AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 15 Bitcoin

primitives: delete Script and ScriptSig

Public commit record

What the developer wrote

Authored by Andrew Poelstra

98/100 · Strong
primitives: delete Script and ScriptSig

This commit confirms that there is not a single untouched script instance
across the project; every one has been converted to a tagged script.

This triggers a number of doc changes which should have gone into previous
commits. I apologize for that. But it's a PITA to go back and locate exactly
which commit each doc change was supposed to go into.

In bitcoin/src/network/params.rs I changed the signet example to use a
WitnessScript. I wasn't sure if this script is interpreted as a witness
script or a scriptpubkey on Signet itself so I guessed.

In p2p/src/message.rs there is a "script" that is actually just a blob
of raw bytes (that happens to be a script) used in a "test" of the bloom
filter messages. See https://github.com/rust-bitcoin/rust-bitcoin/pull/580
where this was added for discussion about script vs bytes.

(BTW why did I let a bloom filtering PR into this project? This whole
system was a bad idea and a DoS vector. Is it even used?)
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This commit is a routine internal cleanup in the rust-bitcoin library. It removes the old untyped Script and ScriptBuf aliases and finishes switching all remaining code to use specific tagged script types (such as ScriptPubKey, ScriptSig, WitnessScript, etc.). There is no security vulnerability here; it is purely a refactoring change to make type usage more precise.

Recommended action

No security action needed. Treat as normal refactoring; verify downstream consumers no longer rely on the removed Script/ScriptBuf aliases before upgrading.

Security signals we found

No strong security signals were identified.

Risk score

Why this scored 15/100

Our methodology →
Potential impact 0/30
Exploitability 0/25
Stealth signal 0/15
Affected reach 0/15
Confidence 10/10
Evidence quality 5/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.