Merge branch 'develop' into dennisdyallo/fixes-182

DennisDyallo · web-flow · commit f0775100fda9 · 2025-08-04T14:34:13.000+02:00
diff --git a/.github/workflows/build-pull-requests.yml b/.github/workflows/build-pull-requests.yml
@@ -52,7 +52,8 @@ jobs:
         with:
           global-json-file: global.json
 
-      - name: Add local NuGet repository
+      # Add local NuGet repository so that we can use internal pre-release versions
+      - name: Add local NuGet repository for prerelease versions
         run: dotnet nuget add source --username ${{ github.actor }} --password ${{ secrets.GITHUB_TOKEN }} --store-password-in-clear-text --name github "https://nuget.pkg.github.com/Yubico/index.json"
 
       - name: Build Yubico.NET.SDK.sln
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -80,21 +80,23 @@ jobs:
       - uses: actions/setup-dotnet@v4
         with:
           global-json-file: "./global.json"
-      - name: Add local NuGet repository
+
+      # Add local NuGet repository if version is not a plain release (i.e., has a suffix, e.g., -prerelease)
+      - name: Add local NuGet repository for non-release versions
+        if: ${{ github.event.inputs.version && (contains(github.event.inputs.version, '-')) }}
         run: dotnet nuget add source --username ${{ github.actor }} --password ${{ secrets.GITHUB_TOKEN }} --store-password-in-clear-text --name github "https://nuget.pkg.github.com/Yubico/index.json"
 
-      - name: Modify version for internal builds
-        if: ${{ github.event.inputs.push-to-dev == 'true' }}
+      - name: Set build version
+        if: ${{ github.event.inputs.version }}
         run: |
           $file = gci ./build/Versions.props
           $versionProp = [xml](gc $file.FullName)
-          $versionProp.Project.PropertyGroup.YubicoCoreVersion = "${{ github.event.inputs.version }}"
-          $versionProp.Project.PropertyGroup.YubicoYubiKeyVersion = "${{ github.event.inputs.version }}"
+          $versionProp.Project.PropertyGroup.CommonVersion = "${{ github.event.inputs.version }}"
           $versionProp.Save($file.FullName)
 
       # Build the project
       - name: Build Yubico.NET.SDK.sln
-        run: dotnet pack --configuration Release --nologo --verbosity minimal Yubico.NET.SDK.sln
+        run: dotnet pack --configuration Release --nologo --verbosity minimal -p:treatWarningsAsErrors=true Yubico.NET.SDK.sln 
 
       # Build the documentation
       - name: Build docs
@@ -251,4 +253,4 @@ jobs:
             echo "| --- | --- |" >> $GITHUB_STEP_SUMMARY
             echo "| **Image Tag** | \`${{ env.DOCS_IMAGE_TAG }}\` |" >> $GITHUB_STEP_SUMMARY
             echo "| **Image Hash** | \`${{ env.DOCS_IMAGE_HASH }}\` |" >> $GITHUB_STEP_SUMMARY
-          fi
+          fi
diff --git a/Yubico.YubiKey/examples/Fido2SampleCode/YubiKeyOperations/Fido2Reset.cs b/Yubico.YubiKey/examples/Fido2SampleCode/YubiKeyOperations/Fido2Reset.cs
@@ -86,7 +86,7 @@ public ResponseStatus RunFido2Reset(Func<KeyEntryData, bool> KeyCollector)
                 // Wait for CheckReinsert to complete, or else the task times out.
                 // If it returns false, the YubiKey was not reinserted within the
                 // time limit, so return false.
-                if (!reinsert.Wait(ReinsertTimeoutSeconds * 1000))
+                if (!reinsert.Wait(ReinsertTimeoutSeconds * 1000)) // Reinsert the YubiKey at this step.
                 {
                     return ResponseStatus.ConditionsNotSatisfied;
                 }
diff --git a/Yubico.YubiKey/examples/SharedSampleCode/SharedSampleCode.csproj b/Yubico.YubiKey/examples/SharedSampleCode/SharedSampleCode.csproj
@@ -23,16 +23,9 @@ limitations under the License. -->
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|AnyCPU'">
     <NoWarn>@(NoWarn);NU5105;NU5104</NoWarn>
   </PropertyGroup>
-
-  <!--
-  To test against local YubiKey library changes, uncomment the following line and adjust the path as needed 
-  and comment out the Yubico.YubiKey PackageReference line below that references the wildcard version (which would then be fetched from the NuGet servers).
+  
   <ItemGroup>
     <ProjectReference Include="..\..\src\Yubico.YubiKey.csproj" />
-  </ItemGroup>-->
-
-  <ItemGroup>
-    <PackageReference Include="Yubico.YubiKey" Version="1.*-*" />
   </ItemGroup>
-
+  
 </Project>
diff --git a/Yubico.YubiKey/src/Yubico/YubiKey/ApplicationSession.cs b/Yubico.YubiKey/src/Yubico/YubiKey/ApplicationSession.cs
@@ -86,11 +86,11 @@ protected IYubiKeyConnection GetConnection(
         {
             string scpType = keyParameters switch
             {
-                Scp03KeyParameters _ when application == YubiKeyApplication.Oath && yubiKey.HasFeature(YubiKeyFeature.Scp03Oath)
+                Scp03KeyParameters when application == YubiKeyApplication.Oath && yubiKey.HasFeature(YubiKeyFeature.Scp03Oath)
                     => "SCP03",
-                Scp03KeyParameters _ when yubiKey.HasFeature(YubiKeyFeature.Scp03)
+                Scp03KeyParameters when yubiKey.HasFeature(YubiKeyFeature.Scp03)
                     => "SCP03",
-                Scp11KeyParameters _ when yubiKey.HasFeature(YubiKeyFeature.Scp11)
+                Scp11KeyParameters when yubiKey.HasFeature(YubiKeyFeature.Scp11)
                     => "SCP11",
                 null => string.Empty,
                 _ => throw new InvalidOperationException("The YubiKey does not support the requested SCP connection.")
diff --git a/Yubico.YubiKey/src/Yubico/YubiKey/ConnectionFactory.cs b/Yubico.YubiKey/src/Yubico/YubiKey/ConnectionFactory.cs
@@ -120,7 +120,7 @@ public IYubiKeyConnection CreateConnection(YubiKeyApplication application)
                 return new KeyboardConnection(_hidKeyboardDevice);
             }
 
