release: Prepare for 0.3.1

real-or-random commented at 1:54 pm on April 10, 2023: contributor

in CHANGELOG.md:12 in c708dbfc2f outdated

 4@@ -5,7 +5,20 @@ All notable changes to this project will be documented in this file.
 5 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 6 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 7 
 8-## [Unreleased]
 9+## [0.3.1] - 2023-04-10
10+We strongly recommend updating to 0.3.1 if you use or plan to use Clang >=14 to compile libsecp256k1, e.g., Xcode >=14 on macOS has Clang >=14. When in doubt, check the Clang version using `clang -v`.
11+
12+#### Security
13+ - Fix "constant-timeness" issue with Clang >=14 that could leave applications using libsecp256k1 vulnerable a timing side-channel attack. The fix avoids secret-dependent control flow and secret-dependent memory accesses in conditional moves of memory objects when libsecp256k1 is compiled with Clang >=14.

sipa commented at 2:10 pm on April 10, 2023:

vulnerable to a timing side-channel attack

real-or-random commented at 2:12 pm on April 10, 2023:

fixed

real-or-random force-pushed on Apr 10, 2023

in CHANGELOG.md:18 in 980907eb49 outdated

14+
15+#### Added
16+  - Added tests against [Project Wycheproof's](https://github.com/google/wycheproof/) set of ECDSA test vectors (Bitcoin "low-S" variant), a fixed set of test cases designed to trigger various edge cases.
17+
18+#### Changed
19+ - Increased minimum required CMake version to 1.13. CMake builds remain experimental.

sipa commented at 2:18 pm on April 10, 2023:

CMake 3.13, no?

real-or-random commented at 2:21 pm on April 10, 2023:

sure.. -.- fixed.

real-or-random force-pushed on Apr 10, 2023

in configure.ac:17 in 00f390844d outdated

14 # https://www.gnu.org/software/libtool/manual/html_node/Updating-version-info.html
15 # All changes in experimental modules are treated as if they don't affect the
16 # interface and therefore only increase the revision.
17 define(_LIB_VERSION_CURRENT, 2)
18-define(_LIB_VERSION_REVISION, 1)
19+define(_LIB_VERSION_REVISION, 2)

jonasnick commented at 2:26 pm on April 10, 2023:

Why increase the lib version?

sipa commented at 2:42 pm on April 10, 2023:

From the linked libtool documentation:

If the library source code has changed at all since the last update, then increment revision (‘c:r:a’ becomes ‘c:r+1:a’).

If any interfaces have been added, removed, or changed since the last update, increment current, and set revision to 0.

If any interfaces have been added since the last public release, then increment age.

If any interfaces have been removed or changed since the last public release, then set age to 0.

I believe only the first rule applies here, so incrementing revision and not changing anything else seems correct to me.

real-or-random commented at 2:42 pm on April 10, 2023:

indeed.

jonasnick commented at 2:56 pm on April 10, 2023:

Maybe I’m missing something obvious, but this library version was never released. I’m not sure why we would treat the library version different to the package version in that regard. The lib version was incremented in #1228 at the same time when the package version was updated to 0.3.1. We do this so that master has a different version than the previous release.

real-or-random commented at 3:10 pm on April 10, 2023:

Oh, I didn’t know that we had already increased it. We should clarify this in the release process…

real-or-random commented at 3:12 pm on April 10, 2023:

fixed

jonasnick commented at 3:20 pm on April 10, 2023:

See #1267

sipa commented at 2:44 pm on April 10, 2023: contributor

ACK 00f390844d97cc811b0443f763f49d08e9b45397

changelog: Catch up in preparation of 0.3.1

Co-authored-by: Pieter Wuille <pieter@wuille.net>

0e091669a1

changelog: Remove inconsistent newlines 1d9a13fc26

real-or-random force-pushed on Apr 10, 2023

real-or-random commented at 2:46 pm on April 10, 2023: contributor

forced-push to rebase on master, just to make sure

release: Prepare for 0.3.1 898e1c676e

real-or-random force-pushed on Apr 10, 2023

jonasnick commented at 3:45 pm on April 10, 2023: contributor

ACK 898e1c676e177af73b2c7b540cc93e72a2790fa2

jonasnick cross-referenced this on Apr 10, 2023 from issue release cleanup: bump version after 0.3.1 by jonasnick

sipa commented at 3:55 pm on April 10, 2023: contributor

ACK 898e1c676e177af73b2c7b540cc93e72a2790fa2

real-or-random commented at 3:56 pm on April 10, 2023: contributor

Let’s maybe wait for CI.

real-or-random commented at 4:11 pm on April 10, 2023: contributor

see also #1268 (comment), please. I assume it’s okay to merge this PR here without the “[Unreleased]” section, but I can add it if you insist, of course.

jonasnick merged this on Apr 10, 2023

jonasnick closed this on Apr 10, 2023

sipa referenced this in commit e1552d578e on Apr 11, 2023

sipa referenced this in commit c981671e9b on Apr 14, 2023

hebasto commented at 3:02 pm on April 15, 2023: member

FWIW, here is an ABI compatibility report created with ABI Compliance Checker.

hebasto referenced this in commit 49c52ea2b1 on May 13, 2023

RandyMcMillan referenced this in commit 3cc75121b3 on May 27, 2023

vmta referenced this in commit e1120c94a1 on Jun 4, 2023

vmta referenced this in commit 8f03457eed on Jul 1, 2023

alokeutpal approved

jonasnick cross-referenced this on Jul 21, 2023 from issue Upstream PRs 1228, 1236, 1243, 1238, 1246, 1247, 1242, 1250, 1244, 1241, 1257, 1226, 1252, 1118, 1245, 1266, 1269 by jonasnick

release: Prepare for 0.3.1 #1266