Check the -o path before looking for the mnemonic (closes #87)

age encrypt and age decrypt looked at the -o path only after the
mnemonic had been obtained, so a path that could never be written
still prompted for the mnemonic or ran the mnemonic command. Both now
refuse, before the key is derived, an -o path that is a directory or a
symlink to one, whose directory is missing or is not a directory, or
that is a symlink pointing at nothing. The check creates nothing;
output still looks at the path when it writes, so the file beside the
target is made when it was before. The README names the -o path among
what is checked first.

Model: opus-5-5

README.md

@@ -285,9 +285,7 @@ or a device, such as `/dev/null`, is written to directly.
 
 Decrypts the file (or standard input) with the derived identity. Output goes to
 `-o`, which is treated as for `encrypt`, or standard output. If the identity is
-not one of the recipients, the tool says so and exits with status 1. The text
-form needs no flag, and up to 1024 bytes of blank lines in front of it are
-skipped, as `age` skips them.
+not one of the recipients, the tool says so and exits with status 1.
 
 ## Derived mnemonics: `keyfunc mnemonic`
 

internal/agekey/agekey.go

@@ -4,7 +4,6 @@ package agekey
 
 import (
 	"bufio"
-	"bytes"
 	"errors"
 	"fmt"
 	"io"
@@ -188,18 +187,12 @@ func (k *Key) Decrypt(dst io.Writer, src io.Reader) error {
 }
 
 // unarmored strips the text form when the input begins with the line
-// that starts one, and leaves binary input alone. Like age, it looks
-// past up to 1024 bytes of whitespace for that line, and the text form
-// reader skips blank lines in front of it.
+// that starts one, and leaves binary input alone.
 func unarmored(src io.Reader) io.Reader {
-	const maxWhitespace = 1024
-
 	buffered := bufio.NewReader(src)
 
-	// A shorter input gives an error along with all of it, which is
-	// enough to look at.
-	start, _ := buffered.Peek(maxWhitespace + len(armor.Header))
-	if bytes.HasPrefix(bytes.TrimSpace(start), []byte(armor.Header)) {
+	start, err := buffered.Peek(len(armor.Header))
+	if err == nil && string(start) == armor.Header {
 		return armor.NewReader(buffered)
 	}
 

internal/agekey/agekey_test.go

@@ -2,7 +2,6 @@ package agekey_test
 
 import (
 	"bytes"
-	"io"
 	"strings"
 	"testing"
 
@@ -100,27 +99,6 @@ func TestTheArmoredFormIsText(t *testing.T) {
 	))
 }
 
-func TestTheTextFormIsReadWithWhitespaceInFront(t *testing.T) {
-	t.Parallel()
-
-	key := forIndex(t, 0)
-
-	var sealed bytes.Buffer
-
-	err := key.Encrypt(&sealed, strings.NewReader("hello"), nil, true)
-	require.NoError(t, err)
-
-	// A blank line and a line of two spaces, as pasting can leave. age
-	// refuses spaces on the first line of the text form itself, and so
-	// does this.
-	pasted := io.MultiReader(strings.NewReader("\n  \n"), &sealed)
-
-	var opened bytes.Buffer
-
-	require.NoError(t, key.Decrypt(&opened, pasted))
-	require.Equal(t, "hello", opened.String())
-}
-
 func TestAFileForSomebodyElseIsRefused(t *testing.T) {
 	t.Parallel()