From 881b7d295aef6d1f1a60af22695f77baebc92786 Mon Sep 17 00:00:00 2001
From: Greg Pfeil <greg@technomadic.org>
Date: Thu, 8 Aug 2024 14:56:50 -0600
Subject: [PATCH 1/4] =?UTF-8?q?Use=20zcash=5Fscript=E2=80=99s=20new=20`Zca?=
 =?UTF-8?q?shScript`=20trait?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is a precursor to testing the Rust implementation of Zcash Script.
---
 zebra-script/src/lib.rs | 150 +++++++++-------------------------------
 1 file changed, 32 insertions(+), 118 deletions(-)

diff --git a/zebra-script/src/lib.rs b/zebra-script/src/lib.rs
index 5b6e5f2a846..d9b2a076ae5 100644
--- a/zebra-script/src/lib.rs
+++ b/zebra-script/src/lib.rs
@@ -6,19 +6,12 @@
 #![allow(unsafe_code)]
 
 use core::fmt;
-use std::{
-    ffi::{c_int, c_uint, c_void},
-    sync::Arc,
-};
+use std::sync::Arc;
 
 use thiserror::Error;
 
-use zcash_script::{
-    zcash_script_error_t, zcash_script_error_t_zcash_script_ERR_OK,
-    zcash_script_error_t_zcash_script_ERR_TX_DESERIALIZE,
-    zcash_script_error_t_zcash_script_ERR_TX_INDEX,
-    zcash_script_error_t_zcash_script_ERR_TX_SIZE_MISMATCH,
-};
+use zcash_script;
+use zcash_script::ZcashScript;
 
 use zebra_chain::{
     parameters::ConsensusBranchId,
@@ -33,46 +26,35 @@ pub enum Error {
     /// script verification failed
     #[non_exhaustive]
     ScriptInvalid,
-    /// could not deserialize tx
-    #[non_exhaustive]
-    TxDeserialize,
     /// input index out of bounds
     #[non_exhaustive]
     TxIndex,
-    /// tx has an invalid size
-    #[non_exhaustive]
-    TxSizeMismatch,
     /// tx is a coinbase transaction and should not be verified
     #[non_exhaustive]
     TxCoinbase,
     /// unknown error from zcash_script: {0}
     #[non_exhaustive]
-    Unknown(zcash_script_error_t),
+    Unknown(zcash_script::Error),
 }
 
 impl fmt::Display for Error {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         f.write_str(&match self {
             Error::ScriptInvalid => "script verification failed".to_owned(),
-            Error::TxDeserialize => "could not deserialize tx".to_owned(),
             Error::TxIndex => "input index out of bounds".to_owned(),
-            Error::TxSizeMismatch => "tx has an invalid size".to_owned(),
             Error::TxCoinbase => {
                 "tx is a coinbase transaction and should not be verified".to_owned()
             }
-            Error::Unknown(e) => format!("unknown error from zcash_script: {e}"),
+            Error::Unknown(e) => format!("unknown error from zcash_script: {:?}", e),
         })
     }
 }
 
-impl From<zcash_script_error_t> for Error {
+impl From<zcash_script::Error> for Error {
     #[allow(non_upper_case_globals)]
-    fn from(err_code: zcash_script_error_t) -> Error {
+    fn from(err_code: zcash_script::Error) -> Error {
         match err_code {
-            zcash_script_error_t_zcash_script_ERR_OK => Error::ScriptInvalid,
-            zcash_script_error_t_zcash_script_ERR_TX_DESERIALIZE => Error::TxDeserialize,
-            zcash_script_error_t_zcash_script_ERR_TX_INDEX => Error::TxIndex,
-            zcash_script_error_t_zcash_script_ERR_TX_SIZE_MISMATCH => Error::TxSizeMismatch,
+            zcash_script::Error::Ok => Error::ScriptInvalid,
             unknown => Error::Unknown(unknown),
         }
     }
@@ -92,41 +74,6 @@ pub struct CachedFfiTransaction {
     all_previous_outputs: Vec<transparent::Output>,
 }
 
