From: merge-script <withtvpeter@gmail.com>
Date: Wed, 28 Oct 2026 12:30:10 +0000 (+0100)
Subject: Merge bitcoindevkit/bdk-cli#347: Validate policy keys and hashes before compiling... 
X-Git-Url: http://internal-gitweb-vhost/-script/src/example_cli/database/hex/struct.DistMap.html?a=commitdiff_plain;p=bdk-cli

Merge bitcoindevkit/bdk-cli#347: Validate policy keys and hashes before compiling descriptors

3b514f4bb64b7329f9532c5359031bce3b774b4b chore: rename ScriptType enum to CompileScriptType (Vihiga Tyonum)
822fcb211dc601c6643b3ad42ff5939f00d07281 fix(compile): move compile helpers to utils, reorder doc comments, add uncompressed-key tr test, and update changelog (Olorunshogo Moses BAMTEFA)
16c990ac7197a3d555ecd4c48fd08b3891e4f170 fix(compile): validate policy keys and hashes before compiling descriptors (Olorunshogo Moses BAMTEFA)

Pull request description:

  # PR summary

  ## Description

  `compile` parsed policies as `Concrete<String>`, so placeholder strings (`pk(ABC)`) or hashes were accepted as keys with no validation, failing only later when a real consumer used the descriptor. It now parses as `Concrete<DescriptorPublicKey>` by default, validating at parse time. The old permissive behavior moves behind `--placeholders` for inspecting a policy's compiled shape without real keys.

  A key can pass that parse-time check and still be the wrong shape for the chosen script type (e.g. an x-only key under `wsh`), which miniscript's compiler turns into a panic instead of an error. `compile` now validates every key against the chosen script context (Legacy/Segwitv0/Tap) before compiling, so this returns a clean `Invalid policy` error instead of crashing.

  Fixes #344

  ## Notes to reviewers

  - `compile_policy<Pk: FromStrKey>` is generic over `DescriptorPublicKey`/`String` to avoid duplicating the `tr` branch's NUMS-tweak internal-key math per key type.
  - The `tr` internal key is built with `Pk::from_str(&xonly_internal_key.to_string())`, which works for both key types since `FromStrKey` requires `FromStr`.
  - `--type` now uses `ValueEnum` (`ScriptType`) instead of a raw string with `value_parser`, so this PR also closes #345.
  - `check_policy_keys` walks the policy via `ForEachKey::for_each_key` and calls `ScriptContext::check_pk` per key. It is a no-op for `Pk = String`, since `String` never reports itself as uncompressed or x-only.
  - `test_compile_policy_beyond_legacy_limits` now passes `--placeholders`.
  - Added `test_compile_rejects_x_only_key_for_non_tr_types`, `test_compile_accepts_x_only_key_for_tr` and `test_compile_rejects_uncompressed_key_for_tr` covering the context checks.
  ## Checklists

  ### All Submissions:

  * [x] I've signed all my commits
  * [x] I followed the [contribution guidelines](https://github.com/bitcoindevkit/bdk-cli/blob/master/CONTRIBUTING.md)
  * [x] I ran `cargo fmt` and `cargo clippy` before committing

  ### Bugfixes:

  * [x] I've added tests to reproduce the issue which are now passing
  * [x] I'm linking the issue being fixed by this PR

Top commit has no ACKs.

Tree-SHA512: 42727b5000ed067ff7a1c0f03c7877774c80b673d380ddfb04ea04c60600b3fb207624054d12bc32784a1e2e1d6487d5fa7c7d9ac0a1225b671e4ba2fad66240
---

66d5618e35f300eeef4e3db848c565ae2e87cbc9