arkd-wallet: adopt txsigner shared library

[Kukks]

Draft / stacked on arkd-signer (#1118), which introduced the txsigner library. Merge after #1118.

Summary

Completes the txsigner extraction — Task 1 (in #1118) created the shared library; this makes arkd-wallet consume it. Replaces two inline blocks in wallet.SignTransaction with the shared primitives:

• the tapscript-path signing block → txsigner.SignTapscriptInput
• the extractRawTx finalize/extract block → txsigner.ExtractFinalizedTx

Both are verbatim matches of the shared functions. Net −72 lines. The key-path (wallet-owned) signing and the chain-fetch prevout logic — both wallet-specific — are unchanged.

Testing

• pkg/arkd-wallet builds; wallet + handler unit tests pass; vet + gofmt clean.
• txsigner.SignTapscriptInput is unit-tested in the library; the changed path (forfeit/connector signing + finalization) is exercised end-to-end by the integration suite.

---

CI note — repo-wide security bump (self-dropping): This branch also carries a golang.org/x/crypto→v0.52.0 / golang.org/x/net→v0.55.0 bump across all 10 modules, clearing a newly-published Trivy CVE batch (x/crypto/ssh + x/net/html) that was failing every arkd build (master included). x/net 0.55 deprecates h2c.NewHandler, so SA1019 is suppressed via a targeted .golangci.yml exclusion (not inline //nolint, which trips the golines length limit). The bump is shared with #1118 and self-drops when this rebases onto a master that already carries it. Migrating off h2c to http.Server’s Protocols field is a tracked follow-up.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e8b572a2-e6ff-489f-8a3f-5b5cc22bfd22

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch arkd-wallet-txsigner

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[arkana-ai-bot]

This PR has been open for 3+ days without review. @Kukks is anyone looking at this?

[arkana-ai-bot]

This PR has been open for 30+ days without review. @Kukks is anyone looking at this?

[arkana-ai-bot]

This PR has been open for 6+ days without review. @Kukks is anyone looking at this?

[arkana-ai-bot]

This PR (arkd-wallet adopt txsigner) has been open 63 days without review. @Kukks is anyone looking at this?

[arkana-ai-bot]

This PR has been open for 4-5+ days without a review. @Kukks is anyone looking at this? (arkd-wallet: adopt txsigner shared library; 5 days without review.)

[arkana-ai-bot]

This PR has been open for 10+ weeks without a review. @Kukks — is this still active?

[arkana-ai-bot]

Arkana review — #1124 (sha 4f77dfa)

arkd-wallet: adopt txsigner shared library

Assessment: dependency and tooling update — looks ready, but adding arkade-os/emulator as a dependency needs a human eye.

What changed

• Dependency bumps: golang.org/x/net 0.52→0.55, golang.org/x/crypto 0.49→0.52, plus assorted golang.org/x/{mod,tools,term,sys,text} bumps.
• Adds github.com/arkade-os/emulator (api-spec, pkg/arkade, pkg/emulator) as a new dependency, along with github.com/consensys/gnark-crypto v0.19.2 and github.com/bits-and-blooms/bitset v1.20.0 (transitive from gnark-crypto).
• Adds a golangci exclusion for SA1019 on interface/grpc/service.go (deprecated h2c.NewHandler), tracked as a follow-up.

Things that look good

• The golang.org/x/crypto bump closes known CVEs in older versions (worth verifying against the current advisory list, but generally good hygiene).
• The golangci exclusion is scoped to a specific file and linter text — not a blanket suppress.

Concern: new emulator dependency

github.com/arkade-os/emulator brings in gnark-crypto (a ZK proof library). This is a significant new trust surface. Questions for the author:

1. What does the arkd-wallet use from the emulator library? Is this from the ArkadeScript emulator in #1122 (standalone signer), or does the wallet itself now run ArkadeScript?
2. gnark-crypto v0.19.2 — is this the release vetted by the ArkadeScript security review? ZK library versions matter for soundness.
3. Has the emulator library itself been reviewed for supply-chain integrity?

No security issues visible in the diff itself, but the dependency addition warrants explicit sign-off.

[arkana-ai-bot]

This PR has been open for 4 days without review. @Kukks is anyone looking at this?