rust-bitcoin

crypto: use constant-time equality for Poly1305 tags

Currently, the `decrypt` method uses the standard `==` operator for tag verification, which is vulnerable to timing attacks

### Changes
- Introduced a helper function `constant_time_eq` that iterates through the entire 16-byte tag regardless of where a mismatch occurs as constant-time alternative.

This change ensures that the decryption process is secure against side-channel timing leaks.

Fixes #6122

Add with_compressedness to LegacyPublicKey

At present, to convert a compressed LegacyPublicKey to an uncompressed
copy, a user must either to use from_secp_uncompressed(key.to_inner())
or roundtrip serialize-deserialize. Neither of these are ideal. To
avoid users touching the secp types directly, we can copy the pattern
used for parity in XOnlyPublicKey's with_parity.

Introduce with_compressedness method on LegacyPublicKey to set
compressedness.

crypto: Remove with_serialized from LegacyPublicKey

The with_serialized method on LegacyPublicKey has been used for
serialising the legacy public key in an optionally compressed form
without allocating a vec. With the introduction of the
SerialisedLegacyPublicKey type, the to_bytes() method can now trivially
replace this method with a simpler interface.

Replace all uses of with_serialized with to_bytes and remove method
from LegacyPublicKey.

crypto: Fix lint errors in crypto::taproot

Following the move to crypto, the stricter lint requirements now
trigger various problems with the module that should be fixed.

Fix all lint errors in the crypto::taproot module.

crypto: Move taproot errors into submodule

Now that the taproot module in crypto is publicly visible, it should
be update to follow the patterns of other crates in the workspace
regarding the use of error submodules.

Move error types to error submodule and re-export.

Move taproot signatures to crypto

As part of the move of types to crypto, the taproot signatures should
also be moved to the crypto crate.

Move taproot module to crypto and re-export signatures and errors in
bitcoin.

Remove io dependency from crypto taproot

The taproot module in bitcoin's crypto holds only the Signature and
SerializedSignature types. In order to retain the lack of io dep in
crypto, the io based methods on these types should be removed, as they
were on the corresponding ecdsa signature types.

Remove Signature::serialize_to_writer and SerializedSignature::write_to
methods.

Update API files

Simplify `Decodable` trait

The `Decodable` trait already required that a decoder can be created
without providing any extra arguments and it required that the output of
the decoder is `Self`, implying that no decoder can be reused for
different types.

We observe that simply requiring that `Decoder` impls `Default` is
practically the same thing - requires constructibility without
arguments. By bounding `Decoder` on `Default` in addition to `Decoder`
and providing a default implementation of the method we simplify the
implementations: they now only need to impl `Default` which often can be
derived and specify the associated decoder type.

Remove now-useless overrides of `decoder`

The previous commit added a default impl for the `decoder` method which
renders the existing ones uselsess overrides. This commit simply removes
all of them.

Update manifest and github yaml

In order to reduce the diff in the previous patch, the actual changes
generated by the generate-files.sh script should be split into a new
patch.

Run fuzz/generate-files.sh.

crypto: Make trivial types no-alloc

Having just moved from bitcoin, the code in crypto is all written
assuming the presence of alloc. In the new crate, it is better if the
alloc feature can be used correctly, and have most of the functionality
enabled even in a no-alloc environment.

Remove alloc feature from the modules and only alloc gate things which
can't trivially be used no-alloc.

Make unrecognized field of SighashTypeParseError an InputString

At present, the entire SighashTypeParseError type relies on alloc due
to the presence of the String field "unrecognized". The InputString
in internals is designed to replace such fields and conditionally
enables or disables typical string functionality depending on alloc.

Replace the unrecognized field of SighashTypeParseError with
InputString. Adjust Display impl of SighashTypeParseError accordingly.

Move sighashtype FromStr tests to crypto

The EcdsaSighashType and TapSighashType FromStr tests are currently
located in bitcoin. This means testing regressions to the FromStr impl
requires running a significantly larger test set for no reason. These
should be located alongside the impls themselves in crypto.

Move sighashtype_fromstr_display tests to crypto::sighash.

Implement Serde traits for ArrayVec

This implementation is a prerequisite for the serde traits
impl for `WitnessVersion` and `WitnessProgram`.

Add tests covering round-trip serialization, capacity overflow errors,
and wire-format compatibilitywith slices using both JSON and Bincode.

