bitcoin · hebasto · Oct 28, 2025 · Sep 8, 2025 · Jul 17, 2025 · Sep 9, 2025
diff --git a/ci/test/03_test_script.sh b/ci/test/03_test_script.sh
@@ -41,7 +41,10 @@ echo "=== BEGIN env ==="
 env
 echo "=== END env ==="
 
-(
+# Don't apply patches in the tidy job, because it relies on the `git diff`
+# command to detect IWYU errors. It is safe to skip this patch in the tidy job
+# because it doesn't run a UB detector.
+if [ "$RUN_TIDY" != "true" ]; then
   # compact->outputs[i].file_size is uninitialized memory, so reading it is UB.
   # The statistic bytes_written is only used for logging, which is disabled in
   # CI, so as a temporary minimal fix to work around UB and CI failures, leave
@@ -62,7 +65,7 @@ echo "=== END env ==="
    mutex_.Lock();
    stats_[compact->compaction->level() + 1].Add(stats);
 EOF
-)
+fi
 
 if [ "$RUN_FUZZ_TESTS" = "true" ]; then
   export DIR_FUZZ_IN=${DIR_QA_ASSETS}/fuzz_corpora/
@@ -210,14 +213,30 @@ if [ "${RUN_TIDY}" = "true" ]; then
     false
   fi
 
+  # TODO: Consider enforcing IWYU across the entire codebase.
+  FILES_WITH_ENFORCED_IWYU="/src/(crypto|index)/.*\\.cpp"
+  jq --arg patterns "$FILES_WITH_ENFORCED_IWYU" 'map(select(.file | test($patterns)))' "${BASE_BUILD_DIR}/compile_commands.json" > "${BASE_BUILD_DIR}/compile_commands_iwyu_errors.json"
+  jq --arg patterns "$FILES_WITH_ENFORCED_IWYU" 'map(select(.file | test($patterns) | not))' "${BASE_BUILD_DIR}/compile_commands.json" > "${BASE_BUILD_DIR}/compile_commands_iwyu_warnings.json"
+
   cd "${BASE_ROOT_DIR}"
-  python3 "/include-what-you-use/iwyu_tool.py" \
-           -p "${BASE_BUILD_DIR}" "${MAKEJOBS}" \
-           -- -Xiwyu --cxx17ns -Xiwyu --mapping_file="${BASE_ROOT_DIR}/contrib/devtools/iwyu/bitcoin.core.imp" \
-           -Xiwyu --max_line_length=160 \
-           2>&1 | tee /tmp/iwyu_ci.out
-  cd "${BASE_ROOT_DIR}/src"
-  python3 "/include-what-you-use/fix_includes.py" --nosafe_headers < /tmp/iwyu_ci.out
+
+  run_iwyu() {
+    mv "${BASE_BUILD_DIR}/$1" "${BASE_BUILD_DIR}/compile_commands.json"
+    python3 "/include-what-you-use/iwyu_tool.py" \
+             -p "${BASE_BUILD_DIR}" "${MAKEJOBS}" \
+             -- -Xiwyu --cxx17ns -Xiwyu --mapping_file="${BASE_ROOT_DIR}/contrib/devtools/iwyu/bitcoin.core.imp" \
+             -Xiwyu --max_line_length=160 \
+             2>&1 | tee /tmp/iwyu_ci.out
+    python3 "/include-what-you-use/fix_includes.py" --nosafe_headers < /tmp/iwyu_ci.out
+  }
+
+  run_iwyu "compile_commands_iwyu_errors.json"
+  if ! ( git --no-pager diff --exit-code ); then
+    echo "^^^ ⚠️ Failure generated from IWYU"
+    false
+  fi
+
+  run_iwyu "compile_commands_iwyu_warnings.json"
   git --no-pager diff
 fi
 

diff --git a/contrib/devtools/iwyu/bitcoin.core.imp b/contrib/devtools/iwyu/bitcoin.core.imp
@@ -1,3 +1,16 @@
-# Nothing for now.
 [
+  # Compiler intrinsics.
+  # See: https://github.com/include-what-you-use/include-what-you-use/issues/1764.
+  { "include": [ "<emmintrin.h>", "private", "<immintrin.h>", "public" ] },
+  { "include": [ "<smmintrin.h>", "private", "<immintrin.h>", "public" ] },
+  { "include": [ "<tmmintrin.h>", "private", "<immintrin.h>", "public" ] },
+
+  # libc symbols.
+  { "symbol": ["AT_HWCAP", "private", "<sys/auxv.h>", "public"] },
+  { "symbol": ["AT_HWCAP2", "private", "<sys/auxv.h>", "public"] },
+
+  # Fixed in https://github.com/include-what-you-use/include-what-you-use/pull/1706.
+  { "symbol": ["SEEK_CUR", "private", "<cstdio>", "public"] },
+  { "symbol": ["SEEK_END", "private", "<cstdio>", "public"] },
+  { "symbol": ["SEEK_SET", "private", "<cstdio>", "public"] },
 ]
diff --git a/src/crypto/chacha20.cpp b/src/crypto/chacha20.cpp
@@ -8,11 +8,10 @@
 #include <crypto/common.h>
 #include <crypto/chacha20.h>
 #include <support/cleanse.h>
-#include <span.h>
 
 #include <algorithm>
 #include <bit>
-#include <cstring>
+#include <cassert>
 
 #define QUARTERROUND(a,b,c,d) \
   a += b; d = std::rotl(d ^ a, 16); \

diff --git a/src/crypto/chacha20.h b/src/crypto/chacha20.h
@@ -5,12 +5,11 @@
 #ifndef BITCOIN_CRYPTO_CHACHA20_H
 #define BITCOIN_CRYPTO_CHACHA20_H
 
-#include <span.h>
-
 #include <array>
 #include <cstddef>
 #include <cstdint>
-#include <cstdlib>
+#include <iterator>
+#include <span>
 #include <utility>
 
 // classes for ChaCha20 256-bit stream cipher developed by Daniel J. Bernstein

diff --git a/src/crypto/chacha20poly1305.h b/src/crypto/chacha20poly1305.h
@@ -7,10 +7,10 @@
 
 #include <cstddef>
 #include <cstdint>
+#include <span>
 
 #include <crypto/chacha20.h>
 #include <crypto/poly1305.h>
-#include <span.h>
 
 /** The AEAD_CHACHA20_POLY1305 authenticated encryption algorithm from RFC8439 section 2.8. */
 class AEADChaCha20Poly1305

diff --git a/src/crypto/hex_base.cpp b/src/crypto/hex_base.cpp
@@ -5,8 +5,10 @@
 #include <crypto/hex_base.h>
 
 #include <array>
+#include <cassert>
 #include <cstring>
 #include <string>
+#include <tuple>
 
 namespace {
 

diff --git a/src/crypto/hex_base.h b/src/crypto/hex_base.h
@@ -9,6 +9,7 @@
 
 #include <cstddef>
 #include <cstdint>
+#include <span>
 #include <string>
 
 /**

diff --git a/src/crypto/hkdf_sha256_32.cpp b/src/crypto/hkdf_sha256_32.cpp
@@ -4,8 +4,9 @@
 
 #include <crypto/hkdf_sha256_32.h>
 
+#include <crypto/hmac_sha256.h>
+
 #include <cassert>
-#include <cstring>
 
 CHKDF_HMAC_SHA256_L32::CHKDF_HMAC_SHA256_L32(const unsigned char* ikm, size_t ikmlen, const std::string& salt)
 {

diff --git a/src/crypto/hkdf_sha256_32.h b/src/crypto/hkdf_sha256_32.h
@@ -5,10 +5,8 @@
 #ifndef BITCOIN_CRYPTO_HKDF_SHA256_32_H
 #define BITCOIN_CRYPTO_HKDF_SHA256_32_H
 
-#include <crypto/hmac_sha256.h>
-
-#include <cstdint>
-#include <cstdlib>
+#include <cstddef>
+#include <string>
 
 /** A rfc5869 HKDF implementation with HMAC_SHA256 and fixed key output length of 32 bytes (L=32) */
 class CHKDF_HMAC_SHA256_L32

diff --git a/src/crypto/hmac_sha256.cpp b/src/crypto/hmac_sha256.cpp
@@ -4,6 +4,8 @@
 
 #include <crypto/hmac_sha256.h>
 
+#include <crypto/sha256.h>
+
 #include <cstring>
 
 CHMAC_SHA256::CHMAC_SHA256(const unsigned char* key, size_t keylen)

diff --git a/src/crypto/hmac_sha256.h b/src/crypto/hmac_sha256.h
@@ -7,8 +7,7 @@
 
 #include <crypto/sha256.h>
 
-#include <cstdint>
-#include <cstdlib>
+#include <cstddef>
 
 /** A hasher class for HMAC-SHA-256. */
 class CHMAC_SHA256

diff --git a/src/crypto/hmac_sha512.cpp b/src/crypto/hmac_sha512.cpp
@@ -4,6 +4,8 @@
 
 #include <crypto/hmac_sha512.h>
 
+#include <crypto/sha512.h>
+
 #include <cstring>
 
 CHMAC_SHA512::CHMAC_SHA512(const unsigned char* key, size_t keylen)

diff --git a/src/crypto/hmac_sha512.h b/src/crypto/hmac_sha512.h
@@ -7,8 +7,7 @@
 
 #include <crypto/sha512.h>
 
-#include <cstdint>
-#include <cstdlib>
+#include <cstddef>
 
 /** A hasher class for HMAC-SHA-512. */
 class CHMAC_SHA512

diff --git a/src/crypto/muhash.cpp b/src/crypto/muhash.cpp
@@ -7,11 +7,12 @@
 #include <crypto/chacha20.h>
 #include <crypto/common.h>
 #include <hash.h>
+#include <span.h>
+#include <uint256.h>
 #include <util/check.h>
 
 #include <bit>
-#include <cassert>
-#include <cstdio>
+#include <cstring>
 #include <limits>
 
 namespace {

diff --git a/src/crypto/muhash.h b/src/crypto/muhash.h
@@ -6,9 +6,12 @@
 #define BITCOIN_CRYPTO_MUHASH_H
 
 #include <serialize.h>
-#include <uint256.h>
 
+#include <cstddef>
 #include <cstdint>
+#include <span>
+
+class uint256;
 
 class Num3072
 {

diff --git a/src/crypto/poly1305.cpp b/src/crypto/poly1305.cpp
@@ -5,8 +5,6 @@
 #include <crypto/common.h>
 #include <crypto/poly1305.h>
 
-#include <cstring>
-
 namespace poly1305_donna {
 
 // Based on the public domain implementation by Andrew Moon

diff --git a/src/crypto/poly1305.h b/src/crypto/poly1305.h
@@ -8,8 +8,9 @@
 #include <span.h>
 
 #include <cassert>
+#include <cstddef>
 #include <cstdint>
-#include <cstdlib>
+#include <span>
 
 #define POLY1305_BLOCK_SIZE 16
 

diff --git a/src/crypto/sha256.cpp b/src/crypto/sha256.cpp
@@ -10,7 +10,7 @@
 #include <cstring>
 
 #if !defined(DISABLE_OPTIMIZED_SHA256)
-#include <compat/cpuid.h>
+#include <compat/cpuid.h> // IWYU pragma: keep
 
 #if defined(__linux__) && defined(ENABLE_ARM_SHANI)
 #include <sys/auxv.h>

diff --git a/src/crypto/sha256_arm_shani.cpp b/src/crypto/sha256_arm_shani.cpp
@@ -13,7 +13,6 @@
 #include <array>
 #include <cstdint>
 #include <cstddef>
-#include <arm_acle.h>
 #include <arm_neon.h>
 
 namespace {

diff --git a/src/crypto/sha256_sse4.cpp b/src/crypto/sha256_sse4.cpp
@@ -5,11 +5,11 @@
 // This is a translation to GCC extended asm syntax from YASM code by Intel
 // (available at the bottom of this file).
 
+#if defined(__x86_64__) || defined(__amd64__)
+
 #include <cstdint>
 #include <cstdlib>
 
-#if defined(__x86_64__) || defined(__amd64__)
-
 namespace sha256_sse4
 {
 void Transform(uint32_t* s, const unsigned char* chunk, size_t blocks)

diff --git a/src/crypto/sha256_x86_shani.cpp b/src/crypto/sha256_x86_shani.cpp
@@ -8,6 +8,7 @@
 
 #if defined(ENABLE_SSE41) && defined(ENABLE_X86_SHANI)
 
+#include <cstddef>
 #include <cstdint>
 #include <immintrin.h>
 

diff --git a/src/crypto/sha3.cpp b/src/crypto/sha3.cpp
@@ -9,9 +9,9 @@
 #include <crypto/common.h>
 
 #include <algorithm>
-#include <array>
 #include <bit>
-#include <cstdint>
+#include <cassert>
+#include <iterator>
 #include <span>
 
 void KeccakF(uint64_t (&st)[25])

diff --git a/src/crypto/sha3.h b/src/crypto/sha3.h
@@ -5,10 +5,9 @@
 #ifndef BITCOIN_CRYPTO_SHA3_H
 #define BITCOIN_CRYPTO_SHA3_H
 
-#include <span.h>
-
 #include <cstdint>
 #include <cstdlib>
+#include <span>
 
 //! The Keccak-f[1600] transform.
 void KeccakF(uint64_t (&st)[25]);

diff --git a/src/crypto/siphash.cpp b/src/crypto/siphash.cpp
@@ -4,7 +4,11 @@
 
 #include <crypto/siphash.h>
 
+#include <uint256.h>
+
 #include <bit>
+#include <cassert>
+#include <span>
 
 #define SIPROUND do { \
     v0 += v1; v1 = std::rotl(v1, 13); v1 ^= v0; \

diff --git a/src/crypto/siphash.h b/src/crypto/siphash.h
@@ -6,9 +6,9 @@
 #define BITCOIN_CRYPTO_SIPHASH_H
 
 #include <cstdint>
+#include <span>
 
-#include <span.h>
-#include <uint256.h>
+class uint256;
 
 /** SipHash-2-4 */
 class CSipHasher

diff --git a/src/index/base.cpp b/src/index/base.cpp
@@ -2,31 +2,45 @@
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
-#include <chainparams.h>
-#include <common/args.h>
 #include <index/base.h>
+
+#include <chain.h>
+#include <common/args.h>
+#include <dbwrapper.h>
 #include <interfaces/chain.h>
+#include <interfaces/types.h>
 #include <kernel/chain.h>
 #include <logging.h>
 #include <node/abort.h>
 #include <node/blockstorage.h>
 #include <node/context.h>
 #include <node/database_args.h>
 #include <node/interface_ui.h>
+#include <primitives/block.h>
+#include <sync.h>
 #include <tinyformat.h>
+#include <uint256.h>
 #include <undo.h>
+#include <util/fs.h>
 #include <util/string.h>
 #include <util/thread.h>
+#include <util/threadinterrupt.h>
+#include <util/time.h>
 #include <util/translation.h>
 #include <validation.h>
+#include <validationinterface.h>
 
-#include <chrono>
+#include <cassert>
+#include <compare>
+#include <cstdint>
 #include <memory>
 #include <optional>
+#include <span>
 #include <stdexcept>
 #include <string>
 #include <thread>
 #include <utility>
+#include <vector>
 
 constexpr uint8_t DB_BEST_BLOCK{'B'};