Release zcash_script 0.6.0 and libzcash_script 0.2.0 (bip32 0.6, secp256k1 0.33)

[nuttycom]

DO NOT SQUASH-MERGE

Releases zcash_script 0.6.0 and libzcash_script 0.2.0.

Crate	Version
zcash_script	0.5.2 → 0.6.0
libzcash_script	0.1.0 → 0.2.0

Motivation

The Zcash Rust crates are moving to orchard 0.16 and sapling-crypto 0.9, which require zcash_note_encryption 0.5.1. That release depends on cipher 0.5 and so on the stable crypto-common 0.2, which bip32 =0.6.0-pre.1 (via digest 0.11.0-pre.9) cannot build against. Every consumer that links both zcash_script and the shielded crates therefore needs zcash_script on bip32 0.6 (zcash/librustzcash#3091).

Changes

• bip32 0.6 and secp256k1 0.33. Signature verification uses secp256k1::ecdsa::verify in place of the deprecated Secp256k1::verify_ecdsa. secp256k1 types appear in the public API, so this is a breaking release.
• MSRV 1.85. bip32 0.6 requires it. The pinned toolchain moves from 1.81 to 1.85, where the Linux C++ linking problem noted in rust-toolchain.toml is fixed. Includes the fixes for the clippy lints the 1.85 toolchain reports.
• The 0.4.4 and 0.4.5 changes. This branch is based on the merge of zcash_script-v0.4.5 (Merge zcash_script-0.4.5 back to master #309), so 0.6.0 is the first release of this line to include HashType::raw_bits() and the zcashd-matching sig_op_count().
• libsecp256k1 0.8.0 for the C++ interpreter. The libsecp256k1 copy that libzcash_script vendors under depend/zcash/src/secp256k1 is updated in place from 0.2.0 to 0.8.0, the release secp256k1-sys 0.14 vendors, by git subtree pull. The zcashd subtree metadata for that path was lost when zcashd was squashed into this repository, so a -s ours merge first records its upstream base (v0.2.0); later updates are a plain git subtree pull --prefix libzcash_script/depend/zcash/src/secp256k1 https://github.com/bitcoin-core/secp256k1.git <tag> --squash. The library is built with the modules and precomputation parameters secp256k1-sys uses, so building with --cfg rust_secp_no_symbol_renaming links the Rust secp256k1 bindings against it and leaves a single copy of libsecp256k1 in the binary. The commit message records why each of zcashd's former configuration defines could be removed.
• libzcash_script link fixes. The bundled library is linked after libzcash_script and under a name distinct from secp256k1-sys's, and SECP256K1_STATIC is defined so that libsecp256k1 0.8.0's headers do not declare its API as imported from a DLL on Windows.
• CI. The Package job runs on stable and nightly, whose cargo packages the workspace members together; on 1.85 libzcash_script cannot be packaged against an unpublished zcash_script. A new Test Suite (single libsecp256k1) job runs libzcash_script's Rust/C++ comparison tests with --cfg rust_secp_no_symbol_renaming and checks that each test binary contains the unprefixed libsecp256k1 and none of secp256k1-sys's prefixed copy.

Each first-parent commit builds on its own (cargo check --workspace --all-targets and cargo check -p zcash_script --all-features --all-targets).

Test plan

• cargo test (default members): libzcash_script 14 passed, zcash_script 5 passed
• cargo test -p zcash_script --all-features
• cargo test -p libzcash_script with --cfg rust_secp_no_symbol_renaming, and the single-libsecp256k1 symbol check (which fails, as intended, on a default build)
• cargo check -p zcash_script --no-default-features --features signature-validation
• cargo clippy --workspace --all-targets -- -D warnings and cargo clippy -p zcash_script --all-features --all-targets -- -D warnings on 1.85
• cargo fmt --all -- --check
• cargo +stable package (both crates)
• Windows MSVC build, which only CI exercises

After merge: create the zcash_script-v0.6.0 and libzcash_script-v0.2.0 GitHub releases and publish zcash_script before libzcash_script, per zcash_script/README.md.

🤖 Generated with Claude Code

[conradoplg]

This is missing some fixes that were included in the 0.4.x branch that were never incorporated in to the 0.5.x branch which ended up being abandoned. Claude findings:

---

Must fix before merging

1. Consensus regression in sig_op_count (zcash_script/src/script/iter.rs:106)

• Cause: neither 5db94de ("make sig_op_count() match zcashd", released in 0.4.5) nor bc58d40 (HashType::raw_bits(), released in 0.4.4) is an ancestor of the PR. The PR head still has the try_fold that
  stops at the first Disabled opcode.
• Evidence: I ran a probe on both versions:

Script	0.4.5 (and zcashd)	PR head
OP_CODESEPARATOR OP_CHECKSIG	1	0
OP_CAT OP_CHECKSIG	1	0
OP_CODESEPARATOR + 50× OP_CHECKMULTISIG	1000	0

The PR's test plan shows 4 zcash_script tests, not 5, because 0.4.5's regression test isn't there.

• Impact: Zebra moving from 0.4.5 to 0.6.0 would undercount sigops and accept blocks that zcashd rejects.
• Fix: forward-port both commits to master first. raw_bits() is also a public API regression for anyone on 0.4.4 or later. The published 0.5.2 has the same bug. zcash_script/README.md only describes
  cherry-picking from main to the backport branch, which is how this gap opened, so it needs a forward-port step.

2. The Windows (MSVC) build is broken. CI's Test Suite (windows-latest) fails with LNK2019: unresolved external symbol __imp_secp256k1_ecdsa_verify and five other _imp_secp256k1* symbols.

• Cause: v0.8.0's include/secp256k1.h declares its API __declspec(dllimport) on _WIN32 unless SECP256K1_STATIC is defined. v0.2.0 had no such default.
• Fix: add .define("SECP256K1_STATIC", None) to base_config in libzcash_script/build.rs (around line 82). MinGW is affected the same way. I couldn't test this without Windows.

5. The std feature doesn't enable secp256k1/std (std = []). So ecdsa::verify uses secp256k1's no-std shared context. Each call spins on one global lock, copies the context, and then builds a new one anyway,
   because upstream clone_into never sets the cached pointer (I checked the source).

• The old code also built a context on every call, so this is mostly added contention when Zebra verifies in parallel.
• std = ["secp256k1?/std"] avoids it. I didn't benchmark.

6. Minor items:

• The 0.6.0 CHANGELOG doesn't list which public APIs changed type: signature::Decoded::sig(), descriptor::KeyExpression::from_xpub and descriptor::Key.

[nuttycom]

self-utACK

[nuttycom]

@conradoplg were those changes never merged back to main?

[conradoplg]

@conradoplg were those changes never merged back to main?

No, we ended up never getting around doing that ☹️

[nuttycom]

@conradoplg were those changes never merged back to main?

No, we ended up never getting around doing that ☹️
Fixed now. So this PR should now be in the correct state for release. Can you re-review?

[str4d]

Reviewed c2f9969

[str4d]

utACK 534eb4b

[str4d]

utACK 8d2fc24