This removes a check for $ac_cv_prog_cc_c89 which is set by AC_PROG_CC
if defined(__STDC__) in the preprocessor. (Standard compliant compilers
are supposed to define __STDC__ to 1 but the value is actually not
checked here.)

Unfortunately, MSVC doesn't define it, so configure fails for MSVC.

This check is not very useful in practice. Over 30 years after C89 has
been released, there are no C compilers out there that are not
sufficiently compliant with C89 for the project. The only practically
relevant case was that the check rejected C++ compilers. A different
method to reject C++ compilers will be introduced in a later commit.

- Updated _gej_add_var, _gej_add_ge_var, _gej_add_zinv_var
- 2 fewer _fe_negate in each method
- Updated operation counts and standardize layout
- Added internal benchmark for _gej_add_zinv_var
- Update sage files (fixed by Tim Ruffing)

…ddition

2f984ff Save negations in var-time group addition (Peter Dettman)

Pull request description:

  - Updated _gej_add_var, _gej_add_ge_var, _gej_add_zinv_var
  - 2 fewer _fe_negate in each method
  - Updated operation counts and standardize layout
  - Added internal benchmark for _gej_add_zinv_var

  benchmark_internal shows about 2% speedup in each method as a result (64bit).

ACKs for top commit:
  real-or-random:
    ACK 2f984ff
  jonasnick:
    ACK 2f984ff

Tree-SHA512: 01366fa23c83a8dd37c9a0a24e0acc53ce38a201607fe4da6672ea5618d82c62d1299f0e0aa50317883821539af739ea52b6561faff230c148e6fdc5bc5af30b

…BIT_ASM_CHECK`

7efc983 Fix the false positive of `SECP_64BIT_ASM_CHECK` (Sprite)

Pull request description:

  I'm trying to compile this project for RISC-V architecture, and I encountered errors:
  ```
  src/field_5x52_asm_impl.h:28:1: error: unknown register name '%r15' in 'asm'
     28 | __asm__ __volatile__(
        | ^
  src/field_5x52_asm_impl.h:28:1: error: unknown register name '%r14' in 'asm'
  src/field_5x52_asm_impl.h:28:1: error: unknown register name '%r13' in 'asm'
  src/field_5x52_asm_impl.h:28:1: error: unknown register name '%r12' in 'asm'
  src/field_5x52_asm_impl.h:28:1: error: unknown register name '%r11' in 'asm'
  src/field_5x52_asm_impl.h:28:1: error: unknown register name '%r10' in 'asm'
  src/field_5x52_asm_impl.h:28:1: error: unknown register name '%r9' in 'asm'
  src/field_5x52_asm_impl.h:28:1: error: unknown register name '%r8' in 'asm'
  src/field_5x52_asm_impl.h:28:1: error: unknown register name '%rdx' in 'asm'
  src/field_5x52_asm_impl.h:28:1: error: unknown register name '%rcx' in 'asm'
  src/field_5x52_asm_impl.h:28:1: error: unknown register name '%rax' in 'asm'
  src/field_5x52_asm_impl.h:28:1: error: output number 0 not directly addressable
  src/field_5x52_asm_impl.h: In function 'secp256k1_fe_sqr':
  src/field_5x52_asm_impl.h:298:1: error: unknown register name '%r15' in 'asm'
    298 | __asm__ __volatile__(
        | ^
  src/field_5x52_asm_impl.h:298:1: error: unknown register name '%r14' in 'asm'
  src/field_5x52_asm_impl.h:298:1: error: unknown register name '%r13' in 'asm'
  src/field_5x52_asm_impl.h:298:1: error: unknown register name '%r12' in 'asm'
  src/field_5x52_asm_impl.h:298:1: error: unknown register name '%r11' in 'asm'
  src/field_5x52_asm_impl.h:298:1: error: unknown register name '%r10' in 'asm'
  src/field_5x52_asm_impl.h:298:1: error: unknown register name '%r9' in 'asm'
  src/field_5x52_asm_impl.h:298:1: error: unknown register name '%r8' in 'asm'
  src/field_5x52_asm_impl.h:298:1: error: unknown register name '%rdx' in 'asm'
  src/field_5x52_asm_impl.h:298:1: error: unknown register name '%rcx' in 'asm'
  src/field_5x52_asm_impl.h:298:1: error: unknown register name '%rbx' in 'asm'
  src/field_5x52_asm_impl.h:298:1: error: unknown register name '%rax' in 'asm'
  src/field_5x52_asm_impl.h:298:1: error: output number 0 not directly addressable
  ```

  After further investigation I found that for RISC-V, macro `USE_ASM_X86_64` was defined unexpectedly, and `checking for x86_64 assembly availability... yes` appeared in the compilation log file, which means `SECP_64BIT_ASM_CHECK` was not working as expected.

  For unknown reasons, `AC_COMPILE_IFELSE` does not check if `__asm__` can be compiled, and an example can verify this point:
  ```m4
  AC_DEFUN([SECP_64BIT_ASM_CHECK],[
  AC_MSG_CHECKING(for x86_64 assembly availability)
  AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
    #include <stdint.h>]],[[
    __asm__ __volatile__("this is obviously wrong");
    ]])],[has_64bit_asm=yes],[has_64bit_asm=no])
  AC_MSG_RESULT([$has_64bit_asm])
  ])
  ```

  It always gives results: `checking for x86_64 assembly availability... yes`

  After testing, replacing `AC_COMPILE_IFELSE` with `AC_LINK_IFELSE` can correctly check if `__asm__` can be compiled and make the project able to compile for RISC-V.

ACKs for top commit:
  real-or-random:
    ACK 7efc983

Tree-SHA512: 7318dd42004b2930cfcd6541c5a9ce0aa186e2179a668b76089a908bea8d9f70fcfdb264512f971e395a3ce9dc7f9ca24c8f3d46175cad2972a2d713f518ed85

libtool takes care of building both object versions, we just need to pick the
right one to export symbols.

…raries

6f6cab9 abi: Don't export symbols in static Windows libraries (Cory Fields)

Pull request description:

  For context, Bitcoin Core has recently merged [libbitcoin-kernel](bitcoin/bitcoin#24322), a small library that intends to eventually minimally encompass Core's validation engine. This kernel lib includes a static libsecp256k1. Without this change, because libsecp256k1.a ends up with exported symbols, we end up with libsecp256k1 symbols exported by our libbitcoin-kernel library (which causes unrelated problems not worth getting into here).

  libtool takes care of building both object versions, and it automatically builds objects for shared libs with -DDLL_EXPORT. We just need to opt-in to its functionality.

  I can't imagine this having any negative impact on any current statically-linking applications, if anything they'll just be a tiny bit smaller because they can now strip unused symbols.

ACKs for top commit:
  real-or-random:
    utACK 6f6cab9
  theuni:
    > Not sure what other changes made compilation on CI fail but Concept ACK [6f6cab9](bitcoin-core/secp256k1@6f6cab9). This should be entirely harmless.
  sipa:
    utACK 6f6cab9
  laanwj:
    utACK 6f6cab9

Tree-SHA512: 39f240046639738f7a8c01068e728b2f9ceac2754cc4b0a5fa46c28f6f57a8c4124653b56dfbf5c13106b07c11ac599cc41b508e16862d539ce1af6c3365a205

This adds MSVC builds built on Linux using wine. This requires some
settings of tools and flags because the autotools support for MSVC is
naturally somewhat limited.

The advantage of this approach is that it is compatible with our
existing CI scripts, so there's no need to write a Windows CI script
(in PowerShell or similar). If we want to test building and running on
Windows native (e.g., as supported by Cirrus CI) we could still do this
in the future.

Another advantage of this approach is that contributors can simply use
the docker image if they need a MSVC installation in a non-Windows
environment.

This commit also improves the Dockerfile by grouping RUN commands
according to Docker docs:
https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#run

This commit also raises the TEST_ITERS for wine tasks to the default.
The overhead of wine is negligible, so we can certainly afford the same
number of iterations as for native Linux tests.

49e2acd configure: Improve rationale for WERROR_CFLAGS (Tim Ruffing)
8dc4b03 ci: Add a C++ job that compiles the public headers without -fpermissive (Tim Ruffing)
51f296a ci: Run persistent wineserver to speed up wine (Tim Ruffing)
3fb3269 ci: Add 32-bit MinGW64 build (Tim Ruffing)
9efc2e5 ci: Add MSVC builds (Tim Ruffing)
2be6ba0 configure: Convince autotools to work with MSVC's archiver lib.exe (Tim Ruffing)
bd81f41 schnorrsig bench: Suppress a stupid warning in MSVC (Tim Ruffing)
09f3d71 configure: Add a few CFLAGS for MSVC (Tim Ruffing)
3b4f3d0 build: Reject C++ compilers in the preprocessor (Tim Ruffing)
1cc0941 configure: Don't abort if the compiler does not define __STDC__ (Tim Ruffing)
cca8cbb configure: Output message when checking for valgrind (Tim Ruffing)
1a6be57 bench: Make benchmarks compile on MSVC (Tim Ruffing)

Pull request description:

ACKs for top commit:
  jonasnick:
    ACK 49e2acd

Tree-SHA512: 986c498fb218231fff3519167d34a92e11dea6a4383788a9723be105c20578cd483c6b06ba5686c6669e3a02cfeebc29b8e5f1428552ebf4ec67fa7a86957548

…HECK` after invalid scrach space check

1827c9b scratch_destroy: move VERIFY_CHECK after invalid scrach space check (siv2r)

Pull request description:

ACKs for top commit:
  sipa:
    utACK 1827c9b
  jonasnick:
    ACK 1827c9b

Tree-SHA512: 5c4f97ca16f46380b30d1d077a54e25eab21efb10e0ce3ca27e7f73a2318d130f0f0773e26b2fdfc8f9d98c1334880f9d80a51b0941be3ba0af2b656b7c0ea7e

… group.h

069aba8 Fix sepc256k1 -> secp256k1 typo in group.h (henopied)

Pull request description:

ACKs for top commit:
  real-or-random:
    ACK 069aba8

Tree-SHA512: 0fcb7d042f201737870da99f5425c8449e9ec3f5f8e9bbe5eb719e46cdf230db057509fb9102d4ce50a94d616015233c29249665c754e726899174fea3ea9f40

This simplifies building without a build system.

This is in line with #925; the paths fixed here were either forgotten
there or only introduced later. This commit also makes the Makefile
stricter so that further "wrong" #include paths will lead to build
errors even in autotools builds.

This belongs to #929.

Co-authored-by: Hennadii Stepanov <[email protected]>

… get rid of further -I arguments

40a3473 build: Fix #include "..." paths to get rid of further -I arguments (Tim Ruffing)

Pull request description:

  This simplifies building without a build system.

  This is in line with #925; the paths fixed here were either forgotten
  there or only introduced later. This commit also makes the Makefile
  stricter so that further "wrong" #include paths will lead to build
  errors even in autotools builds.

  This belongs to #929.

ACKs for top commit:
  hebasto:
    ACK 40a3473

Tree-SHA512: 6f4d825ea3cf86b13f294e2ec19fafc29660fa99450e6b579157d7a6e9bdb3404d761edf89c1135fa89b984d6431a527beeb97031dc90f2fae9761528f4d06d1

Running the RNG is pointless if no seed is available because the key
will be fixed. The computation just wastes time.

Previously, users could avoid this computation at least by asking for
a context without signing capabilities. But since 3b0c218 we always
build an ecmult_gen context, ignoring the context flags. Moreover,
users could never avoid this pointless computation when asking for
the creation of a signing context.

Whenever I read this code, I first think that rescaling ctx->initial is
a dead store because we overwrite it later with gb. But that's wrong.
The rescaling blinds the computation of gb and affects its result.

This simplifies manual builds and solves one item in #929.

… blinding if no seed is available

55f8bc9 ecmult_gen: Improve comments about projective blinding (Tim Ruffing)
7a86955 ecmult_gen: Simplify code (no observable change) (Tim Ruffing)
4cc0b1b ecmult_gen: Skip RNG when creating blinding if no seed is available (Tim Ruffing)

Pull request description:

  Running the RNG is pointless if no seed is available because the key
  will be fixed. The computation just wastes time.

  Previously, users could avoid this computation at least by asking for
  a context without signing capabilities. But since 3b0c218 we always
  build an ecmult_gen context, ignoring the context flags. Moreover,
  users could never avoid this pointless computation when asking for
  the creation of a signing context.

  This fixes one item in #1065.

ACKs for top commit:
  sipa:
    ACK 55f8bc9
  apoelstra:
    ACK 55f8bc9

Tree-SHA512: 5ccba56041f94fa8f40a8a56ce505369ff2e0ed20cd7f0bfc3fdfffa5fa7bf826a93602b9b2455a352865a9548ab4928e858c19bb5af7ec221594a3bf25c4f3d

It's unused and thus potentially confusing.

…probability 15/16 instead of 1/4

17065f4 tests: Randomize the context with probability 15/16 instead of 1/4 (Tim Ruffing)

Pull request description:

ACKs for top commit:
  sipa:
    ACK 17065f4
  jonasnick:
    ACK 17065f4

Tree-SHA512: 3b7005770007b922a294be610f23da60b0dde74dfd7585d64a2cb04eaa6ec879de8d21a0ade31c1857019a8dd97260fa3aa167ae16fc55027ef280a3e3feaa6d

…for ECMULT_* config values

c27ae45 config: Remove basic-config.h (Tim Ruffing)
da6514a config: Introduce DEBUG_CONFIG macro for debug output of config (Tim Ruffing)
d0cf55e config: Set preprocessor defaults for ECMULT_* config values (Tim Ruffing)

Pull request description:

ACKs for top commit:
  sipa:
    ACK c27ae45
  hebasto:
    ACK c27ae45, I have reviewed the code and it looks correct.
  jonasnick:
    ACK c27ae45

Tree-SHA512: 56b0f384bd9f42cf7c903bec08f4807db1415ddf9a06676dfe1e638e4d02431c522ef0422585e85429074e0dbb51da4f400cf53e8f883d6e07122731c57be1e3

We had removed `PKG_PROG_PKG_CONFIG` in 21b2eba
(#1090). But then then the not rebased (!) merge of 2be6ba0
(#1084) brought that macro back at another location, without git
complaining about a conflict.

Fixes #1127.

… again (reintroduced by mismerge)

cabe085 configure: Remove pkgconfig macros again (reintroduced by mismerge) (Tim Ruffing)

Pull request description:

  We had removed `PKG_PROG_PKG_CONFIG` in 21b2eba
  (#1090). But then then the not rebased (!) merge of 2be6ba0
  (#1084) brought that macro back at another location, without git
  complaining about a conflict.

  Fixes #1127.

ACKs for top commit:
  fanquake:
    ACK cabe085
  hebasto:
    ACK cabe085
  jonasnick:
    ACK cabe085

Tree-SHA512: ba497503db3a11e631b15c4fe875e62d892971c2c708d90b2f6be684e85d164043ea97c13af0452831eef41f3cf8230cd8a9eafa332dc5b5ae18e118b87c3828

88b0089 readme: Fix line break (Tim Ruffing)
78f5296 readme: Sell "no runtime dependencies" (Tim Ruffing)
ef48f08 readme: Add IRC channel (Tim Ruffing)

Pull request description:

ACKs for top commit:
  apoelstra:
    utACK 88b0089
  sipa:
    ACK 88b0089

Tree-SHA512: 174f1596406f98a19059a18cd4fb993102e5ffb8ec29fcc6d03e27f135fcb526b37204b64055b5e4f0a273daab05d395cf335f26241cf3a29a060041c9ef109b

We don't enable the ECDSA recovery module, because we don't recommend
ECDSA recovery for new protocols. In particular, the recovery API is
prone to misuse: It invites the caller to forget to check the public
key (and the verification function always returns 1).

In general, we also don't recommend ordinary ECDSA for new protocols.
But disabling the ECDSA functions is not possible because they're not
in a module, and let's be honest: disabling ECDSA would mean to ignore
reality blatantly.

This reverts commit bceefd6.

The removed line was introduced for `obj/.gitignore` file. Since the
`obj` directory has been removed, it is not longer required.

f5039cb Cleanup `.gitignore` file (Hennadii Stepanov)
798727a Revert "Add test logs to gitignore" (Hennadii Stepanov)

Pull request description:

ACKs for top commit:
  jonasnick:
    ACK f5039cb
  real-or-random:
    ACK f5039cb

Tree-SHA512: 3586329e77958a9bfa06dd84e5b121cd456e93332670d5afc1a6691e165cdfa5a6fd6a61f82be12ec33f2a58b26a13adfedeb177ae1056202e53a530949fc549

$CC, $WRAPPER_CMD and valgrind are not necessarily defined

Currently CHECK is used only in test and bench mark files except for one
usage in `ecmult_impl.h`.

We would like to move the definition of CHECK out of `util.h` so that
`util.h` no longer has a hard dependency on `stdio.h`.

Done in preparation for moving the definition of `CHECK` as part of an
effort to allow secp256k1 to be compiled to WASM as part of
`rust-secp256k1`.

After this commit, int128.h and int128_impl.h are included as follows:
 - .c files which use int128 include int128_impl.h (after util.h)
 - .h files which use int128 include int128.h (after util.h)

This list is exhaustive. util.h needs to included first because it sets
up necessary #defines.

5c9f1a5 ci: always cat all logs_snippets (Jonas Nick)

Pull request description:

ACKs for top commit:
  real-or-random:
    ACK 5c9f1a5

Tree-SHA512: fc715c5fc4006d80a4b0c2faa8ef81ed23c4479614945ffa7c96665a3acc38fe956dd6d148bcf97043232ceee055b724ea9490e4ac4142a210e4488fed8dd299

…nd" irrelevant error

49ae843 ci: mostly prevent "-v/--version: not found" irrelevant error (Jonas Nick)

Pull request description:

ACKs for top commit:
  real-or-random:
    ACK 49ae843

Tree-SHA512: 2e048b037826dff372e26103f198e0d490494e7909d17d8632b51f6d9e0629b51bcd0b55b65b2c21d63d522394ccfed481ce126cea165c087df670556bc8ccf6

… the job outside of CI

4e54c03 ci: print env to allow reproducing the job outside of CI (Jonas Nick)

Pull request description:

  Example output:

  ```
  WERROR_CFLAGS="-Werror -pedantic-errors"  MAKEFLAGS="-j4"  BUILD="check"  ECMULTWINDOW="auto"  ECMULTGENPRECISION="auto"  ASM="no"  WIDEMUL="int64"  WITH_VALGRIND="no"  EXTRAFLAGS=""  EXPERIMENTAL="no"  ECDH="no"  RECOVERY="yes"  SCHNORRSIG="no"  SECP256K1_TEST_ITERS=""  BENCH="yes"  SECP256K1_BENCH_ITERS="2"  CTIMETEST="yes"  EXAMPLES="yes"  WRAPPER_CMD=""  CC="gcc"  AR=""  NM=""  HOST=""  ./ci/cirrus.sh
  ```

ACKs for top commit:
  sipa:
    ACK 4e54c03
  real-or-random:
    ACK bitcoin-core/secp256k1@4e54c03

Tree-SHA512: b74a8724e72b3de7884e4d93fe933dc5043aec37020672b7997a8faebda3b0cbbba1bca69c344109729261ab4a94e76f4eca0d8773dc101a443fdf9e0d7d54f5

…t file

6a965b6 Remove usage of CHECK from non-test file (Tobin C. Harding)

Pull request description:

  Currently CHECK is used only in test and bench mark files except for one usage in `ecmult_impl.h`.

  We would like to move the definition of CHECK out of `util.h` so that `util.h` no longer has a hard dependency on `stdio.h`.

  Done as part of an effort to allow secp256k1 to be compiled to WASM as part of `rust-secp256k1`.

  ### Note to reviewers

  Please review carefully, I don't actually know if this patch is correct. Done while working on #1095. I'm happy to make any changes both in concept and execution - I'm super rusty at C programming.

  cc real-or-random

ACKs for top commit:
  sipa:
    utACK 6a965b6
  real-or-random:
    utACK 6a965b6

Tree-SHA512: 6bfb456bdb92a831acd3bc202607e80f6d0a194d6b2cf745c8eceb12ba675d03a319d6d105332b0cbca474e443969295e5a8e938635453e21e057d0ee597440b

a340d95 ci: add int128_struct tests (Jonas Nick)
dceaa1f int128: Tidy #includes of int128.h and int128_impl.h (Tim Ruffing)
2914bcc Simulated int128 type. (Russell O'Connor)

Pull request description:

  Abstracts the int128 type and provides an native version, if available, or a implements it using a pair of int64_t's.

  This is activated by setting the configuration flag `--with-test-override-wide-multiply=int128_struct`.

  The primary purpose of this PR is to take advantage of MSVC's [umulh](https://docs.microsoft.com/en-us/cpp/intrinsics/umulh?view=msvc-170) intrinsic that we can use to simulate an int128 type which MSVC does not have (AFAIU). This PR lays out the groundwork for this level of MSVC support, but doesn't include the configuration logic to enable it yet.

  For completeness, and implementation of `umulh` and `mulh` are also provided for compilers that support neither the intrinsic nor the int128 type (such as CompCert?).  This also opens up the possibility of removing the 32-bit field and scalar implementations should that ever be desired.

ACKs for top commit:
  sipa:
    ACK a340d95
  jonasnick:
    ACK a340d95

Tree-SHA512: b4f2853fa3ab60ce9d77b4eaee1fd20c4b612850e19fcb3179d7e36986f420c6c4589ff72f0cf844f989584ace49a1cd23cca3f4e405dabefc8da647a0df679d

00a42b9 Add MSan CI job (Pieter Wuille)

Pull request description:

ACKs for top commit:
  real-or-random:
    utACK 00a42b9
  jonasnick:
    ACK 00a42b9

Tree-SHA512: 0b9ced572430e917041c916d8cda5c94996899a6e0a8c5a13f73f2c99b58b0098f7562cd758b48f18bec8c7095fab37980aa6dc2b139b2d1c293c965ea603686

Also add a corresponding CI job

99bd335 Make int128 overflow test use secp256k1_[ui]128_mul (Pieter Wuille)
3afce0a Avoid signed overflow in MSVC AMR64 secp256k1_mul128 (Pieter Wuille)
9b5f589 Heuristically decide whether to use int128_struct (Pieter Wuille)
63ff064 int128: Add test override for testing __(u)mulh on MSVC X64 (Tim Ruffing)
f2b7e88 Add int128 randomized tests (Pieter Wuille)

Pull request description:

  This is a follow-up to #1000:
  * Add randomized unit tests for int128 logic.
  * Add CI for the `_(u)mulh` code path (on non-ARM64 MSVC).
  * Add heuristic logic to enable int128_struct based arithmetic on 64-bit MSVC, or systems with pointers wider than 32 bits.
  * Fix signed overflow in ARM64 MSVC code.

ACKs for top commit:
  roconnor-blockstream:
    utACK 99bd335
  real-or-random:
    ACK 99bd335 tested this also on MSVC locally with the override, including all the benchmark binaries
  jonasnick:
    utACK 99bd335

Tree-SHA512: 5ea897362293b45a86650593e1fdc8c4004a1d9452eed2fa070d22dffc7ed7ca1ec50a4df61e3a33dbe35e08132ad9686286ac44af6742b32b82f11c9d3341c6

…default

41e8704 build: Enable some modules by default (Tim Ruffing)

Pull request description:

  This has been discussed in bitcoin-core/secp256k1#817 (comment) and I agree with the arguments brought up there.

  Alternatively, we could not enable them and add a discussion to the readme why we discourage people from using the modules. I believe enabling ECDH is not very controversial. But what about recovery? Do we want to leave it off and instead give a reason?

ACKs for top commit:
  sipa:
    ACK 41e8704
  jonasnick:
    ACK 41e8704

Tree-SHA512: 1dd21037043f2b2c94a92cd2f31e69b505ba5b43119897bc0934966d9ccd84fc4fc20e7509af634f1c3a096710db1a2253090f5f1f107b9d258945a5546e9ba4

a8494b0 Use compute credits for macOS jobs (Pieter Wuille)
c0ae48c Update macOS image for CI (Pieter Wuille)

Pull request description:

ACKs for top commit:
  real-or-random:
    ACK a8494b0
  jonasnick:
    ACK a8494b0

Tree-SHA512: af99585ef68fc8305785885efaf0a0ebe45e5765661d654523a36ba843fc83e0ac40a554638437fa53804e4aa42dbcd92d597702ee6225b66a044a6304bafd45

…ogenerated by sage [skip ci]

092be61 gitignore: Add *.sage.py files autogenerated by sage (Tim Ruffing)

Pull request description:

ACKs for top commit:
  jonasnick:
    ACK 092be61

Tree-SHA512: ee77e8634814ccc1894eb633816da877a4d4511d9e77f5628b19e0e37006d43ae45431dfd1b30977504a5975a92a2b1824ed53c7837fb5600994d11003996b86

and improve phrasing slightly.

4386a23 examples: Switch to NONE contexts (Tim Ruffing)
7289b51 docs: Use doxygen style if and only if comment is user-facing (Tim Ruffing)
e7d0185 docs: Get rid of "initialized for signing" terminology (Tim Ruffing)
0612636 docs: Tidy and improve docs about contexts and randomization (Tim Ruffing)
e02d686 selftest: Expose in public API (Tim Ruffing)
e383fbf selftest: Rename internal function to make name available for API (Tim Ruffing)
d2c6d48 tests: Use new name of static context (Tim Ruffing)
53796d2 contexts: Rename static context (Tim Ruffing)
72fedf8 docs: Improve docs for static context (Tim Ruffing)
316ac76 contexts: Deprecate all context flags except SECP256K1_CONTEXT_NONE (Tim Ruffing)
1a553ee docs: Change signature "validation" to "verification" (Tim Ruffing)
ee7341f docs: Never require a verification context (Tim Ruffing)

Pull request description:

ACKs for top commit:
  sipa:
    utACK 4386a23
  jonasnick:
    ACK 4386a23

Tree-SHA512: 7bf07dfae0ecbf7de1418de64ef743a23dc5f244aeba2c1cf3ecbdc117d6ac12bb6c8f17f739605566074a9b901765ee4a32288b6edc6f9a0040a70cb472f6ee

…ith NONE in benchmarks and tests

d6dc0f4 tests: Switch to NONE contexts in module tests (Jonas Nick)
0c8a5ca tests: Switch to NONE contexts in tests.c (Jonas Nick)
86540e9 tests: add test for deprecated flags and rm them from run_context (Jonas Nick)
caa0ad6 group: add gej_eq_var (Jonas Nick)
37ba744 tests: Switch to NONE contexts in exhaustive and ctime tests (Jonas Nick)
8d7a9a8 benchmarks: Switch to NONE contexts (Jonas Nick)

Pull request description:

  Based on #1126.

ACKs for top commit:
  real-or-random:
    ACK d6dc0f4 diff looks good and tests pass locally
  sipa:
    utACK d6dc0f4

Tree-SHA512: 1fb1dc1336409b52827787a03c791a21ee1d6b1bdc388d1fa126600572f348ba16865a01d29bac67b36b8f29f30cda117d82913e2044ccb9d073f5d04338ac9f

The suffix -dev is slightly clearer.

Also, since the package version follows semantic versioning, rename
VERSION_BUILD to VERSION_PATCH for clarity.