Commit 4f15f84b77 for openssl.org

commit 4f15f84b7716b49002f85556efe5a5937801dd47
Author: Richard Levitte <levitte@openssl.foundation>
Date:   Wed Aug 19 08:44:35 2026 +0200

    test: fix TAP stream corruption in three test recipes

    'local $/ = undef' leaks into OpenSSL::Test::run(), which then
    emits a bare "# " that glues onto the following 'ok' line.
    Scope the slurping properly.

    'pkeyutl -verifyrecover' outputs binary on stdout; redirect it.

    Fixes: https://github.com/openssl/openssl/issues/32428
    Assisted-by: Pi:moonshotai/kimi-k3
    Signed-off-by: Richard Levitte <levitte@openssl.foundation>
    Reviewed-by: Mounir Idrassi <mounir.idrassi@idrix.fr>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Merge-date: Thu Aug 27 14:20:32 2026
    Merged-from: https://github.com/openssl/openssl/pull/32429

diff --git a/test/recipes/15-test_ml_dsa_codecs.t b/test/recipes/15-test_ml_dsa_codecs.t
index 16fc5c3021..908f3a414d 100644
--- a/test/recipes/15-test_ml_dsa_codecs.t
+++ b/test/recipes/15-test_ml_dsa_codecs.t
@@ -194,10 +194,9 @@ foreach my $alg (@algs) {
         sprintf("create fake private key: %s", $alg));
     my $realfh = IO::File->new($real, "<:raw");
     my $fakefh = IO::File->new($fake, "<:raw");
-    local $/ = undef;
-    my $realder = <$realfh>;
+    my $realder = do { local $/; <$realfh> };
     $realfh->close();
-    my $fakeder = <$fakefh>;
+    my $fakeder = do { local $/; <$fakefh> };
     $fakefh->close();
     #
     # - 20 bytes PKCS8 fixed overhead,
diff --git a/test/recipes/15-test_ml_kem_codecs.t b/test/recipes/15-test_ml_kem_codecs.t
index 25d92571c5..1c2cc5fecf 100644
--- a/test/recipes/15-test_ml_kem_codecs.t
+++ b/test/recipes/15-test_ml_kem_codecs.t
@@ -179,9 +179,8 @@ foreach my $alg (@algs) {
         sprintf("create fake private key: %s", $alg));
     my $realfh = IO::File->new($real, "<:raw");
     my $fakefh = IO::File->new($fake, "<:raw");
-    local $/ = undef;
-    my $realder = <$realfh>;
-    my $fakeder = <$fakefh>;
+    my $realder = do { local $/; <$realfh> };
+    my $fakeder = do { local $/; <$fakefh> };
     $realfh->close();
     $fakefh->close();
     #
diff --git a/test/recipes/20-test_pkeyutl.t b/test/recipes/20-test_pkeyutl.t
index 79e2629743..037f825ca4 100644
--- a/test/recipes/20-test_pkeyutl.t
+++ b/test/recipes/20-test_pkeyutl.t
@@ -175,8 +175,12 @@ SKIP: {
                     "-rawin", "-digest", "sha256");
     };

+    # -verifyrecover outputs the recovered payload (binary, without a
+    # trailing newline), which would otherwise be echoed into the TAP
+    # stream by run() and corrupt it, so redirect it to a file.
     ok(run(app((['openssl', 'pkeyutl', '-verifyrecover', '-in', $sigfile,
-                 '-pubin', '-inkey', srctop_file('test', 'testrsapub.pem')]))),
+                 '-pubin', '-inkey', srctop_file('test', 'testrsapub.pem')],
+                stdout => 'rsa_verifyrecover.out'))),
        "RSA: Verify signature with -verifyrecover");

     subtest "RSA CLI signature and verification with pkeyopt" => sub {