cf36df070b Wallet: Check crypter return values (benthecarman)
b76afff274 Wallet: Use unsigned KDF iteration count (benthecarman)
Pull request description:
CMasterKey::nDeriveIterations values are deserialized from wallet files
as unsigned 32-bit integers, but key derivation narrowed the count to a
signed int. A count above INT_MAX became negative in the conversion, and
the derivation loop counter then overflowed, which is undefined
behavior.
Keep the count unsigned through the derivation path to match the
serialized type, and add tests for zero and normal counts.
Also check key-derivation calibration failures and validate calculated
iteration counts before conversion. Keep the output master key unchanged
until derivation and encryption succeed, and mark fallible crypter
methods as [[nodiscard]].
ACKs for top commit:
l0rinc:
code review ACK cf36df070b
achow101:
ACK cf36df070b
Tree-SHA512: 95d5db2655fef8ca499af7da0f0258b4bee90975468286cb88e424257c4c5bf36407d2b2816b538e2ac3227e2a3a75c8d775211c65fe3ec6d12189da0b05fba1
777aee77d1 refactor: deduplicate keypath element parsing (pythcoiner)
7d8fddfba2 refactor: define BIP32_HARDENED and BIP32_UNHARDENED constants (pythcoiner)
Pull request description:
The codebase used raw `0x80000000` (and implicit `0`) as the bip32 hardened / unhardened flag.
`ParseHDKeypath` and `ParseKeyPathNum` were two separate parsers for BIP32 keypath elements, #32784 aligned their rules (both accept ' and h as hardened marker and reject indexes > 0x7FFFFFFF), but the parsing logic itself was still duplicated.
This PR:
- Define `BIP32_HARDENED_FLAG` / `BIP32_UNHARDENED_FLAG` constants to replace magic `0x80000000` and `0` literals.
- Add `ParseKeyPathElement` as bip32 parsing util and use it consistantly in `ParseHDKeyPath` and the descriptor keypath parser.
ACKs for top commit:
Sjors:
ACK 777aee77d1
achow101:
ACK 777aee77d1
Tree-SHA512: fb096eef82bb5a90baa7de41f5562b935665ee4b64c41586cf89e06c5633be44063a35a89d01a1432c8e63222d94bd06840bafc2a837f252013e317de0f5837a
465bca734e contrib: reject divergent verify-commits history (Lőrinc)
b3d1dca338 contrib: fail on verify-commits ancestry errors (Lőrinc)
Pull request description:
**Problem:** `verify-commits.py` checks a Git commit's history for trusted signatures and tree hashes back to configured roots.
The documented workflow runs this check after fetching a commit and before checkout, proceeding only when the script succeeds.
A commit that is an ancestor of a configured root is intentionally accepted without checking earlier history.
The script also takes this success path after Git errors or for divergent commits, even though neither establishes that relationship.
**Fix:** Require Git to prove the ancestor relationship before taking this success path.
**Reproducers:** Each commit can be validated manually.
<details><summary>Manual reproducer: Git error</summary>
Run this on `master` and at this PR's head:
```bash
contrib/verify-commits/verify-commits.py 0000000000000000000000000000000000000000 && echo ❌ || echo ✅
```
`master` exits successfully without verifying the missing commit, while the PR head rejects the Git error.
</details>
<details><summary>Manual reproducer: divergent history</summary>
On `master` and at this PR's head, create an unreferenced sibling of the trusted root and run the verifier:
```bash
root=$(head -n1 contrib/verify-commits/trusted-git-root)
divergent_commit=$(git commit-tree "$root^{tree}" -p "$root^" -m 'divergent commit')
contrib/verify-commits/verify-commits.py "$divergent_commit" && echo ❌ || echo ✅
```
`master` exits successfully without verifying the sibling commit, while the PR head rejects divergent history.
</details>
This issue was also found and disclosed responsibly by the Red Team 🟥.
ACKs for top commit:
151henry151:
tACK 465bca734e
jeanpablojp:
tACK 465bca734e
achow101:
ACK 465bca734e
sedited:
ACK 465bca734e
maflcko:
review ACK 465bca734e🥜
Tree-SHA512: 72b8cd9902d881e59a1d99fda8e5d511806826fa27c05a2c21a7d2eb62b2a5a0b1b6bdc67e8d19d57f9171278f4858fd019eb7890b960df0475ba4713683f0ac
2c16efbb7b psbt: Remove unused IsNull() methods (nebula-21)
Pull request description:
This PR removes the `IsNull()` methods from `PartiallySignedTransaction`, `PSBTInput`, and `PSBTOutput`, along with their calls from the fuzz target.
This methods have no production callers, their only callers are the fuzz target. As such, keeping these methods seems not useful.
The motivation for this PR came from jeanpablojp's comment on [#35848](https://github.com/bitcoin/bitcoin/pull/35848#issuecomment-5274013825), added him as coauthor.
ACKs for top commit:
maflcko:
review ACK 2c16efbb7b🥑
vicjuma:
ACK 2c16efbb7b
sedited:
ACK 2c16efbb7b
Tree-SHA512: 129933ae9803a2d053e340ee2a85efd1e5d9e5e38833fac0a0a9cbd467fec3157087959c464a8eeedb04ea99b1e5d7eba5a2fafde2e78a4fabcd247fac855477
4e5327bc98 fuzz: refactor: scope fake clocks to target phases (Hao Xu)
e33410d888 fuzz: document arbitrary mocktimes (Hao Xu)
Pull request description:
Follow-up to #35482 (https://github.com/bitcoin/bitcoin/pull/35482#discussion_r3612852792), addressing a remaining issue with the lifetime of the mock node clock.
This replaces the process-wide `FakeNodeClock` accessor with scoped clocks in the affected fuzz target initialization and input-processing phases, following the existing `FakeSteadyClock` pattern. The active clock is passed to `ResetChainmanAndMempool()` by reference.
Tested the affected fuzz targets with `-runs=1`:
- `cmpctblock`
- `process_message`
- `process_messages`
- `utxo_snapshot`
- `utxo_snapshot_invalid`
ACKs for top commit:
maflcko:
review ACK 4e5327bc98🚉
nervana21:
re-ACK 4e5327bc98
Tree-SHA512: 7763bb2a06e3f33bcae3ad7b43f6d30a231e39197e8d274eadd496da1194fc0178b27cf016b451f36309d9277ce414c85daf734604c85a9deb3803b26b968e6a
8454fb2bd7 test: sync funding block before isolating nodes (shaurya2k06)
Pull request description:
Fixes#35967
test_alternate_witness_tx mines the taproot funding output on node0 with
sync_fun=self.no_op and immediately disconnects. node1 later includes the
script-path spend via generateblock. If the funding block has not reached
node1, that call fails with bad-txns-inputs-missingorspent.
Drop the no_op so generate() uses the default sync_all before the partition.
Later generate* calls keep no_op because the nodes are then disconnected.
Seen twice this week in hebasto bitcoin-core-nightly NetBSD jobs:
https://github.com/hebasto/bitcoin-core-nightly/actions/runs/31350308484/job/93339698854https://github.com/hebasto/bitcoin-core-nightly/actions/runs/31765546925/job/94660585799
The modified test is test/functional/wallet_listtransactions.py. I ran it
locally three times with build/test/functional/wallet_listtransactions.py.
ACKs for top commit:
achow101:
ACK 8454fb2bd7
furszy:
utACK 8454fb2bd7
Tree-SHA512: 6b8fdcdc9ce9c57c2939caff34850e88450864c909fe226ba9b6e02ffcefa3625623589b8ecd2f09b9ca16bcaec3a64bd07642ff2c47ae6e8d250de478d34b53
1156ce6754 test: Tighten `Coin` equality and add debug output (rustaceanrob)
Pull request description:
If the `==` operator on two `Coin` fails, the developer should also see the conditions under which it failed. All that is required is adding a `<<` operator, moving the `==` out of the namespace, and switching `==` sites to `BOOST_TEST`.
Here we also tighten what it means for a coin to be "equal."
This is a pre-requiste for https://github.com/bitcoin/bitcoin/pull/35713 but seems to be a benefit on its own.
ACKs for top commit:
josibake:
reACK 1156ce6754
maflcko:
review ACK 1156ce6754🔋
Tree-SHA512: de5c612998518371ded3d25abdf1c96640e33d9961902dc4765a7e8f5088d8698a66ad63bc0a9822ec2b53e41e72dc95f78196822429af30b2ec29baa31c1ed1
ec61a1af62 depends: Hash included makefiles in package checksums (Hennadii Stepanov)
Pull request description:
This PR fixes an issue where modifications in included files (e.g. `packages/qt_details.mk`) do not trigger a rebuild of the parent packages (`native_qt` and `qt`).
This addresses an oversight in 248613eb3e from https://github.com/bitcoin/bitcoin/pull/30997.
### Reproduction
On master (@ 595504a432), modifying the included makefile does not change the build ID:
```
$ cd depends
$ gmake print-qt_build_id HOST=x86_64-w64-mingw32
qt_build_id=b2ce790473c
$ gmake print-native_qt_build_id HOST=x86_64-w64-mingw32
native_qt_build_id=70e1e5164c5
$ echo "" >> packages/qt_details.mk
$ gmake print-qt_build_id HOST=x86_64-w64-mingw32
qt_build_id=b2ce790473c
$ gmake print-native_qt_build_id HOST=x86_64-w64-mingw32
native_qt_build_id=70e1e5164c5
```
### With this patch
The checksum calculation now parses `include` directives and adds those files to the hash. The IDs now update correctly:
```
$ cd depends
$ gmake print-qt_build_id HOST=x86_64-w64-mingw32
qt_build_id=9a6ebf79cb3
$ gmake print-native_qt_build_id HOST=x86_64-w64-mingw32
native_qt_build_id=6ad78a3f644
$ echo "" >> packages/qt_details.mk
$ gmake print-qt_build_id HOST=x86_64-w64-mingw32
qt_build_id=ca820665c52
$ gmake print-native_qt_build_id HOST=x86_64-w64-mingw32
native_qt_build_id=082e4cb2364
```
ACKs for top commit:
sedited:
ACK ec61a1af62
Tree-SHA512: 9425d606dcf003ef9342560a1d0def3d591279ed261a6af0cfb2bf7b2fb1864bf7937877a1119e4c694e6c74a46074eb5e84e6198a90f4d1cd49010088077f92
de9b436ba3 depends: Switch from multilib to platform-specific toolchains (Hennadii Stepanov)
Pull request description:
Using the multilib GCC toolchain, as currently documented in [`depends/README.md`](4c1906a500/depends/README.md), has several issues, such as:
1. The [`g++-multilib`](https://packages.ubuntu.com/noble/g++-multilib) package conflicts with platform-specific cross-compiler packages. This means it is not possible to cross compile for `i686` and other platforms using the same set of installed packages.
2. The [`g++-multilib`](https://packages.ubuntu.com/noble/g++-multilib) package is not available for `arm64`:
```sh
$ sudo apt install g++-multilib
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
E: Unable to locate package g++-multilib
```
3. Managing the multilib GCC toolchain requires additional code in both depends and Guix scripts.
This PR addresses all the issues mentioned above by switching from multilib to platform-specific toolchains.
Also see https://github.com/bitcoin/bitcoin/pull/22456.
