Sync with the main repo

ci/README.md

@@ -8,8 +8,7 @@ Be aware that the tests will be built and run in-place, so please run at your ow
 If the repository is not a fresh git clone, you might have to clean files from previous builds or test runs first.
 
 The ci needs to perform various sysadmin tasks such as installing packages or writing to the user's home directory.
-While most of the actions are done inside a docker container, this is not possible for all. Thus, cache directories,
-such as the depends cache, previous release binaries, or ccache, are mounted as read-write into the docker container. While it should be fine to run
+While it should be fine to run
 the ci system locally on you development box, the ci scripts can generally be assumed to have received less review and
 testing compared to other parts of the codebase. If you want to keep the work tree clean, you might want to run the ci
 system in a virtual machine with a Linux operating system of your choice.

ci/test/00_setup_env.sh

@@ -8,11 +8,10 @@ export LC_ALL=C.UTF-8
 
 # The root dir.
 # The ci system copies this folder.
-# This is where the depends build is done.
 BASE_ROOT_DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )"/../../ >/dev/null 2>&1 && pwd )
 export BASE_ROOT_DIR
 # The depends dir.
-# This folder exists on the ci host and ci guest. Changes are propagated back and forth.
+# This folder exists only on the ci guest, and on the ci host as a volume.
 export DEPENDS_DIR=${DEPENDS_DIR:-$BASE_ROOT_DIR/depends}
 # A folder for the ci system to put temporary files (ccache, datadirs for tests, ...)
 # This folder only exists on the ci host.
@@ -58,12 +57,14 @@ export CCACHE_SIZE=${CCACHE_SIZE:-100M}
 export CCACHE_TEMPDIR=${CCACHE_TEMPDIR:-/tmp/.ccache-temp}
 export CCACHE_COMPRESS=${CCACHE_COMPRESS:-1}
 # The cache dir.
-# This folder exists on the ci host and ci guest. Changes are propagated back and forth.
+# This folder exists only on the ci guest, and on the ci host as a volume.
 export CCACHE_DIR=${CCACHE_DIR:-$BASE_SCRATCH_DIR/.ccache}
 # Folder where the build result is put (bin and lib).
 export BASE_OUTDIR=${BASE_OUTDIR:-$BASE_SCRATCH_DIR/out/$HOST}
 # Folder where the build is done (dist and out-of-tree build).
 export BASE_BUILD_DIR=${BASE_BUILD_DIR:-$BASE_SCRATCH_DIR/build}
+# The folder for previous release binaries.
+# This folder exists only on the ci guest, and on the ci host as a volume.
 export PREVIOUS_RELEASES_DIR=${PREVIOUS_RELEASES_DIR:-$BASE_ROOT_DIR/releases/$HOST}
 export SDK_URL=${SDK_URL:-https://bitcoincore.org/depends-sources/sdks}
 export CI_BASE_PACKAGES=${CI_BASE_PACKAGES:-build-essential libtool autotools-dev automake pkg-config bsdmainutils curl ca-certificates ccache python3 rsync git procps bison}

ci/test/04_install.sh

@@ -39,6 +39,9 @@ if [ -z "$DANGER_RUN_CI_ON_HOST" ]; then
       --build-arg "FILE_ENV=${FILE_ENV}" \
       --tag="${CONTAINER_NAME}" \
       "${BASE_ROOT_DIR}"
+  docker volume create "${CONTAINER_NAME}_ccache" || true
+  docker volume create "${CONTAINER_NAME}_depends" || true
+  docker volume create "${CONTAINER_NAME}_previous_releases" || true
 
