From 02b2eb9ede088c87b88a853b5f029eaa0353ed12 Mon Sep 17 00:00:00 2001
From: lzwind <100665065+lzwind@users.noreply.github.com>
Date: Wed, 5 Aug 2026 15:59:47 +0800
Subject: [PATCH] man: clarify that --fido2-with-user-presence= may not be
 supported (#43266)

Reword the note for --fido2-with-user-presence= to make it clear that the
setting has no effect if the token does not support the up feature, or does
not allow the user presence requirement to be enabled or disabled for the
requested operation. Drop the surrounding parentheses and the spurious
"in other contexts" qualifier.

Apply the same rewording to the sibling --fido2-with-client-pin= and
--fido2-with-user-verification= options so the three parallel FIDO2
entries stay consistent.

Fixes #23632.
---
 man/systemd-cryptenroll.xml | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/man/systemd-cryptenroll.xml b/man/systemd-cryptenroll.xml
index 94cab54ad7..d0dc8e75cf 100644
--- a/man/systemd-cryptenroll.xml
+++ b/man/systemd-cryptenroll.xml
@@ -538,9 +538,9 @@
 
         <listitem><para>When enrolling a FIDO2 security token, controls whether to require the user to enter
         a PIN when unlocking the volume (the FIDO2 <literal>clientPin</literal> feature). Defaults to
-        <literal>yes</literal>. (Note: this setting is without effect if the security token does not support
-        the <literal>clientPin</literal> feature at all, or does not allow enabling or disabling
-        it.)</para>
+        <literal>yes</literal>. Note that this setting has no effect if the security token does not
+        support the <literal>clientPin</literal> feature, or does not allow the client PIN requirement
+        to be enabled or disabled for the requested operation.</para>
 
         <xi:include href="version-info.xml" xpointer="v249"/></listitem>
       </varlistentry>
@@ -550,9 +550,9 @@
 
         <listitem><para>When enrolling a FIDO2 security token, controls whether to require the user to
         verify presence (tap the token, the FIDO2 <literal>up</literal> feature) when unlocking the volume.
-        Defaults to <literal>yes</literal>. (Note: this setting is without effect if the security token does not support
-        the <literal>up</literal> feature at all, or does not allow enabling or disabling it.)
-        </para>
+        Defaults to <literal>yes</literal>. Note that this setting has no effect if the security token does not
+        support the <literal>up</literal> feature, or does not allow the user presence requirement to be
+        enabled or disabled for the requested operation.</para>
 
         <xi:include href="version-info.xml" xpointer="v249"/></listitem>
       </varlistentry>
@@ -562,8 +562,9 @@
 
         <listitem><para>When enrolling a FIDO2 security token, controls whether to require user verification
         when unlocking the volume (the FIDO2 <literal>uv</literal> feature). Defaults to
-        <literal>no</literal>. (Note: this setting is without effect if the security token does not support
-        the <literal>uv</literal> feature at all, or does not allow enabling or disabling it.)</para>
+        <literal>no</literal>. Note that this setting has no effect if the security token does not
+        support the <literal>uv</literal> feature, or does not allow the user verification requirement
+        to be enabled or disabled for the requested operation.</para>
 
         <xi:include href="version-info.xml" xpointer="v249"/></listitem>
       </varlistentry>