---
Here are examples of building for different scenarions:
- Linux, `x86_64` or `arm64`, building with depends natively:
```sh
$ gmake -C depends -j $(nproc)
$ cmake -B build --toolchain depends/$(./depends/config.sub $(./depends/config.guess))/toolchain.cmake
$ cmake --build build -j $(nproc)
```
- Linux, `x86_64` or `arm64`, cross compiling for `i686-pc-linux-gnu`:
```sh
$ sudo apt install g++-i686-linux-gnu binutils-i686-linux-gnu
$ export HOST=i686-linux-gnu
$ gmake -C depends -j $(nproc)
$ cmake -B build-${HOST} --toolchain depends/${HOST}/toolchain.cmake
$ cmake --build build-${HOST} -j $(nproc)
```
- Linux, `x86_64`, cross compiling for `arm64`:
```sh
$ sudo apt install g++-aarch64-linux-gnu binutils-aarch64-linux-gnu
$ export HOST=aarch64-linux-gnu
$ gmake -C depends -j $(nproc)
$ cmake -B build-${HOST} --toolchain depends/${HOST}/toolchain.cmake
$ cmake --build build-${HOST} -j $(nproc)
```
- Linux, `arm64`, cross compiling for `x86_64`:
```sh
$ sudo apt install g++-x86-64-linux-gnu binutils-x86-64-linux-gnu
$ export HOST=x86_64-linux-gnu
$ gmake -C depends -j $(nproc)
$ cmake -B build-${HOST} --toolchain depends/${HOST}/toolchain.cmake
$ cmake --build build-${HOST} -j $(nproc)
```
ACKs for top commit:
fanquake:
ACK de9b436ba3
BrandonOdiwuor:
ACK de9b436ba3
Tree-SHA512: 453b4744974cdf56d6edfdbe93bb11e3bae3f9bc9cd99b9c57aee74e65fcdd3ac011a1dcc19f485ea3be427f4e9c6c6b0d704881369f719620f0cb299123e561
Avoid exposing a process-wide FakeNodeClock accessor from the test
utility module. Initialize separate scoped clocks for target setup and
input processing, and pass the active clock to ResetChainmanAndMempool
by reference.
ResetChainmanAndMempool sets each scoped clock to the selected chain's
genesis time. Avoid hard-coding the mainnet genesis timestamp when
constructing these clocks, because the targets use REGTEST parameters
and the value is overwritten during reset.
Initialize each clock from the fuzz harness's existing mock time until
ResetChainmanAndMempool sets the REGTEST genesis time.
This commit does not change behavior.
Co-authored-by: maflcko <6399679+maflcko@users.noreply.github.com>
Co-authored-by: nervana21 <205626986+nervana21@users.noreply.github.com>
We should not proceed syncing headers from peers when the local system clock is incorrectly set.
A node with a system clock set too far back will typically fail early during startup when the chainstate detects the tip to be too far in the future. This means that in practice we don't expect the failure to ever happen in net_processing.cpp.
An exception is thrown from HeadersSyncState() in order to only compute the error condition once. An alternative would be to compute it a second time in TryLowWorkHeadersSync() to guard against calling HeadersSyncState(), and have an assert inside HeadersSyncState(). We shut down the process so possible resource leaks due to the exception should not be an issue, although none have been spotted. Throwing an exception also keeps the unit test straightforward.
Co-authored-by: Lőrinc <pap.lorinc@gmail.com>
If the `==` operator on two `Coin` fails, the developer should also see
the conditions under which it failed. All that is required is adding a
`<<` operator, moving the `==` out of the namespace, and switching `==`
sites to `BOOST_TEST`.
Here we also tighten what it means for a coin to be "equal."
This is a pre-requiste for #35713 but seems to be a benefit on its own.
Co-authored-by: l0rinc <pap.lorinc@gmail.com>
The node currently continues low-work headers presync and requests more headers when its clock is more than `MAX_FUTURE_BLOCK_TIME` behind the chain-start MTP.
Record this behavior before the follow-up rejects the invalid elapsed-time calculation.
The unit test covers HeadersSyncState() behavior while the functional test covers net_processing.cpp behavior.
Co-authored-by: Lőrinc <pap.lorinc@gmail.com>
ec5d19665b wallet: WalletBatch->WriteVersion respect argument. (David Gumberg)
Pull request description:
> Previously would use global `CLIENT_VERSION` no matter what, but this is one sense a refactor since all of the places where WriteVersion is called currently call it with `CLIENT_VERSION` anyways. The `client_version` argument is kept since future test code may want to write other versions.
> Addresses a review comment from [#32636](https://github.com/bitcoin/bitcoin/pull/32636#discussion_r2356299627):
This was originally pointed out in https://github.com/bitcoin/bitcoin/pull/32636#discussion_r2356299627, and the followup (#34490) was never merged. However I think it's confusing to have functions that take arguments but ignore them (and it's dead code), so I've cherry-picked the fix up from #34490.
ACKs for top commit:
achow101:
ACK ec5d19665b
pablomartin4btc:
ACK ec5d19665b
w0xlt:
ACK ec5d19665b
Tree-SHA512: 3ad82d979493ac14704975bef504c791ac72fe7910c25097f0019bf61e3d384b0e1646f90c730d2f655733428b14ccd0196c333df2d6153ff5b55ab41918a6dd
fada80192b test: Print os exit code on failure (MarcoFalke)
Pull request description:
Printing the exit code (like printing the stderr) seems independently useful, but should also help to debug the Windows CI failures, which have an empty stderr and truncated combined log:
* https://github.com/bitcoin/bitcoin/issues/34925
* https://github.com/bitcoin/bitcoin/issues/34367
* ...
ACKs for top commit:
sedited:
tACK fada80192b
Tree-SHA512: 085201532ccce9da27cf996136d48436b7800b00a8c8011977d37fcfe152ca029e093428b06ba058759ae10f6dd8e94500b34df712f13d6064f6a7499539bcdc
fc0dcf950f kernel: keep range iterators tied to their owner (Lőrinc)
0936c55f62 test: characterize kernel range iterators (Lőrinc)
Pull request description:
**Problem:** Kernel wrapper methods return `Range` views by value, but their iterators point to the `Range` object.
Saving an iterator from a temporary view, such as `block.Transactions().begin()`, leaves it pointing to the destroyed view, so later use has undefined behavior.
**Fix:** Make range iterators point to the underlying Kernel wrapper object and use the range's compile-time getter for element access.
Remove `operator->`, which returned elements by value and could not easily support arrow expressions.
ACKs for top commit:
purpleKarrot:
ACK fc0dcf950f
yuvicc:
ACK fc0dcf950f
sedited:
ACK fc0dcf950f
Tree-SHA512: 85ae1f8d4c62a762a10c546ebb312f126efc5ef349557dd235c81b585bef92cbb6c4a565734d85d315641a169f48b6032b859f5a9f070bc347b1424b05473e5d
fe7d475d45 private broadcast: bound broadcast attempts per tx to 1k (Gregory Sanders)
Pull request description:
Since rebroacasts introduce additional state, bound the state growth by capping the number of rebroadcasts. With ~72 bytes per record, 10k transactions rebroadcasting for ~42 hours will result about 703 MiB allocated with overhead.
ACKs for top commit:
andrewtoth:
ACK fe7d475d45
frankomosh:
ReACK fe7d475d45
sedited:
ACK fe7d475d45
Tree-SHA512: e4ec5156b90ad24d68b561df03ad09bdf0ac7535886ff56891cb698cf64ff0e1e484075b76040bba6194baf874c9237028c82debf7405136447ba5b5faee589c
5548818115 guix: build glibc with --enable-kernel=3.17.0 (fanquake)
Pull request description:
Our minimum required kernel version is documented as `3.17.0`. Pass `--enable-kernel=3.17.0` when building glibc, so that version is reflected in the binary, and the version checked in the symbol-check script, aligns with the expected minimum.
ACKs for top commit:
hebasto:
ACK 5548818115, tested on Ubuntu 24.04:
willcl-ark:
ACK 5548818115
Tree-SHA512: fc23561d77da80f53cf7564bdb87f5f3c0b23401de79e0801168190d7a99c96e6a60e9437779680b43173572aededf4242b0fba0fe255970f83e6529e3149870
979a42ec17 http: Make HTTPRequest::m_client a weak_ptr (Hodlinator)
Pull request description:
Removes the need for `HTTPClient::ReleaseRequest()` as the client<->request cycle is broken. Not having to remember to call `ReleaseRequest()` reduces cognitive load.
Follow-up to #35735.
ACKs for top commit:
pinheadmz:
untested ACK 979a42ec17
Tree-SHA512: b740a765ffe0592055819e71df8654614e9e140bb77e4a6d146045255f1db9b470ae4a1a77aa16a0d3f3519b7c0d1e9f8c9fbc4c29aab28a2d55ea828ca912c6
c079288967 psbt: update output metadata without inputs (Lőrinc)
4f5712476a test: characterize P2WSH miniscript output (Lőrinc)
e24e8fa2a6 test: characterize PSBT output metadata (Lőrinc)
Pull request description:
**Problem:** PSBTv2 permits outputs to be added before inputs.
An authenticated `descriptorprocesspsbt` request can abort the node while updating metadata for one of those outputs because `UpdatePSBTOutput()` traverses the output script with a signature creator for input index 0.