   if [ -n "${RESTART_CI_DOCKER_BEFORE_RUN}" ] ; then
     echo "Restart docker before run to stop and clear all containers started with --rm"
@@ -48,9 +51,9 @@ if [ -z "$DANGER_RUN_CI_ON_HOST" ]; then
   # shellcheck disable=SC2086
   CI_CONTAINER_ID=$(docker run $CI_CONTAINER_CAP --rm --interactive --detach --tty \
                   --mount type=bind,src=$BASE_ROOT_DIR,dst=/ro_base,readonly \
-                  --mount type=bind,src=$CCACHE_DIR,dst=$CCACHE_DIR \
-                  --mount type=bind,src=$DEPENDS_DIR,dst=$DEPENDS_DIR \
-                  --mount type=bind,src=$PREVIOUS_RELEASES_DIR,dst=$PREVIOUS_RELEASES_DIR \
+                  --mount "type=volume,src=${CONTAINER_NAME}_ccache,dst=$CCACHE_DIR" \
+                  --mount "type=volume,src=${CONTAINER_NAME}_depends,dst=$DEPENDS_DIR" \
+                  --mount "type=volume,src=${CONTAINER_NAME}_previous_releases,dst=$PREVIOUS_RELEASES_DIR" \
                   -w $BASE_ROOT_DIR \
                   --env-file /tmp/env \
                   --name $CONTAINER_NAME \

configure.ac

@@ -1418,14 +1418,15 @@ if test "$use_upnp" != "no"; then
     [AC_CHECK_LIB([miniupnpc], [upnpDiscover], [MINIUPNPC_LIBS="$MINIUPNPC_LIBS -lminiupnpc"], [have_miniupnpc=no], [$MINIUPNPC_LIBS])],
     [have_miniupnpc=no]
   )
-  dnl The minimum supported miniUPnPc API version is set to 10. This keeps compatibility
-  dnl with Ubuntu 16.04 LTS and Debian 8 libminiupnpc-dev packages.
+
+  dnl The minimum supported miniUPnPc API version is set to 17. This excludes
+  dnl versions with known vulnerabilities.
   if test "$have_miniupnpc" != "no"; then
     AC_MSG_CHECKING([whether miniUPnPc API version is supported])
     AC_PREPROC_IFELSE([AC_LANG_PROGRAM([[
         @%:@include <miniupnpc/miniupnpc.h>
       ]], [[
-        #if MINIUPNPC_API_VERSION >= 10
+        #if MINIUPNPC_API_VERSION >= 17
         // Everything is okay
         #else
         #  error miniUPnPc API version is too old
@@ -1434,7 +1435,7 @@ if test "$use_upnp" != "no"; then
         AC_MSG_RESULT([yes])
       ],[
       AC_MSG_RESULT([no])
-      AC_MSG_WARN([miniUPnPc API version < 10 is unsupported, disabling UPnP support.])
+      AC_MSG_WARN([miniUPnPc API version < 17 is unsupported, disabling UPnP support.])
       have_miniupnpc=no
     ])
   fi

