user105453: I've created a raw transaction, and I get this error when I try to send it with sendrawtransaction to my local bitcoin regtest:
{
    "error": {
        "code": -26,
        "message": "mandatory-script-verify-flag-failed (Signature must be zero for failed CHECK(MULTI)SIG operation)"
    },
    "id": "1",
    "result": null
}

This is the transaction from which I want to spend:
{
    "error": null,
    "id": "1",
    "result": {
        "hash": "95d4f6bbdda2ec79350c0559d5d9e9c279f73e5d37f8267834034a40c6d520c2",
        "hex": "0200000001c1c8886fe4e25ee471423e000532412b387fb0fea11a17a68cea09c122229e2c010000006a473044022029296a6ac3fdaf0a0c4616c783bee1b3b5f7ea24a63f3df3544e74aa4c1a65b102207baa71419ef0ceff6218e78b6fb93bfe6ac7445584e23d20be1fbf6454bab50f012102a4379f994ccce7041d30026092b13a7987c12cd6e33222dabdf890a00fc50b2effffffff01e0d96aee000000001976a91459fe1a9f9f0a5af33396c59990f064be1ca5127488ac00000000",
        "locktime": 0,
        "size": 191,
        "txid": "95d4f6bbdda2ec79350c0559d5d9e9c279f73e5d37f8267834034a40c6d520c2",
        "version": 2,
        "vin": [
            {
                "scriptSig": {
                    "asm": "3044022029296a6ac3fdaf0a0c4616c783bee1b3b5f7ea24a63f3df3544e74aa4c1a65b102207baa71419ef0ceff6218e78b6fb93bfe6ac7445584e23d20be1fbf6454bab50f[ALL] 02a4379f994ccce7041d30026092b13a7987c12cd6e33222dabdf890a00fc50b2e",
                    "hex": "473044022029296a6ac3fdaf0a0c4616c783bee1b3b5f7ea24a63f3df3544e74aa4c1a65b102207baa71419ef0ceff6218e78b6fb93bfe6ac7445584e23d20be1fbf6454bab50f012102a4379f994ccce7041d30026092b13a7987c12cd6e33222dabdf890a00fc50b2e"
                },
                "sequence": 4294967295,
                "txid": "2c9e2222c109ea8ca6171aa1feb07f382b413205003e4271e45ee2e46f88c8c1",
                "vout": 1
            }
        ],
        "vout": [
            {
                "n": 0,
                "scriptPubKey": {
                    "addresses": [
                        "moinqaiuWShfsemB9nGcAGFZNMa3ZwPMq6"
                    ],
                    "asm": "OP_DUP OP_HASH160 59fe1a9f9f0a5af33396c59990f064be1ca51274 OP_EQUALVERIFY OP_CHECKSIG",
                    "hex": "76a91459fe1a9f9f0a5af33396c59990f064be1ca5127488ac",
                    "reqSigs": 1,
                    "type": "pubkeyhash"
                },
                "value": 39.9998
            }
        ],
        "vsize": 191,
        "weight": 764
    }
}

I performed the following steps:

Create the raw transaction. This is the raw transaction:

0100000001c220d5c6404a03347826f8375d3ef779c2e9d9d559050c3579eca2ddbbf6d495000000001976a91459fe1a9f9f0a5af33396c59990f064be1ca5127488acffffffff020065cd1d000000001976a9141af72e49ec135151f1421c185b6cb1ce836576c388acc0269dd0000000001976a91459fe1a9f9f0a5af33396c59990f064be1ca5127488ac00000000

