btclib

Only the latest release is supported (SECURITY.md). For upgrading, RELEASING.md runs griffe check against the previous tag, and RELEASE_NOTES.md lists each breaking change with its before and after. https://github.com/btclib-org/btclib/blob/main/RELEASE_NOTES.md

Issues are tracked in this repository's GitHub Issues, with issue forms; cross-repository issues go to btclib-org/.github's tracker. https://github.com/btclib-org/btclib/issues

The reporter of GHSA-9fr5-46w5-5f9r, pmazzocchi, is credited as finder on the advisory. https://github.com/btclib-org/btclib/security/advisories/GHSA-9fr5-46w5-5f9r

SECURITY.md's Reporting a vulnerability gives the private channels (a GitHub security advisory, or security at btclib dot org), who sees a report, and how to request a CVE. Private vulnerability reporting is enabled. https://github.com/btclib-org/btclib/blob/main/SECURITY.md

pyproject.toml's [tool.ruff] selects every rule (select = ["ALL"]) with a documented ignore list, and [tool.mypy] runs in strict mode. CONTRIBUTING.md names both and the commands that run them. https://github.com/btclib-org/btclib/blob/main/pyproject.toml

ruff-check, ruff-format and mypy run in .pre-commit-config.yaml, which the required lint check runs on every pull request. https://github.com/btclib-org/btclib/blob/main/.pre-commit-config.yaml

btclib is pure Python built with uv_build, so no compiler or linker runs for CC, CFLAGS or LDFLAGS to reach. https://github.com/btclib-org/btclib/blob/main/pyproject.toml

No native build or installation step exists to strip or preserve debugging information. https://github.com/btclib-org/btclib/blob/main/pyproject.toml

This tree builds no native binaries, so there is no recursive-build question to answer. https://github.com/btclib-org/btclib/blob/main/pyproject.toml

Every week sdist-rebuild.yml rebuilds the latest release's sdist from its tag. It passes only if the rebuilt file matches the release's attested digest byte for byte. https://github.com/btclib-org/btclib/blob/main/.github/workflows/sdist-rebuild.yml

btclib is on PyPI, so pip install and pip uninstall install and remove it. README.md gives the command. https://github.com/btclib-org/btclib/blob/main/README.md

Installation is pip install, which follows pip's own install-location conventions; the project has no installer of its own. https://github.com/btclib-org/btclib/blob/main/pyproject.toml

uv sync installs the whole development environment in one command. CONTRIBUTING.md's The environment and the gates gives it. https://github.com/btclib-org/btclib/blob/main/CONTRIBUTING.md

Every dependency is declared in machine-readable form in pyproject.toml's [project.dependencies] and dependency-groups, resolved and pinned in the committed uv.lock. https://github.com/btclib-org/btclib/blob/main/pyproject.toml

Dependabot version updates are configured in .github/dependabot.yml, and Dependabot security updates are enabled on the repository. https://github.com/btclib-org/btclib/blob/main/.github/dependabot.yml

Reused components are standard-library modules or PyPI packages pinned in uv.lock. Dependabot updates them weekly through pull requests that run the full suite. https://github.com/btclib-org/btclib/blob/main/.github/dependabot.yml

ruff's UP and FA rules flag deprecated standard-library and typing constructs. pytest runs with filterwarnings = ["error"], so a deprecation warning fails the suite, and deps-latest.yml runs it weekly against each dependency's newest release. https://github.com/btclib-org/btclib/blob/main/pyproject.toml

test.yml runs the suite, and integration-bitcoind.yml runs tests/integration against Bitcoin Core on regtest, on every pull request and push to main. Both are required checks. https://github.com/btclib-org/btclib/blob/main/.github/workflows/test.yml

Every bug fix to src/ merged in the last six months also changes tests/. The 100% line and branch coverage gate also fails a fix whose new code no test runs. https://github.com/btclib-org/btclib/pulls?q=is%3Apr+is%3Amerged

pyproject.toml sets fail_under = 100.0 under [tool.coverage.report], gated on every pull request. https://github.com/btclib-org/btclib/blob/main/pyproject.toml

CONTRIBUTING.md requires 100% coverage, and fail_under = 100.0 fails the required check for any new code without a test. https://github.com/btclib-org/btclib/blob/main/CONTRIBUTING.md

CONTRIBUTING.md documents the 100% coverage requirement, so new functionality needs a test. https://github.com/btclib-org/btclib/blob/main/CONTRIBUTING.md

ruff runs with select = ["ALL"] and mypy with strict = true, both with zero findings allowed in the required lint check. https://github.com/btclib-org/btclib/blob/main/pyproject.toml

ASSURANCE_CASE.md's Secure design principles argues how each principle applies to ARCHITECTURE.md's layers. https://github.com/btclib-org/btclib/blob/main/ASSURANCE_CASE.md

btclib's only SHA-1 is Bitcoin script's OP_SHA1, which the protocol requires and which runs with usedforsecurity=False. The curve schemes and ECIES are btclib_ecc's. SECURITY.md documents where a secret reaches the Python fallback. https://github.com/btclib-org/btclib/blob/main/SECURITY.md

btclib has no configuration file or credential store: a private key or password is a function argument, never read from or written to a file. https://github.com/btclib-org/btclib/blob/main/SECURITY.md

btclib does not communicate over a network, as docs/source/guide.rst states. https://github.com/btclib-org/btclib/blob/main/docs/source/guide.rst

btclib performs no network communications and so uses no TLS. https://github.com/btclib-org/btclib/blob/main/docs/source/guide.rst

btclib performs no network communications and so uses no TLS. https://github.com/btclib-org/btclib/blob/main/docs/source/guide.rst

btclib performs no network communications and so uses no TLS. https://github.com/btclib-org/btclib/blob/main/docs/source/guide.rst

Every PyPI file from 2026.8.7 on carries a PEP 740 attestation, and every GitHub release from v2026.8.21 on a Sigstore provenance bundle. Release tags are signed from v2026.8.21 on. SECURITY.md gives the verify command. https://github.com/btclib-org/btclib/releases/latest

Release tags are signed from v2026.8.21 on, and GitHub verifies each. RELEASING.md signs each tag with git tag -s and reads the signature back after the push. https://github.com/btclib-org/btclib/tags

Every public function validates its inputs and refuses what is invalid; the unchecked work lives in a private twin the public function calls once it has validated, as CONTRIBUTING.md requires. https://github.com/btclib-org/btclib/blob/main/CONTRIBUTING.md

ruff's select = ["ALL"] includes the bandit S rules, so unsafe deserialization, weak temp files and shell injection fail the lint gate. CodeQL also runs on every pull request, every push to main and weekly. https://github.com/btclib-org/btclib/blob/main/.github/workflows/codeql.yml

ASSURANCE_CASE.md states the threat model, the trust boundaries, the secure-design argument and the argument against common implementation weaknesses this criterion asks for. https://github.com/btclib-org/btclib/blob/main/ASSURANCE_CASE.md

CodeQL runs on every pull request, every push to main and weekly, and ruff's select = ["ALL"] includes the bandit S rules. https://github.com/btclib-org/btclib/blob/main/.github/workflows/codeql.yml

This tree ships pure Python, a memory-safe language; it produces no software written in a memory-unsafe language for a dynamic memory-safety tool to run against. https://github.com/btclib-org/btclib/blob/main/pyproject.toml