… group.h

069aba8 Fix sepc256k1 -> secp256k1 typo in group.h (henopied)

Pull request description:

ACKs for top commit:
  real-or-random:
    ACK 069aba8

Tree-SHA512: 0fcb7d042f201737870da99f5425c8449e9ec3f5f8e9bbe5eb719e46cdf230db057509fb9102d4ce50a94d616015233c29249665c754e726899174fea3ea9f40

This simplifies building without a build system.

This is in line with #925; the paths fixed here were either forgotten
there or only introduced later. This commit also makes the Makefile
stricter so that further "wrong" #include paths will lead to build
errors even in autotools builds.

This belongs to #929.

Co-authored-by: Hennadii Stepanov <32963518+hebasto@users.noreply.github.com>

… get rid of further -I arguments

40a3473 build: Fix #include "..." paths to get rid of further -I arguments (Tim Ruffing)

Pull request description:

  This simplifies building without a build system.

  This is in line with #925; the paths fixed here were either forgotten
  there or only introduced later. This commit also makes the Makefile
  stricter so that further "wrong" #include paths will lead to build
  errors even in autotools builds.

  This belongs to #929.

ACKs for top commit:
  hebasto:
    ACK 40a3473

Tree-SHA512: 6f4d825ea3cf86b13f294e2ec19fafc29660fa99450e6b579157d7a6e9bdb3404d761edf89c1135fa89b984d6431a527beeb97031dc90f2fae9761528f4d06d1

Running the RNG is pointless if no seed is available because the key
will be fixed. The computation just wastes time.

Previously, users could avoid this computation at least by asking for
a context without signing capabilities. But since 3b0c218 we always
build an ecmult_gen context, ignoring the context flags. Moreover,
users could never avoid this pointless computation when asking for
the creation of a signing context.

Whenever I read this code, I first think that rescaling ctx->initial is
a dead store because we overwrite it later with gb. But that's wrong.
The rescaling blinds the computation of gb and affects its result.

This simplifies manual builds and solves one item in #929.

… blinding if no seed is available

55f8bc9 ecmult_gen: Improve comments about projective blinding (Tim Ruffing)
7a86955 ecmult_gen: Simplify code (no observable change) (Tim Ruffing)
4cc0b1b ecmult_gen: Skip RNG when creating blinding if no seed is available (Tim Ruffing)

Pull request description:

  Running the RNG is pointless if no seed is available because the key
  will be fixed. The computation just wastes time.

  Previously, users could avoid this computation at least by asking for
  a context without signing capabilities. But since 3b0c218 we always
  build an ecmult_gen context, ignoring the context flags. Moreover,
  users could never avoid this pointless computation when asking for
  the creation of a signing context.

  This fixes one item in #1065.

ACKs for top commit:
  sipa:
    ACK 55f8bc9
  apoelstra:
    ACK 55f8bc9

Tree-SHA512: 5ccba56041f94fa8f40a8a56ce505369ff2e0ed20cd7f0bfc3fdfffa5fa7bf826a93602b9b2455a352865a9548ab4928e858c19bb5af7ec221594a3bf25c4f3d

It's unused and thus potentially confusing.

…probability 15/16 instead of 1/4

17065f4 tests: Randomize the context with probability 15/16 instead of 1/4 (Tim Ruffing)

Pull request description:

ACKs for top commit:
  sipa:
    ACK 17065f4
  jonasnick:
    ACK 17065f4

Tree-SHA512: 3b7005770007b922a294be610f23da60b0dde74dfd7585d64a2cb04eaa6ec879de8d21a0ade31c1857019a8dd97260fa3aa167ae16fc55027ef280a3e3feaa6d

…for ECMULT_* config values

c27ae45 config: Remove basic-config.h (Tim Ruffing)
da6514a config: Introduce DEBUG_CONFIG macro for debug output of config (Tim Ruffing)
d0cf55e config: Set preprocessor defaults for ECMULT_* config values (Tim Ruffing)

Pull request description:

ACKs for top commit:
  sipa:
    ACK c27ae45
  hebasto:
    ACK c27ae45, I have reviewed the code and it looks correct.
  jonasnick:
    ACK c27ae45

Tree-SHA512: 56b0f384bd9f42cf7c903bec08f4807db1415ddf9a06676dfe1e638e4d02431c522ef0422585e85429074e0dbb51da4f400cf53e8f883d6e07122731c57be1e3

We had removed `PKG_PROG_PKG_CONFIG` in 21b2eba
(#1090). But then then the not rebased (!) merge of 2be6ba0
(#1084) brought that macro back at another location, without git
complaining about a conflict.