contrib/verify-commits/allow-revsig-commits

@@ -643,3 +643,178 @@ b7365f0545b1a6862e3277b2b2139ee0d5aee1cf
 4bd0e9b90a39c5c6a016b83882ae44cb4d28f1f8
 7438ceac716fdfe6621728c05e718eaa89dd89aa
 4e3efd47e0d50c6cd1dc81ccc9669a5b2658f495
+5ab6a942764bf6577ae311f2551153dde3d4830c
+b04f42efe31e23e15cc945efe0de906ed2eadb2b
+ceae0eb7e31f9d3495a13a23df7372e5e870b572
+5bf65ec66e5986c9188e3f6234f1c5c0f8dc7f90
+55c9e2d790fa2e137ccd0d91e6cf3e2d0bff4813
+ba29911e21c88f49780c6c87f94ff8ed6e764a9d
+fffff0abb9c71f0af83a7925db3c293b3bb12158
+aaeb315ff0f7956449a92736160795f0140369e3
+0dd34773334c7f4db7b05df30ee61b011795b46d
+2598720d6c1ef15288045599de7e65f8707d09bc
+bc83710fdcc09d8e427e77457df107acc9db1be5
+ddd7a39aa960ee3639ef1e59b2e53852e0862c52
+0808c88d7bd992d5c9ded0009c9563f6177b4035
+a085a554913ae8f4ed83afac830ce6dc39c9cc65
+b1a824dd06aa58618947783edee2dd891b5204dc
+a4e066af8573dcefb11dff120e1c09e8cf7f40c2
+58b9d6cf9e9b801be9c677a3ae121e5d2950ce66
+7377ed778c6d832ecd291e65b2789af7bac2ae2b
+c3a41ad980cc5149de3f9ec8414962c183b1fed9
+5884a47c367f6ff1aff3ae1ef6894881c5a5e0b7
+1d39c9ca0672e7ad4c1f0959f9d58d2fcc7dc46b
+e16f6441044fc2123e0cbdcbd8a5842ec3aae7a0
+6c6cc7989cac79450bf83b932ca82d390a37e17b
+bc28ca3afb7f6656a0bf50038a5e383ee7f9b219
+57a491bee17af88f75c2cea8c109d93b1cdbc9a8
+f8586b25f6a4f1e30a54e58f45dd28aaf580bbc6
+e5df0ba0d97e5f8cfd748f09d6ed77b7bfc45471
+1b0469199bdaedfd452eea718268be7fd50db3c0
+015717e2b873b7a2ce433bd3be2328a782aa5d91
+3b3c66f85959f3393a3a9e87a29004b526f91b93
+874529665c1c326fc86fc0d0d6c3512fab087ab8
+7f2c983e1cfdb58b6f84eabe5ff6a16f143f39aa
+0ea92cad5274f3939f09d6890da31a21b8481282
+489b5876698f9bb2d93b1b1d62d514148b31effd
+faf25b09d9e78f2ff129e25b90f67930d2fc1c4f
+df933596e7e9aa17f7e5cd6e1c850520f5b56f1b
+9e4fbebcc8e497016563e46de4c64fa094edab2d
+1557014378cc5a6234a9244fa60132955206fd27
+c5fbcf5f8d7b36bee54ac80d1027d0dccea2aa75
+cccbc5fe3ea5ae52426203f4485b11071fbe4b6e
+5174a139c92c1238f9700d06e362dc628d81a0a9
+9dae9f5f1e2bf29f58d3f49b0c612063d883b8b3
+e282764e049523439bc8adaadc002a1420122830
+d8ae5044488248d5eb134aa7c0a15c813a2f8715
+06ea2783a2c11e7b171e2809c3211bb3091d894d
+00ce8543f16f4357926eb6dc701ac6229142be80
+1f63b460a8506675ccacb4647941f07d391735e3
+a100c42a136da5ddfd09aa442543ec2190f24faf
+636991d0c0f969968c790d490c82c1d2fa4e8047
+dd52f79a73eca18301db1569d517197160018dbb
+e157b98640c7cfb94cae7e0faca3bcffc2dde990
+ad9e5eaf77bf7e19a926a43407c88386a8a1e58f
+c5e67be03bb06a5d7885c55db1f016fbf2333fe3
+48eec32347494da781f26478fa488b28336afbd2
+c324b07a541a04698954ece94e5879ae7131c1c7
+4901631dac6a883c6ddd0d4e5e3edd08b10d7609
+cacbdbaa95317b45cf2100702bca92410fb43b9a
+b4f686952a60bbadc7ed2250651d0d6af0959f4d
+90e49c1ececd6296c6ec6109cea525a208c0626e
+700808754884919916a5518e7ecfdabadef956d8
+0cd1a2eff9e0020ec1052a931f3863794d1a95d9
+51527ec1ec4264f7e24ef548bb049db07a89fc7f
+ed4eeafbb6e2e73ff9fb9c03bd66bbb049b8aacd
+d4475ea7ae70ad1a1f9374b88c68f01590a88d54
+5e1aacab576b8d8918da129097a9ac0816b6ead2
+fe6a299fc0020cd62156d4b7dd9c8dac358c69c5
+0047d9b89b9fa6be660c363961cf0af72fa62ecf
+037c5e511fe2185d244049cae25a98f99b878787
+8730bd3fc87c8a7d44347267e1ff3c7a8674201b
+47b8256da872722953693c4037d1b9e07caadcb1
+85aea18ae660b5edf7b6c1415f033cfcb15307f9
+132d5f8c2f2397a4600a42203f413dafdb6bcc37
+23ebd7a8027f12e722834d214113892fe8561fe1
+a19f641a80cb2841ca9f593e9be589dbc4b4ae7c
+1e7db37e76c510d373c4404eea2b97508b367aca
+16fa967d3cca66eef0f17b41fd8aaee6a1420fbc
+9eedbe98c86ff2a9214c24c37f6524ce67fd129b
+0342ae1d395ca82614f6d3b8fabb6a44403baf2a
+777b89b3008e53374eb13fdee70db315cd61a703
+8b686776ef5cbd6ef9d5281c3136eded25ea35a4
+c90b42bcdb594638c5759ef5ef0773314d0a1379
+7134327be5c1bdcef7919ed735049a6bbfc457ec
+e88a52e9a2fda971d34425bb80e42ad2d6623d68
+173c79626867e9f89d49be7dcbb0c2042c480553
+2513499348fa955d0e4b0970b08ba9e715e6316e
+43bb10661360d9f35d921d493a1f94ac95df00e2
+6f55ab57cbfa414d57a8e9fb9a47f9bcd8c836d7
+6300b9556ec927a61371053fafe1a4045f5afb00
+f8b2e9bcfc76fede05f5e12f7b15f0d9c9d0add5
+b297b945f7610772434817181ad12067b2832565
+57a73d71a36ce212977607d3e94de6ef55521bfc
+5fdf37e14bb3b66264a7e6868250c2084ac39054
+3059d4dd72af73b654077d9f72019c47edd47674
+333a41882c5ccd5f0c7f884f97d25449bdeec07b
+7da4f65a00a8d96da2119de613ed7fbee2a28a0d
+e14f0fa6a346afecbb1d5470aef5226a8cc33e57
+cf0a8b9c4870cc88254a757286140d9632e7b70c
+b69fd5eaa99f84b62a49d7c7f48d8cee1227592a
+1e3ed01faa77215a7c36308237280aaa58895532
+6c9bc14a3f2cfa50144607c820ebab5288f9571c
+8e3c266a4f02093d57d563f32ba73d3ab4b5f208
+decde9bba6f9d3671bdf0af4fe6ff4bf28992d1d
+9b7eb584ade2ce73dbfcda080935172c3857b758
+3bbc46ddafb61f68785c7e581817db952f99d93a
+bbb83f0b2b2671980c06453fd243b1f2801a1cc4
+6c9460edaeb6c89692b71f51be7b7ee386f4f5c4
+b3072799248fae8fc16f910b642edb9c5acf8bac
+696d39410fc3372d120a6e89695c1543ac2fc052
+c5c4fb31828107a5ded88627632e19e05b2c7e83
+9ce1c506a3a5d20b1bf254235bfae48af592d86c
+fe66dad8a779ed928b1c2fc0c3accf594b042877
+f421de5be611f874a027392d5fee7e113dce4f54
+d492dc1cdaabdc52b0766bf4cba4bd73178325d0
+6348bc61b533705a229f2c2ddcff2bdd98849d07
+83b26cb97cb46516aa4fdee3bcbfa751d28c1233
+afac75f140a3e7d89877f03420e1bc64a8d8c6cd
+171f6f2699dc27e77843318be2fefdfcd9e589fb
+50c806f001d66e20f314777b9fa7fefa01dc6893
+bdbabc50ba6c87ded97ea2bbacd3605c59cd12d0
+9e32adbb5c543885b2c01a984bf1e4b80e8cec16
+7c08d81e119570792648fe95bbacddbb1d5f9ae2
+65e9ca22785f4a799cbcff6d95cbe1ce4b4a6bd2
+2948d6dea098bf722828b969838668f833c2cb00
+deb847b75710d600e5b0d3d5c77fa5166d80808a
+05e5af5a6c884d2ade3d7acc766ad5380cb85b64
+cba41db327a241f992f9329b214d9070888255b8
+f6d335e82822ed8f2da56c1bcaddf7f99acd4997
+30308cc380a8176a5ec0e0bd2beed8b9c482ccf7
+8b6cd42c6226dea28c182a48a214d1c091b9b5bb
+267917f5632a99bb51fc3fe516d8308e79d31ed1
+ba11eb354b9f3420ebb8608227062fb639a07496
+848b11615b67a3c49f76ebbcaa241a322d8014d8
+25290071c434638e2719a99784572deef44542ad
+159f89c118645c0f9e23e453f01cede84abac795
+37637bea3a9a48c0d52d68d3f78f154f8249a009
+0a76bf848c72211f986a6cc5b1c13de820b861dd
+358fe779cbb2681666ae5ab23a19662db21a2c46
+c44e734dca64a15fae92255a5d848c04adaad2fa
+8add59d77dd621be57059229f378822e4b707318
+922c49a1389531d9fba30168257c466bd413f625
+df0825046acc7cb496c47666e36af18118beb030
+c23bf06492dddacfc0eece3d4dd12cce81496dd0
+3eec29ed3aa1c8eb293a7a7a6be356fc014f8813
+a7e80449c0811b361cdaea39b6bab78ca5fbf668
+5e8e0b3d7f6055e326bda61e60712b530e8920f0
+a5edd191be93aff8f9c0f60f04e711e2e78ecc77
+515200298b555845696a07ae2bc0a84a5dd02ae4
+e8a3882e20f0ffeeb9b3964c2c09d8aa5eb53fd4
+c545a7aeb1d559377933c7b2e6edc2d4a37b33fb
+df669230cf2001dd869e897bb4f2d9c46f9accd9
+56a0fbf8365343d73cdff2b0a0e16542294d7577
+196b4599201dbce3e0317e9b98753fa6a244b82d
+cf5bb048e80d4cde8828787b266b7f5f2e3b6d7b
+b94d0c7af11bd91dad4f180ce2a2ffa09e4b5668
+792d0d8d512cf8ddca200317b74ce550c1a1a428
+767ee2e3a1082468b4e2248bac3ef8bd54bb2ddb
+31db3dd874dfbba88616c96a5767e2c9861d9a7a
+018fd9620293582f0ce43d344ac3110e19c4dedc
+801aaac2b39564aa14009785146ba26d2506fb53
+121d47afe3e67ff7f94d26e08a39573dccf652aa
+af7fba3af788e91a460582351d40f8f5e2118760
+8f1c28a609b203e0d0a844d9cc5ada9eb9160a5e
+8319c4e906e6df5f2048e7c048942fde285a93a2
+66be456d93a66526322b7f36fd734a8dbd5e5524
+c006ab29ceec9274dc85a0de7f7d0502021a4b87
+1220af5e6d1072ea306f6ecaaa7effe3d386c379
+14ba286556faad794f288ef38493c540382897cb
+784a21d35466736a7a372364498ed94482a12a2a
+4ad59042b359f473d5888ecee0c9288dcf98f1c9
+fee16b15fa3425871670239c25d4e61ae961e0c5
+216f4ca9e7ccb1f0fcb9bab0f9940992a87ae55f
+2d0bdb2089644f5904629413423cdc897911b081
+50c502f54abd9eb15c8ddca013f0fdfae3d132a9
+c840ab0231bc29057172179f005001c9ab299554
+aab5e48d422d396aec09bd6389de68613b19def5

contrib/verify-commits/trusted-git-root

@@ -1 +1 @@
-577bd51a4b8de066466a445192c1c653872657e2
+8ef096d4f8e08ac691502e3fd34721a8bdfa9044

contrib/verify-commits/trusted-keys

@@ -1,4 +1,3 @@
-71A3B16735405025D447E8F274810B012346C9A6
 B8B3F1C0E58C15DB6A81D30C3648A882F4316B9B
 E777299FC265DD04793070EB944D35F9AC3DB76A
 D1DBF2C4B96F2DEBF4C16654410108112E7EA81F

contrib/verifybinaries/README.md

@@ -1,16 +1,5 @@
 ### Verify Binaries
 
-#### Preparation:
-
-Make sure you obtain the proper release signing key and verify the fingerprint with several independent sources.
-
-```sh
-$ gpg --fingerprint "Bitcoin Core binary release signing key"
-pub   4096R/36C2E964 2015-06-24 [expires: YYYY-MM-DD]
-      Key fingerprint = 01EA 5486 DE18 A882 D4C2  6845 90C8 019E 36C2 E964
-uid                  Wladimir J. van der Laan (Bitcoin Core binary release signing key) <[email protected]>
-```
-
 #### Usage:
 
 This script attempts to download the signature file `SHA256SUMS.asc` from https://bitcoin.org.

doc/build-freebsd.md

@@ -36,13 +36,30 @@ pkg install sqlite3
 ```
 
 ###### Legacy Wallet Support
-`db5` is only required to support legacy wallets.
-Skip if you don't intend to use legacy wallets.
+BerkeleyDB is only required if legacy wallet support is required.
+
+It is required to use Berkeley DB 4.8. You **cannot** use the BerkeleyDB library
+from ports. However, you can build DB 4.8 yourself [using depends](/depends).
 
-```bash
-pkg install db5
 ```
----
+gmake -C depends NO_BOOST=1 NO_LIBEVENT=1 NO_QT=1 NO_SQLITE=1 NO_NATPMP=1 NO_UPNP=1 NO_ZMQ=1 NO_USDT=1
+```
+
+When the build is complete, the Berkeley DB installation location will be displayed:
+
+```
+to: /path/to/bitcoin/depends/x86_64-unknown-freebsd[release-number]
+```
+
+Finally, set `BDB_PREFIX` to this path according to your shell:
+
+```
+csh: setenv BDB_PREFIX [path displayed above]
+```
+
+```
+sh/bash: export BDB_PREFIX=[path displayed above]
+```
 
 #### GUI Dependencies
 ###### Qt5
@@ -91,12 +108,12 @@ This explicitly enables the GUI and disables legacy wallet support, assuming `sq
 
 ##### Descriptor & Legacy Wallet. No GUI:
 This enables support for both wallet types and disables the GUI, assuming
-`sqlite3` and `db5` are both installed.
+`sqlite3` and `db4` are both installed.
 ```bash
 ./autogen.sh
-./configure --with-gui=no --with-incompatible-bdb \
-    BDB_LIBS="-ldb_cxx-5" \
-    BDB_CFLAGS="-I/usr/local/include/db5" \
+./configure --with-gui=no \
+    BDB_LIBS="-L${BDB_PREFIX}/lib -ldb_cxx-4.8" \
+    BDB_CFLAGS="-I${BDB_PREFIX}/include" \
     MAKE=gmake
 ```
 

doc/dependencies.md

@@ -36,7 +36,7 @@ You can find installation instructions in the `build-*.md` file for your platfor
 | Dependency | Releases | Version used | Minimum required | Runtime |
 | --- | --- | --- | --- | --- |
 | [libnatpmp](../depends/packages/libnatpmp.mk) | [link](https://github.com/miniupnp/libnatpmp/) | commit [07004b9...](https://github.com/bitcoin/bitcoin/pull/25917) | | No |
-| [MiniUPnPc](../depends/packages/miniupnpc.mk) | [link](https://miniupnp.tuxfamily.org/) | [2.2.2](https://github.com/bitcoin/bitcoin/pull/20421) | 1.9 | No |
+| [MiniUPnPc](../depends/packages/miniupnpc.mk) | [link](https://miniupnp.tuxfamily.org/) | [2.2.2](https://github.com/bitcoin/bitcoin/pull/20421) | 2.1 | No |
 
 ### Notifications
 | Dependency | Releases | Version used | Minimum required | Runtime |

share/rpcauth/rpcauth.py

@@ -4,22 +4,20 @@
 # file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 from argparse import ArgumentParser
-from base64 import urlsafe_b64encode
 from getpass import getpass
-from os import urandom
-
+from secrets import token_hex, token_urlsafe
 import hmac
 
 def generate_salt(size):
     """Create size byte hex salt"""
-    return urandom(size).hex()
+    return token_hex(size)
 
 def generate_password():
     """Create 32 byte b64 password"""
-    return urlsafe_b64encode(urandom(32)).decode('utf-8')
+    return token_urlsafe(32)
 
 def password_to_hmac(salt, password):
-    m = hmac.new(bytearray(salt, 'utf-8'), bytearray(password, 'utf-8'), 'SHA256')
+    m = hmac.new(salt.encode('utf-8'), password.encode('utf-8'), 'SHA256')
     return m.hexdigest()
 
 def main():
@@ -38,8 +36,8 @@ def main():
     password_hmac = password_to_hmac(salt, args.password)
 
     print('String to be appended to bitcoin.conf:')
-    print('rpcauth={0}:{1}${2}'.format(args.username, salt, password_hmac))
-    print('Your password:\n{0}'.format(args.password))
+    print(f'rpcauth={args.username}:{salt}${password_hmac}')
+    print(f'Your password:\n{args.password}')
 
 if __name__ == '__main__':
     main()