-/// A sighash context used for the zcash_script sighash callback.
-struct SigHashContext<'a> {
-    /// The index of the input being verified.
-    input_index: usize,
-    /// The SigHasher for the transaction being verified.
-    sighasher: SigHasher<'a>,
-}
-
-/// The sighash callback to use with zcash_script.
-extern "C" fn sighash(
-    sighash_out: *mut u8,
-    sighash_out_len: c_uint,
-    ctx: *const c_void,
-    script_code: *const u8,
-    script_code_len: c_uint,
-    hash_type: c_int,
-) {
-    // SAFETY: `ctx` is a valid SigHashContext because it is always passed to
-    // `zcash_script_verify_callback` which simply forwards it to the callback.
-    // `script_code` and `sighash_out` are valid buffers since they are always
-    //  specified when the callback is called.
-    unsafe {
-        let ctx = ctx as *const SigHashContext;
-        let script_code_vec =
-            std::slice::from_raw_parts(script_code, script_code_len as usize).to_vec();
-        let sighash = (*ctx).sighasher.sighash(
-            HashType::from_bits_truncate(hash_type as u32),
-            Some(((*ctx).input_index, script_code_vec)),
-        );
-        // Sanity check; must always be true.
-        assert_eq!(sighash_out_len, sighash.0.len() as c_uint);
-        std::ptr::copy_nonoverlapping(sighash.0.as_ptr(), sighash_out, sighash.0.len());
-    }
-}
-
 impl CachedFfiTransaction {
     /// Construct a `PrecomputedTransaction` from a `Transaction` and the outputs
     /// from previous transactions that match each input in the transaction
@@ -168,27 +115,11 @@ impl CachedFfiTransaction {
         } = previous_output;
         let script_pub_key: &[u8] = lock_script.as_raw_bytes();
 
-        // This conversion is useful on some platforms, but not others.
-        #[allow(clippy::useless_conversion)]
-        let n_in = input_index
-            .try_into()
-            .expect("transaction indexes are much less than c_uint::MAX");
-
-        let flags = zcash_script::zcash_script_SCRIPT_FLAGS_VERIFY_P2SH
-            | zcash_script::zcash_script_SCRIPT_FLAGS_VERIFY_CHECKLOCKTIMEVERIFY;
-        // This conversion is useful on some platforms, but not others.
-        #[allow(clippy::useless_conversion)]
-        let flags = flags
-            .try_into()
-            .expect("zcash_script_SCRIPT_FLAGS_VERIFY_* enum values fit in a c_uint");
-
-        let mut err = 0;
+        let flags = zcash_script::VerificationFlags::P2SH
+            | zcash_script::VerificationFlags::CHECKLOCKTIMEVERIFY;
+
         let lock_time = self.transaction.raw_lock_time() as i64;
-        let is_final = if self.transaction.inputs()[input_index].sequence() == u32::MAX {
-            1
-        } else {
-            0
-        };
+        let is_final = self.transaction.inputs()[input_index].sequence() == u32::MAX;
         let signature_script = match &self.transaction.inputs()[input_index] {
             transparent::Input::PrevOut {
                 outpoint: _,
@@ -198,31 +129,26 @@ impl CachedFfiTransaction {
             transparent::Input::Coinbase { .. } => Err(Error::TxCoinbase)?,
         };
 
-        let ctx = Box::new(SigHashContext {
-            input_index: n_in,
-            sighasher: SigHasher::new(&self.transaction, branch_id, &self.all_previous_outputs),
-        });
-        // SAFETY: The `script_*` fields are created from a valid Rust `slice`.
-        let ret = unsafe {
-            zcash_script::zcash_script_verify_callback(
-                (&*ctx as *const SigHashContext) as *const c_void,
-                Some(sighash),
-                lock_time,
-                is_final,
-                script_pub_key.as_ptr(),
-                script_pub_key.len() as u32,
-                signature_script.as_ptr(),
-                signature_script.len() as u32,
-                flags,
-                &mut err,
+        let calculate_sighash = |script_code: &[u8], hash_type: zcash_script::HashType| {
+            let script_code_vec = script_code.to_vec();
+            Some(
+                SigHasher::new(&self.transaction, branch_id, &self.all_previous_outputs)
+                    .sighash(
+                        HashType::from_bits_truncate(hash_type.bits() as u32),
+                        Some((input_index, script_code_vec)),
+                    )
+                    .0,
             )
         };
-
-        if ret == 1 {
-            Ok(())
-        } else {
-            Err(Error::from(err))
-        }
+        zcash_script::Cxx::verify_callback(
+            &calculate_sighash,
+            lock_time,
+            is_final,
+            script_pub_key,
+            signature_script,
+            flags,
+        )
+        .map_err(Error::from)
     }
 
     /// Returns the number of transparent signature operations in the
@@ -239,13 +165,7 @@ impl CachedFfiTransaction {
                     sequence: _,
                 } => {
                     let script = unlock_script.as_raw_bytes();
-                    // SAFETY: `script` is created from a valid Rust `slice`.
-                    unsafe {
-                        zcash_script::zcash_script_legacy_sigop_count_script(
-                            script.as_ptr(),
-                            script.len() as u32,
-                        )
-                    }
+                    zcash_script::Cxx::legacy_sigop_count_script(script).map_err(Error::from)?
                 }
                 transparent::Input::Coinbase { .. } => 0,
             } as u64;
@@ -253,13 +173,7 @@ impl CachedFfiTransaction {
 
         for output in self.transaction.outputs() {
             let script = output.lock_script.as_raw_bytes();
-            // SAFETY: `script` is created from a valid Rust `slice`.
-            let ret = unsafe {
-                zcash_script::zcash_script_legacy_sigop_count_script(
-                    script.as_ptr(),
-                    script.len() as u32,
-                )
-            };
+            let ret = zcash_script::Cxx::legacy_sigop_count_script(script).map_err(Error::from)?;
             count += ret as u64;
         }
         Ok(count)

From aad75ac3129b1780eeec94d773e2f83f5c64a38c Mon Sep 17 00:00:00 2001
From: Greg Pfeil <greg@technomadic.org>
Date: Sun, 29 Sep 2024 13:38:14 -0600
Subject: [PATCH 2/4] Point zcash_script dependency at master

Show that #8751 would work with a new zcash_script release.
---
 Cargo.lock | 4 ++--
 Cargo.toml | 3 +++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index a33bbb48c3a..dd60aa762e5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5685,10 +5685,10 @@ dependencies = [
 [[package]]
 name = "zcash_script"
 version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2122a042c77d529d3c60b899e74705eda39ae96a8a992460caeb06afa76990a2"
+source = "git+https://github.com/ZcashFoundation/zcash_script.git?rev=9d16e79#9d16e79c72ea469642ae991f064c30de424bba99"
 dependencies = [
  "bindgen 0.70.1",
+ "bitflags 2.6.0",
  "cc",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index c50c93ad414..400ae47fbcc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -34,6 +34,9 @@ zcash_primitives = "0.19.0"
 zcash_proofs = "0.19.0"
 zcash_protocol = "0.4.0"
 
+[patch.crates-io]
+zcash_script = { git = 'https://github.com/ZcashFoundation/zcash_script.git', rev = "9d16e79" }
+
 [workspace.metadata.release]
 
 # We always do releases from the main branch

From eb26f143d01b474269e837c5323327bc5516858b Mon Sep 17 00:00:00 2001
From: Conrado Gouvea <conrado@zfnd.org>
Date: Thu, 30 Jan 2025 11:50:30 -0300
Subject: [PATCH 3/4] Adjust for the latest zcash_script API

---
 Cargo.lock              | 138 +++++++++++++++++++++++++---------------
 Cargo.toml              |   2 +-
 zebra-script/src/lib.rs |  26 +++++---
 3 files changed, 104 insertions(+), 62 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index dd60aa762e5..f587851729b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -411,30 +411,12 @@ version = "0.69.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "271383c67ccabffb7381723dea0672a673f292304fcb45c01cc648c7a8d58088"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.8.0",
  "cexpr",
  "clang-sys",
  "itertools 0.12.1",
  "lazy_static",
  "lazycell",
- "proc-macro2",
- "quote",
- "regex",
- "rustc-hash 1.1.0",
- "shlex",
- "syn 2.0.90",
-]
-
-[[package]]
-name = "bindgen"
-version = "0.70.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f49d8fed880d473ea71efb9bf597651e77201bdd4893efe54c9e5d65ae04ce6f"
-dependencies = [
- "bitflags 2.6.0",
- "cexpr",
- "clang-sys",
- "itertools 0.13.0",
  "log",
  "prettyplease",
  "proc-macro2",
@@ -443,6 +425,7 @@ dependencies = [
  "rustc-hash 1.1.0",
  "shlex",
  "syn 2.0.90",
+ "which",
 ]
 
 [[package]]
@@ -455,7 +438,7 @@ dependencies = [
  "hmac",
  "rand_core 0.6.4",
  "ripemd",
- "secp256k1",
+ "secp256k1 0.27.0",
  "sha2",
  "subtle",
  "zeroize",
@@ -484,9 +467,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.6.0"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
+checksum = "8f68f53c83ab957f72c32642f3868eec03eb974d1fb82e453128456482613d36"
 
