Informational 15 Bitcoin Committed Sep 9, 2025 · 10:25 UTC

refactor: Fix includes in `crypto` directory

bdb8eadc View source ↗

Public commit record

What the developer wrote

Authored by Hennadii Stepanov

88/100 · Strong

refactor: Fix includes in `crypto` directory

IWYU issue #1763 appears to be a corner case, so it has been addressed
using a local pragma rather than a global mapping.

✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference

The short version

What changed, and why it matters

This commit is a routine code cleanup that adjusts which header files are included in the cryptographic source files. It does not change any program logic, algorithms, or security behavior. The goal is to make the include lists match what the compiler actually needs, which helps maintainability and tooling but has no direct security impact.

Recommended action

No security action required. Treat as normal refactoring and review for build/tooling correctness only.

Security signals we found

No strong security signals were identified.

Technical analysis

Evidence from the diff

The commit refactors #include directives across the src/crypto directory and the IWYU mapping file. It replaces project-local span.h with the standard header, moves some includes from headers into implementation files, removes unused headers, and adds IWYU pragma mappings for compiler intrinsics and libc symbols. No functional code, constants, or cryptographic operations were modified.

Changed components

src/crypto/chacha20.cppsrc/crypto/chacha20.hsrc/crypto/chacha20poly1305.hsrc/crypto/hex_base.cppsrc/crypto/hex_base.hsrc/crypto/hkdf_sha256_32.cppsrc/crypto/hkdf_sha256_32.hsrc/crypto/hmac_sha256.cppsrc/crypto/hmac_sha256.hsrc/crypto/hmac_sha512.cppsrc/crypto/hmac_sha512.hsrc/crypto/muhash.cppsrc/crypto/muhash.hsrc/crypto/poly1305.cppsrc/crypto/poly1305.hsrc/crypto/sha256.cppsrc/crypto/sha256_arm_shani.cppsrc/crypto/sha256_sse4.cppsrc/crypto/sha256_x86_shani.cppsrc/crypto/sha3.cppsrc/crypto/sha3.hsrc/crypto/siphash.cppsrc/crypto/siphash.hcontrib/devtools/iwyu/bitcoin.core.imp

Inspect captured patch +48 / −32

diff --git a/contrib/devtools/iwyu/bitcoin.core.imp b/contrib/devtools/iwyu/bitcoin.core.imp
index c4c4ba4c..789abcda 100644
--- a/contrib/devtools/iwyu/bitcoin.core.imp
+++ b/contrib/devtools/iwyu/bitcoin.core.imp
@@ -1,3 +1,11 @@
-# Nothing for now.
 [
+  # Compiler intrinsics.
+  # See: https://github.com/include-what-you-use/include-what-you-use/issues/1764.
+  { "include": [ "<emmintrin.h>", "private", "<immintrin.h>", "public" ] },
+  { "include": [ "<smmintrin.h>", "private", "<immintrin.h>", "public" ] },
+  { "include": [ "<tmmintrin.h>", "private", "<immintrin.h>", "public" ] },
+
+  # libc symbols.
+  { "symbol": ["AT_HWCAP", "private", "<sys/auxv.h>", "public"] },
+  { "symbol": ["AT_HWCAP2", "private", "<sys/auxv.h>", "public"] },
 ]
diff --git a/src/crypto/chacha20.cpp b/src/crypto/chacha20.cpp
index 91064050..6bdffe69 100644
--- a/src/crypto/chacha20.cpp
+++ b/src/crypto/chacha20.cpp
@@ -8,11 +8,10 @@
 #include <crypto/common.h>
 #include <crypto/chacha20.h>
 #include <support/cleanse.h>
-#include <span.h>
 
 #include <algorithm>
 #include <bit>
-#include <cstring>
+#include <cassert>
 
 #define QUARTERROUND(a,b,c,d) \
   a += b; d = std::rotl(d ^ a, 16); \
diff --git a/src/crypto/chacha20.h b/src/crypto/chacha20.h
index 6653c2c9..15035621 100644
--- a/src/crypto/chacha20.h
+++ b/src/crypto/chacha20.h
@@ -5,12 +5,11 @@
 #ifndef BITCOIN_CRYPTO_CHACHA20_H
 #define BITCOIN_CRYPTO_CHACHA20_H
 
-#include <span.h>
-
 #include <array>
 #include <cstddef>
 #include <cstdint>
-#include <cstdlib>
+#include <iterator>
+#include <span>
 #include <utility>
 
 // classes for ChaCha20 256-bit stream cipher developed by Daniel J. Bernstein
diff --git a/src/crypto/chacha20poly1305.h b/src/crypto/chacha20poly1305.h
index a6c3a668..9a863dda 100644
--- a/src/crypto/chacha20poly1305.h
+++ b/src/crypto/chacha20poly1305.h
@@ -7,10 +7,10 @@
 
 #include <cstddef>
 #include <cstdint>
+#include <span>
 
 #include <crypto/chacha20.h>
 #include <crypto/poly1305.h>
-#include <span.h>
 
 /** The AEAD_CHACHA20_POLY1305 authenticated encryption algorithm from RFC8439 section 2.8. */
 class AEADChaCha20Poly1305
diff --git a/src/crypto/hex_base.cpp b/src/crypto/hex_base.cpp
index e2eccf55..7098aba7 100644
--- a/src/crypto/hex_base.cpp
+++ b/src/crypto/hex_base.cpp
@@ -5,8 +5,10 @@
 #include <crypto/hex_base.h>
 
 #include <array>
+#include <cassert>
 #include <cstring>
 #include <string>
+#include <tuple>
 
 namespace {
 
diff --git a/src/crypto/hex_base.h b/src/crypto/hex_base.h
index 704b19f8..9975f7f6 100644
--- a/src/crypto/hex_base.h
+++ b/src/crypto/hex_base.h
@@ -9,6 +9,7 @@
 
 #include <cstddef>
 #include <cstdint>
+#include <span>
 #include <string>
 
 /**
diff --git a/src/crypto/hkdf_sha256_32.cpp b/src/crypto/hkdf_sha256_32.cpp
index e6224944..3cd2cf88 100644
--- a/src/crypto/hkdf_sha256_32.cpp
+++ b/src/crypto/hkdf_sha256_32.cpp
@@ -4,8 +4,9 @@
 
 #include <crypto/hkdf_sha256_32.h>
 
+#include <crypto/hmac_sha256.h>
+
 #include <cassert>
-#include <cstring>
 
 CHKDF_HMAC_SHA256_L32::CHKDF_HMAC_SHA256_L32(const unsigned char* ikm, size_t ikmlen, const std::string& salt)
 {
diff --git a/src/crypto/hkdf_sha256_32.h b/src/crypto/hkdf_sha256_32.h
index f9f343b4..7c5d5a7f 100644
--- a/src/crypto/hkdf_sha256_32.h
+++ b/src/crypto/hkdf_sha256_32.h
@@ -5,10 +5,8 @@
 #ifndef BITCOIN_CRYPTO_HKDF_SHA256_32_H
 #define BITCOIN_CRYPTO_HKDF_SHA256_32_H
 
-#include <crypto/hmac_sha256.h>
-
-#include <cstdint>
-#include <cstdlib>
+#include <cstddef>
+#include <string>
 
 /** A rfc5869 HKDF implementation with HMAC_SHA256 and fixed key output length of 32 bytes (L=32) */
 class CHKDF_HMAC_SHA256_L32
diff --git a/src/crypto/hmac_sha256.cpp b/src/crypto/hmac_sha256.cpp
index 03465206..a95ef708 100644
--- a/src/crypto/hmac_sha256.cpp
+++ b/src/crypto/hmac_sha256.cpp
@@ -4,6 +4,8 @@
 
 #include <crypto/hmac_sha256.h>
 
+#include <crypto/sha256.h>
+
 #include <cstring>
 
 CHMAC_SHA256::CHMAC_SHA256(const unsigned char* key, size_t keylen)
diff --git a/src/crypto/hmac_sha256.h b/src/crypto/hmac_sha256.h
index ea8cee88..a26947d5 100644
--- a/src/crypto/hmac_sha256.h
+++ b/src/crypto/hmac_sha256.h
@@ -7,8 +7,7 @@
 
