Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): Use github.com/decred/dcrd/dcrec/secp256k1/v4 directly #97

Merged
merged 1 commit into from
Oct 3, 2023

Conversation

ryanschneider
Copy link
Contributor

To work around the false positive CVE being detected based on our dependency on github.com/btcsuite/btcd/btcec I went down the rabbit hole and learned that btcec is actually a pretty light wrapper around github.com/decred/dcrd/dcrec/secp256k1, so updated to use that directly to minimize our dependency graph.

However, in doing so I learned that github.com/decred/dcrd/dcrec/secp256k1 didn't actually expose the R and S values until very recently, in fact the functionality was just added in decred/dcrd#3188 but hasn't been released yet, hence the go.mod pointing directly to a commit on https://github.com/decred/dcrd master. Once 1.9.0 is released we can update our dep to point to that instead.

This also has the nice affect of significantly lowering the total deps since we don't need to pull in everything else from btcd's dependency chain.

@ryanschneider ryanschneider merged commit 8b8f17d into master Oct 3, 2023
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants