Migrate swift-secp256k1 to the P256K module (0.17.0 → 0.23.x)

[jvsena42]

Split out of #657, where the dependabot bump to 0.23.2 broke CI. Details in #657 (comment) — swift-secp256k1 was reverted to 0.17.0 there so the CodeScanner and Lottie bumps could land.

Problem

0.23.2 renames the secp256k1 product to P256K and moves the raw C API into a separate libsecp256k1 product that the Swift wrapper imports internally rather than re-exporting. Bumping Package.resolved alone fails the project load on every target:

Bitkit.xcodeproj: error: Missing package product 'secp256k1'
  (in targets 'Bitkit', 'BitkitTests', 'BitkitNotification')

Required changes

• Add both P256K and libsecp256k1 as product dependencies on Bitkit, BitkitTests and BitkitNotification, and bump the package requirement minimumVersion (dependabot leaves it at 0.17.0, a version that no longer vends the product)
• Crypto.swift: import P256K for ECDH and libsecp256k1 for the C API (secp256k1_ecdsa_sign_recoverable, secp256k1_ec_pubkey_create); rename secp256k1.KeyAgreement.* to P256K.KeyAgreement.*. sharedSecretFromKeyAgreement is no longer throwing, so the try comes off
• WatchOnlyAccountService.swift: import libsecp256k1 only — it uses just the C API
• Add -skipPackagePluginValidation to every scripted xcodebuild invocation (unit-tests, integration-tests, e2e-tests ×2, e2e_migration, ai-device-tests, plus the build/archive commands in README.md, AGENTS.md, Docs/AI_DEVICE_TESTS.md, Docs/RELEASE.md, .agents/commands/release.md)

That last one is the easy one to miss: 0.23.2 also ships a SharedSourcesPlugin build-tool plugin, and xcodebuild refuses to run an untrusted plugin non-interactively. Xcode shows a one-time "Trust & Enable" prompt, so a local GUI build passes while CI fails with Validate plug-in "SharedSourcesPlugin" in package "swift-secp256k1". Worth a README troubleshooting entry.

Testing

This touches push-notification payload decryption and watch-only key parsing, so the migration should carry regression coverage for the paths that change modules. testBlocktankEncryptedPayload already pins ECDH to a known server vector, and testSerializedXpubRejectsWellFormedPayloadWithKeyOffTheCurve covers secp256k1_ec_pubkey_parse, but Crypto.getPublicKey and Crypto.sign have none. Suggested additions:

• pin getPublicKey to private→compressed-pubkey vectors computed independently of the dependency (using privkey 0x01, whose answer is the curve generator, makes the vectors self-validating)
• sign a Lightning message, then recover the signer's public key from the signature via P256K.Recovery and assert it matches getPublicKey — this catches a wrong recovery-id offset or a broken recovery module, which a length check alone would not

Notes

• The package requires swift-tools 6.1 (Xcode 16.3+) and uses SwiftPM traits; CI runs Xcode 16.4
• Dependabot will re-propose this bump monthly until the migration lands. If that becomes noisy, add a swift-secp256k1 ignore entry to .github/dependabot.yml in the meantime

A verified-green implementation of all of the above (build + 758 unit tests passing) was prototyped on #657 before the revert.

[jvsena42]

The prototype from #657, as a patch. Verified green before it was reverted: build succeeded (app + BitkitNotification extension) and the unit-test suite passed with 758 tests, 0 failures, on Xcode 26.5 / iPhone 16 simulator.

It applies on top of 4a149c1c (the dependabot commit), so it assumes Package.resolved is already at swift-secp256k1 0.23.2 — that file is not in the diff. On current master, bump the resolved pin first:

git checkout -b chore/secp256k1-p256k master
# set swift-secp256k1 to 0.23.2 / e70a10e036a55fffea31568f0af92d69b6d449cd in Package.resolved
git apply p256k-migration.diff
xcodebuild -project Bitkit.xcodeproj -resolvePackageDependencies

Treat it as a starting point, not a finished PR — it predates any newer changes to the workflows and docs it touches, and 0.23.x may have moved on from 0.23.2 by the time this is picked up.

p256k-migration.diff — 14 files (project, 2 sources, 2 new tests, 5 workflows, 4 docs)

diff --git a/.agents/commands/release.md b/.agents/commands/release.md
index 3d7c9b2b..1fc3c8ba 100644
--- a/.agents/commands/release.md
+++ b/.agents/commands/release.md
@@ -257,7 +257,8 @@ xcodebuild archive \
   -project Bitkit.xcodeproj \
   -scheme Bitkit \
   -archivePath ./build/Bitkit.xcarchive \
-  -configuration Release
+  -configuration Release \
+  -skipPackagePluginValidation
 ```
 
 Export and upload to TestFlight (requires App Store Connect API key in `~/.appstoreconnect/private_keys/` — see `Docs/RELEASE.md` for setup):
diff --git a/.github/workflows/ai-device-tests.yml b/.github/workflows/ai-device-tests.yml
index f9466190..657e4fc8 100644
--- a/.github/workflows/ai-device-tests.yml
+++ b/.github/workflows/ai-device-tests.yml
@@ -98,6 +98,7 @@ jobs:
             -configuration Debug \
             -destination "platform=iOS Simulator,name=$SIMULATOR_NAME,OS=$SIMULATOR_OS" \
             -derivedDataPath DerivedData \
+            -skipPackagePluginValidation \
             -resultBundlePath TestResults/TrezorBridgeDashboardUITests.xcresult \
             SWIFT_ACTIVE_COMPILATION_CONDITIONS='DEBUG E2E_BUILD TEST_TREZOR_EMU' \
             -only-testing:BitkitUITests/TrezorBridgeDashboardUITests \
diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml
index 4108d43b..9338fee5 100644
--- a/.github/workflows/e2e-tests.yml
+++ b/.github/workflows/e2e-tests.yml
@@ -116,6 +116,7 @@ jobs:
             SWIFT_ACTIVE_COMPILATION_CONDITIONS='DEBUG E2E_BUILD' \
             TREZOR_BRIDGE=true \
             TREZOR_BRIDGE_URL=http://127.0.0.1:21325 \
+            -skipPackagePluginValidation \
             -allowProvisioningUpdates \
             build
 
@@ -205,6 +206,7 @@ jobs:
             -destination "platform=iOS Simulator,name=$SIMULATOR_NAME,OS=$OS_VERSION" \
             -derivedDataPath DerivedData \
             SWIFT_ACTIVE_COMPILATION_CONDITIONS='DEBUG E2E_BUILD' \
+            -skipPackagePluginValidation \
             -allowProvisioningUpdates \
             build
 
diff --git a/.github/workflows/e2e_migration.yml b/.github/workflows/e2e_migration.yml
index 22292319..165415a2 100644
--- a/.github/workflows/e2e_migration.yml
+++ b/.github/workflows/e2e_migration.yml
@@ -94,6 +94,7 @@ jobs:
             -destination "platform=iOS Simulator,name=${{ env.SIMULATOR_NAME }},OS=${{ env.IOS_VERSION }}" \
             -derivedDataPath DerivedData \
             SWIFT_ACTIVE_COMPILATION_CONDITIONS='$(inherited) E2E_BUILD' \
+            -skipPackagePluginValidation \
             -allowProvisioningUpdates \
             build
 
diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index 0a988fcd..2121538e 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -65,6 +65,7 @@ jobs:
             set -o pipefail && xcodebuild test \
               -scheme Bitkit \
               -destination 'platform=iOS Simulator,name=iPhone 16,OS=latest' \
+              -skipPackagePluginValidation \
               -enableCodeCoverage NO \
               -parallel-testing-enabled NO \
               -only-testing:BitkitTests/UtxoSelectionTests \
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 21815005..d83a470c 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -68,6 +68,7 @@ jobs:
           set -o pipefail && xcodebuild test \
             -scheme Bitkit \
             -destination 'platform=iOS Simulator,name=iPhone 16,OS=latest' \
+            -skipPackagePluginValidation \
             -enableCodeCoverage NO \
             -parallel-testing-enabled NO \
             -skip-testing:BitkitTests/TxBumpingTests \
diff --git a/AGENTS.md b/AGENTS.md
index b3c1d563..348657cc 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -30,6 +30,7 @@ xcodebuild -workspace Bitkit.xcodeproj/project.xcworkspace \
   -scheme Bitkit \
   -configuration Debug \
   SWIFT_ACTIVE_COMPILATION_CONDITIONS='$(inherited) E2E_BUILD' \
+  -skipPackagePluginValidation \
   build
 
 # E2E test build with network Electrum and regtest (Info.plist build setting)
@@ -38,6 +39,7 @@ E2E_BACKEND=network E2E_NETWORK=regtest \
   -scheme Bitkit \
   -configuration Debug \
   SWIFT_ACTIVE_COMPILATION_CONDITIONS='$(inherited) E2E_BUILD' \
+  -skipPackagePluginValidation \
   build
 ```
 
@@ -53,7 +55,8 @@ DEVICE_ID="<device-identifier-from-list>"
 
 # Build for device
 xcodebuild -project Bitkit.xcodeproj -scheme Bitkit -configuration Debug \
-  -destination 'generic/platform=iOS' -derivedDataPath build build
+  -destination 'generic/platform=iOS' -derivedDataPath build \
+  -skipPackagePluginValidation build
 
 # Install app on device
 xcrun devicectl device install app --device $DEVICE_ID build/Build/Products/Debug-iphoneos/Bitkit.app
diff --git a/Bitkit.xcodeproj/project.pbxproj b/Bitkit.xcodeproj/project.pbxproj
index 492ab49e..e5cf2ef2 100644
--- a/Bitkit.xcodeproj/project.pbxproj
+++ b/Bitkit.xcodeproj/project.pbxproj
@@ -23,9 +23,12 @@
 		96DEA03A2DE8BBA1009932BF /* BitkitCore in Frameworks */ = {isa = PBXBuildFile; productRef = 96DEA0392DE8BBA1009932BF /* BitkitCore */; };
 		96DEA03C2DE8BBAB009932BF /* BitkitCore in Frameworks */ = {isa = PBXBuildFile; productRef = 96DEA03B2DE8BBAB009932BF /* BitkitCore */; };
 		96E20CD42CB6D91A00C24149 /* CodeScanner in Frameworks */ = {isa = PBXBuildFile; productRef = 96E20CD32CB6D91A00C24149 /* CodeScanner */; };
-		96E493A42C942FD1000E8BC2 /* secp256k1 in Frameworks */ = {isa = PBXBuildFile; productRef = 96E493A32C942FD1000E8BC2 /* secp256k1 */; };
-		96E493A62C94317D000E8BC2 /* secp256k1 in Frameworks */ = {isa = PBXBuildFile; productRef = 96E493A52C94317D000E8BC2 /* secp256k1 */; };
-		96E493A82C943184000E8BC2 /* secp256k1 in Frameworks */ = {isa = PBXBuildFile; productRef = 96E493A72C943184000E8BC2 /* secp256k1 */; };
+		96E493A42C942FD1000E8BC2 /* P256K in Frameworks */ = {isa = PBXBuildFile; productRef = 96E493A32C942FD1000E8BC2 /* P256K */; };
+		96E493A62C94317D000E8BC2 /* P256K in Frameworks */ = {isa = PBXBuildFile; productRef = 96E493A52C94317D000E8BC2 /* P256K */; };
+		96E493A82C943184000E8BC2 /* P256K in Frameworks */ = {isa = PBXBuildFile; productRef = 96E493A72C943184000E8BC2 /* P256K */; };
+		96E493B22C942FD1000E8BC2 /* libsecp256k1 in Frameworks */ = {isa = PBXBuildFile; productRef = 96E493B12C942FD1000E8BC2 /* libsecp256k1 */; };
+		96E493B42C94317D000E8BC2 /* libsecp256k1 in Frameworks */ = {isa = PBXBuildFile; productRef = 96E493B32C94317D000E8BC2 /* libsecp256k1 */; };
+		96E493B62C943184000E8BC2 /* libsecp256k1 in Frameworks */ = {isa = PBXBuildFile; productRef = 96E493B52C943184000E8BC2 /* libsecp256k1 */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
@@ -250,7 +253,8 @@
 				3D7626104C9C4A53B1E4A001 /* CoreBluetooth.framework in Frameworks */,
 				968FE1402DFB016B0053CD7F /* LDKNode in Frameworks */,
 				96DEA03C2DE8BBAB009932BF /* BitkitCore in Frameworks */,
-				96E493A82C943184000E8BC2 /* secp256k1 in Frameworks */,
+				96E493A82C943184000E8BC2 /* P256K in Frameworks */,
+				96E493B62C943184000E8BC2 /* libsecp256k1 in Frameworks */,
 				18D65E022EB964BD00252335 /* VssRustClientFfi in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
@@ -263,7 +267,8 @@
 				3D76260F4C9C4A53B1E4A001 /* CoreBluetooth.framework in Frameworks */,
 				968FDF162DFAFE230053CD7F /* LDKNode in Frameworks */,
 				18D65E002EB964B500252335 /* VssRustClientFfi in Frameworks */,
-				96E493A42C942FD1000E8BC2 /* secp256k1 in Frameworks */,
+				96E493A42C942FD1000E8BC2 /* P256K in Frameworks */,
+				96E493B22C942FD1000E8BC2 /* libsecp256k1 in Frameworks */,
 				96DEA03A2DE8BBA1009932BF /* BitkitCore in Frameworks */,
 				96E20CD42CB6D91A00C24149 /* CodeScanner in Frameworks */,
 				4AAB08CA2E1FE77600BA63DF /* Lottie in Frameworks */,
@@ -274,7 +279,8 @@
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				96E493A62C94317D000E8BC2 /* secp256k1 in Frameworks */,
+				96E493A62C94317D000E8BC2 /* P256K in Frameworks */,
+				96E493B42C94317D000E8BC2 /* libsecp256k1 in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -364,7 +370,8 @@
 			);
 			name = BitkitNotification;
 			packageProductDependencies = (
-				96E493A72C943184000E8BC2 /* secp256k1 */,
+				96E493A72C943184000E8BC2 /* P256K */,
+				96E493B52C943184000E8BC2 /* libsecp256k1 */,
 				96DEA03B2DE8BBAB009932BF /* BitkitCore */,
 				968FE13F2DFB016B0053CD7F /* LDKNode */,
 				18D65E012EB964BD00252335 /* VssRustClientFfi */,
@@ -395,7 +402,8 @@
 			name = Bitkit;
 			packageProductDependencies = (
 				9613018B2C5022D700878183 /* LDKNode */,
-				96E493A32C942FD1000E8BC2 /* secp256k1 */,
+				96E493A32C942FD1000E8BC2 /* P256K */,
+				96E493B12C942FD1000E8BC2 /* libsecp256k1 */,
 				96E20CD32CB6D91A00C24149 /* CodeScanner */,
 				96DEA0392DE8BBA1009932BF /* BitkitCore */,
 				4AAB08C92E1FE77600BA63DF /* Lottie */,
@@ -424,7 +432,8 @@
 			);
 			name = BitkitTests;
 			packageProductDependencies = (
-				96E493A52C94317D000E8BC2 /* secp256k1 */,
+				96E493A52C94317D000E8BC2 /* P256K */,
+				96E493B32C94317D000E8BC2 /* libsecp256k1 */,
 			);
 			productName = BitkitTests;
 			productReference = 96FE1F722C2DE6AC006D0C8B /* BitkitTests.xctest */;
@@ -1223,7 +1232,7 @@
 			repositoryURL = "https://github.com/21-DOT-DEV/swift-secp256k1";
 			requirement = {
 				kind = upToNextMajorVersion;
-				minimumVersion = 0.17.0;
+				minimumVersion = 0.23.2;
 			};
 		};
 /* End XCRemoteSwiftPackageReference section */
@@ -1274,20 +1283,35 @@
 			package = 96E20CD22CB6D91A00C24149 /* XCRemoteSwiftPackageReference "CodeScanner" */;
 			productName = CodeScanner;
 		};
-		96E493A32C942FD1000E8BC2 /* secp256k1 */ = {
+		96E493A32C942FD1000E8BC2 /* P256K */ = {
 			isa = XCSwiftPackageProductDependency;
 			package = 96E493A22C942FD1000E8BC2 /* XCRemoteSwiftPackageReference "swift-secp256k1" */;
-			productName = secp256k1;
+			productName = P256K;
 		};
-		96E493A52C94317D000E8BC2 /* secp256k1 */ = {
+		96E493A52C94317D000E8BC2 /* P256K */ = {
 			isa = XCSwiftPackageProductDependency;
 			package = 96E493A22C942FD1000E8BC2 /* XCRemoteSwiftPackageReference "swift-secp256k1" */;
-			productName = secp256k1;
+			productName = P256K;
 		};
-		96E493A72C943184000E8BC2 /* secp256k1 */ = {
+		96E493A72C943184000E8BC2 /* P256K */ = {
 			isa = XCSwiftPackageProductDependency;
 			package = 96E493A22C942FD1000E8BC2 /* XCRemoteSwiftPackageReference "swift-secp256k1" */;
-			productName = secp256k1;
+			productName = P256K;
+		};
+		96E493B12C942FD1000E8BC2 /* libsecp256k1 */ = {
+			isa = XCSwiftPackageProductDependency;
+			package = 96E493A22C942FD1000E8BC2 /* XCRemoteSwiftPackageReference "swift-secp256k1" */;
+			productName = libsecp256k1;
+		};
+		96E493B32C94317D000E8BC2 /* libsecp256k1 */ = {
+			isa = XCSwiftPackageProductDependency;
+			package = 96E493A22C942FD1000E8BC2 /* XCRemoteSwiftPackageReference "swift-secp256k1" */;
+			productName = libsecp256k1;
+		};
+		96E493B52C943184000E8BC2 /* libsecp256k1 */ = {
+			isa = XCSwiftPackageProductDependency;
+			package = 96E493A22C942FD1000E8BC2 /* XCRemoteSwiftPackageReference "swift-secp256k1" */;
+			productName = libsecp256k1;
 		};
 /* End XCSwiftPackageProductDependency section */
 	};
diff --git a/Bitkit/Services/WatchOnlyAccountService.swift b/Bitkit/Services/WatchOnlyAccountService.swift
index 65d10ea2..56dbfaf5 100644
--- a/Bitkit/Services/WatchOnlyAccountService.swift
+++ b/Bitkit/Services/WatchOnlyAccountService.swift
@@ -3,7 +3,7 @@ import Combine
 import CryptoKit
 import Foundation
 import LDKNode
-import secp256k1
+import libsecp256k1
 
 enum WatchOnlyAccountSetupState: String, Codable {
     case pendingDelivery
diff --git a/Bitkit/Utilities/Crypto.swift b/Bitkit/Utilities/Crypto.swift
index 952af5e4..367e2149 100644
--- a/Bitkit/Utilities/Crypto.swift
+++ b/Bitkit/Utilities/Crypto.swift
@@ -1,6 +1,7 @@
 import CryptoKit
 import Foundation
-import secp256k1
+import libsecp256k1
+import P256K
 
 class Crypto {
     struct KeyPair {
@@ -23,11 +24,11 @@ class Crypto {
     }
 
     static func generateSharedSecret(privateKey: Data, nodePubkey: String, derivationName: String? = nil) throws -> Data {
-        let privateKey = try secp256k1.KeyAgreement.PrivateKey(dataRepresentation: privateKey.bytes)
+        let privateKey = try P256K.KeyAgreement.PrivateKey(dataRepresentation: privateKey.bytes)
 
-        let publicKey = try secp256k1.KeyAgreement.PublicKey(dataRepresentation: nodePubkey.hexaBytes)
+        let publicKey = try P256K.KeyAgreement.PublicKey(dataRepresentation: nodePubkey.hexaBytes)
 
-        let baseSecret = try privateKey.sharedSecretFromKeyAgreement(with: publicKey, format: .compressed).bytes
+        let baseSecret = privateKey.sharedSecretFromKeyAgreement(with: publicKey, format: .compressed).bytes
 
         if let derivationName {
             let bytes = stringToBytes(derivationName)
diff --git a/BitkitTests/CryptoTests.swift b/BitkitTests/CryptoTests.swift
index ef9b8e6c..9cf98b6c 100644
--- a/BitkitTests/CryptoTests.swift
+++ b/BitkitTests/CryptoTests.swift
@@ -1,3 +1,5 @@
+import CryptoKit
+import P256K
 import XCTest
 
 final class CryptoTests: XCTestCase {
@@ -90,4 +92,56 @@ final class CryptoTests: XCTestCase {
 
         XCTAssertEqual(String(data: value, encoding: .utf8), decryptedPayload)
     }
+
+    func testGetPublicKeyKnownVectors() throws {
+        // Vectors derived independently of the secp256k1 dependency; the first is the curve
+        // generator point, so a wrong-curve or wrong-serialization regression cannot pass.
+        let vectors = [
+            (
+                "0000000000000000000000000000000000000000000000000000000000000001",
+                "0279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798"
+            ),
+            (
+                "cc74b1a4fdcd35916c766d3318c5a93b7e33a36ebeff0463128bf284975c2680",
+                "02f7c231fe139475b8193194b42043ae546768167e5cf836f5a4063f5d448a127f"
+            ),
+            (
+                "7d8f6a2b3c4e5f60718293a4b5c6d7e8f9012345678910abcdef0123456789ab",
+                "032ae34ba5d519c5882298c249b3a10983cde634fbd953aba1a1b2f5f66e8bd085"
+            ),
+        ]
+
+        for (privateKey, expectedPublicKey) in vectors {
+            let publicKey = try Crypto.getPublicKey(privateKey: privateKey.hexaData)
+            XCTAssertEqual(publicKey.count, 33)
+            XCTAssertEqual(publicKey.hex, expectedPublicKey)
+        }
+    }
+
+    func testSignProducesRecoverableSignature() throws {
+        let privateKey = "cc74b1a4fdcd35916c766d3318c5a93b7e33a36ebeff0463128bf284975c2680".hexaData
+        let message = "Bitkit regression vector"
+
+        let signature = try Crypto.sign(message: message, privateKey: privateKey)
+        let signatureBytes = signature.hexaData
+
+        // 1 recovery byte + 64 byte compact signature
+        XCTAssertEqual(signatureBytes.count, 65)
+
+        // ECDSA signing is deterministic (RFC 6979), so the same input must sign identically.
+        XCTAssertEqual(try Crypto.sign(message: message, privateKey: privateKey), signature)
+
+        let recoveryId = Int32(signatureBytes[0]) - 31
+        XCTAssertTrue((0 ... 3).contains(recoveryId), "unexpected recovery id \(recoveryId)")
+
+        let prefixedMessage = "Lightning Signed Message:" + message
+        let digest = SHA256.hash(data: Data(SHA256.hash(data: Data(prefixedMessage.utf8))))
+        let recoverable = try P256K.Recovery.ECDSASignature(
+            compactRepresentation: signatureBytes.dropFirst(),
+            recoveryId: recoveryId
+        )
+        let recovered = P256K.Recovery.PublicKey(digest, signature: recoverable)
+
+        XCTAssertEqual(recovered.dataRepresentation, try Crypto.getPublicKey(privateKey: privateKey))
+    }
 }
diff --git a/Docs/AI_DEVICE_TESTS.md b/Docs/AI_DEVICE_TESTS.md
index 4b6fa797..6b97e2b8 100644
--- a/Docs/AI_DEVICE_TESTS.md
+++ b/Docs/AI_DEVICE_TESTS.md
@@ -27,6 +27,7 @@ xcodebuild test \
   -configuration Debug \
   -destination 'platform=iOS Simulator,name=iPhone 17,OS=26.2' \
   -derivedDataPath DerivedData \
+  -skipPackagePluginValidation \
   SWIFT_ACTIVE_COMPILATION_CONDITIONS='DEBUG E2E_BUILD TEST_TREZOR_EMU' \
   -only-testing:BitkitUITests/TrezorBridgeDashboardUITests \
   -parallel-testing-enabled NO
diff --git a/Docs/RELEASE.md b/Docs/RELEASE.md
index af714873..e3663be4 100644
--- a/Docs/RELEASE.md
+++ b/Docs/RELEASE.md
@@ -153,7 +153,8 @@ xcodebuild archive \
   -project Bitkit.xcodeproj \
   -scheme Bitkit \
   -archivePath ./build/Bitkit.xcarchive \
-  -configuration Release
+  -configuration Release \
+  -skipPackagePluginValidation
 ```
 
 **Export and upload to TestFlight:**
diff --git a/README.md b/README.md
index a9bb499d..0f525f5f 100644
--- a/README.md
+++ b/README.md
@@ -25,6 +25,7 @@ xcodebuild -workspace Bitkit.xcodeproj/project.xcworkspace \
   -scheme Bitkit \
   -configuration Debug \
   SWIFT_ACTIVE_COMPILATION_CONDITIONS='$(inherited) E2E_BUILD' \
+  -skipPackagePluginValidation \
   build
 ```
 
@@ -37,6 +38,7 @@ E2E_BACKEND=network E2E_NETWORK=regtest \
   -scheme Bitkit \
   -configuration Debug \
   SWIFT_ACTIVE_COMPILATION_CONDITIONS='$(inherited) E2E_BUILD' \
+  -skipPackagePluginValidation \
   build
 
 # Use network Electrum with mainnet
@@ -45,6 +47,7 @@ E2E_BACKEND=network E2E_NETWORK=bitcoin \
   -scheme Bitkit \
   -configuration Debug \
   SWIFT_ACTIVE_COMPILATION_CONDITIONS='$(inherited) E2E_BUILD' \
+  -skipPackagePluginValidation \
   build
 ```
 
@@ -174,6 +177,14 @@ The first CLI resolve often dies with `fatalError` or `file not found at path: .
 
 An aborted resolve can leave an artifact half-extracted, with only a `__MACOSX` directory where the `.xcframework` should be. Re-running `-resolvePackageDependencies` reports success without repairing it, because SPM's workspace state still claims the artifact is present. Use `just clean spm` and re-resolve.
 
+### `Validate plug-in "SharedSourcesPlugin" in package "swift-secp256k1"`
+
+`swift-secp256k1` ships a build-tool plugin, and Xcode refuses to run an untrusted plugin from the command line. Building in Xcode shows a one-time "Trust & Enable" prompt instead; `xcodebuild` just fails. Every scripted build passes `-skipPackagePluginValidation`, and so should yours:
+
+```bash
+xcodebuild ... -skipPackagePluginValidation build
+```
+
 ### Why we don't disable explicit modules
 
 `SWIFT_ENABLE_EXPLICIT_MODULES` is deliberately left at Xcode's default (`YES`). Setting it to `NO` would make the stale-`.pcm` error above disappear, but it slows every clean build — including CI, which never caches DerivedData — and trades a loud error for silently stale modules. For a one-off local build you can still override it: