It's necessary (although not documented) for the password file passed to
pesign to end in a \r or \n character. The password parsing code[0]
reads into a 200 char buffer and then walks from the end of the buffer
looking for an end-of-line character, writing null bytes until it is
found.

Without the newline, the entire buffer is zeroed out and a negative
return code is given to the caller. The calling function returns a NULL
pointer if this occurs. The caller of that function does not check if
the returned pointer is null, but when the password is used it obviously
doesn't match and so pesign fails with an error about the password not
matching.

[0] https://github.com/rhboot/pesign/blob/d734b6a00c95eaf205d713ea580a9df8f9b6c1ec/src/password.c#L101