readpassword: support spaces in "-passfile" filename

...and while we are at it, also filenames starting with "-".

Documentation/MANPAGE.md

@@ -149,7 +149,7 @@ Options:
 
 **-passfile string**
 :	Read password from the specified file. This is a shortcut for
-	specifying "-extpass /bin/cat FILE".
+	specifying '-extpass="/bin/cat -- FILE"'.
 
 **-passwd**
 :	Change the password. Will ask for the old password, check if it is

cli_args.go

@@ -151,9 +151,9 @@ func parseCliOpts() (args argContainer) {
 			os.Exit(ErrExitUsage)
 		}
 	}
-	// "-passfile FILE" is a shortcut for "-extpass=/bin/cat FILE"
+	// '-passfile FILE' is a shortcut for -extpass='/bin/cat -- FILE'
 	if args.passfile != "" {
-		args.extpass = "/bin/cat " + args.passfile
+		args.extpass = "/bin/cat -- " + args.passfile
 	}
 	if args.extpass != "" && args.masterkey != "" {
 		tlog.Fatal.Printf("The options -extpass and -masterkey cannot be used at the same time")

internal/readpassword/read.go

@@ -83,7 +83,16 @@ func readPasswordStdin() string {
 // Exits on read error or empty result.
 func readPasswordExtpass(extpass string) string {
 	tlog.Info.Println("Reading password from extpass program")
-	parts := strings.Split(extpass, " ")
+	var parts []string
+	// The option "-passfile=FILE" gets transformed to
+	// "-extpass="/bin/cat -- FILE". We don't want to split FILE on spaces,
+	// so let's handle it manually.
+	passfileCat := "/bin/cat -- "
+	if strings.HasPrefix(extpass, passfileCat) {
+		parts = []string{"/bin/cat", "--", extpass[len(passfileCat):]}
+	} else {
+		parts = strings.Split(extpass, " ")
+	}
 	cmd := exec.Command(parts[0], parts[1:]...)
 	cmd.Stderr = os.Stderr
 	pipe, err := cmd.StdoutPipe()