{
    "error": null,
    "id": "1",
    "result": {
        "hash": "16fa981ab0af1b0516467f80c71ced3e6b0d58e3fdd80137320029633dce1881",
        "locktime": 0,
        "size": 144,
        "txid": "16fa981ab0af1b0516467f80c71ced3e6b0d58e3fdd80137320029633dce1881",
        "version": 1,
        "vin": [
            {
                "scriptSig": {
                    "asm": "OP_DUP OP_HASH160 59fe1a9f9f0a5af33396c59990f064be1ca51274 OP_EQUALVERIFY OP_CHECKSIG",
                    "hex": "76a91459fe1a9f9f0a5af33396c59990f064be1ca5127488ac"
                },
                "sequence": 4294967295,
                "txid": "95d4f6bbdda2ec79350c0559d5d9e9c279f73e5d37f8267834034a40c6d520c2",
                "vout": 0
            }
        ],
        "vout": [
            {
                "n": 0,
                "scriptPubKey": {
                    "addresses": [
                        "mhyXyTy4fnu2jcmAGeChkgd9RmNgTg7xV5"
                    ],
                    "asm": "OP_DUP OP_HASH160 1af72e49ec135151f1421c185b6cb1ce836576c3 OP_EQUALVERIFY OP_CHECKSIG",
                    "hex": "76a9141af72e49ec135151f1421c185b6cb1ce836576c388ac",
                    "reqSigs": 1,
                    "type": "pubkeyhash"
                },
                "value": 5
            },
            {
                "n": 1,
                "scriptPubKey": {
                    "addresses": [
                        "moinqaiuWShfsemB9nGcAGFZNMa3ZwPMq6"
                    ],
                    "asm": "OP_DUP OP_HASH160 59fe1a9f9f0a5af33396c59990f064be1ca51274 OP_EQUALVERIFY OP_CHECKSIG",
                    "hex": "76a91459fe1a9f9f0a5af33396c59990f064be1ca5127488ac",
                    "reqSigs": 1,
                    "type": "pubkeyhash"
                },
                "value": 34.9996
            }
        ],
        "vsize": 144,
        "weight": 576
    }
}


Add 01000000 at the of the transaction. This is the hex of the transaction before signing:

0100000001c220d5c6404a03347826f8375d3ef779c2e9d9d559050c3579eca2ddbbf6d495000000001976a91459fe1a9f9f0a5af33396c59990f064be1ca5127488acffffffff020065cd1d000000001976a9141af72e49ec135151f1421c185b6cb1ce836576c388acc0269dd0000000001976a91459fe1a9f9f0a5af33396c59990f064be1ca5127488ac0000000001000000


Double SHA256 the raw transaction from step 2. This is the hash:

0b5a635ff615175cb114f051ea89e3f90e373dc059fc5ec8059ceeea4b42099f


Sign the transaction. To sign the transaction I have to use an endpoint of an HSM. I have to send the public key and the hex of the transaction and it returns the signature. The returned signature looks like this:

3044022052fe83beb097408e84d138bc4f723507f626b0f07019385df2103ebfc559a67a02206b5281554dfd80f1a29a0257d9cdfe07a7f7684d52c6ef875678ea3e3d289451

This is the public key:
3056301006072a8648ce3d020106052b8104000a034200049665be7c887cc801b1f6c5bb189434aa0a0635cd23d3b62832ffe3be70e9a3af64b03bb1217ee29ff2a0d5a88ff433c531cef6ba29f080e047f24f7e612bd93b

This is the signed transaction:
0100000001c220d5c6404a03347826f8375d3ef779c2e9d9d559050c3579eca2ddbbf6d495000000008a473044022052fe83beb097408e84d138bc4f723507f626b0f07019385df2103ebfc559a67a02206b5281554dfd80f1a29a0257d9cdfe07a7f7684d52c6ef875678ea3e3d2894510141049665be7c887cc801b1f6c5bb189434aa0a0635cd23d3b62832ffe3be70e9a3af64b03bb1217ee29ff2a0d5a88ff433c531cef6ba29f080e047f24f7e612bd93bffffffff020065cd1d000000001976a9141af72e49ec135151f1421c185b6cb1ce836576c388acc0269dd0000000001976a91459fe1a9f9f0a5af33396c59990f064be1ca5127488ac00000000

{
    "error": null,
    "id": "1",
    "result": {
        "hash": "5fcf741fba06e52692d731e69bf937e1e92d0439b3976f54dc733a90dd93a288",
        "locktime": 0,
        "size": 257,
        "txid": "5fcf741fba06e52692d731e69bf937e1e92d0439b3976f54dc733a90dd93a288",
        "version": 1,
        "vin": [
            {
                "scriptSig": {
                    "asm": "3044022052fe83beb097408e84d138bc4f723507f626b0f07019385df2103ebfc559a67a02206b5281554dfd80f1a29a0257d9cdfe07a7f7684d52c6ef875678ea3e3d289451[ALL] 049665be7c887cc801b1f6c5bb189434aa0a0635cd23d3b62832ffe3be70e9a3af64b03bb1217ee29ff2a0d5a88ff433c531cef6ba29f080e047f24f7e612bd93b",
                    "hex": "473044022052fe83beb097408e84d138bc4f723507f626b0f07019385df2103ebfc559a67a02206b5281554dfd80f1a29a0257d9cdfe07a7f7684d52c6ef875678ea3e3d2894510141049665be7c887cc801b1f6c5bb189434aa0a0635cd23d3b62832ffe3be70e9a3af64b03bb1217ee29ff2a0d5a88ff433c531cef6ba29f080e047f24f7e612bd93b"
                },
                "sequence": 4294967295,
                "txid": "95d4f6bbdda2ec79350c0559d5d9e9c279f73e5d37f8267834034a40c6d520c2",
                "vout": 0
            }
        ],
        "vout": [
            {
                "n": 0,
                "scriptPubKey": {
                    "addresses": [
                        "mhyXyTy4fnu2jcmAGeChkgd9RmNgTg7xV5"
                    ],
                    "asm": "OP_DUP OP_HASH160 1af72e49ec135151f1421c185b6cb1ce836576c3 OP_EQUALVERIFY OP_CHECKSIG",
                    "hex": "76a9141af72e49ec135151f1421c185b6cb1ce836576c388ac",
                    "reqSigs": 1,
                    "type": "pubkeyhash"
                },
                "value": 5
            },
            {
                "n": 1,
                "scriptPubKey": {
                    "addresses": [
                        "moinqaiuWShfsemB9nGcAGFZNMa3ZwPMq6"
                    ],
                    "asm": "OP_DUP OP_HASH160 59fe1a9f9f0a5af33396c59990f064be1ca51274 OP_EQUALVERIFY OP_CHECKSIG",
                    "hex": "76a91459fe1a9f9f0a5af33396c59990f064be1ca5127488ac",
                    "reqSigs": 1,
                    "type": "pubkeyhash"
                },
                "value": 34.9996
            }
        ],
        "vsize": 257,
        "weight": 1028
    }
}


Send the signed transaction with rpc sendrawtransaction:

{"id":"1","jsonrpc":"1.0","method":"sendrawtransaction","params":["0100000001c220d5c6404a03347826f8375d3ef779c2e9d9d559050c3579eca2ddbbf6d495000000008a473044022052fe83beb097408e84d138bc4f723507f626b0f07019385df2103ebfc559a67a02206b5281554dfd80f1a29a0257d9cdfe07a7f7684d52c6ef875678ea3e3d2894510141049665be7c887cc801b1f6c5bb189434aa0a0635cd23d3b62832ffe3be70e9a3af64b03bb1217ee29ff2a0d5a88ff433c531cef6ba29f080e047f24f7e612bd93bffffffff020065cd1d000000001976a9141af72e49ec135151f1421c185b6cb1ce836576c388acc0269dd0000000001976a91459fe1a9f9f0a5af33396c59990f064be1ca5127488ac00000000"]}

sendrawtransaction returns the following error:
{
    "error": {
        "code": -26,
        "message": "mandatory-script-verify-flag-failed (Signature must be zero for failed CHECK(MULTI)SIG operation)"
    },
    "id": "1",
    "result": null
}

What does this error mean? What am I doing wrong?

user48884: The problem is that you are serializing the transaction for signing incorrectly. The data that is signed is not just the raw transaction with the sighash appended to it. You need to slightly modify it too. Specifically, for the input currently being signed, you need to put the scriptCode into that input's scriptSig. The scriptSigs of all other inputs must be empty.
The scriptCode is the scriptPubKey of the output being spent by that input except for P2SH. If the output is a P2SH output, then you need to use the redeemScript.
So you should be signing:
0100000001c220d5c6404a03347826f8375d3ef779c2e9d9d559050c3579eca2ddbbf6d495000000001976a91459fe1a9f9f0a5af33396c59990f064be1ca5127488acffffffff020065cd1d000000001976a9141af72e49ec135151f1421c185b6cb1ce836576c388ace0749dd0000000001976a91459fe1a9f9f0a5af33396c59990f064be1ca5127488ac00000000

Furthermore, Bitcoin uses double sha256. If your HSM hashes the message with SHA256, then you need to give it the first hash. So you have to hash the above once with SHA256 then give that hash to the HSM. If it just takes the hash, then you need to hash it with SHA256 twice.

105453: <p>I've created a raw transaction, and I get this error when I try to send it with sendrawtransaction to my local bitcoin regtest:</p>

<pre><code>{
    "error": {
        "code": -26,
        "message": "mandatory-script-verify-flag-failed (Signature must be zero for failed CHECK(MULTI)SIG operation)"
    },
    "id": "1",
    "result": null
}
</code></pre>

<p>This is the transaction from which I want to spend:</p>

<pre><code>{
    "error": null,
    "id": "1",
    "result": {
        "hash": "95d4f6bbdda2ec79350c0559d5d9e9c279f73e5d37f8267834034a40c6d520c2",
        "hex": "0200000001c1c8886fe4e25ee471423e000532412b387fb0fea11a17a68cea09c122229e2c010000006a473044022029296a6ac3fdaf0a0c4616c783bee1b3b5f7ea24a63f3df3544e74aa4c1a65b102207baa71419ef0ceff6218e78b6fb93bfe6ac7445584e23d20be1fbf6454bab50f012102a4379f994ccce7041d30026092b13a7987c12cd6e33222dabdf890a00fc50b2effffffff01e0d96aee000000001976a91459fe1a9f9f0a5af33396c59990f064be1ca5127488ac00000000",
        "locktime": 0,
        "size": 191,
        "txid": "95d4f6bbdda2ec79350c0559d5d9e9c279f73e5d37f8267834034a40c6d520c2",
        "version": 2,
        "vin": [
            {
                "scriptSig": {
                    "asm": "3044022029296a6ac3fdaf0a0c4616c783bee1b3b5f7ea24a63f3df3544e74aa4c1a65b102207baa71419ef0ceff6218e78b6fb93bfe6ac7445584e23d20be1fbf6454bab50f[ALL] 02a4379f994ccce7041d30026092b13a7987c12cd6e33222dabdf890a00fc50b2e",
                    "hex": "473044022029296a6ac3fdaf0a0c4616c783bee1b3b5f7ea24a63f3df3544e74aa4c1a65b102207baa71419ef0ceff6218e78b6fb93bfe6ac7445584e23d20be1fbf6454bab50f012102a4379f994ccce7041d30026092b13a7987c12cd6e33222dabdf890a00fc50b2e"
                },
                "sequence": 4294967295,
                "txid": "2c9e2222c109ea8ca6171aa1feb07f382b413205003e4271e45ee2e46f88c8c1",
                "vout": 1
            }
        ],
        "vout": [
            {
                "n": 0,
                "scriptPubKey": {
                    "addresses": [
                        "moinqaiuWShfsemB9nGcAGFZNMa3ZwPMq6"
                    ],
                    "asm": "OP_DUP OP_HASH160 59fe1a9f9f0a5af33396c59990f064be1ca51274 OP_EQUALVERIFY OP_CHECKSIG",
                    "hex": "76a91459fe1a9f9f0a5af33396c59990f064be1ca5127488ac",
                    "reqSigs": 1,
                    "type": "pubkeyhash"
                },
                "value": 39.9998
            }
        ],
        "vsize": 191,
        "weight": 764
    }
}
</code></pre>

<p>I performed the following steps:</p>

<ol>
<li>Create the raw transaction. This is the raw transaction:</li>
</ol>

<pre><code>0100000001c220d5c6404a03347826f8375d3ef779c2e9d9d559050c3579eca2ddbbf6d495000000001976a91459fe1a9f9f0a5af33396c59990f064be1ca5127488acffffffff020065cd1d000000001976a9141af72e49ec135151f1421c185b6cb1ce836576c388acc0269dd0000000001976a91459fe1a9f9f0a5af33396c59990f064be1ca5127488ac00000000
</code></pre>

<pre><code>{
    "error": null,
    "id": "1",
    "result": {
        "hash": "16fa981ab0af1b0516467f80c71ced3e6b0d58e3fdd80137320029633dce1881",
        "locktime": 0,
        "size": 144,
        "txid": "16fa981ab0af1b0516467f80c71ced3e6b0d58e3fdd80137320029633dce1881",
        "version": 1,
        "vin": [
            {
                "scriptSig": {
                    "asm": "OP_DUP OP_HASH160 59fe1a9f9f0a5af33396c59990f064be1ca51274 OP_EQUALVERIFY OP_CHECKSIG",
                    "hex": "76a91459fe1a9f9f0a5af33396c59990f064be1ca5127488ac"
                },
                "sequence": 4294967295,
                "txid": "95d4f6bbdda2ec79350c0559d5d9e9c279f73e5d37f8267834034a40c6d520c2",
                "vout": 0
            }
        ],
        "vout": [
            {
                "n": 0,
                "scriptPubKey": {
                    "addresses": [
                        "mhyXyTy4fnu2jcmAGeChkgd9RmNgTg7xV5"
                    ],
                    "asm": "OP_DUP OP_HASH160 1af72e49ec135151f1421c185b6cb1ce836576c3 OP_EQUALVERIFY OP_CHECKSIG",
                    "hex": "76a9141af72e49ec135151f1421c185b6cb1ce836576c388ac",
                    "reqSigs": 1,
                    "type": "pubkeyhash"
                },
                "value": 5
            },
            {
                "n": 1,
                "scriptPubKey": {
                    "addresses": [
                        "moinqaiuWShfsemB9nGcAGFZNMa3ZwPMq6"
                    ],
                    "asm": "OP_DUP OP_HASH160 59fe1a9f9f0a5af33396c59990f064be1ca51274 OP_EQUALVERIFY OP_CHECKSIG",
                    "hex": "76a91459fe1a9f9f0a5af33396c59990f064be1ca5127488ac",
                    "reqSigs": 1,
                    "type": "pubkeyhash"
                },
                "value": 34.9996
            }
        ],
        "vsize": 144,
        "weight": 576
    }
}
</code></pre>

