ElementsProject · jgriffiths · May 28, 2026 · May 7, 2026 · May 7, 2026 · May 7, 2026
diff --git a/.github/workflows/wasm-package.yml b/.github/workflows/wasm-package.yml
@@ -10,7 +10,7 @@ on:
 
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
 
     steps:
       - uses: actions/checkout@v5
@@ -24,7 +24,7 @@ jobs:
       # bullseye_deps.sh is written for Debian, but works as-is on Ubuntu too.
       # Skip installing Java (-j), the Android NDK (-n) and MinGW (-w) which
       # we don't need for building the NPM package.
-      - run: sudo contrib/bullseye_deps.sh -j -n -w
+      - run: sudo contrib/trixie_deps.sh -j -n -w
 
       # Build NPM package into a tgz file (pack internally triggers the build/prepare script)
       - run: cd src/wasm_package && npm ci && npm pack --foreground-scripts

diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
@@ -33,7 +33,8 @@ jobs:
 
       - name: Install MSVC
         if: runner.os == 'Windows'
-        uses: ilammy/msvc-dev-cmd@v1.13.0
+        shell: cmd
+        run: call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
 
       - name: Install qemu aarch64
         if: runner.os == 'Linux'
@@ -44,7 +45,7 @@ jobs:
       - name: Build Wheels
         uses: pypa/cibuildwheel@v3.1.4
         env:
-          CIBW_SKIP: "cp38* cp314* *-win32 *-musllinux_aarch64 pp* gp* cp3??t-*"
+          CIBW_SKIP: "cp38* cp315* *-win32 *-musllinux_aarch64 pp* gp* cp3??t-*"
           CIBW_ARCHS_LINUX: "x86_64 aarch64"
           CIBW_ARCHS_MACOS: "x86_64 arm64 universal2"
 

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
@@ -4,57 +4,54 @@ variables:
 stages:
   - test
   - release
+  - docker_build
 
-test_with_valgrind:
+.test_template:
   stage: test
-  image: greenaddress/wallycore@sha256:956b107d688f549c6e3884424991b7d3d34d84173990d43046fd760d7918db7c
+  image: blockstream/wallycore@sha256:060af7536b6d197b269f4e8bcab0e30fe082f656dd4738cf64ad9fd90b93e1d7
+  tags:
+    - ga
+
+test_with_valgrind:
+  extends: .test_template
   parallel:
     matrix:
       - CONFIGURE_ARGS: [--enable-elements=yes,--enable-elements=no,--enable-minimal=yes]
-  tags:
-    - ga
   artifacts:
     reports:
       codequality: valgrind.json
   script:
     - ./tools/cleanup.sh && ./tools/autogen.sh
     - CFLAGS='-Werror' ./configure --enable-export-all --enable-swig-python --enable-swig-java $CONFIGURE_ARGS --enable-shared --disable-static
     - make -j $(($(grep ^processor /proc/cpuinfo | wc -l) / 2))
-    - make check -j $(($(grep ^processor /proc/cpuinfo | wc -l) / 2))
     - for t in $(ls src/.libs/test_* | egrep -v '_clear|xml|json' | tr '\n' ' '); do LD_LIBRARY_PATH=./src/.libs/ valgrind --tool=memcheck --leak-check=full --show-leak-kinds=all --track-origins=yes --verbose --xml=yes --xml-file=$t.xml $t; done
     - for t in $(ls src/.libs/test_* | egrep -v '_clear|xml|json' | tr '\n' ' '); do valgrind-codequality --input-file $t.xml --output-file $t.json; done
     - for t in $(ls src/test/test_*.py | tr '\n' ' '); do WALLY_SKIP_EXPENSIVE_TESTS=1 PYTHONMALLOC=malloc PYTHONDEVMODE=1 MALLOC_CHECK_=3 valgrind --tool=memcheck --leak-check=no --verbose --xml=yes --xml-file=$t.xml python $t; done
     - for t in $(ls src/test/test_*.py | tr '\n' ' '); do valgrind-codequality --input-file $t.xml --output-file $t.json; done
     - jq '[.[]|.[]]' -s ./src/.libs/test_*.json src/test/test_*.json > valgrind.json || true
 