Update API files

fuzz: remove psbt fuzz targets and document explicit local bitcoin dependency

p2p: add V1MessageHeader constructor

Adds a constructor to `V1MessageHeader` which also computes the 4 byte
checksum as defined by protocol docs. This constructor is used to
compose a network header that can be transmitted over the network stream.

Any network message (payload) must be directly preceded in the network
stream by a header. In that way, the receiving client knows how many
bytes to read, and what message to interpret.

A working code example might be a Pong response:
```
let message = bitcoin_p2p_messages::message::Pong(nonce);
let msg_header = V1MessageHeader::new(magic, &message, "pong");

// write the header to stream
encoding::encode_to_writer(&msg_header, &stream);

// write message to stream
encoding::encode_to_writer(&message, &stream);
```

Note that Currently, CommandString wraps a Cow<'static, str>, so the
lifetime of `cmd` must match the static lifetime. However, the protocol
documents define this as a 12 byte field, so this can and should be
changed at some point.

The fields defined in `V1MessageHeader` is the first four fields of a
message structure. An example given in the docs of message header is
given as:

```
Message Header:
F9 BE B4 D9 - Main network magic bytes
76 65 72 73 69 6F 6E 00 00 00 00 00 - "version" command
64 00 00 00 - Payload is 100 bytes long
35 8d 49 32 - payload checksum (byte order)
```

crypto: Change to_public_key to return FullPublicKey

In general, modern bitcoin code should be using either the compressed
FullPublicKey or the XOnlyPublicKey. Users should try to avoid the
legacy optionally-compressed public key. To this end, the types were
renamed. To further consolidate this, the to_public_key methods
throughout the key module should also return FullPublicKey, with the
existing behaviour relegated to new to_legacy_public_key.

Change all to_public_key functions to return FullPublicKey and
introduce corresponding to_legacy_public_key functions to return
LegacyPublicKey where necessary.

bitcoin: cut down on exact_features test matrixes

The Github CI runner is timing out when running all the feature sets
on the older MSRV compiler. The current list of exact_features in the
bitcoin crate was a conserative "include everything" when we switched
over to cargo-rbmt. This cuts it down ~50% and focuses on core
interactions we want to always cover. This puts more responsibilites on
cargo-rbmt's random feature subsets it runs on every commit.

crypto: Remove unused test from ecdsa

In ecdsa, the write_serialized_signature test was used to test the
serialize_to_writer method on the ecdsa::Signature. Since this was
removed as part of the bitcoin-io dep removal, the test should also
be removed.

Remove write_serialized_signature test case from ecdsa tests module.

Re-name consensus_encoding main traits

When we did the first implementation of the `consensus_encoding` crate
we used the same names for the public traits as the old encoding code.

In hindsight we should have used the more Rusty terms `Encode` and
`Decode` instead of `Encodable` and `Decodable`.

Bonus points the new names are easier to spell.

Do trivial-ish rename. Leave the `EncodableBytesIter` as is because
the fix to it is non-trivial. Leave the old encoding traits as they
are because they are destined for the grave very soon anyways.

crypto: Bump version to 0.2.0

Bump the `crypto` version. Update the dep in `bitcoin` and add an
explicit version number in `taproot-primitives`.

In preparation add a changelog entry, bump the version number, and
update the lock files.

Delete psbt module

In #6055 we deprecated the `psbt` module on the `0.32.x` branch. Now
we can delete it from master.

### Context

Development of the PSBT has moved to a separate crate. Hosted on the
new Forgejo instance at:

https://git.rust-bitcoin.org/rust-bitcoin/rust-psbt

Crate name is `psbt-v2` because it has initial support for PSBTv2. The
crate also includes all code from the `0.32.x` branch (as well as
miniscript code). In other words the crate is a drop in replacement
for the `Psbt` type and its functionality.

During release of `psbt-v2 v0.3.0` we attempted to ensure feature
parity with `0.32.x` since the actual migration was done a while back.

The road map for dev of `psbt-v2` is loosely:

- Improve PSBTv2 stuff
- Continue work on supporting Silent Payments
- Use crate as a test bed for the process of upgrade of `bitcoin 0.32.x`


Exact strategy of the last point is being worked on. We are
investigating creating a bunch of step-by-step releases to help the
process. To prove (and develop) the process we plan on using:

- miniscript
- psbt-v2
- corepc

fuzz: Migrate p2p fuzz targets to new encoding