taproot: Remove From<&Signature> for SerializedSignature
What the developer wrote
Authored by Mitchell Bagot
taproot: Remove From<&Signature> for SerializedSignature
The From<&'a Signature> for SerializedSignature impl functions by
derefing the signature and then serializing it. The presence of the
trait implies that SerializedSignature is some sort of reference to
the signature, when it is instead a type owning its own data.
Remove From<&Signature> impl from taproot::SerializedSignature.
What changed, and why it matters
This commit removes a convenience conversion that let users turn a borrowed Taproot signature into an owned, serialized byte form. The change is API-cleanup: the old trait made it look like the serialized form was just a view of the original signature, when it actually copies/owns the bytes. There is no direct security bug fixed here, but removing the misleading conversion reduces the chance that future callers misunderstand ownership and accidentally clone or mishandle signature data.
Treat as a minor API-hardening change. Review downstream code that relied on `SerializedSignature::from(&signature)` and replace it with explicit serialization or an owned conversion. No urgent security deployment is required unless an advisory is later published.
Security signals we found
API semantics hardening: removing a trait impl whose existence misrepresented ownership
Potential misuse reduction: borrowed-to-owned conversion could encourage unnecessary cloning or confusion about signature lifetime/ownership
No direct memory-safety or cryptographic bug is visible in the diff
Evidence from the diff
The patch deletes impl<'a> From<&'a Signature> for SerializedSignature in crypto/src/taproot.rs. The remaining From<Signature> (owned) impl stays. The removed impl dereferenced a borrowed Signature and serialized it into an owned SerializedSignature. The commit message frames this as a semantic correction: SerializedSignature owns its data, so a From<&Signature> impl wrongly suggests it is a reference/view. This is a hardening/cleanup change, not a patch for an exploitable vulnerability.
Changed components
crypto/src/taproot.rstaproot::SerializedSignaturetaproot::SignatureInspect captured patch +0 / −4
diff --git a/crypto/src/taproot.rs b/crypto/src/taproot.rs
index 7188b777..aecc63c5 100644
--- a/crypto/src/taproot.rs
+++ b/crypto/src/taproot.rs
@@ -302,10 +302,6 @@ impl From<Signature> for SerializedSignature {
fn from(value: Signature) -> Self { Self::from_signature(value) }
}
-impl<'a> From<&'a Signature> for SerializedSignature {
- fn from(value: &'a Signature) -> Self { Self::from_signature(*value) }
-}
-
impl TryFrom<SerializedSignature> for Signature {
type Error = SigFromSliceError;
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.