 #include <crypto/sha256.h>
 
-#include <cstdint>
-#include <cstdlib>
+#include <cstddef>
 
 /** A hasher class for HMAC-SHA-256. */
 class CHMAC_SHA256
diff --git a/src/crypto/hmac_sha512.cpp b/src/crypto/hmac_sha512.cpp
index 245ed29e..f37e709d 100644
--- a/src/crypto/hmac_sha512.cpp
+++ b/src/crypto/hmac_sha512.cpp
@@ -4,6 +4,8 @@
 
 #include <crypto/hmac_sha512.h>
 
+#include <crypto/sha512.h>
+
 #include <cstring>
 
 CHMAC_SHA512::CHMAC_SHA512(const unsigned char* key, size_t keylen)
diff --git a/src/crypto/hmac_sha512.h b/src/crypto/hmac_sha512.h
index d6bebc09..dfae8d05 100644
--- a/src/crypto/hmac_sha512.h
+++ b/src/crypto/hmac_sha512.h
@@ -7,8 +7,7 @@
 
 #include <crypto/sha512.h>
 
-#include <cstdint>
-#include <cstdlib>
+#include <cstddef>
 
 /** A hasher class for HMAC-SHA-512. */
 class CHMAC_SHA512
diff --git a/src/crypto/muhash.cpp b/src/crypto/muhash.cpp
index 02c38c44..c04f58ec 100644
--- a/src/crypto/muhash.cpp
+++ b/src/crypto/muhash.cpp
@@ -7,11 +7,12 @@
 #include <crypto/chacha20.h>
 #include <crypto/common.h>
 #include <hash.h>
+#include <span.h>
+#include <uint256.h>
 #include <util/check.h>
 
 #include <bit>
-#include <cassert>
-#include <cstdio>
+#include <cstring>
 #include <limits>
 
 namespace {
diff --git a/src/crypto/muhash.h b/src/crypto/muhash.h
index f3409373..5e2be323 100644
--- a/src/crypto/muhash.h
+++ b/src/crypto/muhash.h
@@ -6,9 +6,12 @@
 #define BITCOIN_CRYPTO_MUHASH_H
 
 #include <serialize.h>
-#include <uint256.h>
 
+#include <cstddef>
 #include <cstdint>
+#include <span>
+
+class uint256;
 
 class Num3072
 {
diff --git a/src/crypto/poly1305.cpp b/src/crypto/poly1305.cpp
index c9c066b3..d6762a1f 100644
--- a/src/crypto/poly1305.cpp
+++ b/src/crypto/poly1305.cpp
@@ -5,8 +5,6 @@
 #include <crypto/common.h>
 #include <crypto/poly1305.h>
 
-#include <cstring>
-
 namespace poly1305_donna {
 
 // Based on the public domain implementation by Andrew Moon
diff --git a/src/crypto/poly1305.h b/src/crypto/poly1305.h
index 494f7cdd..af4aede2 100644
--- a/src/crypto/poly1305.h
+++ b/src/crypto/poly1305.h
@@ -8,8 +8,9 @@
 #include <span.h>
 
 #include <cassert>
+#include <cstddef>
 #include <cstdint>
-#include <cstdlib>
+#include <span>
 
 #define POLY1305_BLOCK_SIZE 16
 
diff --git a/src/crypto/sha256.cpp b/src/crypto/sha256.cpp
index d75d01b6..8ad9a85d 100644
--- a/src/crypto/sha256.cpp
+++ b/src/crypto/sha256.cpp
@@ -10,7 +10,7 @@
 #include <cstring>
 
 #if !defined(DISABLE_OPTIMIZED_SHA256)
-#include <compat/cpuid.h>
+#include <compat/cpuid.h> // IWYU pragma: keep
 
 #if defined(__linux__) && defined(ENABLE_ARM_SHANI)
 #include <sys/auxv.h>
diff --git a/src/crypto/sha256_arm_shani.cpp b/src/crypto/sha256_arm_shani.cpp
index 2ea1d9c2..a778e871 100644
--- a/src/crypto/sha256_arm_shani.cpp
+++ b/src/crypto/sha256_arm_shani.cpp
@@ -13,7 +13,6 @@
 #include <array>
 #include <cstdint>
 #include <cstddef>
-#include <arm_acle.h>
 #include <arm_neon.h>
 
 namespace {
diff --git a/src/crypto/sha256_sse4.cpp b/src/crypto/sha256_sse4.cpp
index d0a34934..3de30f74 100644
--- a/src/crypto/sha256_sse4.cpp
+++ b/src/crypto/sha256_sse4.cpp
@@ -5,11 +5,11 @@
 // This is a translation to GCC extended asm syntax from YASM code by Intel
 // (available at the bottom of this file).
 
+#if defined(__x86_64__) || defined(__amd64__)
+
 #include <cstdint>
 #include <cstdlib>
 
-#if defined(__x86_64__) || defined(__amd64__)
-
 namespace sha256_sse4
 {
 void Transform(uint32_t* s, const unsigned char* chunk, size_t blocks)
diff --git a/src/crypto/sha256_x86_shani.cpp b/src/crypto/sha256_x86_shani.cpp
index 5ee957aa..daccdc51 100644
--- a/src/crypto/sha256_x86_shani.cpp
+++ b/src/crypto/sha256_x86_shani.cpp
@@ -8,6 +8,7 @@
 
 #if defined(ENABLE_SSE41) && defined(ENABLE_X86_SHANI)
 
+#include <cstddef>
 #include <cstdint>
 #include <immintrin.h>
 
diff --git a/src/crypto/sha3.cpp b/src/crypto/sha3.cpp
index 4c61bce5..f6844476 100644
--- a/src/crypto/sha3.cpp
+++ b/src/crypto/sha3.cpp
@@ -9,9 +9,9 @@
 #include <crypto/common.h>
 
 #include <algorithm>
-#include <array>
 #include <bit>
-#include <cstdint>
+#include <cassert>
+#include <iterator>
 #include <span>
 
 void KeccakF(uint64_t (&st)[25])
diff --git a/src/crypto/sha3.h b/src/crypto/sha3.h
index 7a538e4a..91cdb5ca 100644
--- a/src/crypto/sha3.h
+++ b/src/crypto/sha3.h
@@ -5,10 +5,9 @@
 #ifndef BITCOIN_CRYPTO_SHA3_H
 #define BITCOIN_CRYPTO_SHA3_H
 
-#include <span.h>
-
 #include <cstdint>
 #include <cstdlib>
+#include <span>
 
 //! The Keccak-f[1600] transform.
 void KeccakF(uint64_t (&st)[25]);
diff --git a/src/crypto/siphash.cpp b/src/crypto/siphash.cpp
index dda28a6c..1a9eb771 100644
--- a/src/crypto/siphash.cpp
+++ b/src/crypto/siphash.cpp
@@ -4,7 +4,11 @@
 
 #include <crypto/siphash.h>
 
+#include <uint256.h>
+
 #include <bit>
+#include <cassert>
+#include <span>
 
 #define SIPROUND do { \
     v0 += v1; v1 = std::rotl(v1, 13); v1 ^= v0; \
diff --git a/src/crypto/siphash.h b/src/crypto/siphash.h
index 4c6a39e0..8d41a083 100644
--- a/src/crypto/siphash.h
+++ b/src/crypto/siphash.h
@@ -6,9 +6,9 @@
 #define BITCOIN_CRYPTO_SIPHASH_H
 
 #include <cstdint>
+#include <span>
 
-#include <span.h>
-#include <uint256.h>
+class uint256;
 
 /** SipHash-2-4 */
 class CSipHasher

Risk score

Why this scored 15/100

Our methodology →

Potential impact 0/30

Exploitability 0/25

Stealth signal 0/15

Affected reach 0/15

Confidence 10/10

Evidence quality 5/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 15/100

Community notes

Related watches

test: test the result order of a multiple import request is correct

test: test invalid or missing timestamp throws importdescriptors

ci, iwyu: Enforce warning-free `src/common`