Fix/paymaster cli hardening

.gitattributes

@@ -1 +1,4 @@
 src/clientversion.cpp export-subst
+
+# Keep executable build helpers usable after a Windows checkout or WSL copy.
+*.sh text eol=lf

.github/workflows/codeql.yml

@@ -69,11 +69,11 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -94,18 +94,18 @@ jobs:
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
       - if: matrix.build-mode == 'manual'
-        name: Quick build for CodeQL analysis
+        name: Build wallet and tests for CodeQL analysis
         shell: bash
         run: |
-          # Quick minimal build just for CodeQL analysis
-          # Match the simple Ubuntu 22.04 CI configuration
+          # C/C++ manual mode analyzes only compiled translation units. Keep
+          # wallet and tests enabled so Paymaster persistence, signing and RPC
+          # orchestration are present in the CodeQL database.
           ./autogen.sh
-          ./configure --disable-wallet --disable-tests --disable-bench --disable-fuzz --disable-fuzz-binary \
+          ./configure --disable-bench --disable-fuzz --disable-fuzz-binary \
                       --with-gui=no --disable-man --disable-zmq --without-utils --without-daemon
-          # Build all available libraries for analysis
-          make -j$(nproc) -C src
+          make -j$(nproc) -C src test/test_digibyte
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/dependency-review.yml

@@ -0,0 +1,22 @@
+# Copyright (c) 2026 The DigiByte Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+name: Dependency Review
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      - name: Reject newly introduced vulnerable dependencies
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high

.github/workflows/paymaster-security.yml

@@ -0,0 +1,166 @@
+# Copyright (c) 2026 The DigiByte Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+name: Paymaster Security
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/paymaster-security.yml'
+      - 'src/dandelion.cpp'
+      - 'src/net.cpp'
+      - 'src/net.h'
+      - 'src/net_processing.cpp'
+      - 'src/netbase.cpp'
+      - 'src/netbase.h'
+      - 'src/paymaster/**'
+      - 'src/protocol.cpp'
+      - 'src/protocol.h'
+      - 'src/rpc/net.cpp'
+      - 'src/rpc/digidollar.cpp'
+      - 'src/Makefile.am'
+      - 'src/Makefile.test.include'
+      - 'src/test/fuzz/paymaster_*.cpp'
+      - 'src/test/paymaster_*.cpp'
+      - 'src/wallet/paymaster*.cpp'
+      - 'src/wallet/paymaster*.h'
+      - 'src/wallet/db.h'
+      - 'src/wallet/digidollarwallet.cpp'
+      - 'src/wallet/rpc/paymaster*.cpp'
+      - 'src/wallet/rpc/paymaster*.h'
+      - 'src/wallet/spend.cpp'
+      - 'src/wallet/test/fuzz/paymaster_*.cpp'
+      - 'src/wallet/test/paymaster_*.cpp'
+      - 'src/wallet/walletdb.cpp'
+      - 'src/wallet/walletdb.h'
+      - 'test/functional/*paymaster*.py'
+      - 'test/functional/test_framework/paymaster.py'
+  schedule:
+    - cron: '17 3 * * 0'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  asan-ubsan-unit:
+    name: ASan and UBSan Paymaster unit tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Install build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            autoconf automake bsdmainutils build-essential clang libboost-dev \
+            libdb++-dev libevent-dev libminiupnpc-dev libnatpmp-dev \
+            libsqlite3-dev libtool pkg-config python3 systemtap-sdt-dev
+
+      - name: Configure sanitizer build
+        env:
+          CC: clang
+          CXX: clang++
+        run: |
+          ./autogen.sh
+          ./configure \
+            --with-sanitizers=address,undefined \
+            --disable-bench --disable-fuzz --disable-fuzz-binary \
+            --with-gui=no --disable-man --disable-zmq \
+            --without-utils --without-daemon
+
+      - name: Build unit test binary
+        run: make -j2 -C src test/test_digibyte
+
+      - name: Run Paymaster unit tests
+        env:
+          ASAN_OPTIONS: detect_leaks=1:halt_on_error=1
+          LSAN_OPTIONS: suppressions=${{ github.workspace }}/test/sanitizer_suppressions/lsan
+          UBSAN_OPTIONS: suppressions=${{ github.workspace }}/test/sanitizer_suppressions/ubsan:print_stacktrace=1:halt_on_error=1:report_error_type=1
+        run: |
+          set -euo pipefail
+          # Include newly split suites (including wallet load/maintenance)
+          # automatically instead of maintaining a second suite inventory.
+          ./src/test/test_digibyte \
+            '--run_test=paymaster_*' --log_level=test_suite --report_level=short \
+            2>&1 | tee paymaster-sanitizer.log
+
+      - name: Upload test log
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: paymaster-sanitizer-test-log
+          path: paymaster-sanitizer.log
+          if-no-files-found: ignore
+
+  sanitizer-fuzz:
+    name: Scheduled Paymaster sanitizer fuzzing
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 120
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Install build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            autoconf automake bsdmainutils build-essential clang libboost-dev \
+            libdb++-dev libevent-dev libminiupnpc-dev libnatpmp-dev \
+            libsqlite3-dev libtool pkg-config python3 systemtap-sdt-dev
+
+      - name: Configure fuzz build
+        env:
+          CC: clang
+          CXX: clang++
+        run: |
+          ./autogen.sh
+          ./configure \
+            --enable-fuzz \
+            --with-sanitizers=address,fuzzer,undefined \
+            --disable-bench --with-gui=no --disable-man --disable-zmq \
+            --without-utils --without-daemon
+
+      - name: Build fuzz binary
+        run: make -j2 -C src test/fuzz/fuzz
+
+      - name: Run bounded Paymaster campaigns
+        env:
+          ASAN_OPTIONS: detect_leaks=1:halt_on_error=1
+          LSAN_OPTIONS: suppressions=${{ github.workspace }}/test/sanitizer_suppressions/lsan
+          UBSAN_OPTIONS: suppressions=${{ github.workspace }}/test/sanitizer_suppressions/ubsan:print_stacktrace=1:halt_on_error=1:report_error_type=1
+        run: |
+          set -euo pipefail
+          for target in \
+            paymaster_wire_envelopes \
+            paymaster_stateful_security \
+            paymaster_pool_lifecycle \
+            paymaster_persistence_records
+          do
+            corpus="${RUNNER_TEMP}/paymaster-corpus/${target}"
+            mkdir -p "$corpus"
+            FUZZ="$target" ./src/test/fuzz/fuzz \
+              -max_total_time=300 -timeout=30 "$corpus"
+          done
+
+      - name: Upload reproducer artifacts
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: paymaster-fuzz-reproducers
+          path: |
+            crash-*
+            leak-*
+            timeout-*
+            oom-*
+          if-no-files-found: ignore

.github/workflows/sbom.yml

@@ -0,0 +1,34 @@
+# Copyright (c) 2026 The DigiByte Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+name: Export SPDX SBOM
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  export:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Export repository dependency graph as SPDX
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh api \
+            -H 'Accept: application/vnd.github+json' \
+            -H 'X-GitHub-Api-Version: 2026-03-10' \
+            "/repos/${GITHUB_REPOSITORY}/dependency-graph/sbom" \
+            --jq '.sbom' > digibyte-dependency-graph.spdx.json
+
+      - name: Upload SPDX artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: digibyte-dependency-graph-sbom
+          path: digibyte-dependency-graph.spdx.json
+          if-no-files-found: error

.gitignore

@@ -187,3 +187,5 @@ RC43_FIX_WORK_PROMPT.md
 Z_RED_HORNET_FINAL_PROMPT.md
 Z_RED_HORNET_v2.md
 Z_DOC_VALIDATION_v9.26.2_PROMPT.md
+
+.ai