From dc69840b8f0fbf642cb9d2ffd31a29f8aa5b9d50 Mon Sep 17 00:00:00 2001 From: Renata Date: Mon, 20 Jul 2026 18:12:28 +0200 Subject: [PATCH] fix: _setup_yubikey must actually reset when generating a new key --- taf/keys.py | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/taf/keys.py b/taf/keys.py index 6fd7cd67..3d79d294 100644 --- a/taf/keys.py +++ b/taf/keys.py @@ -655,8 +655,17 @@ def _setup_yubikey( if yubikeys is not None: key, serial_num, key_name = yubikeys[0] if not use_existing: + # TODO: always resetting is temporary - once signing supports + # slots other than SIGNATURE, let the user pick which slot to + # use here (default SIGNATURE), and only overwrite it (force, + # non-destructive to the rest of the card) instead of ever + # doing a full reset key = yk.setup_new_yubikey( - auth_repo.pin_manager, serial_num, scheme, key_size=key_size + auth_repo.pin_manager, + serial_num, + scheme, + key_size=key_size, + reset=True, ) if certs_dir is not None: