Fix lint warnings after upgrade to secp-0.32.0-beta.2
What changed, and why it matters
This commit is a routine code cleanup that updates rust-bitcoin to match a newer version of the secp256k1 cryptographic library. It only renames function calls (for example, switching from older methods like `secp.sign_ecdsa` to newer standalone functions like `secp256k1::ecdsa::sign`) and does not change any security logic, fix a bug, or alter how secrets are handled.
No security action required; treat as normal dependency/API maintenance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff is a pure API-migration patch triggered by upgrading secp256k1 to 0.32.0-beta.2. It replaces deprecated/renamed methods with their current equivalents across examples, library code, and tests: SecretKey::from_byte_array → from_secret_bytes, secret_bytes() → to_secret_bytes(), Keypair::from_seckey_str → str::parse::<Keypair>(), context-bound signing/recovery methods → crate-level secp256k1::ecdsa::sign, secp256k1::schnorr::sign, RecoverableSignature::sign_ecdsa_recoverable, etc. No cryptographic semantics, input validation, or context-lifetime behavior is changed.
Changed components
bitcoin/examples/create-p2wpkh-address.rsbitcoin/examples/sign-tx-segwit-v0.rsbitcoin/examples/sign-tx-taproot.rsbitcoin/examples/taproot-psbt.rsbitcoin/src/address/mod.rsbitcoin/src/bip32.rsbitcoin/src/crypto/key.rsbitcoin/src/crypto/sighash.rsbitcoin/src/psbt/mod.rsbitcoin/src/sign_message.rsbitcoin/tests/bip_174.rsbitcoin/tests/psbt-sign-taproot.rsInspect captured patch +31 / −28
diff --git a/bitcoin/examples/create-p2wpkh-address.rs b/bitcoin/examples/create-p2wpkh-address.rs
index 7899c303..ff2290bb 100644
--- a/bitcoin/examples/create-p2wpkh-address.rs
+++ b/bitcoin/examples/create-p2wpkh-address.rs
@@ -8,7 +8,7 @@ fn main() {
let secp = Secp256k1::new();
// Generate secp256k1 public and private key pair.
- let (secret_key, public_key) = secp.generate_keypair(&mut rand::rng());
+ let (secret_key, public_key) = secp256k1::generate_keypair(&mut rand::rng());
// Create a Bitcoin private key to be used on the Bitcoin mainnet.
let private_key = PrivateKey::new(secret_key, Network::Bitcoin);
diff --git a/bitcoin/examples/sign-tx-segwit-v0.rs b/bitcoin/examples/sign-tx-segwit-v0.rs
index e28601f5..744e68e4 100644
--- a/bitcoin/examples/sign-tx-segwit-v0.rs
+++ b/bitcoin/examples/sign-tx-segwit-v0.rs
@@ -70,7 +70,7 @@ fn main() {
// Sign the sighash using the secp256k1 library (exported by rust-bitcoin).
let msg = Message::from(sighash);
- let signature = secp.sign_ecdsa(msg, &sk);
+ let signature = secp256k1::ecdsa::sign(msg, &sk);
// Update the witness stack.
let signature = bitcoin::ecdsa::Signature { signature, sighash_type };
diff --git a/bitcoin/examples/sign-tx-taproot.rs b/bitcoin/examples/sign-tx-taproot.rs
index 2ecfcb36..6fd28f68 100644
--- a/bitcoin/examples/sign-tx-taproot.rs
+++ b/bitcoin/examples/sign-tx-taproot.rs
@@ -69,7 +69,7 @@ fn main() {
// Sign the sighash using the secp256k1 library (exported by rust-bitcoin).
let tweaked: TweakedKeypair = keypair.tap_tweak(&secp, None);
- let signature = secp.sign_schnorr(&sighash.to_byte_array(), tweaked.as_keypair());
+ let signature = secp256k1::schnorr::sign(&sighash.to_byte_array(), tweaked.as_keypair());
// Update the witness stack.
let signature = bitcoin::taproot::Signature { signature, sighash_type };
diff --git a/bitcoin/examples/taproot-psbt.rs b/bitcoin/examples/taproot-psbt.rs
index 079e6640..92ea5355 100644
--- a/bitcoin/examples/taproot-psbt.rs
+++ b/bitcoin/examples/taproot-psbt.rs
@@ -748,13 +748,13 @@ fn sign_psbt_taproot(
sighash_type: TapSighashType,
secp: &Secp256k1<secp256k1::All>,
) {
- let keypair = secp256k1::Keypair::from_seckey_byte_array(secret_key.secret_bytes()).unwrap();
+ let keypair = secp256k1::Keypair::from_seckey_byte_array(secret_key.to_secret_bytes()).unwrap();
let keypair = match leaf_hash {
None => keypair.tap_tweak(secp, psbt_input.tap_merkle_root).to_keypair(),
Some(_) => keypair, // no tweak for script spend
};
- let signature = secp.sign_schnorr(&hash.to_byte_array(), &keypair);
+ let signature = secp256k1::schnorr::sign(&hash.to_byte_array(), &keypair);
let final_signature = taproot::Signature { signature, sighash_type };
diff --git a/bitcoin/src/address/mod.rs b/bitcoin/src/address/mod.rs
index a24de091..dff07123 100644
--- a/bitcoin/src/address/mod.rs
+++ b/bitcoin/src/address/mod.rs
@@ -15,7 +15,7 @@
//!
//! // Generate random key pair.
//! let secp = Secp256k1::new();
-//! let (_sk, pk) = secp.generate_keypair(&mut rand::rng());
+//! let (_sk, pk) = secp256k1::generate_keypair(&mut rand::rng());
//! let public_key = PublicKey::new(pk); // Or `PublicKey::from(pk)`.
//!
//! // Generate a mainnet pay-to-pubkey-hash address.
diff --git a/bitcoin/src/bip32.rs b/bitcoin/src/bip32.rs
index bb349af9..435c605e 100644
--- a/bitcoin/src/bip32.rs
+++ b/bitcoin/src/bip32.rs
@@ -720,7 +720,7 @@ impl Xpriv {
depth: 0,
parent_fingerprint: Default::default(),
child_number: ChildNumber::ZERO_NORMAL,
- private_key: secp256k1::SecretKey::from_byte_array(
+ private_key: secp256k1::SecretKey::from_secret_bytes(
*hmac.as_byte_array().split_array::<32, 32>().0,
)
.expect("cryptographically unreachable"),
@@ -745,7 +745,7 @@ impl Xpriv {
/// Constructs a new BIP-0340 keypair for Schnorr signatures and Taproot use matching the internal
/// secret key representation.
pub fn to_keypair<C: secp256k1::Signing>(self, secp: &Secp256k1<C>) -> Keypair {
- Keypair::from_seckey_byte_array(self.private_key.secret_bytes())
+ Keypair::from_seckey_byte_array(self.private_key.to_secret_bytes())
.expect("BIP-0032 internal private key representation is broken")
}
@@ -800,7 +800,7 @@ impl Xpriv {
engine.input(&u32::from(i).to_be_bytes());
let hmac: Hmac<sha512::Hash> = engine.finalize();
let sk =
- secp256k1::SecretKey::from_byte_array(*hmac.as_byte_array().split_array::<32, 32>().0)
+ secp256k1::SecretKey::from_secret_bytes(*hmac.as_byte_array().split_array::<32, 32>().0)
.expect("statistically impossible to hit");
let tweaked =
sk.add_tweak(&self.private_key.into()).expect("statistically impossible to hit");
@@ -837,7 +837,7 @@ impl Xpriv {
parent_fingerprint,
child_number,
chain_code,
- private_key: secp256k1::SecretKey::from_byte_array(*private_key)?,
+ private_key: secp256k1::SecretKey::from_secret_bytes(*private_key)?,
})
}
@@ -943,7 +943,7 @@ impl Xpub {
engine.input(&n.to_be_bytes());
let hmac = engine.finalize();
- let private_key = secp256k1::SecretKey::from_byte_array(
+ let private_key = secp256k1::SecretKey::from_secret_bytes(
*hmac.as_byte_array().split_array::<32, 32>().0,
)
.expect("cryptographically unreachable");
diff --git a/bitcoin/src/crypto/key.rs b/bitcoin/src/crypto/key.rs
index 957d9d98..0a78dc69 100644
--- a/bitcoin/src/crypto/key.rs
+++ b/bitcoin/src/crypto/key.rs
@@ -325,7 +325,7 @@ impl PublicKey {
msg: secp256k1::Message,
sig: ecdsa::Signature,
) -> Result<(), secp256k1::Error> {
- secp.verify_ecdsa(msg, &sig.signature, &self.inner)
+ secp256k1::ecdsa::verify(&sig.signature, msg, &self.inner)
}
}
@@ -467,7 +467,7 @@ impl CompressedPublicKey {
msg: secp256k1::Message,
sig: ecdsa::Signature,
) -> Result<(), secp256k1::Error> {
- Ok(secp.verify_ecdsa(msg, &sig.signature, &self.0)?)
+ Ok(secp256k1::ecdsa::verify(&sig.signature, msg, &self.0)?)
}
}
@@ -578,7 +578,7 @@ impl PrivateKey {
data: [u8; 32],
network: impl Into<NetworkKind>,
) -> Result<Self, secp256k1::Error> {
- Ok(Self::new(secp256k1::SecretKey::from_byte_array(data)?, network))
+ Ok(Self::new(secp256k1::SecretKey::from_secret_bytes(data)?, network))
}
/// Deserializes a private key from a slice.
@@ -640,7 +640,7 @@ impl PrivateKey {
}
};
- Ok(Self { compressed, network, inner: secp256k1::SecretKey::from_byte_array(*key)? })
+ Ok(Self { compressed, network, inner: secp256k1::SecretKey::from_secret_bytes(*key)? })
}
/// Returns a new private key with the negated secret value.
diff --git a/bitcoin/src/crypto/sighash.rs b/bitcoin/src/crypto/sighash.rs
index 1938b959..b28f147c 100644
--- a/bitcoin/src/crypto/sighash.rs
+++ b/bitcoin/src/crypto/sighash.rs
@@ -2032,7 +2032,7 @@ mod tests {
.taproot_signature_hash(tx_ind, &Prevouts::All(&utxos), None, None, hash_ty)
.unwrap();
- let key_spend_sig = secp.sign_schnorr_with_aux_rand(
+ let key_spend_sig = secp256k1::schnorr::sign_with_aux_rand(
&sighash.to_byte_array(),
&tweaked_keypair,
&[0u8; 32],
diff --git a/bitcoin/src/psbt/mod.rs b/bitcoin/src/psbt/mod.rs
index adc2daaa..b9caa8b1 100644
--- a/bitcoin/src/psbt/mod.rs
+++ b/bitcoin/src/psbt/mod.rs
@@ -379,7 +379,7 @@ impl Psbt {
};
let sig = ecdsa::Signature {
- signature: secp.sign_ecdsa(msg, &sk.inner),
+ signature: secp256k1::ecdsa::sign(msg, &sk.inner),
sighash_type: sighash_ty,
};
@@ -445,10 +445,10 @@ impl Psbt {
.to_keypair();
#[cfg(feature = "rand-std")]
- let signature = secp.sign_schnorr(&sighash.to_byte_array(), &key_pair);
+ let signature = secp256k1::schnorr::sign(&sighash.to_byte_array(), &key_pair);
#[cfg(not(feature = "rand-std"))]
let signature =
- secp.sign_schnorr_no_aux_rand(&sighash.to_byte_array(), &key_pair);
+ secp256k1::schnorr::sign_no_aux_rand(&sighash.to_byte_array(), &key_pair);
let signature = taproot::Signature { signature, sighash_type };
input.tap_key_sig = Some(signature);
@@ -473,10 +473,10 @@ impl Psbt {
self.sighash_taproot(input_index, cache, Some(lh))?;
#[cfg(feature = "rand-std")]
- let signature = secp.sign_schnorr(&sighash.to_byte_array(), &key_pair);
+ let signature = secp256k1::schnorr::sign(&sighash.to_byte_array(), &key_pair);
#[cfg(not(feature = "rand-std"))]
let signature =
- secp.sign_schnorr_no_aux_rand(&sighash.to_byte_array(), &key_pair);
+ secp256k1::schnorr::sign_no_aux_rand(&sighash.to_byte_array(), &key_pair);
let signature = taproot::Signature { signature, sighash_type };
input.tap_script_sigs.insert((xonly, lh), signature);
diff --git a/bitcoin/src/sign_message.rs b/bitcoin/src/sign_message.rs
index 9c8feff0..660c878f 100644
--- a/bitcoin/src/sign_message.rs
+++ b/bitcoin/src/sign_message.rs
@@ -139,7 +139,7 @@ mod message_signing {
msg_hash: sha256d::Hash,
) -> Result<PublicKey, MessageSignatureError> {
let msg = secp256k1::Message::from_digest(msg_hash.to_byte_array());
- let pubkey = secp_ctx.recover_ecdsa(msg, &self.signature)?;
+ let pubkey = self.signature.recover_ecdsa(msg)?;
Ok(PublicKey { inner: pubkey, compressed: self.compressed })
}
@@ -222,9 +222,11 @@ pub fn sign<C: secp256k1::Signing>(
msg: impl AsRef<[u8]>,
privkey: SecretKey,
) -> MessageSignature {
+ use secp256k1::ecdsa::RecoverableSignature;
+
let msg_hash = signed_msg_hash(msg);
let msg_to_sign = secp256k1::Message::from_digest(msg_hash.to_byte_array());
- let secp_sig = secp_ctx.sign_ecdsa_recoverable(msg_to_sign, &privkey);
+ let secp_sig = RecoverableSignature::sign_ecdsa_recoverable(msg_to_sign, &privkey);
MessageSignature { signature: secp_sig, compressed: true }
}
@@ -244,6 +246,7 @@ mod tests {
#[test]
#[cfg(all(feature = "secp-recovery", feature = "base64", feature = "rand-std"))]
fn message_signature() {
+ use secp256k1::ecdsa::RecoverableSignature;
use crate::{Address, AddressType, Network, NetworkKind};
let secp = secp256k1::Secp256k1::new();
@@ -251,7 +254,7 @@ mod tests {
let msg_hash = super::signed_msg_hash(message);
let msg = secp256k1::Message::from_digest(msg_hash.to_byte_array());
let privkey = secp256k1::SecretKey::new(&mut secp256k1::rand::rng());
- let secp_sig = secp.sign_ecdsa_recoverable(msg, &privkey);
+ let secp_sig = RecoverableSignature::sign_ecdsa_recoverable(msg, &privkey);
let signature = super::MessageSignature { signature: secp_sig, compressed: true };
assert_eq!(signature.to_string(), super::sign(&secp, message, privkey).to_string());
diff --git a/bitcoin/tests/bip_174.rs b/bitcoin/tests/bip_174.rs
index 124e58d7..889e122a 100644
--- a/bitcoin/tests/bip_174.rs
+++ b/bitcoin/tests/bip_174.rs
@@ -123,7 +123,7 @@ fn build_extended_private_key() -> Xpriv {
let xpriv = extended_private_key.parse::<Xpriv>().unwrap();
let sk = PrivateKey::from_wif(seed).unwrap();
- let seeded = Xpriv::new_master(NetworkKind::Test, &sk.inner.secret_bytes());
+ let seeded = Xpriv::new_master(NetworkKind::Test, &sk.inner.to_secret_bytes());
assert_eq!(xpriv, seeded);
xpriv
diff --git a/bitcoin/tests/psbt-sign-taproot.rs b/bitcoin/tests/psbt-sign-taproot.rs
index 3b126227..ca2e84dc 100644
--- a/bitcoin/tests/psbt-sign-taproot.rs
+++ b/bitcoin/tests/psbt-sign-taproot.rs
@@ -60,7 +60,7 @@ fn psbt_sign_taproot() {
let script3 = create_basic_single_sig_script(secp, sk_path[2].0); // m/86'/1'/0'/0/2
// Just use one of the secret keys for the key path spend.
- let kp = Keypair::from_seckey_str(sk_path[2].0).expect("failed to create keypair");
+ let kp = sk_path[2].0.parse::<Keypair>().expect("failed to create keypair");
let internal_key = kp.x_only_public_key().0; // Ignore the parity.
@@ -114,7 +114,7 @@ fn psbt_sign_taproot() {
// script path spend
{
// use private key of path "m/86'/1'/0'/0/1" as signing key
- let kp = Keypair::from_seckey_str(sk_path[1].0).expect("failed to create keypair");
+ let kp = sk_path[1].0.parse::<Keypair>().expect("failed to create keypair");
let x_only_pubkey = kp.x_only_public_key().0;
let signing_key_path = sk_path[1].1;
@@ -167,7 +167,7 @@ fn psbt_sign_taproot() {
}
fn create_basic_single_sig_script(secp: &Secp256k1<secp256k1::All>, sk: &str) -> TapScriptBuf {
- let kp = Keypair::from_seckey_str(sk).expect("failed to create keypair");
+ let kp = sk.parse::<Keypair>().expect("failed to create keypair");
let x_only_pubkey = kp.x_only_public_key().0;
script::Builder::new()
.push_slice(x_only_pubkey.serialize())
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.