AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 18 Bitcoin

primitives: Remove hashes from the public API

Public commit record

What the developer wrote

Authored by Tobin C. Harding

80/100 · Strong
primitives: Remove hashes from the public API

Currently `hashes` is showing up in the public API because of our
usage of the `hashes::hash_newtype` macro.

Crate a private module `hash_types` and use a bit of trickery and
`include!` a `generic.rs` hash type implementation so we don't violate
the DRY principle.
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
The short version

What changed, and why it matters

This is a large internal refactoring of the rust-bitcoin library. It moves Bitcoin hash wrapper types (like transaction IDs and block hashes) into a new private module so that the lower-level `hashes` crate no longer appears directly in the public API. The visible behavior of the library is intended to stay the same. There is no obvious security vulnerability introduced, but any wide-reaching refactor carries a small risk of accidental behavioral changes in serialization or parsing.

Recommended action

Treat as a normal code-quality/API review. Verify that the new manual `Encodable`/`Decodable` implementations produce byte-identical output to the previous macro-generated ones for all affected hash types, and that the `include!("./generic.rs")` pattern correctly preserves `DISPLAY_BACKWARD`, serde, hex, and arbitrary trait behavior. No urgent security action is indicated.

Security signals we found

01

Large refactor touching consensus-critical hash types and their serialization

02

Manual replacement of macro-generated Encodable/Decodable impls for block/transaction/merkle hash types

03

New generic.rs included into multiple modules via include! — shared code path for hash type behavior

04

No explicit security claim or bug fix in commit message

Risk score

Why this scored 18/100

Our methodology →
Potential impact 2/30
Exploitability 1/25
Stealth signal 1/15
Affected reach 3/15
Confidence 8/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.