testsuite: add Pbkdf2FileMixin unit tests, refs #9556

[mr-raj12]

Description

Unit tests for Pbkdf2FileMixin, refs #9556.

Pbkdf2FileMixin (legacy/crypto/key.py) is the PBKDF2 + AES-256-CTR layer borg 1.x uses to protect key files on disk. It shipped in earlier phases with no unit tests. This PR adds src/borg/testsuite/crypto/legacy_key_test.py with 4 tests covering encrypt_key_file and decrypt_key_file.

src/borg/testsuite/crypto/legacy_key_test.py -- 4 tests for Pbkdf2FileMixin:

• encrypt/decrypt round-trip: encrypt_key_file -> decrypt_key_file recovers the original plaintext
• wrong passphrase returns None: PBKDF2 derives a different key, HMAC check fails, None returned (not raised)
• tampered HMAC returns None: correct passphrase and ciphertext but zeroed-out hash field fails hmac.compare_digest
• unsupported version raises UnsupportedKeyFormatError: version != 1 is not part of the borg 1.x format

BORG_TESTONLY_WEAKEN_KDF is set globally by conftest.py, so PBKDF2 runs at 1 iteration and tests are fast.

No production code changes.

Refs #9556

Checklist

• PR is against master (or maintenance branch if only applicable there)
• New code has tests (this PR is the tests)
• Tests pass (run tox or the relevant test subset)
• Commit messages are clean and reference related issues

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.95%. Comparing base (7f43779) to head (fb5ad53).
⚠️ Report is 5 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #9686      +/-   ##
==========================================
+ Coverage   83.87%   83.95%   +0.07%     
==========================================
  Files          93       93              
  Lines       15586    15586              
  Branches     2335     2335              
==========================================
+ Hits        13073    13085      +12     
+ Misses       1785     1775      -10     
+ Partials      728      726       -2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[ThomasWaldmann]

LGTM.

[ThomasWaldmann]

Do we already have similar tests for the argon2 kdf?

[mr-raj12]

Do we already have similar tests for the argon2 kdf?

test_key_file_roundtrip in crypto/key_test.py covers the Argon2 roundtrip. Wrong-passphrase for Argon2 is not tested yet. Should I add it here?

[ThomasWaldmann]

yes, please, would be good to have similar tests for both.