Yubico Libfido2

https://github.com/yubico/libfido2
Admin
Yubico Libfido2 is a C library that provides an API for interacting with FIDO2 authenticators.
Tokens:31,174
Snippets:131
Trust Score:9.4
License:BSD-2-Clause
Update:8 months ago
Show doc for...
Tokens:
Raw
### Install gzipped man pages with CMake if GZIP_PATH is set

Source: https://github.com/yubico/libfido2/blob/main/man/CMakeLists.txt

This CMake block handles the installation of gzipped man pages when `GZIP_PATH` is defined. It sets dependencies, then iterates through man sources and aliases, installing their `.gz` versions into the appropriate `man1` or `man3` directories based on their extensions.

```cmake
if(GZIP_PATH)
	add_dependencies(man_gzip man_copy)
	add_dependencies(man_symlink_gzip man_gzip)
	add_dependencies(man man_symlink_gzip)
	foreach(f ${MAN_SOURCES})
		if (${f} MATCHES ".1$")
			install(FILES ${PROJECT_BINARY_DIR}/man/${f}.gz
				DESTINATION "${CMAKE_INSTALL_MANDIR}/man1")
		elseif(${f} MATCHES ".3$")
			install(FILES ${PROJECT_BINARY_DIR}/man/${f}.gz
				DESTINATION "${CMAKE_INSTALL_MANDIR}/man3")
		endif()
	endforeach()
	foreach(i RANGE 0 ${MAN_ALIAS_MAX} 2)
		math(EXPR j "${i} + 1")
		list(GET MAN_ALIAS ${j} DST)
		install(FILES ${PROJECT_BINARY_DIR}/man/${DST}.3.gz
			DESTINATION "${CMAKE_INSTALL_MANDIR}/man3")
	endforeach()
else()
	add_dependencies(man man_symlink)
	foreach(f ${MAN_SOURCES})
		if (${f} MATCHES ".1$")
			install(FILES ${PROJECT_BINARY_DIR}/man/${f}
				DESTINATION "${CMAKE_INSTALL_MANDIR}/man1")
		elseif(${f} MATCHES ".3$")
			install(FILES ${PROJECT_BINARY_DIR}/man/${f}
				DESTINATION "${CMAKE_INSTALL_MANDIR}/man3")
		endif()
	endforeach()
	foreach(i RANGE 0 ${MAN_ALIAS_MAX} 2)
		math(EXPR j "${i} + 1")
		list(GET MAN_ALIAS ${j} DST)
		install(FILES ${PROJECT_BINARY_DIR}/man/${DST}.3
			DESTINATION "${CMAKE_INSTALL_MANDIR}/man3")
	endforeach()
endif()
```

--------------------------------

### Install Executables (CMake)

Source: https://github.com/yubico/libfido2/blob/main/tools/CMakeLists.txt

This CMake code defines the installation rules for the built executables. It specifies that the targets 'fido2-cred', 'fido2-assert', and 'fido2-token' should be installed to the binary directory defined by `${CMAKE_INSTALL_BINDIR}`. This ensures that the executables are placed in the correct location on the system after installation.

```cmake
install(TARGETS fido2-cred fido2-assert fido2-token
	DESTINATION ${CMAKE_INSTALL_BINDIR})
```

--------------------------------

### Install HTML man pages with CMake if MANDOC_PATH is set

Source: https://github.com/yubico/libfido2/blob/main/man/CMakeLists.txt

This CMake block conditionally installs HTML man pages and a CSS stylesheet when the `MANDOC_PATH` variable is defined. It sets up dependencies, installs `style.css`, and then iterates through man sources and aliases to install their corresponding HTML versions.

```cmake
if(MANDOC_PATH)
	add_dependencies(man man_symlink_html)
	add_dependencies(man_gzip man_lint)
	install(FILES ${PROJECT_SOURCE_DIR}/man/style.css
		DESTINATION "${CMAKE_INSTALL_DOCDIR}/html")
	foreach(f ${MAN_SOURCES})
		string(REGEX REPLACE "\\.[13]$" "" f ${f})
		install(FILES ${PROJECT_BINARY_DIR}/man/${f}.html
			DESTINATION "${CMAKE_INSTALL_DOCDIR}/html")
	endforeach()
	foreach(i RANGE 0 ${MAN_ALIAS_MAX} 2)
		math(EXPR j "${i} + 1")
		list(GET MAN_ALIAS ${j} DST)
		install(FILES ${PROJECT_BINARY_DIR}/man/${DST}.html
			DESTINATION "${CMAKE_INSTALL_DOCDIR}/html")
	endforeach()
endif()
```

--------------------------------

### Install Header Files

Source: https://github.com/yubico/libfido2/blob/main/src/CMakeLists.txt

This command installs the main header file `fido.h` and the contents of the `fido` directory to the include path. This makes the library's API accessible to users.

```cmake
install(FILES fido.h DESTINATION include)
install(DIRECTORY fido DESTINATION include)
```

--------------------------------

### Configure and Install Pkg-config File

Source: https://github.com/yubico/libfido2/blob/main/src/CMakeLists.txt

This command configures the `libfido2.pc.in` template file using CMake's `configure_file` command and then installs the generated `libfido2.pc` file to the pkg-config directory. This allows other projects to easily find and link against the libfido2 library using pkg-config.

```cmake
configure_file(libfido2.pc.in libfido2.pc @ONLY)
install(FILES "${CMAKE_CURRENT_BINARY_DIR}/libfido2.pc"
	DESTINATION "${CMAKE_INSTALL_LIBDIR}/pkgconfig")
```

--------------------------------

### Configure Build Options for libfido2 (CMake)

Source: https://github.com/yubico/libfido2/blob/main/CMakeLists.txt

This snippet shows how to define various build options for the libfido2 project using CMake. These options control features such as building tests, examples, man pages, shared/static libraries, tools, fuzzing, and support for different backends like HIDAPI, PCSC, WinHello, and NFC on Linux. The options are set using the 'option()' command, with a default value and a description.

```cmake
option(BUILD_TESTS       "Build the regress tests"                 ON)
option(BUILD_EXAMPLES    "Build example programs"                  ON)
option(BUILD_MANPAGES    "Build man pages"                         ON)
option(BUILD_SHARED_LIBS "Build a shared library"                  ON)
option(BUILD_STATIC_LIBS "Build a static library"                  ON)
option(BUILD_TOOLS       "Build tool programs"                     ON)
option(FUZZ              "Enable fuzzing instrumentation"          OFF)
option(USE_HIDAPI        "Use hidapi as the HID backend"           OFF)
option(USE_PCSC          "Enable experimental PCSC support"        ON)
option(USE_WINHELLO      "Abstract Windows Hello as a FIDO device" ON)
option(NFC_LINUX         "Enable NFC support on Linux"             ON)
```

--------------------------------

### Install UDEV Rules Conditionally (CMake)

Source: https://github.com/yubico/libfido2/blob/main/udev/CMakeLists.txt

This CMake code snippet conditionally installs the '70-u2f.rules' file to the specified UDEV rules directory. The installation only occurs if the UDEV_RULES_DIR variable is defined, ensuring that rules are only deployed when a valid destination is available.

```cmake
if(UDEV_RULES_DIR)
	install(FILES 70-u2f.rules DESTINATION ${UDEV_RULES_DIR})
endif()
```

--------------------------------

### Set Install Name Directory for macOS (CMake)

Source: https://github.com/yubico/libfido2/blob/main/CMakeLists.txt

For macOS builds, this CMake code sets the installation directory for dynamic library names. It ensures that shared libraries installed on macOS will have their `install_name` property set to the combined path of the installation prefix and the library directory, which is crucial for proper dynamic linking.

```cmake
if(APPLE)
	set(CMAKE_INSTALL_NAME_DIR
	    "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}")
endif()
```

--------------------------------

### Get Assertion from FIDO Device (C)

Source: https://context7.com/yubico/libfido2/llms.txt

This C code snippet demonstrates how to use `fido_dev_get_assert()` to request an assertion from a FIDO device. It includes setting up client data, relying party ID, and optional parameters like user presence and verification. The function returns an assertion which can then be processed to verify the user's identity. Dependencies include `<fido.h>` and `<fido/es256.h>`.

```c
#include <fido.h>
#include <fido/es256.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

/* Example client data for assertion */
static const unsigned char client_data[32] = {
    0xec, 0x8d, 0x8f, 0x78, 0x42, 0x4a, 0x2b, 0xb7,
    0x82, 0x34, 0xaa, 0xca, 0x07, 0xa1, 0xf6, 0x56,
    0x42, 0x1c, 0xb6, 0xf6, 0xb3, 0x00, 0x86, 0x52,
    0x35, 0x2d, 0xa2, 0x62, 0x4a, 0xbe, 0x89, 0x76,
};

int main(int argc, char **argv)
{
    fido_dev_t *dev;
    fido_assert_t *assert;
    const char *pin = NULL;
    int r;

    if (argc < 2) {
        fprintf(stderr, "Usage: %s <device_path> [pin]\n", argv[0]);
        return 1;
    }
    if (argc > 2) {
        pin = argv[2];
    }

    fido_init(0);

    /* Allocate and open device */
    if ((dev = fido_dev_new()) == NULL ||
        (r = fido_dev_open(dev, argv[1])) != FIDO_OK) {
        fprintf(stderr, "Failed to open device: %s\n", fido_strerr(r));
        return 1;
    }

    /* Allocate assertion */
    if ((assert = fido_assert_new()) == NULL) {
        fprintf(stderr, "fido_assert_new failed\n");
        fido_dev_close(dev);
        fido_dev_free(&dev);
        return 1;
    }

    /* Set client data */
    if ((r = fido_assert_set_clientdata(assert, client_data, sizeof(client_data))) != FIDO_OK) {
        fprintf(stderr, "fido_assert_set_clientdata: %s\n", fido_strerr(r));
        goto cleanup;
    }

    /* Set relying party ID */
    if ((r = fido_assert_set_rp(assert, "example.com")) != FIDO_OK) {
        fprintf(stderr, "fido_assert_set_rp: %s\n", fido_strerr(r));
        goto cleanup;
    }

    /* Optional: Require user presence */
    if ((r = fido_assert_set_up(assert, FIDO_OPT_TRUE)) != FIDO_OK) {
        fprintf(stderr, "fido_assert_set_up: %s\n", fido_strerr(r));
        goto cleanup;
    }

    /* Optional: Require user verification */
    if ((r = fido_assert_set_uv(assert, FIDO_OPT_TRUE)) != FIDO_OK) {
        fprintf(stderr, "fido_assert_set_uv: %s\n", fido_strerr(r));
        goto cleanup;
    }

    /* Optional: Add allowed credential IDs (for non-discoverable credentials)
    unsigned char cred_id[] = {...};
    if ((r = fido_assert_allow_cred(assert, cred_id, sizeof(cred_id))) != FIDO_OK) {
        fprintf(stderr, "fido_assert_allow_cred: %s\n", fido_strerr(r));
        goto cleanup;
    }
    */

    printf("Touch your authenticator to get assertion...\n");

    /* Get assertion from device */
    if ((r = fido_dev_get_assert(dev, assert, pin)) != FIDO_OK) {
        fprintf(stderr, "fido_dev_get_assert: %s (0x%x)\n", fido_strerr(r), r);
        fido_dev_cancel(dev);
        goto cleanup;
    }

    printf("Assertion retrieved successfully!\n");
    printf("  Number of assertions: %zu\n", fido_assert_count(assert));

    /* Process first assertion */
    if (fido_assert_count(assert) > 0) {
        printf("  Assertion 0:\n");
        printf("    Authenticator data length: %zu bytes\n",
               fido_assert_authdata_len(assert, 0));
        printf("    Signature length: %zu bytes\n",
               fido_assert_sig_len(assert, 0));
        printf("    Signature count: %u\n", fido_assert_sigcount(assert, 0));
        printf("    Flags: 0x%02x\n", fido_assert_flags(assert, 0));

        /* Print user info if available (discoverable credentials) */
        const char *user_name = fido_assert_user_name(assert, 0);
        if (user_name != NULL) {
            printf("    User name: %s\n", user_name);
        }
        const char *display_name = fido_assert_user_display_name(assert, 0);
        if (display_name != NULL) {
            printf("    Display name: %s\n", display_name);
        }
    }

cleanup:
    fido_assert_free(&assert);
    fido_dev_close(dev);
    fido_dev_free(&dev);
    return r == FIDO_OK ? 0 : 1;
}
/* Expected output:
Touch your authenticator to get assertion...
Assertion retrieved successfully!
  Number of assertions: 1
  Assertion 0:
    Authenticator data length: 37 bytes
    Signature length: 71 bytes
    Signature count: 5
    Flags: 0x05
    User name: alice
    Display name: Alice Smith
*/
```

--------------------------------

### Get FIDO2 Device CBOR Info using C

Source: https://context7.com/yubico/libfido2/llms.txt

Retrieves detailed FIDO2 device information using the `fido_dev_get_cbor_info` function. This function requires a valid `fido_dev_t` object opened to a FIDO2 device. It populates a `fido_cbor_info_t` structure with supported versions, extensions, AAGUID, and various device limits. Error handling for device opening and information retrieval is included.

```c
#include <fido.h>
#include <stdio.h>
#include <stdlib.h>

int main(int argc, char **argv)
{
    fido_dev_t *dev;
    fido_cbor_info_t *ci;
    int r;

    if (argc != 2) {
        fprintf(stderr, "Usage: %s <device_path>\n", argv[0]);
        return 1;
    }

    fido_init(0);

    if ((dev = fido_dev_new()) == NULL ||
        (r = fido_dev_open(dev, argv[1])) != FIDO_OK) {
        fprintf(stderr, "Failed to open device\n");
        return 1;
    }

    if (!fido_dev_is_fido2(dev)) {
        fprintf(stderr, "Device is not FIDO2\n");
        fido_dev_close(dev);
        fido_dev_free(&dev);
        return 1;
    }

    /* Allocate CBOR info structure */
    if ((ci = fido_cbor_info_new()) == NULL) {
        fprintf(stderr, "fido_cbor_info_new failed\n");
        fido_dev_close(dev);
        fido_dev_free(&dev);
        return 1;
    }

    /* Get device CBOR info */
    if ((r = fido_dev_get_cbor_info(dev, ci)) != FIDO_OK) {
        fprintf(stderr, "fido_dev_get_cbor_info: %s (0x%x)\n", fido_strerr(r), r);
        fido_cbor_info_free(&ci);
        fido_dev_close(dev);
        fido_dev_free(&dev);
        return 1;
    }

    /* Print supported versions */
    printf("Supported versions: ");
    char **versions = fido_cbor_info_versions_ptr(ci);
    for (size_t i = 0; i < fido_cbor_info_versions_len(ci); i++) {
        printf("%s%s", i > 0 ? ", " : "", versions[i]);
    }
    printf("\n");

    /* Print supported extensions */
    printf("Supported extensions: ");
    char **extensions = fido_cbor_info_extensions_ptr(ci);
    for (size_t i = 0; i < fido_cbor_info_extensions_len(ci); i++) {
        printf("%s%s", i > 0 ? ", " : "", extensions[i]);
    }
    printf("\n");

    /* Print AAGUID */
    printf("AAGUID: ");
    const unsigned char *aaguid = fido_cbor_info_aaguid_ptr(ci);
    for (size_t i = 0; i < fido_cbor_info_aaguid_len(ci); i++) {
        printf("%02x", aaguid[i]);
    }
    printf("\n");

    /* Print limits */
    printf("Max message size: %llu\n", (unsigned long long)fido_cbor_info_maxmsgsiz(ci));
    printf("Max credential ID length: %llu\n", (unsigned long long)fido_cbor_info_maxcredidlen(ci));
    printf("Min PIN length: %llu\n", (unsigned long long)fido_cbor_info_minpinlen(ci));
    printf("Firmware version: 0x%llx\n", (unsigned long long)fido_cbor_info_fwversion(ci));

    fido_cbor_info_free(&ci);
    fido_dev_close(dev);
    fido_dev_free(&dev);

    return 0;
}
/* Expected output:
Supported versions: FIDO_2_1, FIDO_2_0, U2F_V2
Supported extensions: credProtect, hmac-secret, largeBlobKey, credBlob, minPinLength
AAGUID: 2fc0579f811347eab116bb5a8db9202a
Max message size: 1200
Max credential ID length: 128
Min PIN length: 4
Firmware version: 0x50403
*/
```

--------------------------------

### Error Handling with fido_strerr() in libfido2 (C)

Source: https://context7.com/yubico/libfido2/llms.txt

Illustrates how to handle errors returned by libfido2 functions using the `fido_strerr()` function to convert error codes into human-readable strings. The example demonstrates opening a non-existent device and provides a switch-case structure to handle various common libfido2 error codes.

```c
#include <fido.h>
#include <fido/err.h>
#include <stdio.h>

void demonstrate_error_handling(void)
{
    fido_dev_t *dev;
    int r;

    fido_init(0);

    if ((dev = fido_dev_new()) == NULL) {
        fprintf(stderr, "Memory allocation failed\n");
        return;
    }

    /* Attempt to open a non-existent device */
    r = fido_dev_open(dev, "/dev/nonexistent");

    switch (r) {
    case FIDO_OK:
        printf("Device opened successfully\n");
        fido_dev_close(dev);
        break;
    case FIDO_ERR_INVALID_ARGUMENT:
        printf("Invalid argument provided\n");
        break;
    case FIDO_ERR_NOT_FIDO_DEVICE:
        printf("Not a FIDO device\n");
        break;
    case FIDO_ERR_PIN_REQUIRED:
        printf("PIN is required for this operation\n");
        break;
    case FIDO_ERR_PIN_INVALID:
        printf("Invalid PIN provided\n");
        break;
    case FIDO_ERR_PIN_AUTH_BLOCKED:
        printf("PIN authentication blocked (too many attempts)\n");
        break;
    case FIDO_ERR_ACTION_TIMEOUT:
        printf("Operation timed out waiting for user action\n");
        break;
    case FIDO_ERR_UP_REQUIRED:
        printf("User presence required\n");
        break;
    default:
        /* Use fido_strerr() for any error code */
        printf("Error: %s (0x%x)\n", fido_strerr(r), r);
        break;
    }

    fido_dev_free(&dev);
}
/* Common error codes defined in fido/err.h:
FIDO_OK                    - Success
FIDO_ERR_TX                - Transmission error
FIDO_ERR_RX                - Reception error
FIDO_ERR_RX_INVALID_CBOR   - Invalid CBOR received
FIDO_ERR_INVALID_PARAM     - Invalid parameter in request
FIDO_ERR_INVALID_SIG       - Invalid signature
FIDO_ERR_INVALID_ARGUMENT  - Invalid argument
FIDO_ERR_PIN_REQUIRED      - PIN required
FIDO_ERR_PIN_INVALID       - Invalid PIN
FIDO_ERR_PIN_AUTH_BLOCKED  - PIN auth blocked
FIDO_ERR_NO_CREDENTIALS    - No credentials found
FIDO_ERR_ACTION_TIMEOUT    - User action timeout
FIDO_ERR_UP_REQUIRED       - User presence required
FIDO_ERR_UV_BLOCKED        - User verification blocked
*/

```

--------------------------------

### libfido2 Initialization and Logging

Source: https://github.com/yubico/libfido2/blob/main/man/CMakeLists.txt

Basic initialization function for the libfido2 library and a function to set a custom log handler for capturing library messages.

```c
fido_init
fido_set_log_handler
```

--------------------------------

### Initialize libfido2 Library (C)

Source: https://context7.com/yubico/libfido2/llms.txt

Initializes the libfido2 library. This function must be called before any other libfido2 functions. It accepts flags to control debug output or disable U2F fallback behavior.

```c
#include <fido.h>
#include <stdio.h>

int main(void)
{
    /* Initialize libfido2 with no flags */
    fido_init(0);

    /* Alternative: Enable debug output */
    // fido_init(FIDO_DEBUG);

    /* Alternative: Disable U2F fallback for FIDO2 devices */
    // fido_init(FIDO_DISABLE_U2F_FALLBACK);

    printf("libfido2 initialized successfully\n");
    return 0;
}
```

--------------------------------

### Generate gzipped man pages with CMake

Source: https://github.com/yubico/libfido2/blob/main/man/CMakeLists.txt

This snippet uses CMake's `add_custom_command` to create gzipped versions of man page source files. It iterates through a list of man sources, compresses each using `gzip -cn`, and directs the output to a `.gz` file. The command depends on the original source file.

```cmake
foreach(f ${MAN_SOURCES})
	add_custom_command(OUTPUT ${f}.gz
		COMMAND gzip -cn ${f} > ${f}.gz
		DEPENDS ${f})
	list(APPEND GZ_FILES ${f}.gz)
endforeach()
```

--------------------------------

### Set up dependencies for man page build targets in CMake

Source: https://github.com/yubico/libfido2/blob/main/man/CMakeLists.txt

This CMake code establishes dependencies between various man page build targets. It ensures that targets like `man_symlink_html` depend on `man_html`, and `man_gzip` depends on `man_lint`, creating a logical build order. A top-level `man` target aggregates other dependencies.

```cmake
add_dependencies(man_symlink man_copy)
add_dependencies(man_lint man_symlink)
add_dependencies(man_html man_lint)
add_dependencies(man_symlink_html man_html)
add_dependencies(man_html_partial man_lint)
add_dependencies(man_symlink_html_partial man_html_partial)
add_custom_target(man ALL)
```

--------------------------------

### Build Static Library

Source: https://github.com/yubico/libfido2/blob/main/src/CMakeLists.txt

This block defines and installs a static version of the libfido2 library if `BUILD_STATIC_LIBS` is enabled. It specifies the source files, target properties, linked libraries, and installation directories.

```cmake
if(BUILD_STATIC_LIBS)
	add_library(fido2 STATIC ${FIDO_SOURCES} ${COMPAT_SOURCES})
	if(WIN32 AND NOT MINGW)
		set_target_properties(fido2 PROPERTIES OUTPUT_NAME fido2_static)
	endif()
	target_link_libraries(fido2 ${TARGET_LIBRARIES})
	install(TARGETS fido2 ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
		LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR})
endif()
```

--------------------------------

### Build Shared Library

Source: https://github.com/yubico/libfido2/blob/main/src/CMakeLists.txt

This block defines and installs a shared (dynamic) version of the libfido2 library if `BUILD_SHARED_LIBS` is enabled. It sets version information, links necessary libraries, and specifies installation paths for libraries and executables.

```cmake
if(BUILD_SHARED_LIBS)
	add_library(fido2_shared SHARED ${FIDO_SOURCES} ${COMPAT_SOURCES})
	set_target_properties(fido2_shared PROPERTIES OUTPUT_NAME fido2
		VERSION ${FIDO_VERSION} SOVERSION ${FIDO_MAJOR})
	target_link_libraries(fido2_shared ${TARGET_LIBRARIES})
	install(TARGETS fido2_shared
		ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
		LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
		RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
endif()
```

--------------------------------

### Get Assertion (Authentication)

Source: https://context7.com/yubico/libfido2/llms.txt

The `fido_dev_get_assert()` function requests an assertion from the FIDO device, which is used to authenticate the user by proving possession of a registered credential.

```APIDOC
## GET /assertion

### Description
Requests an assertion from the FIDO device to authenticate the user. This function proves that the user possesses a previously registered credential.

### Method
GET (Conceptual - this is a function call, not a web API endpoint)

### Endpoint
N/A (Function call: `fido_dev_get_assert`)

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
None

### Request Example
```c
// Example C code snippet demonstrating the usage of fido_dev_get_assert
#include <fido.h>
#include <stdio.h>

fido_dev_t *dev;
fido_assert_t *assert;
const char *pin = NULL;
int r;

// Assume 'dev' is an initialized and opened fido_dev_t pointer
// Assume 'assert' is an initialized fido_assert_t pointer with client data and RP ID set

printf("Touch your authenticator to get assertion...\n");

// Get assertion from device
r = fido_dev_get_assert(dev, assert, pin);
if (r != FIDO_OK) {
    fprintf(stderr, "fido_dev_get_assert failed: %s\n", fido_strerr(r));
    // Handle error
} else {
    printf("Assertion retrieved successfully!\n");
    // Process assertion data
}

// Cleanup resources (fido_assert_free, fido_dev_close, fido_dev_free)
```

### Response
#### Success Response (FIDO_OK)
- **Assertion Data**: The retrieved assertion data, including authenticator data, signature, and potentially user information.

#### Response Example
```json
{
  "authenticator_data_length": 37,
  "signature_length": 71,
  "signature_count": 5,
  "flags": "0x05",
  "user_name": "alice",
  "display_name": "Alice Smith"
}
```

#### Error Response
- **Error Code**: A `FIDO_ERR` code indicating the reason for failure (e.g., `FIDO_ERR_PIN_POLICY`, `FIDO_ERR_USER_ACTION_TIMEOUT`).
- **Error Message**: A human-readable string describing the error.
```

--------------------------------

### Discover FIDO2 Devices (C)

Source: https://context7.com/yubico/libfido2/llms.txt

Discovers all connected FIDO2 devices using `fido_dev_info_manifest()`. It populates a device list with information such as path, vendor/product IDs, and descriptive strings. Requires `fido_init()` to be called first.

```c
#include <fido.h>
#include <stdio.h>
#include <stdlib.h>

int main(void)
{
    fido_dev_info_t *devlist;
    size_t ndevs;
    int r;

    fido_init(0);

    /* Allocate space for up to 64 devices */
    if ((devlist = fido_dev_info_new(64)) == NULL) {
        fprintf(stderr, "fido_dev_info_new failed\n");
        return 1;
    }

    /* Discover connected FIDO2 devices */
    if ((r = fido_dev_info_manifest(devlist, 64, &ndevs)) != FIDO_OK) {
        fprintf(stderr, "fido_dev_info_manifest: %s (0x%x)\n", fido_strerr(r), r);
        fido_dev_info_free(&devlist, 64);
        return 1;
    }

    printf("Found %zu FIDO2 device(s):\n", ndevs);

    for (size_t i = 0; i < ndevs; i++) {
        const fido_dev_info_t *di = fido_dev_info_ptr(devlist, i);
        printf("  [%zu] %s: vendor=0x%04x, product=0x%04x (%s %s)\n",
            i,
            fido_dev_info_path(di),
            (uint16_t)fido_dev_info_vendor(di),
            (uint16_t)fido_dev_info_product(di),
            fido_dev_info_manufacturer_string(di),
            fido_dev_info_product_string(di));
    }

    fido_dev_info_free(&devlist, 64);
    return 0;
}
/* Expected output:
Found 1 FIDO2 device(s):
  [0] /dev/hidraw5: vendor=0x1050, product=0x0407 (Yubico YubiKey OTP+FIDO+CCID)
*/
```

--------------------------------

### CMake: Linting Man Pages

Source: https://github.com/yubico/libfido2/blob/main/man/CMakeLists.txt

Custom CMake command to lint man pages using `mandoc -T lint`. It generates a `.lint` file for each man page and creates the file using `cmake -E touch` to ensure the dependency is met.

```cmake
add_custom_command(OUTPUT ${f}.lint
	COMMAND mandoc -T lint -W warning ${f}
	COMMAND ${CMAKE_COMMAND} -E touch ${f}.lint
	DEPENDS ${f})
```

--------------------------------

### FIDO Device Large Blob Handling in libfido2

Source: https://github.com/yubico/libfido2/blob/main/man/CMakeLists.txt

Functions for managing large data blobs on FIDO devices. This includes getting, setting, removing, and retrieving large blobs, as well as handling them as arrays.

```c
fido_dev_largeblob_get
fido_dev_largeblob_set
fido_dev_largeblob_remove
fido_dev_largeblob_get_array
fido_dev_largeblob_set_array
```

--------------------------------

### Define FIDO Version (CMake)

Source: https://github.com/yubico/libfido2/blob/main/CMakeLists.txt

This snippet defines the version of the FIDO library being built. It sets the major, minor, and patch versions as separate variables and then combines them into a single FIDO_VERSION string. This version information is often used for library naming, installation, or internal tracking.

```cmake
set(FIDO_MAJOR "1")
set(FIDO_MINOR "17")
set(FIDO_PATCH "0")
set(FIDO_VERSION ${FIDO_MAJOR}.${FIDO_MINOR}.${FIDO_PATCH})
```

--------------------------------

### Include Compatibility Source Files (CMake)

Source: https://github.com/yubico/libfido2/blob/main/examples/CMakeLists.txt

This snippet shows how to append OpenBSD compatibility source files to a list named COMPAT_SOURCES. These files are used to ensure compatibility across different operating systems. The list is conditionally extended for Windows builds that are not Cygwin or MSYS.

```cmake
list(APPEND COMPAT_SOURCES
	../openbsd-compat/clock_gettime.c
	../openbsd-compat/getopt_long.c
	../openbsd-compat/strlcat.c
	../openbsd-compat/strlcpy.c
)

if(WIN32 AND BUILD_SHARED_LIBS AND NOT CYGWIN AND NOT MSYS)
	list(APPEND COMPAT_SOURCES ../openbsd-compat/posix_win.c)
endif()
```

--------------------------------

### Define Executable Targets and Link Libraries (CMake)

Source: https://github.com/yubico/libfido2/blob/main/examples/CMakeLists.txt

This section demonstrates how to define executable targets in CMake, such as 'manifest', 'info', 'reset', 'cred', 'assert', 'setpin', 'retries', and 'select'. Each executable is built from specific source files, including the compatibility sources, and linked against a library identified by the variable '_FIDO2_LIBRARY'.

```cmake
# manifest
add_executable(manifest manifest.c ${COMPAT_SOURCES})
target_link_libraries(manifest ${_FIDO2_LIBRARY})

# info
add_executable(info info.c ${COMPAT_SOURCES})
target_link_libraries(info ${_FIDO2_LIBRARY})

# reset
add_executable(reset reset.c util.c ${COMPAT_SOURCES})
target_link_libraries(reset ${_FIDO2_LIBRARY})

# cred
add_executable(cred cred.c util.c ${COMPAT_SOURCES})
target_link_libraries(cred ${_FIDO2_LIBRARY})

# assert
add_executable(assert assert.c util.c ${COMPAT_SOURCES})
target_link_libraries(assert ${_FIDO2_LIBRARY})

# setpin
add_executable(setpin setpin.c ${COMPAT_SOURCES})
target_link_libraries(setpin ${_FIDO2_LIBRARY})

# retries
add_executable(retries retries.c ${COMPAT_SOURCES})
target_link_libraries(retries ${_FIDO2_LIBRARY})

# select
add_executable(select select.c ${COMPAT_SOURCES})
target_link_libraries(select ${_FIDO2_LIBRARY})
```

--------------------------------

### Conditional Subdirectory Inclusion in CMake

Source: https://github.com/yubico/libfido2/blob/main/CMakeLists.txt

This snippet demonstrates how CMake is used to conditionally include subdirectories in the build process. It checks various build flags to determine which parts of the project (tests, examples, tools, man pages, fuzzing, udev) are compiled. This allows for a flexible build configuration tailored to specific needs.

```cmake
message(STATUS "USE_WINHELLO: ${USE_WINHELLO}")
message(STATUS "NFC_LINUX: ${NFC_LINUX}")

if(BUILD_TESTS)
	enable_testing()
endif()

add_subdirectory(src)

if(BUILD_TESTS)
	add_subdirectory(regress)
endif()
if(BUILD_EXAMPLES)
	add_subdirectory(examples)
endif()
if(BUILD_TOOLS)
	add_subdirectory(tools)
endif()
if(BUILD_MANPAGES AND NOT MSVC)
	add_subdirectory(man)
endif()

if(NOT WIN32)
	if(FUZZ)
		add_subdirectory(fuzz)
	endif()
	if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
		add_subdirectory(udev)
	endif()
endif()
```

--------------------------------

### Open, Query, and Close FIDO Device (C)

Source: https://context7.com/yubico/libfido2/llms.txt

Manages FIDO device connections using `fido_dev_open()` and `fido_dev_close()`. After opening a device, its capabilities such as protocol version, FIDO2 support, and PIN support can be queried using various `fido_dev_*` functions. Requires `fido_init()` to be called first.

```c
#include <fido.h>
#include <stdio.h>
#include <stdlib.h>

int main(int argc, char **argv)
{
    fido_dev_t *dev;
    int r;

    if (argc != 2) {
        fprintf(stderr, "Usage: %s <device_path>\n", argv[0]);
        return 1;
    }

    fido_init(0);

    /* Allocate device handle */
    if ((dev = fido_dev_new()) == NULL) {
        fprintf(stderr, "fido_dev_new failed\n");
        return 1;
    }

    /* Open the device */
    if ((r = fido_dev_open(dev, argv[1])) != FIDO_OK) {
        fprintf(stderr, "fido_dev_open: %s (0x%x)\n", fido_strerr(r), r);
        fido_dev_free(&dev);
        return 1;
    }

    /* Query device capabilities */
    printf("Device: %s\n", argv[1]);
    printf("  Protocol: 0x%02x\n", fido_dev_protocol(dev));
    printf("  Version: %d.%d.%d\n", fido_dev_major(dev), 
           fido_dev_minor(dev), fido_dev_build(dev));
    printf("  Is FIDO2: %s\n", fido_dev_is_fido2(dev) ? "yes" : "no");
    printf("  Has PIN: %s\n", fido_dev_has_pin(dev) ? "yes" : "no");
    printf("  Supports UV: %s\n", fido_dev_supports_uv(dev) ? "yes" : "no");
    printf("  Supports credman: %s\n", fido_dev_supports_credman(dev) ? "yes" : "no");

    /* Close and free device */
    if ((r = fido_dev_close(dev)) != FIDO_OK) {
        fprintf(stderr, "fido_dev_close: %s (0x%x)\n", fido_strerr(r), r);
    }
    fido_dev_free(&dev);

    return 0;
}
/* Expected output:
Device: /dev/hidraw5
  Protocol: 0x02
  Version: 5.4.3
  Is FIDO2: yes
  Has PIN: yes
  Supports UV: no
  Supports credman: yes
*/
```

--------------------------------

### CMake: Generating Partial HTML Man Pages

Source: https://github.com/yubico/libfido2/blob/main/man/CMakeLists.txt

Custom CMake command to generate partial HTML man pages. It first copies a CSS file and then appends the HTML fragment output of `mandoc` to create a complete HTML snippet.

```cmake
string(REGEX REPLACE "\\.[13]$" "" g ${f})
add_custom_command(OUTPUT ${g}.partial
	COMMAND cat ${PROJECT_SOURCE_DIR}/man/dyc.css > ${g}.partial
	COMMAND mandoc -T html -O man=\"%N.html\",fragment ${f} >> ${g}.partial
	DEPENDS ${f})
```

--------------------------------

### Create FIDO2 Credential with libfido2 (C)

Source: https://context7.com/yubico/libfido2/llms.txt

This C code snippet demonstrates the process of creating a FIDO2 credential on a security key using the libfido2 library. It requires the device path and optionally a PIN. The function `fido_dev_make_cred` is used after configuring the credential parameters with functions like `fido_cred_set_type`, `fido_cred_set_clientdata`, `fido_cred_set_rp`, and `fido_cred_set_user`.

```c
#include <fido.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

/* Example client data (would normally be from WebAuthn) */
static const unsigned char client_data[32] = {
    0xf9, 0x64, 0x57, 0xe7, 0x2d, 0x97, 0xf6, 0xbb,
    0xdd, 0xd7, 0xfb, 0x06, 0x37, 0x62, 0xea, 0x26,
    0x20, 0x44, 0x8e, 0x69, 0x7c, 0x03, 0xf2, 0x31,
    0x2f, 0x99, 0xdc, 0xaf, 0x3e, 0x8a, 0x91, 0x6b,
};

/* Example user ID */
static const unsigned char user_id[32] = {
    0x78, 0x1c, 0x78, 0x60, 0xad, 0x88, 0xd2, 0x63,
    0x32, 0x62, 0x2a, 0xf1, 0x74, 0x5d, 0xed, 0xb2,
    0xe7, 0xa4, 0x2b, 0x44, 0x89, 0x29, 0x39, 0xc5,
    0x56, 0x64, 0x01, 0x27, 0x0d, 0xbb, 0xc4, 0x49,
};

int main(int argc, char **argv)
{
    fido_dev_t *dev;
    fido_cred_t *cred;
    const char *pin = NULL;
    int r;

    if (argc < 2) {
        fprintf(stderr, "Usage: %s <device_path> [pin]\n", argv[0]);
        return 1;
    }
    if (argc > 2) {
        pin = argv[2];
    }

    fido_init(0);

    /* Allocate and open device */
    if ((dev = fido_dev_new()) == NULL ||
        (r = fido_dev_open(dev, argv[1])) != FIDO_OK) {
        fprintf(stderr, "Failed to open device: %s\n", fido_strerr(r));
        return 1;
    }

    /* Allocate credential */
    if ((cred = fido_cred_new()) == NULL) {
        fprintf(stderr, "fido_cred_new failed\n");
        fido_dev_close(dev);
        fido_dev_free(&dev);
        return 1;
    }

    /* Set credential type (algorithm) */
    if ((r = fido_cred_set_type(cred, COSE_ES256)) != FIDO_OK) {
        fprintf(stderr, "fido_cred_set_type: %s\n", fido_strerr(r));
        goto cleanup;
    }

    /* Set client data */
    if ((r = fido_cred_set_clientdata(cred, client_data, sizeof(client_data))) != FIDO_OK) {
        fprintf(stderr, "fido_cred_set_clientdata: %s\n", fido_strerr(r));
        goto cleanup;
    }

    /* Set relying party */
    if ((r = fido_cred_set_rp(cred, "example.com", "Example Site")) != FIDO_OK) {
        fprintf(stderr, "fido_cred_set_rp: %s\n", fido_strerr(r));
        goto cleanup;
    }

    /* Set user information */
    if ((r = fido_cred_set_user(cred, user_id, sizeof(user_id),
                                 "alice", "Alice Smith", NULL)) != FIDO_OK) {
        fprintf(stderr, "fido_cred_set_user: %s\n", fido_strerr(r));
        goto cleanup;
    }

    /* Optional: Make it a resident/discoverable credential */
    if ((r = fido_cred_set_rk(cred, FIDO_OPT_TRUE)) != FIDO_OK) {
        fprintf(stderr, "fido_cred_set_rk: %s\n", fido_strerr(r));
        goto cleanup;
    }

    /* Optional: Request user verification */
    if ((r = fido_cred_set_uv(cred, FIDO_OPT_TRUE)) != FIDO_OK) {
        fprintf(stderr, "fido_cred_set_uv: %s\n", fido_strerr(r));
        goto cleanup;
    }

    printf("Touch your authenticator to create credential...\n");

    /* Create the credential on the device */
    if ((r = fido_dev_make_cred(dev, cred, pin)) != FIDO_OK) {
        fprintf(stderr, "fido_dev_make_cred: %s (0x%x)\n", fido_strerr(r), r);
        fido_dev_cancel(dev);
        goto cleanup;
    }

    printf("Credential created successfully!\n");
    printf("  Format: %s\n", fido_cred_fmt(cred));
    printf("  Credential ID length: %zu bytes\n", fido_cred_id_len(cred));
    printf("  Public key length: %zu bytes\n", fido_cred_pubkey_len(cred));

    /* Print credential ID in hex */
    printf("  Credential ID: ");
    const unsigned char *cred_id = fido_cred_id_ptr(cred);
    for (size_t i = 0; i < fido_cred_id_len(cred) && i < 32; i++) {
        printf("%02x", cred_id[i]);
    }
    if (fido_cred_id_len(cred) > 32) printf("...");
    printf("\n");

cleanup:
    fido_cred_free(&cred);
    fido_dev_close(dev);
    fido_dev_free(&dev);
    return r == FIDO_OK ? 0 : 1;
}
/* Expected output:
Touch your authenticator to create credential...
Credential created successfully!
  Format: packed
  Credential ID length: 64 bytes
  Public key length: 64 bytes
  Credential ID: 2b7a3f8e...
*/
```

--------------------------------

### Append Compatibility Source Files

Source: https://github.com/yubico/libfido2/blob/main/src/CMakeLists.txt

This command appends a list of compatibility source files to the `COMPAT_SOURCES` variable. These files provide implementations for functions or behaviors that are standard in POSIX systems but may be missing on Windows.

```cmake
list(APPEND COMPAT_SOURCES
	../openbsd-compat/bsd-asprintf.c
	../openbsd-compat/bsd-getpagesize.c
	../openbsd-compat/clock_gettime.c
	../openbsd-compat/endian_win32.c
	../openbsd-compat/explicit_bzero.c
	../openbsd-compat/explicit_bzero_win32.c
	../openbsd-compat/freezero.c
	../openbsd-compat/recallocarray.c
	../openbsd-compat/strlcat.c
	../openbsd-compat/timingsafe_bcmp.c
)
```

--------------------------------

### Define symlink targets for different man page formats in CMake

Source: https://github.com/yubico/libfido2/blob/main/man/CMakeLists.txt

This section calls the `define_symlink_target` macro to create symbolic links for man pages in different formats: standard (3), HTML, partial HTML, and gzipped (3.gz). This allows for flexible management of man page versions.

```cmake
define_symlink_target(man_symlink 3)
define_symlink_target(man_symlink_html html)
define_symlink_target(man_symlink_html_partial partial)
define_symlink_target(man_symlink_gzip 3.gz)
```

--------------------------------

### FIDO Device Operations in libfido2

Source: https://github.com/yubico/libfido2/blob/main/man/CMakeLists.txt

Core functions for opening, closing, and managing FIDO devices. This set includes operations for building, canceling, freeing devices, and checking various device capabilities and states like FIDO2 support, Windows Hello compatibility, and PIN/UV status.

```c
fido_dev_open
fido_dev_build
fido_dev_cancel
fido_dev_close
fido_dev_flags
fido_dev_force_fido2
fido_dev_force_u2f
fido_dev_free
fido_dev_has_pin
fido_dev_has_uv
fido_dev_is_fido2
fido_dev_is_winhello
fido_dev_major
fido_dev_minor
fido_dev_new
fido_dev_new_with_info
fido_dev_open_with_info
fido_dev_protocol
fido_dev_supports_cred_prot
fido_dev_supports_credman
fido_dev_supports_permissions
fido_dev_supports_pin
fido_dev_supports_uv
```

--------------------------------

### Link Additional Library for 'select' on MinGW (CMake)

Source: https://github.com/yubico/libfido2/blob/main/examples/CMakeLists.txt

This CMake snippet conditionally links the 'winpthread' library to the 'select' executable when the MINGW build environment is detected. This is necessary to provide the 'nanosleep()' function, which is required by the 'select' utility on MinGW.

```cmake
if(MINGW)
	# needed for nanosleep() in mingw
	target_link_libraries(select winpthread)
endif()
```

--------------------------------

### CMake: Copying Man Pages

Source: https://github.com/yubico/libfido2/blob/main/man/CMakeLists.txt

Custom CMake command to copy man page source files from the project's man directory to the build directory. This ensures man pages are available for subsequent processing.

```cmake
add_custom_command(OUTPUT ${f}
	COMMAND cp -f ${PROJECT_SOURCE_DIR}/man/${f} .
	DEPENDS ${f})
```

--------------------------------

### Device Information Management in libfido2

Source: https://github.com/yubico/libfido2/blob/main/man/CMakeLists.txt

Functions for retrieving and managing information about FIDO devices. This includes obtaining manifest data, freeing device info structures, and accessing specific details like manufacturer, path, and product strings.

```c
fido_dev_info_manifest
fido_dev_info_free
fido_dev_info_manufacturer_string
fido_dev_info_new
fido_dev_info_path
fido_dev_info_product
fido_dev_info_product_string
fido_dev_info_ptr
fido_dev_info_set
fido_dev_info_vendor
```
Tokens:
Raw