From 9b07a160b48d9d85c0bc847284df70abbcb14620 Mon Sep 17 00:00:00 2001 From: Dinh Phu Nguyen Date: Mon, 20 Jul 2026 15:24:03 +0700 Subject: [PATCH] fido2: strip trailing comma when parsing authenticator extensions _fido2_require_extension() splits the `extension strings:` line from `fido2-token -I` on whitespace only. Current libfido2 (>= 1.15) prints that list comma-separated, e.g.: extension strings: credProtect, hmac-secret, largeBlobKey, credBlob, minPinLength so every word except the last retains a trailing comma. The comparison `hmac-secret,` == `hmac-secret` never matches, and `tomb forge --fido2` aborts with the misleading: [E] FIDO2 authenticator does not advertise hmac-secret. even on fully compatible devices (e.g. YubiKey 5) that do support it. Strip the trailing comma from each word before comparing. This handles both the comma-separated and older space-separated output formats. Fixes FIDO2 key forging on libfido2 >= 1.15. Signed-off-by: Dinh Phu Nguyen --- tomb | 1 + 1 file changed, 1 insertion(+) diff --git a/tomb b/tomb index 58ab90e0..c88c9b4a 100755 --- a/tomb +++ b/tomb @@ -1122,6 +1122,7 @@ _fido2_require_extension() { if [[ "${(L)line}" == "extension strings:"* ]]; then line=${line#*:} for word in ${(s: :)line}; do + word=${word%,} # libfido2 comma-separates extensions [[ "$word" == "$ext" ]] && return 0 done fi