Fixes #1127.

… again (reintroduced by mismerge)

cabe085 configure: Remove pkgconfig macros again (reintroduced by mismerge) (Tim Ruffing)

Pull request description:

  We had removed `PKG_PROG_PKG_CONFIG` in 21b2eba
  (#1090). But then then the not rebased (!) merge of 2be6ba0
  (#1084) brought that macro back at another location, without git
  complaining about a conflict.

  Fixes #1127.

ACKs for top commit:
  fanquake:
    ACK cabe085
  hebasto:
    ACK cabe085
  jonasnick:
    ACK cabe085

Tree-SHA512: ba497503db3a11e631b15c4fe875e62d892971c2c708d90b2f6be684e85d164043ea97c13af0452831eef41f3cf8230cd8a9eafa332dc5b5ae18e118b87c3828

88b0089 readme: Fix line break (Tim Ruffing)
78f5296 readme: Sell "no runtime dependencies" (Tim Ruffing)
ef48f08 readme: Add IRC channel (Tim Ruffing)

Pull request description:

ACKs for top commit:
  apoelstra:
    utACK 88b0089
  sipa:
    ACK 88b0089

Tree-SHA512: 174f1596406f98a19059a18cd4fb993102e5ffb8ec29fcc6d03e27f135fcb526b37204b64055b5e4f0a273daab05d395cf335f26241cf3a29a060041c9ef109b

We don't enable the ECDSA recovery module, because we don't recommend
ECDSA recovery for new protocols. In particular, the recovery API is
prone to misuse: It invites the caller to forget to check the public
key (and the verification function always returns 1).

In general, we also don't recommend ordinary ECDSA for new protocols.
But disabling the ECDSA functions is not possible because they're not
in a module, and let's be honest: disabling ECDSA would mean to ignore
reality blatantly.

This reverts commit bceefd6.

The removed line was introduced for `obj/.gitignore` file. Since the
`obj` directory has been removed, it is not longer required.

f5039cb Cleanup `.gitignore` file (Hennadii Stepanov)
798727a Revert "Add test logs to gitignore" (Hennadii Stepanov)

Pull request description:

ACKs for top commit:
  jonasnick:
    ACK f5039cb
  real-or-random:
    ACK f5039cb

Tree-SHA512: 3586329e77958a9bfa06dd84e5b121cd456e93332670d5afc1a6691e165cdfa5a6fd6a61f82be12ec33f2a58b26a13adfedeb177ae1056202e53a530949fc549

$CC, $WRAPPER_CMD and valgrind are not necessarily defined

Currently CHECK is used only in test and bench mark files except for one
usage in `ecmult_impl.h`.

We would like to move the definition of CHECK out of `util.h` so that
`util.h` no longer has a hard dependency on `stdio.h`.

Done in preparation for moving the definition of `CHECK` as part of an
effort to allow secp256k1 to be compiled to WASM as part of
`rust-secp256k1`.

After this commit, int128.h and int128_impl.h are included as follows:
 - .c files which use int128 include int128_impl.h (after util.h)
 - .h files which use int128 include int128.h (after util.h)

This list is exhaustive. util.h needs to included first because it sets
up necessary #defines.

5c9f1a5 ci: always cat all logs_snippets (Jonas Nick)

Pull request description:

ACKs for top commit:
  real-or-random:
    ACK 5c9f1a5

Tree-SHA512: fc715c5fc4006d80a4b0c2faa8ef81ed23c4479614945ffa7c96665a3acc38fe956dd6d148bcf97043232ceee055b724ea9490e4ac4142a210e4488fed8dd299

…nd" irrelevant error

49ae843 ci: mostly prevent "-v/--version: not found" irrelevant error (Jonas Nick)

Pull request description:

ACKs for top commit:
  real-or-random:
    ACK 49ae843

Tree-SHA512: 2e048b037826dff372e26103f198e0d490494e7909d17d8632b51f6d9e0629b51bcd0b55b65b2c21d63d522394ccfed481ce126cea165c087df670556bc8ccf6

… the job outside of CI

4e54c03 ci: print env to allow reproducing the job outside of CI (Jonas Nick)

Pull request description:

  Example output:

  ```
  WERROR_CFLAGS="-Werror -pedantic-errors"  MAKEFLAGS="-j4"  BUILD="check"  ECMULTWINDOW="auto"  ECMULTGENPRECISION="auto"  ASM="no"  WIDEMUL="int64"  WITH_VALGRIND="no"  EXTRAFLAGS=""  EXPERIMENTAL="no"  ECDH="no"  RECOVERY="yes"  SCHNORRSIG="no"  SECP256K1_TEST_ITERS=""  BENCH="yes"  SECP256K1_BENCH_ITERS="2"  CTIMETEST="yes"  EXAMPLES="yes"  WRAPPER_CMD=""  CC="gcc"  AR=""  NM=""  HOST=""  ./ci/cirrus.sh
  ```

ACKs for top commit:
  sipa:
    ACK 4e54c03
  real-or-random:
    ACK bitcoin-core/secp256k1@4e54c03

Tree-SHA512: b74a8724e72b3de7884e4d93fe933dc5043aec37020672b7997a8faebda3b0cbbba1bca69c344109729261ab4a94e76f4eca0d8773dc101a443fdf9e0d7d54f5

…t file

6a965b6 Remove usage of CHECK from non-test file (Tobin C. Harding)

Pull request description:

  Currently CHECK is used only in test and bench mark files except for one usage in `ecmult_impl.h`.

  We would like to move the definition of CHECK out of `util.h` so that `util.h` no longer has a hard dependency on `stdio.h`.

  Done as part of an effort to allow secp256k1 to be compiled to WASM as part of `rust-secp256k1`.

  ### Note to reviewers

  Please review carefully, I don't actually know if this patch is correct. Done while working on #1095. I'm happy to make any changes both in concept and execution - I'm super rusty at C programming.

  cc real-or-random

ACKs for top commit:
  sipa:
    utACK 6a965b6
  real-or-random:
    utACK 6a965b6

Tree-SHA512: 6bfb456bdb92a831acd3bc202607e80f6d0a194d6b2cf745c8eceb12ba675d03a319d6d105332b0cbca474e443969295e5a8e938635453e21e057d0ee597440b

a340d95 ci: add int128_struct tests (Jonas Nick)
dceaa1f int128: Tidy #includes of int128.h and int128_impl.h (Tim Ruffing)
2914bcc Simulated int128 type. (Russell O'Connor)

Pull request description:

  Abstracts the int128 type and provides an native version, if available, or a implements it using a pair of int64_t's.

  This is activated by setting the configuration flag `--with-test-override-wide-multiply=int128_struct`.

  The primary purpose of this PR is to take advantage of MSVC's [umulh](https://docs.microsoft.com/en-us/cpp/intrinsics/umulh?view=msvc-170) intrinsic that we can use to simulate an int128 type which MSVC does not have (AFAIU). This PR lays out the groundwork for this level of MSVC support, but doesn't include the configuration logic to enable it yet.

  For completeness, and implementation of `umulh` and `mulh` are also provided for compilers that support neither the intrinsic nor the int128 type (such as CompCert?).  This also opens up the possibility of removing the 32-bit field and scalar implementations should that ever be desired.

ACKs for top commit:
  sipa:
    ACK a340d95
  jonasnick:
    ACK a340d95

Tree-SHA512: b4f2853fa3ab60ce9d77b4eaee1fd20c4b612850e19fcb3179d7e36986f420c6c4589ff72f0cf844f989584ace49a1cd23cca3f4e405dabefc8da647a0df679d

00a42b9 Add MSan CI job (Pieter Wuille)

Pull request description:

ACKs for top commit:
  real-or-random:
    utACK 00a42b9
  jonasnick:
    ACK 00a42b9

Tree-SHA512: 0b9ced572430e917041c916d8cda5c94996899a6e0a8c5a13f73f2c99b58b0098f7562cd758b48f18bec8c7095fab37980aa6dc2b139b2d1c293c965ea603686

