yubikey is not defined and pyotherside function errors after yubikey-manager 4.0.0a1

[gbcox]

• Yubico Authenticator version: 5.0.4
• Operating system and version: Fedora 33
• YubiKey model and version: Yubikey Neo 3.3.2
• Bug description summary: yubioath fails after manager 4.0.0 installed
  Cross-reference: yubikey-manager requires python-fido2 < 0.90 but Fedora 34 uses python-fido2 0.90-2 yubikey-manager#382

Console shows:
yubioath-desktop --log-level DEBUG
Unhandled PyOtherSide error: Cannot import module: yubikey (Traceback (most recent call last):

File "qrc:///py/yubikey.py", line 12, in
from ykman.descriptor import (

ModuleNotFoundError: No module named 'ykman.descriptor'
)
Unhandled PyOtherSide error: Function not found: 'yubikey.init_with_logging' (Traceback (most recent call last):

File "", line 1, in

NameError: name 'yubikey' is not defined
)
Unhandled PyOtherSide error: Function not found: 'yubikey.controller.check_descriptors' (Traceback (most recent call last):

File "", line 1, in

NameError: name 'yubikey' is not defined
)
Unhandled PyOtherSide error: Function not found: 'yubikey.controller.get_connected_readers' (Traceback (most recent call last):

File "", line 1, in

NameError: name 'yubikey' is not defined
)

[fdennis]

Hi,
Thanks for reporting this. We are working on a new version that will be compatible with the new ykman. However, it is not fully complete yet.

[nbraud]

We ran into the same issue in Debian, as I didn't think to test yubioath-desktop before commiting to shipping fido2 0.9 and ykman 4; TBH, I entirely forgot this existed, as I do not use or maintain it.

Do you have an ETA on a (pre)release?

[dainnilsson]

I don't think we'll be able to release 5.1 in time for inclusion in the upcoming Debian/Fedora versions. Instead I've been looking at a more quick-and-dirty solution of making a new 5.0.4-post1 release which is made to be compatible with ykman 4.0 (as well as still working with 3.x). I don't see any point in making new Windows, Mac or Snap packages for that, so we'd just make a signed tag. Would that be sufficient?

[nbraud]

Sure, that would be just-about perfect.

[gbcox]

Agreed, that would be good. Thanks!

[dainnilsson]

We've now tagged 5.0.4-post1 here: https://github.com/Yubico/yubioath-desktop/releases/tag/yubioath-desktop-5.0.4-post1
This version should work both for ykman 4.0 as well as 3.x, but contains no other changes since the 5.0.4 release. Please do let us know if you run into any issues!

[gbcox]

Thanks for the quick response on this. Much appreciated. I tested this with:
python3-fido2-0.8.1
python3-yubikey-manager-3.1.2
yubikey-manager-3.1.2

Everything appeared to work as expected.

However, when I tested with:
python3-fido2-0.9.1
python3-yubikey-manager-4.0.0a1
yubikey-manager-4.0.0a1

Extra digits were displayed in front of the correct code with the older Neo Yubikey.
Here is the output associated with the specific yubikey. Again, this only happens
when using yubikey-manager 4.0.0a1, not with the current release.

==========================================================
Using:
Device type: YubiKey 5 NFC
Firmware version: 5.1.2
Form factor: Keychain (USB-A)
Enabled USB interfaces: OTP, FIDO, CCID
NFC transport is enabled.

Applications USB NFC
OTP Enabled Enabled
FIDO U2F Enabled Enabled
OpenPGP Enabled Enabled
PIV Enabled Disabled
OATH Enabled Enabled
FIDO2 Enabled Enabled

Device type: YubiKey NEO
Serial number: 3012388
Firmware version: 3.3.2
Enabled USB interfaces: OTP, FIDO, CCID
NFC transport is enabled.

Applications USB NFC
OTP Enabled Enabled
FIDO U2F Enabled Enabled
OpenPGP Enabled Enabled
PIV Enabled Enabled
OATH Enabled Enabled
FIDO2 Not available Not available

[dainnilsson]

Thank you for the report! I suspect I know what is happening here, and will look into it tomorrow. If I'm right it's something we need to fix in ykman.

[norbusan]

@dainnilsson thanks for the (preliminary) fix, and please let us know when a fix has been committed to ykman.

[dainnilsson]

@gbcox - As suspected, this is an issue in ykman 4.0.0a1 with some NEO-specific truncation not being performed. I have committed a fix to the next branch for ykman (which will be the basis for the final 4.0.0 release). The existing yubioath-desktop 5.0.4.post1 release should work properly for NEO once the fixed ykman is used.

[taowa]

Great, thanks!

[gbcox]

@gbcox - As suspected, this is an issue in ykman 4.0.0a1 with some NEO-specific truncation not being performed. I have committed a fix to the next branch for ykman (which will be the basis for the final 4.0.0 release). The existing yubioath-desktop 5.0.4.post1 release should work properly for NEO once the fixed ykman is used.

Thanks for the quick fix. I'm currently testing and it appears to be working fine now with the NEO.

[gbcox]

Closing. Thanks again for the quick response!

[norbusan]

Thanks, fixed also here on Debian with my private rebuild.

[nbraud]

Forgot to mention here, but I tested & uploaded that to Debian shortly after the fix became available.