Merge branch 'chore/main-catchup-2026-08-26' into 'main'HEADmain

Bring main onto the line this project actually ships (incl. the 1.2.23 compactblock port)

Closes #6, #7, #8, #11, #35, #34, #29, #28, #27, and #16

See merge request !16

1 files changed, 138 insertions, 31 deletions

diff --git a/Makefile b/Makefile
index abd75c5..342ec07 100644
--- a/Makefile
+++ b/Makefile
@@ -2,6 +2,7 @@
 #
 #   make linux    build Bitflash-*-x86_64.AppImage
 #   make windows  build Bitflash-*-windows.zip (from MSYS2 UCRT64)
+#   make windows-tor build Bitflash-*-windows-with-tor.zip
 #   make tests    build and run standalone unit tests
 #   make checksums create SHA256SUMS for release assets
 #   make verify-release TAG=v1.2.13
@@ -10,7 +11,10 @@
 ROOT    := $(shell pwd)
 NPROC   := $(shell nproc 2>/dev/null || echo 2)
 SUDO    := $(shell [ "$$(id -u)" = "0" ] && echo "" || echo "sudo")
-VERSION := 1.2.15
+# Not "1.2.20". This tree is upstream v1.2.20 plus our own hardening commits and
+# a hand-merged payout ledger, so a binary built here must not be mistakable for
+# the upstream release of that number -- it names every release artifact.
+VERSION := 1.2.20+sec
 
 # ---- Pinned third-party sources -------------------------------------------
 #
@@ -33,10 +37,23 @@ VERSION := 1.2.15
 # resolves the object by its own hash). Bump deliberately, and rebuild and
 # resync before shipping the result.
 #
+# The check has to decide the exit status, so each recipe below joins its
+# commands with && the whole way to the closing echo. Ending that chain with a
+# `;` meant a failed `test` only skipped the build steps: the echo still ran,
+# the target still exited 0, and make announced a pinned dependency that
+# nothing had verified.
+#
 # RandomX pin is the commit this tree has been building and syncing against
-# (post-v2.0.1 master, 2026-05-24) -- chosen to change nothing today.
+# (post-v2.0.1 master, 2026-05-24) -- identical to upstream's pin.
+#
+# libsecp256k1 is pinned to upstream v1.2.18's commit rather than the one this
+# fork carried, so signature validation matches the binaries the rest of the
+# network runs. Consensus code must not differ from the network by accident.
+# There must be exactly ONE assignment of each of these variables in this file:
+# upstream defines them near the top too, and GNU Make takes the last `:=`, so
+# a second block silently decides the build.
 SECP256K1_REPO   := https://github.com/bitcoin-core/secp256k1
-SECP256K1_COMMIT := 6e2c8bc4ecdc6e71dbe7a368f360d8d453ce435d
+SECP256K1_COMMIT := 7fecac74aed8e1fd9078380d67dd04663705c989
 RANDOMX_REPO     := https://github.com/tevador/RandomX
 RANDOMX_COMMIT   := 1e9d4b2df63fa6edf46b06789486e23c0fcaa55a
 
@@ -48,6 +65,32 @@ APPIMAGETOOL_SHA256 := ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3c
 
 # ---- Linux ----------------------------------------------------------------
 
+# RandomX used to build in $(HOME)/RandomX, and deps-randomx would rm -rf that
+# path whenever the library was missing -- deleting a tree the build did not
+# create and does not own (issue #27; a hand-managed pinned checkout there is
+# what this machine's miners build against). The default is now in-tree, like
+# secp256k1-build. A host that deliberately keeps RandomX elsewhere can set
+# RANDOMX_DIR=... explicitly; the recipe below will still never delete a
+# directory that lacks the marker file this build writes after a successful
+# build. Exported so src/Makefile's own RANDOMX_DIR ?= picks the same tree.
+#
+# Every use of it below is quoted, and the recipe rejects a value that cannot
+# name exactly one directory before it reaches anything destructive. Unquoted,
+# the marker guard could be stepped around: a value holding a glob that matches
+# two directories made `[ -d $(RANDOMX_DIR) ]` a two-argument test, which dies
+# with "unexpected operator" instead of answering, so the && short-circuited,
+# the guard was skipped, and the rm -rf below ran against every match. A value
+# holding a space or a `&&` broke the outer test the same way and reported
+# "already built". Whitespace and glob characters are refused outright rather
+# than merely quoted, because src/Makefile interpolates this same value into
+# -I$(RANDOMX_DIR)/src and -L$(RANDOMX_DIR)/build unquoted, where neither can
+# survive. A relative value is refused rather than silently made absolute: it
+# would mean two different directories to this Makefile and to src/Makefile,
+# whose cwd is src/, and a command-line assignment reaches the sub-make through
+# MAKEFLAGS, where it outranks anything exported from here.
+RANDOMX_DIR ?= $(ROOT)/randomx-build
+export RANDOMX_DIR
+
 linux: deps-linux
         $(MAKE) -C src -f Makefile -j$(NPROC)
         strip src/bitflash
@@ -67,46 +110,79 @@ linux-node: deps-linux
 