ECDSA signing or a miniscript timelock check can then access the missing input.
**Fix:** Make `UpdatePSBTOutput()` traverse output scripts with a temporary one-input transaction while continuing to take the output from the PSBT's unsigned transaction.
`MutableTransactionSignatureCreator` continues to require a valid input index.
Output metadata traversal still records scripts and key origins, allowing outputs to be updated before inputs are added.
ACKs for top commit:
jeanpablojp:
tACK c079288967
achow101:
ACK c079288967
w0xlt:
ACK c079288967
polespinasa:
ACK c079288967
Tree-SHA512: 0d8cda74b8a56c0f4713b2669e5a3e5b0551ecda4fdfceb38a80e5b98a9d208d447f2045a1cc9fee74fe33b2fc8f7a60997cd60b2961de5cea871f53831895fe
9cc7dc50bd p2p: reconsider orphans when missing inputs are mined (Greg Sanders)
Pull request description:
We reconsider for mempool entry of missing inputs, we should reconsider for mining of them too.
ACKs for top commit:
yuvicc:
ACK 9cc7dc50bd
l0rinc:
Lightly tested code review ACK 9cc7dc50bd
marcofleon:
ACK 9cc7dc50bd
Tree-SHA512: 9acfb6898e3b286ce23bc2ca3369ae951fadee5f175baad634a6bd23039108d97283814e47972fb857ae459505535f621866f2514b705e94cf841979c37a3933
de2adc308a qa: Disable Qt's glib event dispatcher for GUI tests on OpenBSD (Hennadii Stepanov)
Pull request description:
When `bitcoin-gui` is built against OpenBSD's system Qt packages (which have GLib support), shutdown emits "GLib-CRITICAL **: g_main_context_pop_thread_default: assertion 'stack != NULL' failed" messages on `stderr`, which the test framework treats as a failure.
Set `QT_NO_GLIB=1` so Qt falls back to its poll-based event dispatcher, which avoids the GLib thread-default context entirely.
Fixes https://github.com/bitcoin/bitcoin/issues/35851.
See the CI log here: https://github.com/hebasto/bitcoin-core-nightly/actions/runs/31510478034.
ACKs for top commit:
maflcko:
lgtm ACK de2adc308a
Tree-SHA512: edc991c7a174bc304a4da0ca29ec97bcaece463289de3da5350a046f1133ce6d830c37d5188536ca2ce238d462e56de8f2167fdeeb1d1e5ecca38d60c8495cce
beefda21be doc : update cjdns docs to discourage using onlynet option (naiyoma)
Pull request description:
Currently, the number of CJDNS addresses is still very small and may not be sufficient to fill all outbound connection slots. When running with the `-cjdnsonly` and `-cjdnsreachable` options, `ThreadOpenConnections()` repeatedly calls `Select()`, which returns the same few addresses over and over. The connection attempts may fail, the addresses remain in `AddrMan`, and the loop continually restarts.
The documentation does mention running CJDNS alongside other networks, but we should explicitly explain why using only CJDNS is discouraged, since running with these options alone is supported.
ACKs for top commit:
achow101:
ACK beefda21be
jonatack:
ACK beefda21be
hodlinator:
ACK beefda21be
brunoerg:
ACK beefda21be
Tree-SHA512: 46126291ceb1c36384f9b3deaccdcf20baf8cd4a68491d2ad9fc4a35ec71ad4194b38c4a22c9853bd3f329e2ecb9a0452813d1eea121eb3712876e73dfd4b3f0
158efbc723 doc: fix outdated URL in hash_tests.cpp (cyb3ralbert)
Pull request description:
The old URL still 301-redirects, but to the site root, not to the file — and the file itself is gone: the same path on the new domain returns 404. The author's page at https://www.aumasson.jp/siphash/ says that the SipHash page and documentation have moved to github.com/veorq/SipHash.
The vectors now live in vectors.h in that repository. All 64 values match the array below.
ACKs for top commit:
maflcko:
lgtm ACK 158efbc723
l0rinc:
tested ACK 158efbc723
Tree-SHA512: e45d6872787474e50d51f408ae496e816adbaa8ff263f34df6af7070cfc94bc4f289c5d43cf79461055a0e9738340eb3088837e42991640a253853a5c9984ec6
e07d826e0e rpc: Fix type in ApplyTypeStrOverride (Shuvam Pandey)
c94074fa1b rpc: Surface OBJ_USER_KEYS description for openrpc (sedited)
c020c21d54 rpc: Handle skip type args for openrpc (sedited)
Pull request description:
This was initially motivated by testing the dump of the schema against open-rpc-generator, which crashed with:
```
open-rpc-generator generate -t client -l rust -n bitcoin_client -d ./openrpc.gen.json -o ./generated
There was error at generator runtime:
TypeError: Cannot convert undefined or null to object
```
The changes here fix this crash (albeit perfectly valid existing schema), but I think creating a more complete output is helpful on its own. The openrpc schema dumps can eventually be re-used for the rpc docs and to track rpc interface changes more accurately. Adding the CreateTxDoc outputs section seems useful for that.
Also includes a type tightening from number to integer in `ApplyTypeStrOverride` to reflect the actual behaviour in the rpc calls, where only integers are accepted.
ACKs for top commit:
achow101:
ACK e07d826e0e
willcl-ark:
ACK e07d826e0e
Tree-SHA512: d0454a71b4f1dab1daf8a0d5b1e5bf1c1b8f1a16d26638d4a64a2652402ad74230366cabf0cf4135a16d0bdab584d3d4b2a47f2968a4eff605348ce85e8dbadb
This removes the need for HTTPClient::ReleaseRequest() as the client<->request cycle is broken. Not having to remember to call ReleaseRequest() reduces cognitive load.
Mark CCrypter's fallible methods and crypto helpers as nodiscard, and
handle key-derivation calibration failures.
Keep the output master key unchanged until encryption succeeds. Validate
calibrated iteration counts before integer conversion. This prevents a
failed calibration from leaving mismatched parameters and ciphertext or
triggering undefined conversion behavior.
Extract ParseKeyPathElement() as a shared helper in util/bip32 that
parses a single BIP32 key path element (e.g. "0", "0'", "0h").
Both ParseHDKeypath() and the descriptor parser's ParseKeyPathNum()
now delegate to it, eliminating duplicated parsing logic.
Whenever a test creates a new `P2PInterface` object a new listener is
created inside `NetworkThread.create_listen_server()` by calling
`cls.network_event_loop.create_server()`.
These listeners are never closed which might result in:
```
2026-06-10T22:13:35.3934880Z Task was destroyed but it is pending!
2026-06-10T22:13:35.3936020Z task: <Task pending name='Task-54' coro=<BaseSelectorEventLoop._accept_connection2() done, defined at /opt/homebrew/Cellar/python@3.14/3.14.5/Frameworks/Python.framework/Versions/3.14/lib/python3.14/asyncio/selector_events.py:217> wait_for=<Future finished result=None>>
```
when the event loop is closed.
Fix that by closing the listeners.
Fixes: https://github.com/bitcoin/bitcoin/issues/35508
Add a string fee_rate_estimator option (default "none") to
estimatesmartfee options. "block_policy" consults only the block
policy fee rate estimator, "none" uses the fee rate estimator
manager selected behaviour, and unknown values are treated as
"none". Unknown option keys are rejected.
Still only the block policy fee rate estimator, so the result is
unchanged; a subsequent commit will change the default behaviour.
Also adds GetFeeRateEstimate(FeeRateEstimatorType, target, conservative)
to FeeRateEstimatorManager so callers can query a single estimator by
type; NONE returns the manager-selected combined estimate.
Introduce FeeRateEstimatorManager to wrap CBlockPolicyEstimator and
act as the single point of contact for fee rate estimation in the node.
It inherits CValidationInterface so it can register directly with the
validation signals and receive mempool/block events.
Wire it into NodeContext (fee_estimator_man), init, shutdown, the RPC
server utility helpers (EnsureAnyFeeEstimatorMan), and the wallet-facing
interfaces::Chain API.