Also add a corresponding CI job

99bd335 Make int128 overflow test use secp256k1_[ui]128_mul (Pieter Wuille)
3afce0a Avoid signed overflow in MSVC AMR64 secp256k1_mul128 (Pieter Wuille)
9b5f589 Heuristically decide whether to use int128_struct (Pieter Wuille)
63ff064 int128: Add test override for testing __(u)mulh on MSVC X64 (Tim Ruffing)
f2b7e88 Add int128 randomized tests (Pieter Wuille)

Pull request description:

  This is a follow-up to #1000:
  * Add randomized unit tests for int128 logic.
  * Add CI for the `_(u)mulh` code path (on non-ARM64 MSVC).
  * Add heuristic logic to enable int128_struct based arithmetic on 64-bit MSVC, or systems with pointers wider than 32 bits.
  * Fix signed overflow in ARM64 MSVC code.

ACKs for top commit:
  roconnor-blockstream:
    utACK 99bd335
  real-or-random:
    ACK 99bd335 tested this also on MSVC locally with the override, including all the benchmark binaries
  jonasnick:
    utACK 99bd335

Tree-SHA512: 5ea897362293b45a86650593e1fdc8c4004a1d9452eed2fa070d22dffc7ed7ca1ec50a4df61e3a33dbe35e08132ad9686286ac44af6742b32b82f11c9d3341c6

…default

41e8704 build: Enable some modules by default (Tim Ruffing)

Pull request description:

  This has been discussed in bitcoin-core/secp256k1#817 (comment) and I agree with the arguments brought up there.

  Alternatively, we could not enable them and add a discussion to the readme why we discourage people from using the modules. I believe enabling ECDH is not very controversial. But what about recovery? Do we want to leave it off and instead give a reason?

ACKs for top commit:
  sipa:
    ACK 41e8704
  jonasnick:
    ACK 41e8704

Tree-SHA512: 1dd21037043f2b2c94a92cd2f31e69b505ba5b43119897bc0934966d9ccd84fc4fc20e7509af634f1c3a096710db1a2253090f5f1f107b9d258945a5546e9ba4

a8494b0 Use compute credits for macOS jobs (Pieter Wuille)
c0ae48c Update macOS image for CI (Pieter Wuille)

Pull request description:

ACKs for top commit:
  real-or-random:
    ACK a8494b0
  jonasnick:
    ACK a8494b0

Tree-SHA512: af99585ef68fc8305785885efaf0a0ebe45e5765661d654523a36ba843fc83e0ac40a554638437fa53804e4aa42dbcd92d597702ee6225b66a044a6304bafd45

…ogenerated by sage [skip ci]

092be61 gitignore: Add *.sage.py files autogenerated by sage (Tim Ruffing)

Pull request description:

ACKs for top commit:
  jonasnick:
    ACK 092be61

Tree-SHA512: ee77e8634814ccc1894eb633816da877a4d4511d9e77f5628b19e0e37006d43ae45431dfd1b30977504a5975a92a2b1824ed53c7837fb5600994d11003996b86

and improve phrasing slightly.

4386a23 examples: Switch to NONE contexts (Tim Ruffing)
7289b51 docs: Use doxygen style if and only if comment is user-facing (Tim Ruffing)
e7d0185 docs: Get rid of "initialized for signing" terminology (Tim Ruffing)
0612636 docs: Tidy and improve docs about contexts and randomization (Tim Ruffing)
e02d686 selftest: Expose in public API (Tim Ruffing)
e383fbf selftest: Rename internal function to make name available for API (Tim Ruffing)
d2c6d48 tests: Use new name of static context (Tim Ruffing)
53796d2 contexts: Rename static context (Tim Ruffing)
72fedf8 docs: Improve docs for static context (Tim Ruffing)
316ac76 contexts: Deprecate all context flags except SECP256K1_CONTEXT_NONE (Tim Ruffing)
1a553ee docs: Change signature "validation" to "verification" (Tim Ruffing)
ee7341f docs: Never require a verification context (Tim Ruffing)

Pull request description:

