Add piv tag for lint-api make target; Fix lint errors in piv package. (#65669)

Makefile

@@ -1349,7 +1349,7 @@ lint-backport:
 .PHONY: lint-api
 lint-api: GO_LINT_API_FLAGS ?=
 lint-api:
-	cd api && golangci-lint run -c ../.golangci.yml $(GO_LINT_API_FLAGS)
+	cd api && golangci-lint run -c ../.golangci.yml  --build-tags='$(PIV_LINT_TAG)' $(GO_LINT_API_FLAGS)
 
 .PHONY: lint-kube-agent-updater
 lint-kube-agent-updater: GO_LINT_API_FLAGS ?=

api/utils/keys/piv/service.go

@@ -47,11 +47,6 @@ type YubiKeyService struct {
 	// that needs its protection.
 	promptMu sync.Mutex
 
-	// signMu prevents prompting for PIN/touch repeatedly for concurrent signatures.
-	// TODO(Joerger): Rather than preventing concurrent signatures, we can make the
-	// PIN and touch prompts durable to concurrent signatures.
-	signMu sync.Mutex
-
 	// yubiKeys is a shared, thread-safe [YubiKey] cache by serial number. It allows for
 	// separate goroutines to share a YubiKey connection to work around the single PC/SC
 	// transaction (connection) per-yubikey limit.
@@ -312,7 +307,7 @@ func (s *YubiKeyService) promptOverwriteSlot(ctx context.Context, msg string, ke
 	if confirmed, confirmErr := s.getPrompt().ConfirmSlotOverwrite(ctx, promptQuestion, keyInfo); confirmErr != nil {
 		return trace.Wrap(confirmErr)
 	} else if !confirmed {
-		return trace.Wrap(trace.CompareFailed(msg), "user declined to overwrite slot")
+		return trace.Wrap(trace.CompareFailed("%s", msg), "user declined to overwrite slot")
 	}
 	return nil
 }

api/utils/keys/piv/yubikey.go

@@ -383,8 +383,7 @@ func (y *YubiKey) checkOrSetPIN(ctx context.Context, prompt hardwarekey.Prompt,
 	}
 
 	if pin == piv.DefaultPIN {
-		pin, err = y.setPINAndPUKFromDefault(ctx, prompt, keyInfo, pinCacheTTL)
-		if err != nil {
+		if _, err = y.setPINAndPUKFromDefault(ctx, prompt, keyInfo, pinCacheTTL); err != nil {
 			return trace.Wrap(err)
 		}
 	}