@scure/btc-signer 1.0.1 → 1.1.1

package/README.md

@@ -2,29 +2,30 @@
 
 Audited & minimal library for creating, signing & decoding Bitcoin transactions.
 
+- 🔒 [**Audited**](#security) by an independent security firm
 - ✍️ Create transactions, inputs, outputs, sign them
 - 📡 No network code: simplified audits and offline usage
 - 🎻 Classic & SegWit: P2PK, P2PKH, P2WPKH, P2SH, P2WSH, P2MS
 - 🧪 Schnorr & Taproot BIP340/BIP341: P2TR, P2TR-NS, P2TR-MS
 - 📨 BIP174 PSBT
 - 👥 Multisig support
-- 🔒 [**Audited**](#security) by an independent security firm
 - 🪶 ~2600 lines
 
 Initial development has been funded by [Ryan Shea](https://shea.io). Check out [the demo](https://signerdemo.micro-btc.dev/) & [its github](https://github.com/shea256/micro-btc-web-demo).
 
 ### This library belongs to _scure_
 
-> **scure** — secure, independently audited packages for every use case.
+> **scure** — audited micro-libraries.
 
-- All releases are signed with PGP keys
-- Check out all libraries:
+- Zero or minimal dependencies
+- Highly readable TypeScript / JS code
+- PGP-signed releases and transparent NPM builds
+- Check out [homepage](https://paulmillr.com/noble/#scure) & all libraries:
   [base](https://github.com/paulmillr/scure-base),
   [bip32](https://github.com/paulmillr/scure-bip32),
   [bip39](https://github.com/paulmillr/scure-bip39),
-  [btc-signer](https://github.com/paulmillr/scure-btc-signer)
-
-*Check out all web3 utility libraries:* [ETH](https://github.com/paulmillr/micro-eth-signer), [BTC](https://github.com/paulmillr/scure-btc-signer), [SOL](https://github.com/paulmillr/micro-sol-signer), [micro-web3](https://github.com/paulmillr/micro-web3), [tx-tor-broadcaster](https://github.com/paulmillr/tx-tor-broadcaster)
+  [btc-signer](https://github.com/paulmillr/scure-btc-signer),
+  [starknet](https://github.com/paulmillr/scure-starknet)
 
 ## Usage
 
@@ -36,7 +37,7 @@ For React Native, you may need a [polyfill for crypto.getRandomValues](https://g
 
 ```ts
 import * as btc from '@scure/btc-signer';
-// import * as btc from "npm:@scure/btc-signer@0.5.0"; // Deno
+// import * as btc from "npm:@scure/btc-signer@1.0.0"; // Deno
 ```
 
 ### Table of Contents
@@ -530,7 +531,7 @@ type TransactionOutput = {
 
 tx.addOutput(o: TransactionOutput): number;
 tx.updateOutput(idx: number, output: TransactionOutput);
-tx.addOutputAddress(address: string, amount: string | bigint, network = NETWORK): number;
+tx.addOutputAddress(address: string, amount: bigint, network = NETWORK): number;
 
 const compressed = hex.decode(
   '030000000000000000000000000000000000000000000000000000000000000001'
@@ -621,10 +622,10 @@ const epriv =
   'tprv8ZgxMBicQKsPd9TeAdPADNnSyH9SSUUbTVeFszDE23Ki6TBB5nCefAdHkK8Fm3qMQR6sHwA56zqRmKmxnHk37JkiFzvncDqoKmPWubu7hDF';
 const hdkey = bip32.HDKey.fromExtendedKey(epriv, testnet.bip32);
 // const seed = 'cUkG8i1RFfWGWy5ziR11zJ5V4U4W3viSFCfyJmZnvQaUsd1xuF3T';
-const tx = new btc.Transaction(2);
+const tx = new btc.Transaction();
 // A creator creating a PSBT for a transaction which creates the following outputs:
-tx.addOutput({ script: '0014d85c2b71d0060b09c9886aeb815e50991dda124d', amount: '1.49990000' });
-tx.addOutput({ script: '001400aea9a2e5f0f876a588df5546e8742d1d87008f', amount: '1.00000000' });
+tx.addOutput({ script: '0014d85c2b71d0060b09c9886aeb815e50991dda124d', amount: btc.Decimal.decode('1.49990000') });
+tx.addOutput({ script: '001400aea9a2e5f0f876a588df5546e8742d1d87008f', amount: btc.Decimal.decode('1.00000000') });
 // and spends the following inputs:
 tx.addInput({
   txid: '75ddabb27b8845f5247975c8a5ba7c6f336c4570708ebe230caf6db5217ae858',
@@ -696,7 +697,7 @@ const psbt2 = tx2.toPSBT();
 // An updater which adds SIGHASH_ALL to the above PSBT must create this PSBT:
 const tx3 = btc.Transaction.fromPSBT(psbt2);
 for (let i = 0; i < tx3.inputs.length; i++)
-  tx3.updateInput(i, { sighashType: btc.SignatureHash.ALL });
+  tx3.updateInput(i, { sighashType: btc.SigHash.ALL });
 const psbt3 = tx3.toPSBT();
 /*
   Given the above updated PSBT, a signer that supports SIGHASH_ALL for P2PKH and P2WPKH spends and uses RFC6979 for nonce generation and has the following keys:
@@ -836,16 +837,36 @@ deepStrictEqual(
 
 ## Security
 
-The library has been audited on Feb 21, 2023 by an independent security firm cure53: [PDF](./audit/2023-02-21-cure53-audit-report.pdf). The audit has been funded by Ryan Shea.
-
-Target was v0.3.0 (commit 397ed56), see [changes since audit](https://github.com/paulmillr/scure-btc-signer/compare/0.3.0..main).
-
-We consider infrastructure attacks like rogue NPM modules very important; that's why it's crucial to minimize the amount of 3rd-party dependencies & native bindings. If your app uses 500 dependencies, any dep could get hacked and you'll be downloading malware with every `npm install`. Our goal is to minimize this attack vector. As for dependencies used by the library:
-
-- noble-curves, noble-hashes are audited cryptography libraries also developed by us and follow the same practices
-- scure-base is used for bech32 / base64 and was also audited
-- micro-packed is used for binary encoding, has not been audited
-- devDependencies contain scure-bip32, micro-packed-debugger, micro-should (our packages). Locked versions of prettier (linter) and typescript which are rarely updated. Every update is checked with `npm-diff`. They are only used if you clone the git repo and want to add some feature to it. End-users won't use them
+The library has been independently audited:
+
+- at version 0.3.0, in Feb 2023, by [cure53](https://cure53.de)
+  - PDFs: [online](https://cure53.de/audit-report_micro-btc-signer.pdf), [offline](./audit/2023-02-21-cure53-audit-report.pdf)
+  - [Changes since audit](https://github.com/paulmillr/scure-btc-signer/compare/0.3.0..main).
+  - The audit has been funded by [Ryan Shea](https://shea.io)
+
+### Supply chain security
+
+1. **Commits** are signed with PGP keys, to prevent forgery. Make sure to verify commit signatures.
+2. **Releases** are transparent and built on GitHub CI. Make sure to verify [provenance](https://docs.npmjs.com/generating-provenance-statements) logs
+3. **Rare releasing** is followed.
+   The less often it is done, the less code dependents would need to audit
+4. **Dependencies** are minimal:
+   - All deps are prevented from automatic updates and have locked-down version ranges. Every update is checked with `npm-diff`
+   - Updates themselves are rare, to ensure rogue updates are not catched accidentally
+   - [noble-hashes](https://github.com/paulmillr/noble-hashes) provides hashing functionality
+   - [noble-curves](https://github.com/paulmillr/noble-curves) provides elliptic curve cryptography
+   - [scure-base](https://github.com/paulmillr/scure-base) provides bech32 / base64
+   - [micro-packed](https://github.com/paulmillr/micro-packed) provides binary encoding - it has not been audited
+5. devDependencies are only used if you want to contribute to the repo. They are disabled for end-users:
+   - scure-bip32, micro-packed-debugger and micro-should are developed by the same author and follow identical security practices
+   - prettier (linter), fast-check (property-based testing) and typescript are used for code quality, vector generation and ts compilation. The packages are big, which makes it hard to audit their source code thoroughly and fully
+
+We consider infrastructure attacks like rogue NPM modules very important;
+that's why it's crucial to minimize the amount of 3rd-party dependencies & native bindings.
+If your app uses 500 dependencies, any dep could get hacked and you'll be
+downloading malware with every install. Our goal is to minimize this attack vector.
+
+If you see anything unusual: investigate and report.
 
 ## License