The Chain method estimateSmartFee is renamed to getFeeRateEstimate and
now returns util::Expected<FeeRateEstimation, FeeRateEstimationError>
instead of CFeeRate, so callers get the full estimation context without
needing FeeCalculation. estimateMaxBlocks is renamed to
maximumFeeEstimationTargetBlocks (still returns the max target).
CBlockPolicyEstimator no longer inherits CValidationInterface; the
manager now receives the mempool/block validation events and forwards
them to the CBlockPolicyEstimator.
Co-authored-by: willcl-ark <will@256k1.dev>
Introduce that common interface:
- FeeRateEstimatorType identifies the source estimator in a result.
- FeeRateEstimation carries the feerate and returned target of a
successful estimate; FeeRateEstimationError carries the error
message alongside a zero-value estimation.
- EstimateFeeRate wraps estimateSmartFee and returns
util::Expected<FeeRateEstimation, FeeRateEstimationError>.
- MaximumTarget delegates to HighestTargetTracked(LONG_HALFLIFE) so
callers do not need to know about block policy horizons.
Update call sites in rpc/fees.cpp and node/interfaces.cpp.
A later commit introduces FeeRateEstimatorManager, which selects
between multiple fee rate estimators. To compare estimates and
report which estimator produced them, the manager needs each fee
rate estimator to expose a uniform output, whereas
estimateSmartFee's CFeeRate/FeeCalculation output is specific to
the block policy fee rate estimator.
Co-authored-by: willcl-ark <will@256k1.dev>
The purpose of the test was to exercise CBlockPolicyEstimator behavior, but it
previously used a real CTxMemPool plus validation signals to track the
txs. Since TryAddToMempool does not emit TransactionAddedToMempool
callbacks, the test also had to fire those callbacks manually and sync the
validation interface queue around estimate checks.
Call processTransaction() and processBlock() directly instead. This removes
the mempool and validation-signal plumbing from the test, makes event
ordering explicit and synchronous, and avoids coupling the test to the
validation interface notifications.
This is useful because subsequent commits moved CBlockPolicyEstimator
from being validation interface client to FeeRateEstimatorManager.
Rename policyestimator_tests.cpp to blockpolicyestimator_tests.cpp.
Also rename the policy_estimator fuzz target to block_policy_estimator so the
test names match CBlockPolicyEstimator.
This makes the block policy fee rate estimator test files accurate and concise,
which makes adding another fee rate estimator test files straightforward.
Now that the wallet reports its own FeeReason, StringForBlockPolicyEstimateReason
is only used internally by the block policy estimator. Move it from
common/messages into the block policy fee rate estimator.
Also add the detailed FeeCalculation debug log to estimateSmartFee, where
the FeeCalculation data originates, and always populate feeCalc locally so
the log is available even when the caller does not pass a valid
FeeCalculation pointer.
The block policy estimator's FeeReason enum mixed two unrelated
concerns: the threshold that produced an estimateSmartFee result
(NONE, HALF_ESTIMATE, ...) and the reason the wallet selected a fee
rate (FALLBACK, MEMPOOL_MIN, REQUIRED).
Split them so each layer owns the reasons it reports:
- Add a wallet-facing FeeReason enum with the reasons the wallet can
select a fee rate: FEE_RATE_ESTIMATOR, MEMPOOL_MIN, USER_SPECIFIED,
FALLBACK, and REQUIRED.
- Rename the estimator enum to BlockPolicyEstimateReason and narrow it
to estimator reasons: NONE, HALF_ESTIMATE, FULL_ESTIMATE,
DOUBLE_ESTIMATE, and CONSERVATIVE.
- Return wallet fee selection metadata through MinimumFeeRateResult
instead of exposing FeeCalculation to wallet callers. The returned
target is now optional and is only set for fee rate estimator results.
Flatten GetMinimumFeeRate() with early returns while preserving the fee
selection order: user feerate still only applies the required-fee check,
while smart-fee results keep fallback, mempool-min, and required fallbacks.
The returned target is cleared for fallback, mempool-min, and required
results.
Replace the CreateTransactionInternal log with a simpler message that
does not depend on estimateSmartFee internals. Detailed estimator
logging will be added in a follow-up commit.
