Commit 19c76c202c for openssl.org

commit 19c76c202c4d3bf76361d272364a5fb12d1766d8
Author: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Date:   Fri Aug 28 10:44:28 2026 +0200

    apps: test enc -kfile option

    Add a subtest covering -kfile: a passphrase read from a file with a
    trailing CRLF encrypts data that decrypts with the same passphrase
    given via -k, an empty passphrase file is rejected and so is a file
    containing only a newline.

    Assisted-by: Claude:claude-fable-5
    Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    Merge-date: Mon Sep  7 13:29:19 2026
    Merged-from: https://github.com/openssl/openssl/pull/32574

diff --git a/test/recipes/20-test_enc.t b/test/recipes/20-test_enc.t
index d8173f9761..0b1a2a815e 100644
--- a/test/recipes/20-test_enc.t
+++ b/test/recipes/20-test_enc.t
@@ -41,7 +41,7 @@ my @ciphers =
                      |rc2|rc4|seed)/x} @ciphers
     if disabled("legacy");

-plan tests => 10 + (scalar @ciphers)*2;
+plan tests => 11 + (scalar @ciphers)*2;

  SKIP: {
      skip "Problems getting ciphers...", 1 + scalar(@ciphers)
@@ -184,4 +184,37 @@ plan tests => 10 + (scalar @ciphers)*2;
             || compare_text($test, "iter_mismatch.clear") != 0,
             "decrypt does not recover the plaintext when -iter does not match");
      };
+
+     subtest "-kfile reads the passphrase from a file" => sub {
+         plan tests => 5;
+
+         # The trailing CRLF must be stripped from the passphrase.
+         open my $fh, ">", "kfile.pass" or die "Cannot write kfile.pass: $!";
+         print $fh "secret\r\n";
+         close $fh;
+
+         ok(run(app([$cmd, "enc", "-aes-128-cbc", "-e", "-kfile", "kfile.pass",
+                     "-in", $test, "-out", "kfile.cipher"])),
+            "encrypt with -kfile");
+         ok(run(app([$cmd, "enc", "-aes-128-cbc", "-d", "-k", "secret",
+                     "-in", "kfile.cipher", "-out", "kfile.clear"])),
+            "decrypt with the same passphrase given with -k");
+         ok(compare_text($test, "kfile.clear") == 0,
+            "decrypted output matches the original");
+
+         open $fh, ">", "kfile_empty.pass" or die "Cannot write file: $!";
+         close $fh;
+         ok(!run(app([$cmd, "enc", "-aes-128-cbc", "-e",
+                      "-kfile", "kfile_empty.pass",
+                      "-in", $test, "-out", "kfile_fail.cipher"])),
+            "an empty passphrase file is rejected");
+
+         open $fh, ">", "kfile_newline.pass" or die "Cannot write file: $!";
+         print $fh "\n";
+         close $fh;
+         ok(!run(app([$cmd, "enc", "-aes-128-cbc", "-e",
+                      "-kfile", "kfile_newline.pass",
+                      "-in", $test, "-out", "kfile_fail.cipher"])),
+            "a passphrase file with only a newline is rejected");
+     };
 }