In this commit, we decode base64 PSBT packets as a stream instead of
reading the full encoded input into memory first.
The previous aggregate bound reused wire.MaxMessagePayload, even though
BIP-174 doesn't bind PSBT packet size to the P2P message limit. This made
the base64 path reject packets that the raw path accepted. We now feed
decoded bytes through the same per-field parser used for raw packets,
while retaining strict base64 and trailing-data checks.
We also add a regression test with nine individually valid 4,000,000-byte
unknown values to pin raw and base64 parsing to the same behavior.
In this commit, we extend taproot PSBT serialization and finalization to reject nil script spend signatures, leaf scripts, and BIP32 derivations before any sort or dereference. We return wrapped ErrInvalidPsbtFormat errors so callers can identify malformed packet state without parsing strings.
We also make FindLeafScript reject nil inputs and leaf entries. This keeps both the direct finalizer and MaybeFinalize paths from panicking on malformed in-memory packets.
In this commit, we address two issues with the strict parsing recently
added to NewFromRawBytes.
First, the trailing data check probed the caller supplied reader with a
blocking one byte read. A reader without a Len method (net.Conn,
io.Pipe) that stays open after delivering a complete packet would hang
the parser forever. We now only enforce the check when the reader can
report its remaining length without an additional read, which covers
in-memory readers along with the decoded base64 path. Plain streams are
left positioned directly after the packet, and the reader contract is
now documented on NewFromRawBytes.
Second, the base64 path read the entire input into memory before any
validation ran, so a very large input could force an arbitrarily large
allocation before the first validity check. We now bound the read to
wire.MaxMessagePayload expanded by the base64 encoding overhead.
Along the way, we simplify assertFullyConsumed down to the bytes.Reader
case that all remaining callers use.
wire.ReadTxOut returns PkScript slices backed by its internal 4 MiB
script slab. PSBT inputs keep parsed WitnessUtxo values, so small
scripts could otherwise keep the whole slab live.
Copy the script before storing the TxOut and assert the parsed witness
script has compact capacity.
In this commit, we strip all of the local `replace ... => ../...`
directives that were introduced as part of #1825 (the v2 module
restructuring), now that proper tags exist for every freshly carved-out
submodule. Every in-tree go.mod is pinned to the newly published tags:
chainhash/v2.0.0, wire/v2.0.0, chaincfg/v2.0.0, address/v2.0.0,
txscript/v2.0.0, btcutil/v2.0.0, psbt/v2.0.0, and btcec is bumped to
v2.5.0 since it now depends on chainhash/v2 (previously
chaincfg/chainhash).
While here, we also unify the Go toolchain to 1.25 across every
submodule so the workspace resolves a consistent set of language
features.
Finally, we bump the main btcd version to v0.26.0-beta.rc1 in
preparation for the upcoming release candidate.
