fix: close all cards on exit

This fixes a bug where if piv-agent exited due to an idle or exit timer
then connections to the card were left in pcscd, and then when piv-agent
started up again it couldn't (re)open the card.

cmd/piv-agent/serve.go

@@ -50,6 +50,7 @@ func (cmd *ServeCmd) Run(log *zap.Logger) error {
 	log.Info("startup", zap.String("version", version),
 		zap.String("build date", date))
 	p := piv.New(log)
+	defer p.CloseAll()
 	// use FDs passed via socket activation
 	ls, err := sockets.Get(validAgents)
 	if err != nil {

internal/keyservice/piv/keyservice.go

@@ -138,3 +138,11 @@ func (p *KeyService) GetDecrypter(keygrip []byte) (crypto.Decrypter, error) {
 	}
 	return &ECDHKey{ecdsa: ecdsaPrivKey}, nil
 }
+
+// CloseAll closes all security keys without checking for errors.
+// This should be called to clean up connections to `pcscd`.
+func (p *KeyService) CloseAll() {
+	for _, k := range p.securityKeys {
+		_ = k.Close()
+	}
+}