 [[package]]
 name = "bitflags-serde-legacy"
@@ -494,7 +477,7 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5b64e60c28b6d25ad92e8b367801ff9aa12b41d05fc8798055d296bace4a60cc"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.8.0",
  "serde",
 ]
 
@@ -669,9 +652,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.1.31"
+version = "1.2.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2e7962b54006dcfcc61cb72735f4d89bb97061dd6a7ed882ec6b8ee53714c6f"
+checksum = "13208fcbb66eaeffe09b99fffbe1af420f00a7b35aa99ad683dfc1aa76145229"
 dependencies = [
  "jobserver",
  "libc",
@@ -731,7 +714,7 @@ checksum = "7e36cc9d416881d2e24f9a963be5fb1cd90966419ac844274161d10488b3e825"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
- "num-traits",
+ "num-traits 0.2.19",
  "serde",
  "windows-targets 0.52.6",
 ]
@@ -975,7 +958,7 @@ dependencies = [
  "criterion-plot",
  "is-terminal",
  "itertools 0.10.5",
- "num-traits",
+ "num-traits 0.2.19",
  "once_cell",
  "oorandom",
  "plotters",
@@ -1248,6 +1231,15 @@ version = "0.3.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a357d28ed41a50f9c765dbfe56cbc04a64e53e5fc58ba79fbc34c10ef3df831f"
 
+[[package]]
+name = "enum_primitive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be4551092f4d519593039259a9ed8daedf0da12e5109c5280338073eaeb81180"
+dependencies = [
+ "num-traits 0.1.43",
+]
+
 [[package]]
 name = "env_logger"
 version = "0.7.1"
@@ -1399,7 +1391,7 @@ dependencies = [
  "libm",
  "num-bigint",
  "num-integer",
- "num-traits",
+ "num-traits 0.2.19",
 ]
 
 [[package]]
@@ -1552,7 +1544,7 @@ version = "0.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b903b73e45dc0c6c596f2d37eccece7c1c8bb6e4407b001096387c63d0d93724"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.8.0",
  "libc",
  "libgit2-sys",
  "log",
@@ -1681,7 +1673,7 @@ dependencies = [
  "byteorder",
  "flate2",
  "nom",
- "num-traits",
+ "num-traits 0.2.19",
 ]
 
 [[package]]
@@ -2314,7 +2306,7 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.8.0",
  "libc",
 ]
 
@@ -2324,7 +2316,7 @@ version = "0.16.0+8.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce3d60bc059831dc1c83903fb45c103f75db65c5a7bf22272764d9cc683e348c"
 dependencies = [
- "bindgen 0.69.5",
+ "bindgen",
  "bzip2-sys",
  "cc",
  "glob",
@@ -2552,7 +2544,7 @@ version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.8.0",
  "cfg-if",
  "cfg_aliases",
  "libc",
@@ -2591,7 +2583,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
 dependencies = [
  "num-integer",
- "num-traits",
+ "num-traits 0.2.19",
 ]
 
 [[package]]
@@ -2616,7 +2608,16 @@ version = "0.1.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
 dependencies = [
- "num-traits",
+ "num-traits 0.2.19",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.1.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92e5113e9fd4cc14ded8e499429f396a20f98c772a47cc8622a736e1ec843c31"
+dependencies = [
+ "num-traits 0.2.19",
 ]
 
 [[package]]
@@ -2945,7 +2946,7 @@ version = "0.3.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5aeb6f403d7a4911efb1e33402027fc44f29b5bf6def3effcc22d7bb75f2b747"
 dependencies = [
- "num-traits",
+ "num-traits 0.2.19",
  "plotters-backend",
  "plotters-svg",
  "wasm-bindgen",
@@ -3070,9 +3071,9 @@ checksum = "b4c2511913b88df1637da85cc8d96ec8e43a3f8bb8ccb71ee1ac240d6f3df58d"
 dependencies = [
  "bit-set",
  "bit-vec",
- "bitflags 2.6.0",
+ "bitflags 2.8.0",
  "lazy_static",
- "num-traits",
+ "num-traits 0.2.19",
  "rand 0.8.5",
  "rand_chacha 0.3.1",
  "rand_xorshift",
@@ -3349,7 +3350,7 @@ version = "11.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ab240315c661615f2ee9f0f2cd32d5a7343a84d5ebcccb99d46e6637565e7b0"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.8.0",
 ]
 
 [[package]]
@@ -3409,7 +3410,7 @@ version = "0.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b6dfecf2c74bce2466cabf93f6664d6998a69eb21e39f4207930065b27b771f"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.8.0",
 ]
 
 [[package]]
@@ -3620,7 +3621,7 @@ version = "0.38.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d7f649912bc1495e167a6edee79151c84b1bad49748cb4f1f1167f459f6224f6"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.8.0",
  "errno",
  "libc",
  "linux-raw-sys",
@@ -3745,10 +3746,19 @@ version = "0.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "25996b82292a7a57ed3508f052cfff8640d38d32018784acd714758b43da9c8f"
 dependencies = [
- "secp256k1-sys",
+ "secp256k1-sys 0.8.1",
  "serde",
 ]
 
+[[package]]
+name = "secp256k1"
+version = "0.29.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9465315bc9d4566e1724f0fffcbcc446268cb522e60f9a27bcded6b19c108113"
+dependencies = [
+ "secp256k1-sys 0.10.1",
+]
+
 [[package]]
 name = "secp256k1-sys"
 version = "0.8.1"
@@ -3758,6 +3768,15 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "secp256k1-sys"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4387882333d3aa8cb20530a17c69a3752e97837832f34f6dccc760e715001d9"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "secrecy"
 version = "0.8.0"
@@ -3971,6 +3990,17 @@ dependencies = [
  "version_check",
 ]
 
+[[package]]
+name = "sha-1"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f5058ada175748e33390e40e872bd0fe59a19f265d0158daa551c5a88a76009c"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
 [[package]]
 name = "sha1"
 version = "0.10.6"
@@ -4008,7 +4038,7 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5f2390975ebfe8838f9e861f7a588123d49a7a7a0a08568ea831d8ad53fc9b4"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.8.0",
  "either",
  "incrementalmerkletree",
  "tracing",
@@ -4318,7 +4348,7 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cfe075d7053dae61ac5413a34ea7d4913b6e6207844fd726bdd858b37ff72bf5"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.8.0",
  "cfg-if",
  "libc",
  "log",
@@ -5637,7 +5667,7 @@ dependencies = [
  "redjubjub",
  "ripemd",
  "sapling-crypto",
- "secp256k1",
+ "secp256k1 0.27.0",
  "sha2",
  "subtle",
  "tracing",
@@ -5685,11 +5715,17 @@ dependencies = [
 [[package]]
 name = "zcash_script"
 version = "0.2.0"
-source = "git+https://github.com/ZcashFoundation/zcash_script.git?rev=9d16e79#9d16e79c72ea469642ae991f064c30de424bba99"
+source = "git+https://github.com/ZcashFoundation/zcash_script.git?rev=61f3ef3e74209ad4bd642f098c44cc3ad54ed6c3#61f3ef3e74209ad4bd642f098c44cc3ad54ed6c3"
 dependencies = [
- "bindgen 0.70.1",
- "bitflags 2.6.0",
+ "bindgen",
+ "bitflags 2.8.0",
  "cc",
+ "enum_primitive",
+ "ripemd",
+ "secp256k1 0.29.1",
+ "sha-1",
+ "sha2",
+ "tracing",
 ]
 
 [[package]]
@@ -5705,7 +5741,7 @@ dependencies = [
 name = "zebra-chain"
 version = "1.0.0-beta.44"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.8.0",
  "bitflags-serde-legacy",
  "bitvec",
  "blake2b_simd",
@@ -5741,7 +5777,7 @@ dependencies = [
  "redjubjub",
  "ripemd",
  "sapling-crypto",
- "secp256k1",
+ "secp256k1 0.27.0",
  "serde",
  "serde-big-array",
  "serde_json",
@@ -5838,7 +5874,7 @@ dependencies = [
 name = "zebra-network"
 version = "1.0.0-beta.44"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.8.0",
  "byteorder",
  "bytes",
  "chrono",
diff --git a/Cargo.toml b/Cargo.toml
index 400ae47fbcc..2eaa7714ec7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -35,7 +35,7 @@ zcash_proofs = "0.19.0"
 zcash_protocol = "0.4.0"
 
 [patch.crates-io]
-zcash_script = { git = 'https://github.com/ZcashFoundation/zcash_script.git', rev = "9d16e79" }
+zcash_script = { git = 'https://github.com/ZcashFoundation/zcash_script.git', rev = "61f3ef3e74209ad4bd642f098c44cc3ad54ed6c3" }
 
 [workspace.metadata.release]
 
diff --git a/zebra-script/src/lib.rs b/zebra-script/src/lib.rs
index d9b2a076ae5..7a848d0161c 100644
--- a/zebra-script/src/lib.rs
+++ b/zebra-script/src/lib.rs
@@ -10,7 +10,6 @@ use std::sync::Arc;
 
 use thiserror::Error;
 
-use zcash_script;
 use zcash_script::ZcashScript;
 
 use zebra_chain::{
@@ -54,7 +53,7 @@ impl From<zcash_script::Error> for Error {
     #[allow(non_upper_case_globals)]
     fn from(err_code: zcash_script::Error) -> Error {
         match err_code {
-            zcash_script::Error::Ok => Error::ScriptInvalid,
+            zcash_script::Error::Ok(_) => Error::ScriptInvalid,
             unknown => Error::Unknown(unknown),
         }
     }
@@ -118,7 +117,7 @@ impl CachedFfiTransaction {
         let flags = zcash_script::VerificationFlags::P2SH
             | zcash_script::VerificationFlags::CHECKLOCKTIMEVERIFY;
 
-        let lock_time = self.transaction.raw_lock_time() as i64;
+        let lock_time = self.transaction.raw_lock_time();
         let is_final = self.transaction.inputs()[input_index].sequence() == u32::MAX;
         let signature_script = match &self.transaction.inputs()[input_index] {
             transparent::Input::PrevOut {
@@ -131,16 +130,21 @@ impl CachedFfiTransaction {
 
         let calculate_sighash = |script_code: &[u8], hash_type: zcash_script::HashType| {
             let script_code_vec = script_code.to_vec();
+            let mut our_hash_type = match hash_type.signed_outputs {
+                zcash_script::SignedOutputs::All => HashType::ALL,
+                zcash_script::SignedOutputs::Single => HashType::SINGLE,
+                zcash_script::SignedOutputs::None => HashType::NONE,
+            };
+            if hash_type.anyone_can_pay {
+                our_hash_type |= HashType::ANYONECANPAY;
+            }
             Some(
                 SigHasher::new(&self.transaction, branch_id, &self.all_previous_outputs)
-                    .sighash(
-                        HashType::from_bits_truncate(hash_type.bits() as u32),
-                        Some((input_index, script_code_vec)),
-                    )
+                    .sighash(our_hash_type, Some((input_index, script_code_vec)))
                     .0,
             )
         };
-        zcash_script::Cxx::verify_callback(
+        zcash_script::CxxRustComparisonInterpreter::verify_callback(
             &calculate_sighash,
             lock_time,
             is_final,
@@ -165,7 +169,8 @@ impl CachedFfiTransaction {
                     sequence: _,
                 } => {
                     let script = unlock_script.as_raw_bytes();
-                    zcash_script::Cxx::legacy_sigop_count_script(script).map_err(Error::from)?
+                    zcash_script::CxxRustComparisonInterpreter::legacy_sigop_count_script(script)
+                        .map_err(Error::from)?
                 }
                 transparent::Input::Coinbase { .. } => 0,
             } as u64;
@@ -173,7 +178,8 @@ impl CachedFfiTransaction {
 
         for output in self.transaction.outputs() {
             let script = output.lock_script.as_raw_bytes();
-            let ret = zcash_script::Cxx::legacy_sigop_count_script(script).map_err(Error::from)?;
+            let ret = zcash_script::CxxRustComparisonInterpreter::legacy_sigop_count_script(script)
+                .map_err(Error::from)?;
             count += ret as u64;
         }
         Ok(count)

From cdeb8af027416f75a7b500019fc2d111904b8d04 Mon Sep 17 00:00:00 2001
From: Conrado Gouvea <conrado@zfnd.org>
Date: Thu, 30 Jan 2025 12:09:10 -0300
Subject: [PATCH 4/4] allow duplicate secp245k1 for now

---
 deny.toml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/deny.toml b/deny.toml
index 3ae46206943..a03a03fbc0a 100644
--- a/deny.toml
+++ b/deny.toml
@@ -109,7 +109,10 @@ skip-tree = [
     { name = "zcash_address", version = "=0.4.0" },
     { name = "zcash_keys", version = "=0.3.0" },
     { name = "zcash_primitives", version = "=0.16.0" },
-    { name = "zcash_protocol", version = "=0.2.0" }
+    { name = "zcash_protocol", version = "=0.2.0" },
+
+    # wait for bip32 to update, and zcash_primitives to update bip32
+    { name = "secp256k1", version = "=0.27.0" }
 ]
 
 # This section is considered when running `cargo deny check sources`.