 test_asan_ubsan_gcc:
-  stage: test
-  image: greenaddress/wallycore@sha256:956b107d688f549c6e3884424991b7d3d34d84173990d43046fd760d7918db7c
+  extends: .test_template
   parallel:
     matrix:
       - CONFIGURE_ARGS: [ --enable-elements=no, --enable-elements=no --enable-minimal=yes, "", --enable-minimal=yes ]
-  tags:
-    - ga
   script:
     - ./tools/cleanup.sh && ./tools/autogen.sh
     - CC=gcc CFLAGS="-O2 -fsanitize=address -fsanitize=bounds -fsanitize=undefined -fsanitize=alignment -fsanitize-address-use-after-scope -fno-sanitize-recover=all" ./configure --enable-export-all --enable-swig-python --enable-swig-java $CONFIGURE_ARGS --enable-shared --disable-static --disable-clear-tests --disable-asm
-    - sed -i 's/^PYTHON = /PYTHON = LD_PRELOAD=\/usr\/lib\/gcc\/x86_64-linux-gnu\/10\/libasan.so /g' src/Makefile
-    - sed -i 's/^JAVA = /JAVA = LD_PRELOAD=\/usr\/lib\/gcc\/x86_64-linux-gnu\/10\/libasan.so /g' src/Makefile
+    - sed -i 's/^PYTHON = /PYTHON = LD_PRELOAD=\/usr\/lib\/gcc\/x86_64-linux-gnu\/14\/libasan.so /g' src/Makefile
+    - sed -i 's/^JAVA = /JAVA = LD_PRELOAD=\/usr\/lib\/gcc\/x86_64-linux-gnu\/14\/libasan.so /g' src/Makefile
     - make -j $(($(grep ^processor /proc/cpuinfo | wc -l) / 2))
     - ASAN_OPTIONS=abort_on_error=1:fast_unwind_on_malloc=0:detect_leaks=0 UBSAN_OPTIONS=print_stacktrace=1 make check V=1
 
 test_scan_build_clang:
-  stage: test
-  image: greenaddress/wallycore@sha256:956b107d688f549c6e3884424991b7d3d34d84173990d43046fd760d7918db7c
+  extends: .test_template
   parallel:
     matrix:
       - CONFIGURE_ARGS: [ --enable-elements=no, --enable-elements=no --enable-minimal=yes, "", --enable-minimal=yes ]
-  tags:
-    - ga
   script:
     - ./tools/cleanup.sh && ./tools/autogen.sh
-    - CC=clang scan-build-11 ./configure --enable-export-all --enable-swig-python --enable-swig-java --disable-clear-tests --disable-asm $CONFIGURE_ARGS
-    - scan-build-11 --keep-cc --exclude src/secp256k1/ --status-bugs --keep-empty -o scan-build-output make -j $(($(grep ^processor /proc/cpuinfo | wc -l) / 2))
+    - CC=clang scan-build-19 ./configure --enable-export-all --enable-swig-python --enable-swig-java --disable-clear-tests --disable-asm $CONFIGURE_ARGS
+    - scan-build-19 --keep-cc --exclude src/secp256k1/ --status-bugs --keep-empty -o scan-build-output make -j $(($(grep ^processor /proc/cpuinfo | wc -l) / 2))
   artifacts:
     expire_in: 3 days
     name: scan-build-output
@@ -63,10 +60,7 @@ test_scan_build_clang:
     - scan-build-output/
 
 test_cmake:
-  stage: test
-  image: greenaddress/wallycore@sha256:956b107d688f549c6e3884424991b7d3d34d84173990d43046fd760d7918db7c
-  tags:
-    - ga
+  extends: .test_template
   script:
     - mv _cmake cmake
     - mv _CMakeLists.txt CMakeLists.txt
@@ -82,7 +76,6 @@ test_cmake:
     - cd build-cmake
     - ctest --output-on-failure
     - cd -
-    - pip install gcovr
     - gcovr --xml-pretty --exclude-unreachable-branches --print-summary -o coverage.xml --root ${CI_PROJECT_DIR}
   coverage: /^\s*lines:\s*\d+.\d+\%/
   artifacts:
@@ -93,59 +86,50 @@ test_cmake:
         path: coverage.xml
 
 test_amalgamation:
-  stage: test
-  image: greenaddress/wallycore@sha256:956b107d688f549c6e3884424991b7d3d34d84173990d43046fd760d7918db7c
+  extends: .test_template
   parallel:
     matrix:
       - CC: [gcc, clang ]
         BUILD_ARGS: [ "", -DBUILD_MINIMAL, -DBUILD_ELEMENTS, -DBUILD_ELEMENTS -DBUILD_MINIMAL ]
-  tags:
-    - ga
   script:
     - touch config.h
     - $CC $BUILD_ARGS -Wall -W -Wextra -Werror -I. -I./src -I./src/ccan -I./src/secp256k1/include src/ctest/amalgamation_compile_test.c
 
 test_mingw_static_build:
-  stage: test
-  image: greenaddress/wallycore@sha256:956b107d688f549c6e3884424991b7d3d34d84173990d43046fd760d7918db7c
-  tags:
-    - ga
+  extends: .test_template
   script:
     - ./tools/cleanup.sh && ./tools/autogen.sh
     - CC=x86_64-w64-mingw32-gcc ./configure --host=x86_64-w64-mingw32 --disable-swig-python --disable-swig-java --disable-shared --enable-static
     - make -j $(($(grep ^processor /proc/cpuinfo | wc -l) / 2))
 
 test_no_elements_abi:
-  stage: test
-  image: greenaddress/wallycore@sha256:956b107d688f549c6e3884424991b7d3d34d84173990d43046fd760d7918db7c
-  tags:
-    - ga
+  extends: .test_template
   artifacts:
   script:
     - ./tools/cleanup.sh && ./tools/autogen.sh
     - CFLAGS='-Wall -W -Wextra -Werror' ./configure --disable-swig-python --disable-swig-java --disable-clear-tests --enable-elements=no --enable-elements-abi=no
     - make -j $(($(grep ^processor /proc/cpuinfo | wc -l) / 2))
 
 build_wally_release_files:
+  extends: .test_template
   stage: release
   needs: [test_mingw_static_build,test_with_valgrind,test_asan_ubsan_gcc,test_scan_build_clang,test_cmake,test_amalgamation]
-  image: greenaddress/wallycore@sha256:956b107d688f549c6e3884424991b7d3d34d84173990d43046fd760d7918db7c
   artifacts:
     expire_in: 7 days
     name: wallycore-bindings
     when: on_success
     paths:
     - dist/*
-  tags:
-    - ga
   script:
-    - python3 -m build
+    - python3 -m build --wheel
+    - mv dist/*.whl ${CI_PROJECT_DIR}
+    - python3 -m build --sdist
     - virtualenv -p python3 .smoketest
     - source .smoketest/bin/activate
-    - pip install --find-links=./dist wallycore
+    - pip install --find-links=${CI_PROJECT_DIR} wallycore
     - python -c "import wallycore as w; assert w.hex_from_bytes(w.hex_to_bytes('ff')) == 'ff'"
     - deactivate
-    - rm -rf .smoketest dist/*.whl
+    - rm -rf .smoketest ${CI_PROJECT_DIR}/*.whl
     - mv dist wally_dist
     - ./tools/build_android_libraries.sh
     - mv release wallycore-android-jni
@@ -166,3 +150,39 @@ build_wally_release_files:
     - cd ../..
     - mv wally_dist/* dist/
     - rmdir wally_dist
+
+.docker_build_template:
+  stage: docker_build
+  needs: []
+  when: manual
+  variables:
+    DOCKER_HOST: tcp://localhost:2375
+    DOCKER_TLS_CERTDIR: ""
+    DOCKER_BUILDKIT: 1
+    BUILDX_GIT_INFO: false
+  image: docker:23
+  services:
+    - docker:23-dind
+  tags:
+    - cloud
+  retry:
+    max: 2
+    when: [runner_system_failure, unknown_failure, stuck_or_timeout_failure]
+  script:
+    - echo "$DOCKER_HUB_TOKEN" | docker login --username "$DOCKER_HUB_USER" --password-stdin
+    - docker buildx create --use --platform=linux/amd64,linux/arm64 --name wally-multi-builder --buildkitd-flags '--allow-insecure-entitlement network.host'
+    - docker buildx inspect --bootstrap
+    - cd contrib
+    - docker buildx build
+      --network=host
+      -t blockstream/wallycore:${CI_COMMIT_SHA}
+      ${DOCKER_BUILD_ARGS}
+      .
+      --progress=plain
+      --push
+
+# Debian stable
+build_docker_trixie:
+  extends: .docker_build_template
+  variables:
+    DOCKER_BUILD_ARGS: -f Dockerfile_trixie --platform linux/amd64,linux/arm64
diff --git a/_cmake/config.h.in b/_cmake/config.h.in
@@ -7,8 +7,7 @@
 /* Define to 1 if you have the <asm/page.h> header file. */
 #cmakedefine HAVE_ASM_PAGE_H @HAVE_ASM_PAGE_H@
 
