chore(deps): Use github.com/decred/dcrd/dcrec/secp256k1/v4 directly #97
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
To work around the false positive CVE being detected based on our dependency on
github.com/btcsuite/btcd/btcec
I went down the rabbit hole and learned thatbtcec
is actually a pretty light wrapper aroundgithub.com/decred/dcrd/dcrec/secp256k1
, so updated to use that directly to minimize our dependency graph.However, in doing so I learned that
github.com/decred/dcrd/dcrec/secp256k1
didn't actually expose theR
andS
values until very recently, in fact the functionality was just added in decred/dcrd#3188 but hasn't been released yet, hence thego.mod
pointing directly to a commit on https://github.com/decred/dcrdmaster
. Once1.9.0
is released we can update our dep to point to that instead.This also has the nice affect of significantly lowering the total deps since we don't need to pull in everything else from
btcd
's dependency chain.