比特币交易的延展性问题(Transaction Malleability)

// 1. 签名一个Tx2的TxIn的主要的方法
func sign(/* 参数省略 */) {

        /* 省略 */

        // 根据Alice的PkScript的类型来确认如何生成签名
        switch class {

        /* 其它类型省略 */

        // 这是一个P2PKH
        case PubKeyHashTy:
                /* 获取私钥步骤省略 */

                // tx 是Alice的Tx1
                // idx Bob要签名的这个TxIn的索引
                // subScript是Tx1里Alice设置的 OP_DUP OP_HASH160 <Bob's PubkeyHash> OP_EQUALVERIFY OP_CHECKSIG
                // hashType 是用来配置不同的签名方式
                // key 是Bob的私钥
                // compressed 表示Bob的公钥是否压缩（这是另外一个话题了）
                script, err := SignatureScript(tx, idx, subScript, hashType,
                        key, compressed)
                if err != nil {
                        return nil, class, nil, 0, err
                }

                return script, class, addresses, nrequired, nil

        /* 其它类型省略 */

        }
}


// 2. sign调用的核心，生成P2PKH的signature script
// SignatureScript creates an input signature script for tx to spend BTC sent
// from a previous output to the owner of privKey. tx must include all
// transaction inputs and outputs, however txin scripts are allowed to be filled
// or empty. The returned script is calculated to be used as the idx'th txin
// sigscript for tx. subscript is the PkScript of the previous output being used
// as the idx'th input. privKey is serialized in either a compressed or
// uncompressed format based on compress. This format must match the same format
// used to generate the payment address, or the script validation will fail.
func SignatureScript(tx *wire.MsgTx, idx int, subscript []byte, hashType SigHashType, privKey *btcec.PrivateKey, compress bool) ([]byte, error) {

        // 先生成signature
        sig, err := RawTxInSignature(tx, idx, subscript, hashType, privKey)
        if err != nil {
                return nil, err
        }

        // 再根据是否压缩生成Bob的Pubkey
        pk := (*btcec.PublicKey)(&privKey.PublicKey)
        var pkData []byte
        if compress {
                pkData = pk.SerializeCompressed()
        } else {
                pkData = pk.SerializeUncompressed()
        }


        // 最后组合成 <Sig> <PubKey> 比特币脚本
        return NewScriptBuilder().AddData(sig).AddData(pkData).Script()
}


// 3. 生成signature的方法
// RawTxInSignature returns the serialized ECDSA signature for the input idx of
// the given transaction, with hashType appended to it.
func RawTxInSignature(tx *wire.MsgTx, idx int, subScript []byte,
        hashType SigHashType, key *btcec.PrivateKey) ([]byte, error) {

        // 先按一定方法计算各部分哈希值
        hash, err := CalcSignatureHash(subScript, hashType, tx, idx)
        if err != nil {
                return nil, err
        }

        // 再用私钥签名该哈希值
        signature, err := key.Sign(hash)
        if err != nil {
                return nil, fmt.Errorf("cannot sign tx input: %s", err)
        }

        // 最后将签名序列化和哈希类型一起返回
        return append(signature.Serialize(), byte(hashType)), nil
}


// 4. 看看CalcSignatureHash调用的calcSignatureHash方法
// calcSignatureHash will, given a script and hash type for the current script
// engine instance, calculate the signature hash to be used for signing and
// verification.
func calcSignatureHash(script []parsedOpcode, hashType SigHashType, tx *wire.MsgTx, idx int) []byte {
        /* 参数说明：
           script是Tx1里Alice设置的: OP_DUP OP_HASH160 <Bob's PubkeyHash> OP_EQUALVERIFY OP_CHECKSIG.
           hashType 是用来配置不同的签名方式
           tx 是Bob的Tx2
           idx 是 Bob要签名的这个txin的索引
        */

        /* 省略部分 */

        // 复制Tx2, 得到移除这个TxIn外其它TxIn的signature script
        // Make a shallow copy of the transaction, zeroing out the script for
        // all inputs that are not currently being processed.
        txCopy := shallowCopyTx(tx)
        for i := range txCopy.TxIn {
                if i == idx {
                        // UnparseScript cannot fail here because removeOpcode
                        // above only returns a valid script.
                        sigScript, _ := unparseScript(script)
                        // 注意，这里用Tx1的PkScript来填充这个相应index的Signature script
                        txCopy.TxIn[idx].SignatureScript = sigScript
                } else {
                        txCopy.TxIn[i].SignatureScript = nil
                }
        }

        // 根据不同的hash的方法邀请，变换操作txCopy达到要求
        switch hashType & sigHashMask {
        case SigHashNone:
                txCopy.TxOut = txCopy.TxOut[0:0] // Empty slice.
                for i := range txCopy.TxIn {
                        if i != idx {
                                txCopy.TxIn[i].Sequence = 0
                        }
                }

        case SigHashSingle:
                // Resize output array to up to and including requested index.
                txCopy.TxOut = txCopy.TxOut[:idx+1]

                // All but current output get zeroed out.
                for i := 0; i < idx; i++ {
                        txCopy.TxOut[i].Value = -1
                        txCopy.TxOut[i].PkScript = nil
                }

                // Sequence on all other inputs is 0, too.
                for i := range txCopy.TxIn {
                        if i != idx {
                                txCopy.TxIn[i].Sequence = 0
                        }
                }

        default:
                // Consensus treats undefined hashtypes like normal SigHashAll
                // for purposes of hash generation.
                fallthrough
        case SigHashOld:
                fallthrough
        case SigHashAll:
                // Nothing special here.
        }
        if hashType&SigHashAnyOneCanPay != 0 {
                txCopy.TxIn = txCopy.TxIn[idx : idx+1]
        }


        /* 最后 DoubleHash（
                 MsgTxCopy序列化(所有Tx2的的内容,除了第idx个Input的Signature Script用Tx1的PKscript代替，以及移除其它的TxIn的Signature Script)
                 + hash类别
                 ）
        */
        // The final hash is the double sha256 of both the serialized modified
        // transaction and the hash type (encoded as a 4-byte little-endian
        // value) appended.
        wbuf := bytes.NewBuffer(make([]byte, 0, txCopy.SerializeSizeStripped()+4))
        txCopy.SerializeNoWitness(wbuf)
        binary.Write(wbuf, binary.LittleEndian, hashType)
        return chainhash.DoubleHashB(wbuf.Bytes())
}