-            bool isFidoApplication = application == YubiKeyApplication.Fido2 || application == YubiKeyApplication.FidoU2f;
+            bool isFidoApplication = application is YubiKeyApplication.Fido2 or YubiKeyApplication.FidoU2f;
             if (_hidFidoDevice != null && isFidoApplication)
             {
                 _log.LogDebug("Connecting via the FIDO interface.");
diff --git a/Yubico.YubiKey/src/Yubico/YubiKey/KeyboardConnection.cs b/Yubico.YubiKey/src/Yubico/YubiKey/KeyboardConnection.cs
@@ -14,7 +14,6 @@
 
 using System;
 using Yubico.Core.Devices.Hid;
-using Yubico.Core.Iso7816;
 using Yubico.YubiKey.Pipelines;
 
 namespace Yubico.YubiKey
diff --git a/Yubico.YubiKey/src/Yubico/YubiKey/Otp/Commands/ReadStatusResponse.cs b/Yubico.YubiKey/src/Yubico/YubiKey/Otp/Commands/ReadStatusResponse.cs
@@ -81,7 +81,7 @@ public OtpStatus GetData()
                 ShortPressRequiresTouch = (responseApduSpan[4] & ShortPressTouchMask) != 0,
                 LongPressRequiresTouch = (responseApduSpan[4] & LongPressTouchMask) != 0,
                 LedBehaviorInverted = (responseApduSpan[4] & LedInvertedMask) != 0,
-                TouchLevel = responseApduSpan[5],
+                TouchLevel = responseApduSpan[5]
             };
         }
     }
diff --git a/Yubico.YubiKey/src/Yubico/YubiKey/Otp/OtpSession.cs b/Yubico.YubiKey/src/Yubico/YubiKey/Otp/OtpSession.cs
@@ -15,7 +15,6 @@
 using System;
 using System.Globalization;
 using Yubico.Core.Logging;
-using Yubico.YubiKey.Oath;
 using Yubico.YubiKey.Otp.Commands;
 using Yubico.YubiKey.Otp.Operations;
 using Yubico.YubiKey.Scp;
diff --git a/build/sign.ps1 b/build/sign.ps1
@@ -202,8 +202,8 @@ function Process-ZipPackage {
         Get-ChildItem -Path $extractPath -Recurse -Filter "*.nuspec" |
         ForEach-Object { 
             Write-Host "        📥 Packing: $($_.Name)"
-            $output = & $NuGetPath pack $_.FullName -OutputDirectory $Directories.Packages 2>&1
-            
+            $output = & $NuGetPath pack $_.FullName -OutputDirectory $Directories.Packages -p TreatWarningsAsErrors=true 2>&1
+
             if ($LASTEXITCODE -ne 0) {
                 $output | ForEach-Object { Write-Host $_ }
                 throw "Packing failed for file: $($_.FullName)"
diff --git a/docs/users-manual/application-fido2/apdu/reset.md b/docs/users-manual/application-fido2/apdu/reset.md
@@ -1,3 +1,7 @@
+---
+uid: Fido2ResetApdu
+---
+
 <!-- Copyright 2022 Yubico AB
 
 Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/docs/users-manual/application-fido2/fido2-reset.md b/docs/users-manual/application-fido2/fido2-reset.md
@@ -18,61 +18,41 @@ limitations under the License. -->
 
 # FIDO2 Reset
 
-It is possible to reset the FIDO2 application on YubiKeys that support FIDO2. A reset will
-remove any credentials and set the application to "no PIN".
+The FIDO2 application can be reset on all YubiKeys that support FIDO2. A reset will
+remove any credentials present and set the application to the "no PIN" state.
 
 However, there are some caveats:
 
-* The YubiKey will no longer be able to perform authentication with credentials previously
-  created with the FIDO2 application by that YubiKey.
+* The YubiKey will no longer be able to perform authentication with credentials that were removed from the FIDO2 application during the reset.
 * The process of resetting is a bit complicated; the .NET YubiKey API does not include a
-  higer-level `Fido2Session` method for performing the entire operation. Instead, you must
-  send a series of lower-level commands described below.
+  higher-level `Fido2Session` method for performing the entire operation. Instead, you must
+  use a lower-level command class as described below.
 
 > [!NOTE]
-> The individual FIDO reset can be used with YubiKey Bio Multi-protocol Edition keys *only if* the FIDO application is not "blocked" (check the key's [ResetBlocked](xref:Yubico.YubiKey.YubiKeyDevice.ResetBlocked) property to confirm). Otherwise, the [device-wide reset](xref:UsersManualBioMpe#resetting-a-yubikey-bio-mpe) must be used instead. 
+> The individual FIDO reset can be used with YubiKey Bio Multi-protocol Edition keys *only if* the FIDO application is not "blocked" (check the key's [ResetBlocked](xref:Yubico.YubiKey.YubiKeyDevice.ResetBlocked) property to confirm). Otherwise, the [device-wide reset](xref:UsersManualBioMpe#resetting-a-yubikey-bio-mpe) must be used instead.
 
 ## Steps
 
 Resetting the FIDO2 application is something you hope you never need to do. Generally, the
 only reason to reset the FIDO2 application is if the password has been blocked.
 
-Nonetheless, if you decide to reset, here's what needs to be done:
-
-1. "Reboot" the YubiKey by removing and re-inserting. Obtain a connection to the YubiKey
-   once it has been reinserted. This will likely be done using a listener class (see
-   [YubiKeyDeviceListener](xref:Yubico.YubiKey.YubiKeyDeviceListener)).
-2. Within a time limit from the reboot (about 5 seconds), complete the reset command:
-
-    1. Send the [ResetCommand](xref:Yubico.YubiKey.Fido2.Commands.ResetCommand). The
-       initial command should return `0x6F30` (i.e. the `StatusWord` property of the
-       [ResetResponse](xref:Yubico.YubiKey.Fido2.Commands.ResetResponse) object is
-       `0x6F30`, the `Status` property is `Failed`).
-    2. The user must remove then reinsert the YubiKey.
-    3. Once the YubiKey has been reinserted, make a connection and send the
-       `ResetCommand` again. The YubiKey will not respond with the `ResetResponse`
-       immediately. It will not complete the reset until the user touches the contact.
-       If the user does not touch the contact within a time limit, the YubiKey will
-       return the `ResetResponse` with a `StatusWord` of `0x6F3A`, the CTAP error of
-       timeout (the `Status` property will be `Failed`).
-    4. If the user touches the contact within the time limit, then the FIDO2 application
-       will be able to reset and the return will be `Success` (the `StatusWord` property
-       will be `0x9000` and the `Status` property will be `Success`).
+To perform a FIDO2 reset, complete the following:
 
-## Sample code
+1. "Reboot" the YubiKey by removing it from and reinserting it into the host device. Connect to the YubiKey and its FIDO2 application once it has been reinserted. This will likely be done using a listener class (see [YubiKeyDeviceListener](xref:Yubico.YubiKey.YubiKeyDeviceListener)).
+
+1. Within a time limit from the reboot (10 seconds for YubiKeys with firmware version 5.5.4 and later or 5 seconds for firmware versions prior to 5.5.2), send the [ResetCommand](xref:Yubico.YubiKey.Fido2.Commands.ResetCommand).
+
+   > [!NOTE]
+   > The reboot requirement and 10-second timeout are mandated by the [CTAP 2.1 standard](https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorReset).
 
-The FIDO2 sample program contains a class that demonstrates how to execute these steps. It
-is located at `Yubico.YubiKey/examples/Fido2SampleCode`. The code that actually performs the
-reset is in `.../Fido2SampleCode/YubiKeyOperations/Fido2Reset.cs`.
+1. The YubiKey will not respond with the [ResetResponse](xref:Yubico.YubiKey.Fido2.Commands.ResetResponse) immediately. Within 30 seconds, a user must touch the contact of the YubiKey. If the touch does not occur in time, the YubiKey will return the `ResetResponse` with a `StatusWord` of `0x6F3A`, the CTAP error of timeout (the `Status` property will be `Failed`). If the user touches the contact within the time limit, then the FIDO2 application will be reset (the `StatusWord` property will be `0x9000`, and the `Status` property will be `Success`).
 
-At the moment, there is no simple SDK API that can reset the FIDO2 application. That is,
-there is no single `Fido2Session` method to call. Rather, the sample code demonstrates how
-you can
+   See the [FIDO2 reset APDU documentation](xref:Fido2ResetApdu) for information on other possible `StatusWord` responses.
+
+## Sample code
 
-1. create a listener to determine when the YubiKey is removed and reinserted, and
-2. call the lower-level SDK command API to perform the actual reset.
+The [FIDO2 sample program](https://github.com/Yubico/Yubico.NET.SDK/tree/HEAD/Yubico.YubiKey/examples/Fido2SampleCode) (located under Yubico.YubiKey/examples/Fido2SampleCode/) contains a [class](https://github.com/Yubico/Yubico.NET.SDK/blob/HEAD/Yubico.YubiKey/examples/Fido2SampleCode/YubiKeyOperations/Fido2Reset.cs) (/Fido2SampleCode/YubiKeyOperations/Fido2Reset.cs) that demonstrates how to execute the FIDO2 reset steps. This includes code for:
 
-Hence, if you want to add the option to reset the FIDO2 application in your app, one
-option is to study the sample code and write something similar. You might be able to
-"cut-and-paste" the `Fido2Reset` class in the sample code, replacing the messages and
-`KeyCollector` to fit your needs. 
+- creating a listener to determine when the YubiKey is removed and reinserted
+- notifying the user to remove, reinsert, and touch the YubiKey
+- calling the lower-level SDK command API to perform the reset once the key has been rebooted
diff --git a/docs/users-manual/application-piv/private-keys.md b/docs/users-manual/application-piv/private-keys.md
diff --git a/docs/users-manual/application-piv/public-keys.md b/docs/users-manual/application-piv/public-keys.md
diff --git a/docs/users-manual/sdk-programming-guide/pin-complexity-policy.md b/docs/users-manual/sdk-programming-guide/pin-complexity-policy.md

Original file line number	Diff line number	Diff line change
`@@ -86,7 +86,7 @@ public ResponseStatus RunFido2Reset(Func<KeyEntryData, bool> KeyCollector)`
`86`	`86`	`// Wait for CheckReinsert to complete, or else the task times out.`
`87`	`87`	`// If it returns false, the YubiKey was not reinserted within the`
`88`	`88`	`// time limit, so return false.`
`89`		`- if (!reinsert.Wait(ReinsertTimeoutSeconds * 1000))`
	`89`	`+ if (!reinsert.Wait(ReinsertTimeoutSeconds * 1000)) // Reinsert the YubiKey at this step.`
`90`	`90`	`{`
`91`	`91`	`return ResponseStatus.ConditionsNotSatisfied;`
`92`	`92`	`}`
Original file line number	Diff line number	Diff line change
`@@ -120,7 +120,7 @@ public IYubiKeyConnection CreateConnection(YubiKeyApplication application)`
`120`	`120`	`return new KeyboardConnection(_hidKeyboardDevice);`
`121`	`121`	`}`
`122`	`122`
`123`		`- bool isFidoApplication = application == YubiKeyApplication.Fido2 \|\| application == YubiKeyApplication.FidoU2f;`
	`123`	`+ bool isFidoApplication = application is YubiKeyApplication.Fido2 or YubiKeyApplication.FidoU2f;`
`124`	`124`	`if (_hidFidoDevice != null && isFidoApplication)`
`125`	`125`	`{`
`126`	`126`	`_log.LogDebug("Connecting via the FIDO interface.");`
Original file line number	Diff line number	Diff line change
`@@ -81,7 +81,7 @@ public OtpStatus GetData()`
`81`	`81`	`ShortPressRequiresTouch = (responseApduSpan[4] & ShortPressTouchMask) != 0,`
`82`	`82`	`LongPressRequiresTouch = (responseApduSpan[4] & LongPressTouchMask) != 0,`
`83`	`83`	`LedBehaviorInverted = (responseApduSpan[4] & LedInvertedMask) != 0,`
`84`		`- TouchLevel = responseApduSpan[5],`
	`84`	`+ TouchLevel = responseApduSpan[5]`
`85`	`85`	`};`
`86`	`86`	`}`
`87`	`87`	`}`