Fix hardware key sign err shadow bug. (#37285)

gravitational · Jan 25, 2024 · bca9688 · bca9688
1 parent a9b3002
commit bca9688
Showing 1 changed file with 7 additions and 7 deletions.
diff --git a/api/utils/keys/yubikey.go b/api/utils/keys/yubikey.go
@@ -330,22 +330,22 @@ func (y *YubiKeyPrivateKey) sign(ctx context.Context, rand io.Reader, digest []b
 	const pivGenericAuthErrCodeString = "6982"
 
 	signature, err := signer.Sign(rand, digest, opts)
-	if err != nil && strings.Contains(err.Error(), pivGenericAuthErrCodeString) && manualRetryWithPIN {
+	switch {
+	case err == nil:
+		return signature, nil
+	case manualRetryWithPIN && strings.Contains(err.Error(), pivGenericAuthErrCodeString):
 		pin, err := promptPIN()
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 		if err := yk.VerifyPIN(pin); err != nil {
 			return nil, trace.Wrap(err)
 		}
-		signature, err = signer.Sign(rand, digest, opts)
-	}
-
-	if err != nil {
+		signature, err := signer.Sign(rand, digest, opts)
+		return signature, trace.Wrap(err)
+	default:
 		return nil, trace.Wrap(err)
 	}
-
-	return signature, nil
 }
 
 func (y *YubiKeyPrivateKey) toPrivateKey() (*PrivateKey, error) {