<ol start="2">
<li>Add 01000000 at the of the transaction. This is the hex of the transaction before signing:</li>
</ol>

<pre><code>0100000001c220d5c6404a03347826f8375d3ef779c2e9d9d559050c3579eca2ddbbf6d495000000001976a91459fe1a9f9f0a5af33396c59990f064be1ca5127488acffffffff020065cd1d000000001976a9141af72e49ec135151f1421c185b6cb1ce836576c388acc0269dd0000000001976a91459fe1a9f9f0a5af33396c59990f064be1ca5127488ac0000000001000000
</code></pre>

<ol start="3">
<li>Double SHA256 the raw transaction from step 2. This is the hash:</li>
</ol>

<pre><code>0b5a635ff615175cb114f051ea89e3f90e373dc059fc5ec8059ceeea4b42099f
</code></pre>

<ol start="4">
<li>Sign the transaction. To sign the transaction I have to use an endpoint of an HSM. I have to send the public key and the hex of the transaction and it returns the signature. The returned signature looks like this:</li>
</ol>

<pre><code>3044022052fe83beb097408e84d138bc4f723507f626b0f07019385df2103ebfc559a67a02206b5281554dfd80f1a29a0257d9cdfe07a7f7684d52c6ef875678ea3e3d289451
</code></pre>

<p>This is the public key:</p>

<pre><code>3056301006072a8648ce3d020106052b8104000a034200049665be7c887cc801b1f6c5bb189434aa0a0635cd23d3b62832ffe3be70e9a3af64b03bb1217ee29ff2a0d5a88ff433c531cef6ba29f080e047f24f7e612bd93b
</code></pre>

<p>This is the signed transaction:</p>

<pre><code>0100000001c220d5c6404a03347826f8375d3ef779c2e9d9d559050c3579eca2ddbbf6d495000000008a473044022052fe83beb097408e84d138bc4f723507f626b0f07019385df2103ebfc559a67a02206b5281554dfd80f1a29a0257d9cdfe07a7f7684d52c6ef875678ea3e3d2894510141049665be7c887cc801b1f6c5bb189434aa0a0635cd23d3b62832ffe3be70e9a3af64b03bb1217ee29ff2a0d5a88ff433c531cef6ba29f080e047f24f7e612bd93bffffffff020065cd1d000000001976a9141af72e49ec135151f1421c185b6cb1ce836576c388acc0269dd0000000001976a91459fe1a9f9f0a5af33396c59990f064be1ca5127488ac00000000
</code></pre>

<pre><code>{
    "error": null,
    "id": "1",
    "result": {
        "hash": "5fcf741fba06e52692d731e69bf937e1e92d0439b3976f54dc733a90dd93a288",
        "locktime": 0,
        "size": 257,
        "txid": "5fcf741fba06e52692d731e69bf937e1e92d0439b3976f54dc733a90dd93a288",
        "version": 1,
        "vin": [
            {
                "scriptSig": {
                    "asm": "3044022052fe83beb097408e84d138bc4f723507f626b0f07019385df2103ebfc559a67a02206b5281554dfd80f1a29a0257d9cdfe07a7f7684d52c6ef875678ea3e3d289451[ALL] 049665be7c887cc801b1f6c5bb189434aa0a0635cd23d3b62832ffe3be70e9a3af64b03bb1217ee29ff2a0d5a88ff433c531cef6ba29f080e047f24f7e612bd93b",
                    "hex": "473044022052fe83beb097408e84d138bc4f723507f626b0f07019385df2103ebfc559a67a02206b5281554dfd80f1a29a0257d9cdfe07a7f7684d52c6ef875678ea3e3d2894510141049665be7c887cc801b1f6c5bb189434aa0a0635cd23d3b62832ffe3be70e9a3af64b03bb1217ee29ff2a0d5a88ff433c531cef6ba29f080e047f24f7e612bd93b"
                },
                "sequence": 4294967295,
                "txid": "95d4f6bbdda2ec79350c0559d5d9e9c279f73e5d37f8267834034a40c6d520c2",
                "vout": 0
            }
        ],
        "vout": [
            {
                "n": 0,
                "scriptPubKey": {
                    "addresses": [
                        "mhyXyTy4fnu2jcmAGeChkgd9RmNgTg7xV5"
                    ],
                    "asm": "OP_DUP OP_HASH160 1af72e49ec135151f1421c185b6cb1ce836576c3 OP_EQUALVERIFY OP_CHECKSIG",
                    "hex": "76a9141af72e49ec135151f1421c185b6cb1ce836576c388ac",
                    "reqSigs": 1,
                    "type": "pubkeyhash"
                },
                "value": 5
            },
            {
                "n": 1,
                "scriptPubKey": {
                    "addresses": [
                        "moinqaiuWShfsemB9nGcAGFZNMa3ZwPMq6"
                    ],
                    "asm": "OP_DUP OP_HASH160 59fe1a9f9f0a5af33396c59990f064be1ca51274 OP_EQUALVERIFY OP_CHECKSIG",
                    "hex": "76a91459fe1a9f9f0a5af33396c59990f064be1ca5127488ac",
                    "reqSigs": 1,
                    "type": "pubkeyhash"
                },
                "value": 34.9996
            }
        ],
        "vsize": 257,
        "weight": 1028
    }
}
</code></pre>

<ol start="5">
<li>Send the signed transaction with rpc <code>sendrawtransaction</code>:</li>
</ol>

<pre><code>{"id":"1","jsonrpc":"1.0","method":"sendrawtransaction","params":["0100000001c220d5c6404a03347826f8375d3ef779c2e9d9d559050c3579eca2ddbbf6d495000000008a473044022052fe83beb097408e84d138bc4f723507f626b0f07019385df2103ebfc559a67a02206b5281554dfd80f1a29a0257d9cdfe07a7f7684d52c6ef875678ea3e3d2894510141049665be7c887cc801b1f6c5bb189434aa0a0635cd23d3b62832ffe3be70e9a3af64b03bb1217ee29ff2a0d5a88ff433c531cef6ba29f080e047f24f7e612bd93bffffffff020065cd1d000000001976a9141af72e49ec135151f1421c185b6cb1ce836576c388acc0269dd0000000001976a91459fe1a9f9f0a5af33396c59990f064be1ca5127488ac00000000"]}
</code></pre>

<p><code>sendrawtransaction</code> returns the following error:</p>

<pre><code>{
    "error": {
        "code": -26,
        "message": "mandatory-script-verify-flag-failed (Signature must be zero for failed CHECK(MULTI)SIG operation)"
    },
    "id": "1",
    "result": null
}
</code></pre>

<p>What does this error mean? What am I doing wrong?</p>
 48884: <p>The problem is that you are serializing the transaction for signing incorrectly. The data that is signed is not just the raw transaction with the sighash appended to it. You need to slightly modify it too. Specifically, for the input currently being signed, you need to put the <code>scriptCode</code> into that input's <code>scriptSig</code>. The <code>scriptSig</code>s of all other inputs must be empty.</p>

<p>The <code>scriptCode</code> is the <code>scriptPubKey</code> of the output being spent by that input except for P2SH. If the output is a P2SH output, then you need to use the <code>redeemScript</code>.</p>

<p>So you should be signing:</p>

<pre><code>0100000001c220d5c6404a03347826f8375d3ef779c2e9d9d559050c3579eca2ddbbf6d495000000001976a91459fe1a9f9f0a5af33396c59990f064be1ca5127488acffffffff020065cd1d000000001976a9141af72e49ec135151f1421c185b6cb1ce836576c388ace0749dd0000000001976a91459fe1a9f9f0a5af33396c59990f064be1ca5127488ac00000000
</code></pre>

<p>Furthermore, Bitcoin uses double sha256. If your HSM hashes the message with SHA256, then you need to give it the first hash. So you have to hash the above once with SHA256 then give that hash to the HSM. If it just takes the hash, then you need to hash it with SHA256 twice.</p>