 deps-linux: deps-apt deps-secp256k1 deps-randomx
 
+# libboost-dev, not libboost-system-dev: Boost.System has been header-only
+# since 1.69 and Ubuntu 26.04 (resolute) no longer ships the -system package.
+# This tree only includes two boost headers and links no boost library. The
+# apt-get update comes first: a fresh image's package lists are empty, and
+# install then fails on the first name it cannot find.
+#
+# A failed update is deliberately not fatal: one unreachable repository should
+# not block an install the lists already on disk can satisfy. It does say so,
+# though -- "unable to locate package" several seconds later is otherwise hard
+# to connect back to it. The install is the last command in the branch, so its
+# status is the target's, and that one does abort.
 deps-apt:
         @if command -v apt-get >/dev/null 2>&1; then \
+          $(SUDO) apt-get update || \
+            echo "  warning: apt-get update failed, using the package lists on disk"; \
           $(SUDO) apt-get install -y build-essential cmake git pkg-config autoconf \
             libtool libssl-dev libdb5.3++-dev libsodium-dev nlohmann-json3-dev \
-            libboost-system-dev libglfw3-dev libgl-dev python3-pil; \
+            libboost-dev libglfw3-dev libgl-dev libsqlite3-dev \
+            python3-pil clang; \
         else \
           echo "Not an apt system — install: g++ cmake git autoconf libtool"; \
-          echo "  libssl libdb++ libsodium nlohmann-json boost glfw3 opengl python3-pil"; \
+          echo "  libssl libdb++ libsodium nlohmann-json boost glfw3 opengl sqlite3 python3-pil"; \
         fi
 
 deps-secp256k1:
         @if [ ! -f /usr/local/lib/libsecp256k1.a ]; then \
           echo "==> building libsecp256k1"; \
-          rm -rf $(ROOT)/secp256k1-build; \
-          git init -q $(ROOT)/secp256k1-build; \
+          rm -rf $(ROOT)/secp256k1-build && \
+          git init -q $(ROOT)/secp256k1-build && \
           cd $(ROOT)/secp256k1-build && \
           git remote add origin $(SECP256K1_REPO) && \
           git fetch -q --depth 1 origin $(SECP256K1_COMMIT) && \
-          git checkout -q $(SECP256K1_COMMIT) && \
-          ./autogen.sh && \
+          git checkout -q --detach FETCH_HEAD && \
+          test "$$(git rev-parse HEAD)" = "$(SECP256K1_COMMIT)" && \
+          echo "==> libsecp256k1 pinned at $(SECP256K1_COMMIT)" && \
+          cd $(ROOT)/secp256k1-build && ./autogen.sh && \
           ./configure --enable-module-schnorrsig --enable-module-extrakeys \
             --disable-shared --with-pic --disable-benchmark --disable-tests && \
-          make -j$(NPROC) && $(SUDO) make install && $(SUDO) ldconfig; \
+          make -j$(NPROC) && $(SUDO) make install && $(SUDO) ldconfig && \
           echo "==> libsecp256k1 done"; \
         else \
           echo "==> libsecp256k1 already installed"; \
         fi
 
 deps-randomx:
-        @if [ ! -f $(HOME)/RandomX/build/librandomx.a ]; then \
+        @ws="$$(printf ' \t')"; \
+        case "$(RANDOMX_DIR)" in \
+          "")        echo "ERROR: RANDOMX_DIR is empty"; exit 1 ;; \
+          /)         echo "ERROR: RANDOMX_DIR is /, refusing"; exit 1 ;; \
+          *[$$ws]*)  echo "ERROR: RANDOMX_DIR contains whitespace: $(RANDOMX_DIR)"; exit 1 ;; \
+          *[*?[]*)   echo "ERROR: RANDOMX_DIR contains a glob character: $(RANDOMX_DIR)"; exit 1 ;; \
+          /*)        ;; \
+          *)         echo "ERROR: RANDOMX_DIR must be an absolute path: $(RANDOMX_DIR)"; exit 1 ;; \
+        esac
+        @if [ ! -f "$(RANDOMX_DIR)/build/librandomx.a" ]; then \
+          if [ -d "$(RANDOMX_DIR)" ] && [ ! -f "$(RANDOMX_DIR)/.bitflash-built" ]; then \
+            echo "ERROR: $(RANDOMX_DIR) exists but was not created by this build"; \
+            echo "       refusing to rm -rf it -- remove it yourself or set RANDOMX_DIR"; \
+            exit 1; \
+          fi; \
           echo "==> building RandomX"; \
-          rm -rf $(HOME)/RandomX; \
-          git init -q $(HOME)/RandomX; \
-          cd $(HOME)/RandomX && \
+          rm -rf "$(RANDOMX_DIR)" && \
+          git init -q "$(RANDOMX_DIR)" && \
+          cd "$(RANDOMX_DIR)" && \
           git remote add origin $(RANDOMX_REPO) && \
           git fetch -q --depth 1 origin $(RANDOMX_COMMIT) && \
-          git checkout -q $(RANDOMX_COMMIT); \
-          mkdir -p $(HOME)/RandomX/build; \
-          cd $(HOME)/RandomX/build && cmake .. -DCMAKE_BUILD_TYPE=Release && \
-          make -j$(NPROC) randomx; \
+          git checkout -q --detach FETCH_HEAD && \
+          test "$$(git rev-parse HEAD)" = "$(RANDOMX_COMMIT)" && \
+          echo "==> RandomX pinned at $(RANDOMX_COMMIT)" && \
+          mkdir -p "$(RANDOMX_DIR)/build" && \
+          cd "$(RANDOMX_DIR)/build" && cmake .. -DCMAKE_BUILD_TYPE=Release && \
+          make -j$(NPROC) randomx && \
+          touch "$(RANDOMX_DIR)/.bitflash-built" && \
           echo "==> RandomX done"; \
         else \
           echo "==> RandomX already built"; \
@@ -157,13 +233,22 @@ img = ico.convert('RGBA'); \
 img.save(d + '/bitflash.png'); \
 import shutil; shutil.copy(d + '/bitflash.png', \
 d + '/usr/share/icons/hicolor/256x256/apps/bitflash.png')"
-        @for lib in libsodium.so.23 libdb_cxx-5.3.so libglfw.so.3; do \
+        @for lib in libsodium.so.23 libdb_cxx-5.3.so libsqlite3.so.0 libglfw.so.3; do \
           path=$$(ldconfig -p | grep " $$lib " | awk '{print $$NF}' | head -1); \
           [ -z "$$path" ] && path=$$(find /usr/lib /lib -name "$$lib" 2>/dev/null | head -1); \
           [ -n "$$path" ] && cp -L "$$path" $(APPDIR)/usr/lib/ && echo "  bundled $$lib" || echo "  missing $$lib"; \
         done
+# appimagetool's output used to be piped through grep ... || true, which
+# discarded its exit status: the target succeeded and announced "Built:"
+# even when no AppImage existed. Run the tool bare so its status decides,
+# then require the artefact to exist, be non-empty, and be newer than the
+# binary it was packaged from before saying so.
         @ARCH=x86_64 $(APPIMAGETOOL) --no-appstream $(APPDIR) \
-          $(ROOT)/Bitflash-$(VERSION)-x86_64.AppImage 2>&1 | grep -E "^Built|^Error" || true
+          $(ROOT)/Bitflash-$(VERSION)-x86_64.AppImage
+        @test -s $(ROOT)/Bitflash-$(VERSION)-x86_64.AppImage || \
+          { echo "ERROR: Bitflash-$(VERSION)-x86_64.AppImage missing or empty"; exit 1; }
+        @test $(ROOT)/Bitflash-$(VERSION)-x86_64.AppImage -nt src/bitflash || \
+          { echo "ERROR: Bitflash-$(VERSION)-x86_64.AppImage is not newer than src/bitflash"; exit 1; }
         @echo "Built: Bitflash-$(VERSION)-x86_64.AppImage"
 
