multi signature – Signing a Bech32 Multisig with Bitcoin Core

I’ve created a multisig address with Bitcoin Core:

$ bitcoin-cli -named createmultisig nrequired=2 keys=""'["'$pubkey1'","'$pubkey2'"]''' address_type=bech32
{
  "address": "tb1q8cg6qwhhv58zp005w6qnpfx8g6606awkjmf5yzlkulg0sc9phx8sqkltdd",
  "redeemScript": "5221039395fa19d6512f03043210cd3e9a03a850f7a8d986c8f35d30f2efc281a8d3312103c57ed70775d7a616778514e738fef0946b4be4ee32440b19f65ddd6e345983c052ae",
  "descriptor": "wsh(multi(2,039395fa19d6512f03043210cd3e9a03a850f7a8d986c8f35d30f2efc281a8d331,03c57ed70775d7a616778514e738fef0946b4be4ee32440b19f65ddd6e345983c0))#k626xmlq"
}

I then created a watch-only address to make it easy to access transactions sent to the address:

$ bitcoin-cli -rpcwallet="watchmulti" listunspent
[
  {
    "txid": "eb41b6d829e83d32ae8e3bd80ece0330db959a90a2c2a3d7f9bf7a177836133e",
    "vout": 1,
    "address": "tb1q8cg6qwhhv58zp005w6qnpfx8g6606awkjmf5yzlkulg0sc9phx8sqkltdd",
    "label": "",
    "witnessScript": "5221039395fa19d6512f03043210cd3e9a03a850f7a8d986c8f35d30f2efc281a8d3312103c57ed70775d7a616778514e738fef0946b4be4ee32440b19f65ddd6e345983c052ae",
    "scriptPubKey": "00203e11a03af7650e20bdf4768130a4c746b4fd75d696d3420bf6e7d0f860a1b98f",
    "amount": 0.00200000,
    "confirmations": 23,
    "spendable": true,
    "solvable": true,
    "desc": "wsh(multi(2,[38101947]039395fa19d6512f03043210cd3e9a03a850f7a8d986c8f35d30f2efc281a8d331,[0394feb3]03c57ed70775d7a616778514e738fef0946b4be4ee32440b19f65ddd6e345983c0))#n5s3dxtx",
    "parent_descs": [
      "wsh(multi(2,039395fa19d6512f03043210cd3e9a03a850f7a8d986c8f35d30f2efc281a8d331,03c57ed70775d7a616778514e738fef0946b4be4ee32440b19f65ddd6e345983c0))#k626xmlq"
    ],
    "safe": true
  }
]

I then created a transaction to spend some of the money:

utxo_txid=$(bitcoin-cli -rpcwallet="watchmulti" listunspent | jq -r '.[0] | .txid') 
utxo_vout=$(bitcoin-cli -rpcwallet="watchmulti" listunspent | jq -r '.[0] | .vout')
utxo_pubkey=$(bitcoin-cli -rpcwallet="watchmulti" listunspent | jq -r '.[0] | .scriptPubKey')

redeem_script="5221039395fa19d6512f03043210cd3e9a03a850f7a8d986c8f35d30f2efc281a8d3312103c57ed70775d7a616778514e738fef0946b4be4ee32440b19f65ddd6e345983c052ae"

$ rawtxhex=$(bitcoin-cli -named createrawtransaction inputs=""'[ { "txid": "'$utxo_txid'", "vout": '$utxo_vout' } ]''' outputs=""'{ "'$recipient'": 0.01, "'$change'": 0.0099  }''')

$ bitcoin-cli decoderawtransaction $rawtxhex
{
  "txid": "2f07d92f7e13c13ced08ebaf63881fb804d05e5413d0013dbb559dc0805ee8f0",
  "hash": "2f07d92f7e13c13ced08ebaf63881fb804d05e5413d0013dbb559dc0805ee8f0",
  "version": 2,
  "size": 125,
  "vsize": 125,
  "weight": 500,
  "locktime": 0,
  "vin": [
    {
      "txid": "eb41b6d829e83d32ae8e3bd80ece0330db959a90a2c2a3d7f9bf7a177836133e",
      "vout": 1,
      "scriptSig": {
        "asm": "",
        "hex": ""
      },
      "sequence": 4294967293
    }
  ],
  "vout": [
    {
      "value": 0.01000000,
      "n": 0,
      "scriptPubKey": {
        "asm": "0 933439cf21eeff085ad1cc9ceb506810fd823779",
        "desc": "addr(tb1qjv6rnnepamlsskk3ejwwk5rgzr7cydmeyaktds)#md8rtul5",
        "hex": "0014933439cf21eeff085ad1cc9ceb506810fd823779",
        "address": "tb1qjv6rnnepamlsskk3ejwwk5rgzr7cydmeyaktds",
        "type": "witness_v0_keyhash"
      }
    },
    {
      "value": 0.00990000,
      "n": 1,
      "scriptPubKey": {
        "asm": "0 3e11a03af7650e20bdf4768130a4c746b4fd75d696d3420bf6e7d0f860a1b98f",
        "desc": "addr(tb1q8cg6qwhhv58zp005w6qnpfx8g6606awkjmf5yzlkulg0sc9phx8sqkltdd)#vjkdfwda",
        "hex": "00203e11a03af7650e20bdf4768130a4c746b4fd75d696d3420bf6e7d0f860a1b98f",
        "address": "tb1q8cg6qwhhv58zp005w6qnpfx8g6606awkjmf5yzlkulg0sc9phx8sqkltdd",
        "type": "witness_v0_scripthash"
      }
    }
  ]
}

But when I try to sign with a wallet holding one of the private keys, I get “Witness program was passed an empty witness”

$ bitcoin-cli -rpcwallet="" -named signrawtransactionwithwallet hexstring=$rawtxhex prevtxs=""'[ { "txid": "'$utxo_txid'", "vout": '$utxo_vout', "scriptPubKey": "'$utxo_pubkey'", "redeemScript": "5221039395fa19d6512f03043210cd3e9a03a850f7a8d986c8f35d30f2efc281a8d3312103c57ed70775d7a616778514e738fef0946b4be4ee32440b19f65ddd6e345983c052ae", "amount": 0.02 } ]'''
{
  "hex": "02000000013e133678177abff9d7a3c2a2909a95db3003ce0ed83b8eae323de829d8b641eb0100000000fdffffff0240420f0000000000160014933439cf21eeff085ad1cc9ceb506810fd823779301b0f00000000002200203e11a03af7650e20bdf4768130a4c746b4fd75d696d3420bf6e7d0f860a1b98f00000000",
  "complete": false,
  "errors": [
    {
      "txid": "eb41b6d829e83d32ae8e3bd80ece0330db959a90a2c2a3d7f9bf7a177836133e",
      "vout": 1,
      "witness": [
      ],
      "scriptSig": "",
      "sequence": 4294967293,
      "error": "Witness program was passed an empty witness"
    }
  ]
}

Any ideas what I’m missing here.

(Obviously, PSBTs are the most up to date way to do this, but I want to demonstrate one of the classic bitcoin-cli methods before going there, and since I can’t dump private keys any more, this seems like the only option.)