ACKs for top commit:
  sipa:
    utACK 4386a23
  jonasnick:
    ACK 4386a23

Tree-SHA512: 7bf07dfae0ecbf7de1418de64ef743a23dc5f244aeba2c1cf3ecbdc117d6ac12bb6c8f17f739605566074a9b901765ee4a32288b6edc6f9a0040a70cb472f6ee

…ith NONE in benchmarks and tests

d6dc0f4 tests: Switch to NONE contexts in module tests (Jonas Nick)
0c8a5ca tests: Switch to NONE contexts in tests.c (Jonas Nick)
86540e9 tests: add test for deprecated flags and rm them from run_context (Jonas Nick)
caa0ad6 group: add gej_eq_var (Jonas Nick)
37ba744 tests: Switch to NONE contexts in exhaustive and ctime tests (Jonas Nick)
8d7a9a8 benchmarks: Switch to NONE contexts (Jonas Nick)

Pull request description:

  Based on #1126.

ACKs for top commit:
  real-or-random:
    ACK d6dc0f4 diff looks good and tests pass locally
  sipa:
    utACK d6dc0f4

Tree-SHA512: 1fb1dc1336409b52827787a03c791a21ee1d6b1bdc388d1fa126600572f348ba16865a01d29bac67b36b8f29f30cda117d82913e2044ccb9d073f5d04338ac9f

The suffix -dev is slightly clearer.

Also, since the package version follows semantic versioning, rename
VERSION_BUILD to VERSION_PATCH for clarity.

- make version on master always equal to latest release with patch+1
- separate regular from maintenance releases
- add more git commands to prevent accidents
- mention that one needs to somehow deal with release dates
- _LIB_VERSIONS_ -> _LIB_VERSION_
- don't push all tags in step 4
- add required message to git tag
- add suggested commit messages

7e5b226 Don't use compute credits for now (Pieter Wuille)

Pull request description:

ACKs for top commit:
  real-or-random:
    ACK 7e5b226

Tree-SHA512: 5f37521dede4270151f4f1ed59e021f78e39b7e3362f4c16ecf2b7733dd1d49306466cc4e9b7837be10769c86799905fb1305cb35fe5cae0366a7f7861e6e9df

There are plenty of unreleased variants of libsecp256k1 version 0.1.0
(libsecp256k1.so.0.0.0) in the wild. We choose a new version number to allow a
clear distinction.

There are variants of 0.1.0 that are incompatible with the initial release,
hence we increase the minor version to arrive at version number 0.2.0. For the
same reason, we increase the LIB_VERSION_CURRENT and keep AGE at 0.

The changelog for 0.2.0 consists of the relevant changes since 2021-12-25, which
is the date when the initial release process PR was merged (and the library
version was set to a pre-release, see 423b6d1).
This is somewhat arbitrary but at least points readers to relevant changes.

e025ccd release: prepare for initial release 0.2.0 (Jonas Nick)
6d1784a build: add missing files to EXTRA_DIST (Jonas Nick)
13bf1b6 changelog: make order of change types match keepachangelog.com (Jonas Nick)
b1f992a doc: improve release process (Jonas Nick)
ad39e2d build: change package version to 0.1.0-dev (Jonas Nick)
90618e9 doc: move CHANGELOG from doc/ to root directory (Jonas Nick)

Pull request description:

  Based on #964

ACKs for top commit:
  sipa:
    ACK e025ccd

Tree-SHA512: b9ab71d7362537d383a32b5e321ef44069f00e3e92340375bcd662267bc5a60c2bad60222998e6602cfac24ad65efb23d772eac37c86065036b90ef090b54c49

…r 0.2.0

02ebc29 release cleanup: bump version after 0.2.0 (Jonas Nick)
b6b360e doc: improve message of cleanup commit (Jonas Nick)

Pull request description:

ACKs for top commit:
  sipa:
    ACK 02ebc29

Tree-SHA512: b887e31a531f7d21025558ed0a64ff5f68dee6feff8288478f7eb023189ceb20e5ca8baf0434ebd2ee49488d35d7aebc1b837888ff8c6e6420e6b86cc2f99cb1

This change eases the use of alternate build systems by moving
the variables in `src/libsecp256k1-config.h` to compiler macros
for each invocation, preventing duplication of these variables
for each build system.

Co-authored-by: Ali Sherief <ali@notatether.com>