From a09174cd0b2d15f86d37d2eac4ea83ff1293c682 Mon Sep 17 00:00:00 2001
From: Brian Joerger <bjoerger@goteleport.com>
Date: Wed, 29 Apr 2026 10:50:49 -0700
Subject: [PATCH] Add piv tag for lint-api make target; Fix lint errors in piv
 package. (#65669)

---
 Makefile                      | 2 +-
 api/utils/keys/piv/service.go | 7 +------
 api/utils/keys/piv/yubikey.go | 3 +--
 3 files changed, 3 insertions(+), 9 deletions(-)

diff --git a/Makefile b/Makefile
index d8264dd1052..2d5d47d2bdf 100644
--- a/Makefile
+++ b/Makefile
@@ -1349,7 +1349,7 @@ lint-backport:
 .PHONY: lint-api
 lint-api: GO_LINT_API_FLAGS ?=
 lint-api:
-	cd api && golangci-lint run -c ../.golangci.yml $(GO_LINT_API_FLAGS)
+	cd api && golangci-lint run -c ../.golangci.yml  --build-tags='$(PIV_LINT_TAG)' $(GO_LINT_API_FLAGS)
 
 .PHONY: lint-kube-agent-updater
 lint-kube-agent-updater: GO_LINT_API_FLAGS ?=
diff --git a/api/utils/keys/piv/service.go b/api/utils/keys/piv/service.go
index a2b51278129..c9862dc583c 100644
--- a/api/utils/keys/piv/service.go
+++ b/api/utils/keys/piv/service.go
@@ -47,11 +47,6 @@ type YubiKeyService struct {
 	// that needs its protection.
 	promptMu sync.Mutex
 
-	// signMu prevents prompting for PIN/touch repeatedly for concurrent signatures.
-	// TODO(Joerger): Rather than preventing concurrent signatures, we can make the
-	// PIN and touch prompts durable to concurrent signatures.
-	signMu sync.Mutex
-
 	// yubiKeys is a shared, thread-safe [YubiKey] cache by serial number. It allows for
 	// separate goroutines to share a YubiKey connection to work around the single PC/SC
 	// transaction (connection) per-yubikey limit.
@@ -312,7 +307,7 @@ func (s *YubiKeyService) promptOverwriteSlot(ctx context.Context, msg string, ke
 	if confirmed, confirmErr := s.getPrompt().ConfirmSlotOverwrite(ctx, promptQuestion, keyInfo); confirmErr != nil {
 		return trace.Wrap(confirmErr)
 	} else if !confirmed {
-		return trace.Wrap(trace.CompareFailed(msg), "user declined to overwrite slot")
+		return trace.Wrap(trace.CompareFailed("%s", msg), "user declined to overwrite slot")
 	}
 	return nil
 }
diff --git a/api/utils/keys/piv/yubikey.go b/api/utils/keys/piv/yubikey.go
index 006c967639e..f1bba69ce21 100644
--- a/api/utils/keys/piv/yubikey.go
+++ b/api/utils/keys/piv/yubikey.go
@@ -383,8 +383,7 @@ func (y *YubiKey) checkOrSetPIN(ctx context.Context, prompt hardwarekey.Prompt,
 	}
 
 	if pin == piv.DefaultPIN {
-		pin, err = y.setPINAndPUKFromDefault(ctx, prompt, keyInfo, pinCacheTTL)
-		if err != nil {
+		if _, err = y.setPINAndPUKFromDefault(ctx, prompt, keyInfo, pinCacheTTL); err != nil {
 			return trace.Wrap(err)
 		}
 	}