-
-/* Define to 1 if you have the <byteswap.h,> header file. */
+/* Define to 1 if you have the <byteswap.h> header file. */
 #cmakedefine HAVE_BYTESWAP_H @HAVE_BYTESWAP_H@
 
 /* Define to 1 if you have the `explicit_bzero' function. */
@@ -41,6 +40,9 @@
 /* Define if we have unaligned access */
 #cmakedefine HAVE_UNALIGNED_ACCESS @HAVE_UNALIGNED_ACCESS@
 
+/* Define to 1 if you have the <unistd.h> header file. */
+#cmakedefine HAVE_UNISTD_H @HAVE_UNISTD_H@
+
 /* Name of package */
 #cmakedefine PACKAGE @PACKAGE@
 
@@ -65,17 +67,7 @@
 /* Version number of package */
 #cmakedefine VERSION @VERSION@
 
-/* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most
-   significant byte first (like Motorola and SPARC, unlike Intel). */
-#if defined AC_APPLE_UNIVERSAL_BUILD
-# if defined __BIG_ENDIAN__
-#  define WORDS_BIGENDIAN 1
-# endif
-#else
-# ifndef WORDS_BIGENDIAN
 #cmakedefine WORDS_BIGENDIAN @WORDS_BIGENDIAN@
-# endif
-#endif
 
 #if defined (_WIN32) && !defined(_SSIZE_T_DECLARED) && !defined(_ssize_t) && !defined(ssize_t)
 #if defined(_WIN64)

diff --git a/_cmake/utils.cmake b/_cmake/utils.cmake
@@ -4,13 +4,18 @@ include(CheckFunctionExists)
 include(CheckCSourceRuns)
 
 function(generate_config_file)
+    # FIXME: AC_APPLE_UNIVERSAL_BUILD
+    check_include_file("asm/page.h" HAVE_ASM_PAGE_H)
+    check_include_file("byteswap.h" HAVE_BYTESWAP_H)
     check_function_exists("explicit_bzero" HAVE_EXPLICIT_BZERO)
     check_function_exists("explicit_memset" HAVE_EXPLICIT_MEMSET)
     check_c_source_compiles(
         "int main(void) {int a = 42; int *pnt = &a; __asm__ __volatile__ (\"\" : : \"r\"(pnt) : \"memory\");}"
         HAVE_INLINE_ASM
     )
+    check_include_file("mbedtls/sha256.h" HAVE_MBEDTLS_SHA256_H)
     check_include_file("mbedtls/sha512.h" HAVE_MBEDTLS_SHA512_H)
+    check_function_exists("memset_s" HAVE_MEMSET_S)
     check_function_exists("mmap" HAVE_MMAP)
     check_function_exists("posix_memalign" HAVE_POSIX_MEMALIGN)
     check_include_file("sys/mman.h" HAVE_SYS_MMAN_H)
@@ -21,6 +26,7 @@ function(generate_config_file)
             "int main(void){static int a[2];return *((int*)(((char*)a)+1)) != 0;}" HAVE_UNALIGNED_ACCESS
         )
     endif()
+    check_include_file("unistd.h" HAVE_UNISTD_H)
     set(PACKAGE \"${CMAKE_PROJECT_NAME}\")
     set(PACKAGE_BUGREPORT \"\")
     set(PACKAGE_NAME \"${CMAKE_PROJECT_NAME}\")
@@ -30,5 +36,11 @@ function(generate_config_file)
     set(PACKAGE_VERSION \"${CMAKE_PROJECT_VERSION}\")
     set(VERSION \"${CMAKE_PROJECT_VERSION}\")
 
+    if(CMAKE_C_BYTE_ORDER STREQUAL "BIG_ENDIAN")
+        set(WORDS_BIGENDIAN TRUE)
+    else()
+        set(WORDS_BIGENDIAN FALSE)
+    endif()
+
     configure_file(cmake/config.h.in config.h)
 endfunction()
diff --git a/configure.ac b/configure.ac
@@ -343,8 +343,8 @@ AC_ARG_ENABLE(python-manylinux,
     [python_manylinux=$enableval], [python_manylinux=no])
 AM_CONDITIONAL([PYTHON_MANYLINUX], [test "x$python_manylinux" = "xyes"])
 
-AX_PYTHON_DEVEL([>= '2.7.0'])
-AM_CONDITIONAL([HAVE_PYTHON], [test "$PYTHON" != ""])
+AX_PYTHON_DEVEL([>= '3.9.0'], [true])
+AM_CONDITIONAL([HAVE_PYTHON], [test "x$ax_python_devel_found" = "xyes"])
 
 
 AC_ARG_ENABLE(wasm-interface,
@@ -422,7 +422,7 @@ AM_CONDITIONAL([HAVE_JAVAC], [test "x$JAVAC" != "x"])
 AM_CONDITIONAL([RUN_JAVA_TESTS],
     dnl Only run tests if we have java-swig, compiler and interpreter
     [test "x$tests" = xyes -a "x$swig_java" = xyes -a -n "$JAVAC" -a -n "$JAVA"])
-JAVAC_TARGET=1.8
+JAVAC_TARGET=17
 AC_SUBST([JAVAC_TARGET])
 
 AC_SUBST([AM_CFLAGS])

diff --git a/contrib/Dockerfile_bookworm b/contrib/Dockerfile_bookworm
@@ -1,5 +1,5 @@
 #
-# Dockerfile for wally builds on Debian bookworm (stable).
+# Dockerfile for wally builds on Debian bookworm (oldstable).
 # build from this directory with e.g:
 #     docker buildx build --platform linux/arm64,linux/amd64 -f Dockerfile_bullseye -t greenaddress/wallycore:bookworm .
 #

diff --git a/contrib/Dockerfile_bullseye b/contrib/Dockerfile_bullseye
@@ -1,5 +1,5 @@
 #
-# Dockerfile for wally builds on Debian bullseye (oldstable).
+# Dockerfile for wally builds on Debian bullseye (oldoldstable).
 # build from this directory with e.g:
 #     DOCKER_BUILDKIT=1 docker build . -t greenaddress/wallycore -f Dockerfile_bullseye
 # and for linux/arm64:

diff --git a/contrib/Dockerfile_trixie b/contrib/Dockerfile_trixie
@@ -0,0 +1,16 @@
+#
+# Dockerfile for wally builds on Debian trixie (stable).
+# build from this directory with e.g:
+#     DOCKER_BUILDKIT=1 docker build . -t blockstream/wallycore -f Dockerfile_trixie
+# and for linux/arm64:
+#     DOCKER_BUILDKIT=1 docker build . -t blockstream/wallycore -f Dockerfile_trixie --platform linux/arm64 --build-arg TARGETARCH=arm64
+#
+FROM debian:trixie@sha256:35b8ff74ead4880f22090b617372daff0ccae742eb5674455d542bef71ef1999
+WORKDIR /root
+COPY trixie_deps.sh ./deps.sh
+COPY requirements.txt ./contrib/requirements.txt
+ARG TARGETARCH=amd64
+ENV TARGETARCH=${TARGETARCH}
+ENV JAVA_HOME=/usr/lib/jvm/java-21-openjdk-${TARGETARCH}
+RUN ./deps.sh && rm ./deps.sh
+ENV ANDROID_NDK=/opt/android-ndk-r26b