ukify: reject trailing garbage in output section specifications

The output section parser matches a valid prefix and ignores any remaining
characters. For example, '.cmdline:textjunk' is treated as text output,
and '.cmdline:text@' is accepted despite the missing output filename.

Require the complete specification to match the existing grammar, and
test malformed suffixes along with valid text and binary output.

(cherry picked from commit fbb4b64bdb326fac5c19122f88bd9d1feb0350e5)

src/ukify/test/test_ukify.py

@@ -345,6 +345,26 @@ def test_parse_sections():
     assert opts.sections[1].measure is False
 
 
+def test_parse_output_sections():
+    sec = ukify.Section.parse_output('.cmdline:text')
+    assert sec.name == '.cmdline'
+    assert sec.output_mode == 'text'
+    assert sec.content is None
+
+    sec = ukify.Section.parse_output('.linux:binary@out dir/a:b')
+    assert sec.name == '.linux'
+    assert sec.output_mode == 'binary'
+    assert sec.content == pathlib.Path('out dir/a:b')
+
+
+@pytest.mark.parametrize(
+    'spec', ['.cmdline:textjunk', '.linux:binarybad', '.cmdline:text@', '.cmdline:text\n']
+)
+def test_parse_output_invalid(spec):
+    with pytest.raises(ValueError, match='Cannot parse section spec'):
+        ukify.Section.parse_output(spec)
+
+
 def test_config_priority(tmp_path):
     config = tmp_path / 'config1.conf'
     # config: use pesign and give certdir + certname

src/ukify/ukify.py

@@ -472,7 +472,7 @@ class Section:
 
     @classmethod
     def parse_output(cls, s: str) -> 'Section':
-        if not (m := re.match(r'([a-zA-Z0-9_.]+):(text|binary)(?:@(.+))?', s)):
+        if not (m := re.fullmatch(r'([a-zA-Z0-9_.]+):(text|binary)(?:@(.+))?', s)):
             raise ValueError(f'Cannot parse section spec: {s!r}')
 
         name, ttype, out = m.groups()