` private

This commit makes a small internal helper type called WitnessesEncoder private. It was previously exported as public API but is only used inside the transaction encoder. The change removes it from the public API surface and moves the code …

07d91f7fby Andrew Poelstra+54−1324 files
No security note in commit
Informational 12 AI analysisMessage 75 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: fix labeller permissions

This commit adjusts a GitHub Actions workflow that automatically labels pull requests based on CI results. It adds a built-in repository token, tells the artifact download step to merge single-file artifacts, and explicitly sets the reposi…

Workflow-only change with no library code modificationsUses the default GITHUB_TOKEN rather than a custom secretRuns in workflow_run context, which already has elevated repository access by design
715f2bd6by Nick Johnson+5−01 file
No security note in commit
Informational 19 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6661: units: Remove `From<u16>` from `NumberOfBlocks`

This is a routine API cleanup, not a security fix. The developers removed a shortcut that let programmers create a 'number of blocks' value directly from any u16 number, replacing it with an existing named constructor called from_height. T…

ed5f1b68by Andrew Poelstra+18−358 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6668: Scrub the transaction encoding logic

This commit is a pure code reorganization (refactor) in the rust-bitcoin library. It moves transaction encoding and decoding definitions around within a single file so the code follows the project's preferred layout. No logic, behavior, or…

c5588ba5by Andrew Poelstra+57−571 file
No security note in commit
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6662: build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It changes the pinned version from 6.0.2 to 6.0.3 across many workflow files. The newer version fixes minor bugs related to SHA-…

Dependency bump of actions/checkout to a patch releaseUpstream fixes for SHA-256 repository checkout and merge commit regexAll affected workflows already disable persisted credentials
f7d364cdby Andrew Poelstra+29−2915 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6663: build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

This is a routine Dependabot update that bumps the version of a third-party GitHub Action used only in automated testing workflows. The change does not touch the project's actual Bitcoin library code, and there is no indication it fixes or…

5c92c0b0by Andrew Poelstra+2−22 files
No security note in commit
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Update the API text files

This commit only updates two generated API text files that list the public surface of the Rust crate. It removes entries for a `WitnessesEncoder` type, reflecting that the type is no longer part of the public API. There is no source code c…

9c391145by Tobin C. Harding+0−782 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Scrub the transaction encoding logic

This commit is a pure code reorganization: it moves existing transaction encoding and decoding definitions around within a single file so they follow the project's preferred layout. No logic was changed, no security bug was fixed, and no n…

80dcef15by Tobin C. Harding+57−571 file
No security note in commit
Informational 15 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Make the WitnessesEncoder private

This commit simply hides an internal helper type called WitnessesEncoder from public view. It is a routine API-cleanup change with no security relevance visible in the code or commit message.

b37accc3by Tobin C. Harding+54−542 files
No security note in commit
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

release bitcoin_hashes 1.2.0

This commit is a routine version bump for the bitcoin_hashes library from version 1.1.0 to 1.2.0. It only updates lock files, the package version number, and the changelog. There is no code change and no security relevance visible in the c…

8899dfd2by Andrew Poelstra+27−224 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install the 'uv' Python tool in two workflow files. The new commit hash corresponds to the legitimate 8.2.0 release of astral-sh/se…

1c438632by dependabot[bot]+2−22 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine automated update by Dependabot that changes the pinned version of a GitHub-provided security scanning helper used in a workflow. It does not modify the project's actual Bitcoin library code, its cryptographic logic, or an…

5293bee4by dependabot[bot]+1−11 file
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

This is a routine Dependabot update that bumps a GitHub Actions helper used in automated testing workflows from version 2.79.12 to 2.81.4. It only changes which version of the action is invoked during CI runs; it does not modify the Rust B…

eb9544f9by dependabot[bot]+2−22 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This is a routine automated update by Dependabot that bumps the GitHub Actions 'actions/checkout' dependency from version 6.0.2 to 6.0.3 across all project workflow files. It only changes pinned commit hashes and version comments for the a…

Routine patch-level dependency bumpNo changes to permissions, inputs, or workflow logicpersist-credentials: false already present on all checkout steps
ae935fadby dependabot[bot]+29−2915 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityReplace Result<(), fmt::Error> with fmt::Resultby Mitchell Bagot · da970ec5 · Mar 7, 2026 · 9 filesMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Replace Result<(), fmt::Error> with fmt::Result

core::fmt::Result is a type alias for results with a unit return and
an fmt::Error return result. Overwhelmingly, the codebase primarily
uses fmt::Result for clarity, but there remain places where the
explicit type is used, without any particular reason for doing so.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a purely cosmetic code cleanup. It replaces the longer way of writing Rust's formatting error return type, `Result<(), fmt::Error>`, with the standard shorter alias, `fmt::Result`. The actual behavior of the code does not change at all.

Lower-priorityUpdate API filesby Mitchell Bagot · 5cd0a9fd · Mar 7, 2026 · 3 filesMessage 51 · ThinInformational 15Details
Commit message · Mitchell Bagot

Update API files

Following the previous change, various fmt functions on types will now
have a "different" return type.

Update the units api files to match new return fmt::Result return type
for various functions.

51/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides detailed explanatory context
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only updates generated API snapshot text files to remove duplicate lines showing an older, more verbose return type for formatting functions. It is a documentation/test-artifact cleanup with no code changes and no security relevance.

Lower-priorityunits: Update API filesby Mitchell Bagot · 78d57ada · Mar 7, 2026 · 3 filesMessage 51 · ThinInformational 15Details
Commit message · Mitchell Bagot

units: Update API files

The previous patches have introduced new functions on various types in
the public API.

Run just check-api to update units api files.

51/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides detailed explanatory context
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only updates automatically-generated API listing files (text snapshots of public functions). It does not change any actual Rust source code, behavior, or fix any bug. There is no security relevance.

Lower-prioritybitcoin: Remove FromHex usage in serde codeby Tobin C. Harding · 9a8c05bf · Mar 7, 2026 · 1 fileMessage 68 · AdequateInformational 19Details
Commit message · Tobin C. Harding

bitcoin: Remove FromHex usage in serde code

In the stable `hex` release we made the decision to totally hide error
internals. This breaks our usage of the lib, how ironic.

Note that since the `consensus` code is slowly on its way out lets
just clobber this error handling and pass the `Display` output to
`de::Error::custom()`.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 19/100

This is a small maintenance patch that changes how hex decoding errors are reported during serialization/deserialization. It removes usage of a now-inaccessible error-detail API from the `hex` crate and instead reports the error's display message. There is no indication this fixes an exploitable vulnerability; it is a compatibility and cleanup change.

Lower-priorityunits: Add FromStr to CompactTarget and BlockTimeby Mitchell Bagot · bed1543f · Mar 7, 2026 · 2 filesMessage 68 · AdequateInformational 16Details
Commit message · Mitchell Bagot

units: Add FromStr to CompactTarget and BlockTime

Of the integer wrapper types in units, only two are missing FromStr
implementations. All other integer wrapper types have FromStr
implemented by passing through to the appropriate integer types's
FromStr and parsing in decimal. For consistency and completeness, both
CompactTarget and BlockTime should follow this.

Add FromStr impl to CompactTarget and BlockTime using
impl_parse_str_from_int_infallible macro.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 16/100

This commit adds the ability to parse CompactTarget and BlockTime values from strings in the rust-bitcoin library. It is a routine consistency improvement that makes two numeric wrapper types behave like all other similar types in the library. There is no security relevance in the change itself.

Lower-priorityRemove alloc gate from Sequence FromStrby Mitchell Bagot · 3c98ea0d · Mar 7, 2026 · 1 fileMessage 68 · AdequateInformational 16Details
Commit message · Mitchell Bagot

Remove alloc gate from Sequence FromStr

The macro used to implement FromStr on Sequence already includes the
correct gating internally, meaning the gating on the macro invocation
needlessly restricts the features.

Remove alloc gate on Sequence FromStr impl.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 16/100

This commit removes an unnecessary feature gate so that parsing a Sequence value from a string works in more build configurations. It is a code-cleanup/feature-availability change, not a security fix.

Security candidateDowngrade the minimum version of cpufeaturesby Tobin C. Harding · 010c7c9f · Mar 7, 2026 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · Tobin C. Harding

Downgrade the minimum version of cpufeatures

The update script does this and it is slightly confusing when it
showings up in unrelated PRs.

Run `just ulf`.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
update trust
AI analysis · Informational 15/100

This commit only lowers the minimum required version of a small helper crate called `cpufeatures` in a lockfile used for testing the oldest supported dependency versions. It is a routine housekeeping change with no security relevance.

Lower-priorityUpdate the API text filesby Tobin C. Harding · 349344d9 · Mar 6, 2026 · 4 filesMessage 45 · ThinInformational 15Details
Commit message · Tobin C. Harding

Update the API text files

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only updates generated API text files that list what functions and types are publicly visible in the library. It removes entries for some encoder constructors and adds a couple of auto-trait implementations. There is no actual source code change, so it cannot introduce a security vulnerability by itself.

Lower-priorityconsensus_encoding: Improve macro defined constructorby Tobin C. Harding · 0747909c · Mar 6, 2026 · 1 fileMessage 85 · StrongInformational 22Details
Commit message · Tobin C. Harding

consensus_encoding: Improve macro defined constructor

The constructor created by the `encoder_newtype` macro is currently
using the passed in visability modifier. In released code it was
`pub`.

So as not to violate the new type pattern we should not add a public
constructor that ties an encoder to the inner type. This is
functionally the same as making the inner field public.

The constructor is however useful because it saves one having to
explicitly construct the `PhantomData` object. Since construction of
an encoder can be done by calling `encoder` there isn't typically a
need for a public constructor.

Make the constructor defined by `encoder_newtype!` use visability
`pub(crate)`.

This is an API breaking change that bubbles up through all types that
implement `Encodable`.

While we are at it make the function `const` and throw a full stop on
the, admittedly private, docs.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 22/100

This commit narrows the visibility of a Rust macro-generated constructor from public to internal-only (pub(crate)). It is described by the author as an API-hardening change to avoid exposing a constructor that would effectively let callers bypass the 'newtype' wrapper pattern. There is no direct evidence in the commit of an exploitable security vulnerability; it is a defensive design improvement.

Lower-priorityprimitives: Update API filesby Mitchell Bagot · 19b8decc · Mar 3, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Mitchell Bagot

primitives: Update API files

Update the api files using "just check-api"

50/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only updates a generated API text file to reflect two newly added auto-derived marker trait implementations (UnsafeUnpin) for internal decoder types. There is no code change, no behavior change, and no security relevance.

Lower-priorityUpdate the API text filesby Tobin C. Harding · f5717d22 · Mar 3, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Tobin C. Harding

Update the API text files

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only updates a generated API text file to reflect two newly added auto-derived marker trait implementations (UnsafeUnpin) for internal decoder types. There is no code change, no functional change, and no security relevance.

Lower-priorityUpgrade nightly toolchainby Tobin C. Harding · 4f3050f4 · Mar 3, 2026 · 1 fileMessage 58 · ThinInformational 15Details
Commit message · Tobin C. Harding

Upgrade nightly toolchain

Same as the bot did in #5734. Done manually now we have the lints
fixed.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This commit simply updates the Rust nightly compiler version used by the project from one recent date to another (2026-02-21 to 2026-02-27). It is a routine maintenance change with no security relevance visible in the diff or commit message.

AI review queuedDo not call into_iterby Tobin C. Harding · fb006eb4 · Mar 3, 2026 · 1 fileMessage 51 · ThinInformational 15Details
Commit message · Tobin C. Harding

Do not call into_iter

Found by clippy and the new nightly toolchain update in (#5743).

No need to explicitly call `into_iter`.

51/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This is a minor code cleanup commit. It removes unnecessary `.into_iter()` calls in three places where Rust will automatically handle iteration. The behavior of the code is unchanged, and there is no security issue.

Lower-priorityIterate on just the map valuesby Tobin C. Harding · 763fe273 · Mar 3, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Tobin C. Harding

Iterate on just the map values

Found by clippy and the new nightly toolchain update in (#5743).

No logic change.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This is a trivial code cleanup: a test was iterating over key-value pairs of a map and ignoring the key, and it was changed to iterate over just the values. The commit explicitly says 'No logic change' and the diff confirms it. There is no security issue.

Security candidatehashes: write padding directly into the bufferby jrakibi · 5668a0aa · Mar 3, 2026 · 4 filesMessage 68 · AdequateInformational 12Details
Commit message · jrakibi

hashes: write padding directly into the buffer

we're calling input() 4 times just for padding. Instead, write
directly into the buffer and call process_blocks.

this is 7.7% faster against master on 10 byte inputs and
1.3% faster compared to the prev patch.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive path
AI analysis · Informational 12/100

This commit is a performance optimization for the finalization step of several cryptographic hash functions (RIPEMD-160, SHA-1, SHA-256, SHA-512). It rewrites how padding bytes are added so the code writes directly into an internal buffer instead of calling the general input() function multiple times. The commit message and diff show only speed improvements; there is no indication of a security fix or behavior change in the hash output.

Lower-priorityAdd `arbitrary` to the list of Cargo featuresby Shing Him Ng · 4ea21cd7 · Mar 3, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Shing Him Ng

Add `arbitrary` to the list of Cargo features

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only adds a one-line documentation comment listing the existing `arbitrary` Cargo feature in the crate's documentation. It does not change any code, dependencies, build configuration, or behavior. There is no security relevance.

Security candidatehashes: remove unused `cmp` importsby jrakibi · c19651a5 · Mar 3, 2026 · 5 filesMessage 60 · AdequateInformational 15Details
Commit message · jrakibi

hashes: remove unused `cmp` imports

we no longer use use `cmp::min in engine_input_impl

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit simply removes unused `cmp` (comparison) imports from five hash algorithm files in the `hashes` crate. It is a cleanup change with no functional effect and no security relevance.

Lower-priorityconsensus_encoding: Slightly improve docs on macrosby Tobin C. Harding · bc72c4d5 · Mar 2, 2026 · 1 fileMessage 65 · AdequateInformational 15Details
Commit message · Tobin C. Harding

consensus_encoding: Slightly improve docs on macros

In preparation for 1.0-ing this crate do some minor improvements to
the encoder newtype macros.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit only changes documentation comments for two Rust macros. It rewrites the docstrings to be clearer and adds a cross-reference between related macros. No code logic, behavior, or security properties were modified.

Lower-priorityAdd whitespace before braceby Tobin C. Harding · 7f820ec1 · Mar 2, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Tobin C. Harding

Add whitespace before brace

To stop those of use with OCD twitching when we read the code.

No logic change.

50/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit only adds a single space before the opening brace in two Rust macro definitions. It is a purely cosmetic code-style change with no effect on program behavior or security.

Security candidate2026-03-01 automated rustfmt nightlyby Fmt Bot · 200b6ef0 · Mar 1, 2026 · 23 filesMessage 45 · ThinInformational 15Details
Commit message · Fmt Bot

2026-03-01 automated rustfmt nightly

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet pathparser or protocol path
AI analysis · Informational 15/100

This commit is a routine automated code-formatting run by the rustfmt tool. It only changes whitespace, import order, line breaks, and other stylistic details across 23 files. No program logic, algorithms, or security-sensitive behavior was altered.

Lower-priorityhashes: remove duplicate sha3-256 vectorsby jrakibi · 6fc70561 · Mar 1, 2026 · 1 fileMessage 70 · AdequateInformational 15Details
Commit message · jrakibi

hashes: remove duplicate sha3-256 vectors

These test vectors are duplicated and already covered
by NIST .rsp files

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit simply deletes a large block of duplicate test data for the SHA3-256 hashing code. The same test cases are already covered by official NIST test files elsewhere in the project. No production code was changed, so this cannot introduce or fix a security vulnerability.

Lower-priorityhashes: Add chunk-combination testsby jrakibi · 8e76922e · Mar 1, 2026 · 1 fileMessage 86 · StrongInformational 15Details
Commit message · jrakibi

hashes: Add chunk-combination tests

For a hash with block size B, we build a deterministic byte array of size
`3 * (B + 1)` and test every (i, j, k) combination in `0..=B` across three
engine.input() calls.
This will help us catch streaming bugs that incremental byte-by-byte checks can miss,
especially block-boundary transitions, empty chunks, and buffering bugs. 

inspired by `ring` `test_i_u_f` tests:
https://github.com/briansmith/ring/commit/5daff2c0e1bb8ef00e44e15b0531dda0b69d0ec5


These tests are slow (`(B + 1)^3` combinations per algo) so I put them to
run only in release mode

86/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This commit only adds new test code. It does not change any production hashing logic, fix a bug, or introduce a vulnerability. The new tests verify that feeding data to hash engines in three chunks of varying sizes produces the same result as hashing the same data all at once, which helps catch streaming bugs in the future but is not itself a security change.

Security candidatehashes: Add NIST CAVP test vectorsby jrakibi · e27977ce · Mar 1, 2026 · 13 filesMessage 78 · AdequateInformational 15Details
Commit message · jrakibi

hashes: Add NIST CAVP test vectors

Add SHAVS test vectors for SHA-1, SHA-256, SHA-384, SHA-512,
SHA-512/256, and SHA3-256.
Each hash is tested with both one-shot and byte-by-byte incremental
hashing against official ShortMsg and LongMsg .rsp files

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidencecryptography-sensitive path
AI analysis · Informational 15/100

This commit only adds new test data and test code. It imports official NIST cryptographic test vectors for several hash algorithms and writes tests that compare the library's output against those known correct answers. There is no change to the actual hashing code, no bug fix, and no security-relevant behavior change.

Lower-priorityhashes: bypass copying into the bufferby jrakibi · fa0fd6ad · Feb 28, 2026 · 1 fileMessage 68 · AdequateInformational 12Details
Commit message · jrakibi

hashes: bypass copying into the buffer

Pass full blocks from the input directly to `process_blocks`
instead of copying them into the internal buffer first.

the new flow:
- if input won't complete a block, copy into the buffer and return
- if there's a partial buffer, complete it and process
- pass remaining full blocks directly from the input to `process_blocks` (zero-copy)
- buffer the final remainder

Benchmark on this patch against mater for 10 bytes inputs:

master at 1ff80cf:
sha256/engine_input/10 time: [201.47 ns 203.54 ns 206.62 ns]

this patch
sha256/engine_input/10 time: [189.64 ns 190.17 ns 190.77 ns]

~6.6% faster on small inputs

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 12/100

This commit is a performance optimization for the SHA-256 hashing code in the rust-bitcoin library. It changes how input data is fed into the hashing engine so that complete blocks of data are processed directly from the input slice instead of being copied into an internal buffer first. The commit message and diff show only benchmark improvements and no security-related claims.

Security candidatehashes: rename process_block to process_blocksby jrakibi · ab9214cf · Feb 28, 2026 · 6 filesMessage 60 · AdequateInformational 15Details
Commit message · jrakibi

hashes: rename process_block to process_blocks

this will allow us later to process one or more 64-byte blocks
in a single call.

only refactoring, no logic changes

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This is a routine code cleanup in the project's hash functions. A single-block helper was renamed and adjusted so it can later accept multiple blocks at once. The actual hashing math and behavior are unchanged, and the commit message explicitly says it is only refactoring with no logic changes.