v31.1-roots.1 · Commit 6: [PATCH 06/17] feat(wallet): preserve Roots signing and spend controls on v31
doc/roots-features.md
Before: doc/roots-features.md · After: doc/roots-features.md
File metadata
index eb9921dfd7bf10781d8ba03c50b4168803b3b418..034b40905ff5cfa2c68a21a108d3e33fa56fc728 100644
Download original patch · Release notes
Diff rows 1–99 of 99. Line numbers refer to the original before/after files.
+ Added− RemovedUnmarked lines are context.
Scroll the code area horizontally to read long lines. The two line-number columns refer to before and after.
doc/roots-features.md
CHANGED
|
@@ -20,7 +20,12 @@ Priority/template
|
|
|
20
20
|
mining to L9; peer controls/health to L10; sweep, coin-control and per-send
|
|
21
21
|
RBF extensions to L11; read/write config, effective-policy RPC, resource support
|
|
22
22
|
and dormant statistics to L12; identity/desktop and maintenance integration to
|
|
23
|
-
L13. The narrow monotonic `uptime` RPC sub-aspect has reviewed upstream
|
|
23
|
+
L13. L11.1 adds database-discovery/write-access safeguards, Unix signer descriptor
|
|
24
|
+
closure, wallet-derived per-send RBF defaults and prepared-transaction/PSBT
|
|
25
|
+
signaling. L11.2 adds transient-key sweep with cancellation/final authorization,
|
|
26
|
+
shared UTXO scanning and wallet-derived coin-control facts.
|
|
27
|
+
|
|
28
|
+
The narrow monotonic `uptime` RPC sub-aspect has reviewed upstream
|
|
24
29
|
equivalence; this does not retire the remaining operator-stats contract.
|
|
25
30
|
|
|
26
31
|
MiniUPnPc dependency discovery is retained, but its UPnP runtime and depends
|
|
@@ -307,37 +312,48 @@ mining. Explicitly supplied staged options warn that they are not enforced.
|
|
|
307
312
|
are inherited Core foundations. Roots rejects unwritable database directories,
|
|
308
313
|
avoids recursively scanning node database directories and symlink/reparse
|
|
309
314
|
points, and closes unrelated child descriptors for signer commands. Preserve
|
|
310
|
-
normal wallet locking and error reporting; do not introduce another database,
|
|
311
|
-
backup/flush promise or Berkeley DB build option. See database (`src/wallet/db.cpp`, source reference),
|
|
312
|
-
SQLite (`src/wallet/sqlite.cpp`, source reference), filesystem helpers (`src/util/fs_helpers.cpp`, source reference)
|
|
313
|
-
and signer child invocation (`src/common/run_command.cpp`, source reference). Acceptance:
|
|
314
|
-
wallet_multiwallet.py (`test/functional/wallet_multiwallet.py`, source reference),
|
|
315
|
-
wallet_signer.py (`test/functional/wallet_signer.py`, source reference) and
|
|
316
|
-
wallet_tests.cpp (`src/wallet/test/wallet_tests.cpp`, source reference). Gap: platform-specific
|
|
317
|
-
reparse-point/permission cases and external signer availability in each build.
|
|
315
|
+
normal wallet locking and error reporting; automatic anti-fee-sniping
|
|
316
|
+
locktimes avoid the CAT21 marker reserved by local policy. Do not introduce another database,
|
|
317
|
+
backup/flush promise or Berkeley DB build option. [See database](../src/wallet/db.cpp),
|
|
318
|
+
[SQLite](../src/wallet/sqlite.cpp), [filesystem helpers](../src/util/fs_helpers.cpp)
|
|
319
|
+
and signer [child invocation](../src/common/run_command.cpp). Acceptance:
|
|
320
|
+
[wallet_multiwallet.py](../test/functional/wallet_multiwallet.py),
|
|
321
|
+
[wallet_signer.py](../test/functional/wallet_signer.py) and
|
|
322
|
+
[wallet_tests.cpp](../src/wallet/test/wallet_tests.cpp). Candidate evidence also
|
|
323
|
+
checks inherited Unix descriptors, directory write
|
|
324
|
+
probes, skipped node databases and symlink traversal. Unix signer closure keeps
|
|
325
|
+
standard streams and the exec-error pipe, closes actual inherited descriptors
|
|
326
|
+
even above a lowered soft limit, and fails before exec if safe closure fails.
|
|
327
|
+
Linux uses `close_range` or raw `/proc/self/fd` enumeration; other Unix builds
|
|
328
|
+
use native `closefrom` when available. Gap: non-Linux fallback runtime, Windows
|
|
329
|
+
reparse-point/permission cases and inherited handle closure; the Unix
|
|
330
|
+
close-descriptor implementation does not prove Windows handle isolation.
|
|
318
331
|
- **wallet-rbf:** the per-send GUI choice starts from the wallet's `walletrbf`
|
|
319
332
|
preference (Core default true), explicitly overrides it for the prepared
|
|
320
333
|
transaction, and shows its resulting signaling in confirmation and saved
|
|
321
334
|
PSBT. It is a signaling choice, not a guarantee of network replacement. See
|
|
322
|
-
Send dialog (`src/qt/sendcoinsdialog.cpp`, source reference) and
|
|
323
|
-
wallet model (`src/qt/walletmodel.cpp`, source reference). Acceptance:
|
|
324
|
-
wallettests.cpp (`src/qt/test/wallettests.cpp`, source reference) `walletTests` explicit on/off
|
|
325
|
-
override and decoded PSBT sequence assertions. Gap: visual confirmation/font
|
|
326
|
-
scale matrix, not established by a headless build.
|
|
335
|
+
[Send dialog](../src/qt/sendcoinsdialog.cpp) and
|
|
336
|
+
[wallet model](../src/qt/walletmodel.cpp). Acceptance:
|
|
337
|
+
[wallettests.cpp](../src/qt/test/wallettests.cpp) `walletTests` explicit on/off
|
|
338
|
+
override and decoded PSBT sequence assertions. Rendering evidence is recorded
|
|
339
|
+
in the wallet theme port review.
|
|
327
340
|
- **wallet-sweep:** only documented WIF/script forms, local-key descriptor
|
|
328
341
|
destination in the selected wallet, no key import, preview by default and
|
|
329
|
-
final authorization before broadcast. Fee state is snapshotted under wallet
|
|
342
|
+
final authorization before broadcast. Destination eligibility requires native
|
|
343
|
+
script satisfaction with available local keys, including encrypted keys:
|
|
344
|
+
incomplete multisig is rejected, while a sufficient subset is accepted.
|
|
345
|
+
Fee state is snapshotted under wallet
|
|
330
346
|
locking; cancellation/invalidation can stop scanning or preview, while accepted
|
|
331
347
|
broadcast submission completes. Reduce secret lifetime using secure storage,
|
|
332
348
|
cleansing and console redaction without claiming complete host/toolkit erasure.
|
|
333
|
-
The full operational contract is [wallet-privacy.md](/doc/wallet-privacy.md).
|
|
334
|
-
See RPC (`src/wallet/rpc/spend.cpp`, source reference), construction (`src/wallet/spend.cpp`, source reference)
|
|
335
|
-
and dialog (`src/qt/sweepdialog.cpp`, source reference). Acceptance:
|
|
336
|
-
wallet_sweepprivkeys.py (`test/functional/wallet_sweepprivkeys.py`, source reference) `run_test`
|
|
349
|
+
The full operational contract is [wallet-privacy.md](wallet-privacy.md).
|
|
350
|
+
See [RPC](../src/wallet/rpc/spend.cpp),
|
|
351
|
+
[construction](../src/wallet/spend.cpp) and [dialog](../src/qt/sweepdialog.cpp). Acceptance:
|
|
352
|
+
[wallet_sweepprivkeys.py](../test/functional/wallet_sweepprivkeys.py) `run_test`
|
|
337
353
|
covers supported script forms, destination rejection, no import, stale/conflicting
|
|
338
|
-
previews and broadcast; wallettests.cpp (`src/qt/test/wallettests.cpp`, source reference)
|
|
354
|
+
previews and broadcast; [wallettests.cpp](../src/qt/test/wallettests.cpp)
|
|
339
355
|
`walletTests` covers secure cache and preview invalidation;
|
|
340
|
-
test_wallet_privacy_contract.py (`ci/test/test_wallet_privacy_contract.py`, source reference)
|
|
356
|
+
[test_wallet_privacy_contract.py](../ci/test/test_wallet_privacy_contract.py)
|
|
341
357
|
checks source structure of authorization/redaction boundaries. Gap: that static
|
|
342
358
|
check is not a race proof; cancellation/authorization concurrency and GUI
|
|
343
359
|
confirmation need runtime and visual evidence.
|
|
@@ -346,12 +362,12 @@ mining. Explicitly supplied staged options warn that they are not enforced.
|
|
|
346
362
|
visible but unselectable; ordinary availability filters still exclude unsafe
|
|
347
363
|
and immature outputs. Material wallet changes clear explicit selection.
|
|
348
364
|
Conspicuously validate custom change; do not add automatic consolidation or
|
|
349
|
-
anonymity claims. See [wallet-privacy.md](/doc/wallet-privacy.md),
|
|
350
|
-
coin control (`src/qt/coincontroldialog.cpp`, source reference) and
|
|
351
|
-
wallet facts (`src/wallet/rpc/wallet.cpp`, source reference). Acceptance:
|
|
352
|
-
wallettests.cpp (`src/qt/test/wallettests.cpp`, source reference) `walletTests` selected/locked
|
|
353
|
-
and invalidation cases, wallet_send.py (`test/functional/wallet_send.py`, source reference) and
|
|
354
|
-
test_wallet_privacy_contract.py (`ci/test/test_wallet_privacy_contract.py`, source reference)
|
|
365
|
+
anonymity claims. See [wallet-privacy.md](wallet-privacy.md),
|
|
366
|
+
[coin control](../src/qt/coincontroldialog.cpp) and
|
|
367
|
+
[wallet facts](../src/wallet/interfaces.cpp). Acceptance:
|
|
368
|
+
[wallettests.cpp](../src/qt/test/wallettests.cpp) `walletTests` selected/locked
|
|
369
|
+
and invalidation cases, [wallet_send.py](../test/functional/wallet_send.py) and
|
|
370
|
+
[test_wallet_privacy_contract.py](../ci/test/test_wallet_privacy_contract.py)
|
|
355
371
|
row-filter assertions. Gap: populated GUI and custom-change visual matrix.
|
|
356
372
|
|
|
357
373
|
### Runtime, configuration, portability and identity
|