 # ---- Windows (MSYS2 UCRT64) -----------------------------------------------
@@ -175,29 +260,42 @@ deps-windows:
           mingw-w64-ucrt-x86_64-glfw \
           mingw-w64-ucrt-x86_64-openssl \
           mingw-w64-ucrt-x86_64-db \
+          mingw-w64-ucrt-x86_64-sqlite3 \
           mingw-w64-ucrt-x86_64-libsodium \
           mingw-w64-ucrt-x86_64-nlohmann-json \
           mingw-w64-ucrt-x86_64-boost \
           mingw-w64-ucrt-x86_64-cmake \
           autoconf automake libtool
         @if [ ! -f deps/lib/libsecp256k1.a ]; then \
-          rm -rf secp256k1-build; \
-          git clone --depth 1 https://github.com/bitcoin-core/secp256k1 secp256k1-build; \
-          cd secp256k1-build && ./autogen.sh && \
+          rm -rf secp256k1-build && \
+          git init -q secp256k1-build && \
+          cd secp256k1-build && \
+          git remote add origin $(SECP256K1_REPO) && \
+          git fetch -q --depth 1 origin $(SECP256K1_COMMIT) && \
+          git checkout -q --detach FETCH_HEAD && \
+          test "$$(git rev-parse HEAD)" = "$(SECP256K1_COMMIT)" && \
+          echo "==> secp256k1 pinned at $(SECP256K1_COMMIT)" && \
+          cd $(ROOT)/secp256k1-build && ./autogen.sh && \
           ./configure --prefix=$(ROOT)/deps \
             --enable-module-schnorrsig --enable-module-extrakeys \
             --disable-shared --with-pic --disable-benchmark --disable-tests && \
-          make install; \
+          make install && \
           echo "==> secp256k1 done"; \
         else \
           echo "==> secp256k1 already built"; \
         fi
         @if [ ! -f RandomX/build/librandomx.a ]; then \
-          rm -rf RandomX; \
-          git clone --depth 1 https://github.com/tevador/RandomX; \
-          mkdir -p RandomX/build; \
-          cd RandomX/build && cmake .. -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release && \
-          make randomx; \
+          rm -rf RandomX && \
+          git init -q RandomX && \
+          cd RandomX && \
+          git remote add origin $(RANDOMX_REPO) && \
+          git fetch -q --depth 1 origin $(RANDOMX_COMMIT) && \
+          git checkout -q --detach FETCH_HEAD && \
+          test "$$(git rev-parse HEAD)" = "$(RANDOMX_COMMIT)" && \
+          echo "==> RandomX pinned at $(RANDOMX_COMMIT)" && \
+          mkdir -p $(ROOT)/RandomX/build && \
+          cd $(ROOT)/RandomX/build && cmake .. -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release && \
+          make randomx && \
           echo "==> RandomX done"; \
         else \
           echo "==> RandomX already built"; \
@@ -213,6 +311,9 @@ windows: deps-windows
         @zip -r Bitflash-$(VERSION)-windows.zip Bitflash-$(VERSION)-windows/
         @echo "Built: Bitflash-$(VERSION)-windows.zip"
 
+windows-tor: windows
+        ./scripts/package-windows-tor.sh
+
 # ---- Clean ----------------------------------------------------------------
 
 clean:
@@ -224,6 +325,12 @@ clean:
 tests:
         $(MAKE) -C src -f Makefile tests
 
+fuzz-net-message-smoke: deps-linux
+        $(MAKE) -C src -f Makefile fuzz-net-message-smoke
+
+fuzz-script-smoke: deps-linux
+        $(MAKE) -C src -f Makefile fuzz-script-smoke
+
 checksums:
         ./scripts/make-release-checksums.sh
 
@@ -233,6 +340,6 @@ sign-checksums:
 verify-release:
         ./scripts/verify-release.sh $(if $(TAG),$(TAG),latest)
 
-.PHONY: linux windows clean appimage \
-        tests checksums sign-checksums verify-release \
+.PHONY: linux windows windows-tor clean appimage \
+        tests fuzz-net-message-smoke fuzz-script-smoke checksums sign-checksums verify-release \
         deps-linux deps-windows deps-apt deps-secp256k1 deps-randomx