Commit 39952ff912 for openssl.org

commit 39952ff9120b47cf424a60d4c972a69778c1d7f7
Author: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Date:   Sat Aug 29 15:40:42 2026 +0200

    apps: cover the ec no_public option in the test recipe

    Write the testec-p256.pem private key in DER form with and without
    -no_public and check that the stripped encoding is smaller and matches
    a new checked-in reference file.  Also check that the public key is
    recomputed from the private scalar when loading such a key, by
    comparing -pubout output against the existing ec-conv-unc.der
    reference.

    Assisted-by: Claude:claude-fable-5
    Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    Merge-date: Mon Sep  7 14:16:44 2026
    Merged-from: https://github.com/openssl/openssl/pull/32596

diff --git a/test/recipes/15-test_ec.t b/test/recipes/15-test_ec.t
index d5d7f4902f..604362e2fb 100644
--- a/test/recipes/15-test_ec.t
+++ b/test/recipes/15-test_ec.t
@@ -19,7 +19,7 @@ setup("test_ec");

 plan skip_all => 'EC is not supported in this build' if disabled('ec');

-plan tests => 20;
+plan tests => 21;

 my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0);

@@ -152,6 +152,31 @@ subtest 'EC parameter encoding (-param_enc)' => sub {
        "an invalid parameter encoding is rejected");
 };

+subtest 'ec -no_public excludes the public key from the private key' => sub {
+    plan tests => 5;
+
+    my $key = srctop_file("test", "testec-p256.pem");
+
+    ok(run(app(['openssl', 'ec', '-in', $key,
+                '-outform', 'DER', '-out', 'ec-priv-default.der'])),
+       "writing private key with the public key included by default");
+    ok(run(app(['openssl', 'ec', '-in', $key, '-no_public',
+                '-outform', 'DER', '-out', 'ec-priv-nopub.der'])),
+       "writing private key with -no_public");
+    ok((-s 'ec-priv-nopub.der') < (-s 'ec-priv-default.der'),
+       "-no_public encoding is smaller than the default one");
+    # The encoding is deterministic for a fixed key, so compare it
+    # against the checked-in reference file.
+    is(compare('ec-priv-nopub.der', data_file('ec-priv-nopub.der')), 0,
+       "-no_public encoding matches the reference file");
+    # The public key is recomputed from the private scalar on load, so
+    # it must match the reference public key encoding.
+    ok(run(app(['openssl', 'ec', '-inform', 'DER', '-in', 'ec-priv-nopub.der',
+                '-pubout', '-outform', 'DER', '-out', 'ec-nopub-pub.der']))
+       && compare('ec-nopub-pub.der', data_file('ec-conv-unc.der')) == 0,
+       "the public key is recovered from a key written with -no_public");
+};
+
 subtest 'ec -text prints the key in text form' => sub {
     plan tests => 7;

diff --git a/test/recipes/15-test_ec_data/ec-priv-nopub.der b/test/recipes/15-test_ec_data/ec-priv-nopub.der
new file mode 100644
index 0000000000..52be88745c
Binary files /dev/null and b/test/recipes/15-test_ec_data/ec-priv-nopub.der differ