The main blocker is the current WebAuthn library depends on the gmp extension, which the tarball currently doesn't. That dependency should be removed or be made a core dependency.

Unless I'm missing something, it doesn't actually.

A few of the dependencies in require have ext-bcmath and/or ext-gmp in suggest... And that is only for performance reasons, suggesting there's fallbacks in most (all?) of them

They both provide secondary authenication factors, and quite different ones. Conceptually there shouldn't be much reason to merge. If one depends on the other, that might be a sign that the common piece of functionality should be in core?

In T303495#8485761, @Tgr wrote:

They both provide secondary authenication factors, and quite different ones. Conceptually there shouldn't be much reason to merge.

Indeed, it's mostly for practical reasons:

• Easier to refactor OATHAuth if all the code was in one Git repository
• Easier for sysadmins to enable 2FA support on their wiki if it's just one extension rather than two

If one depends on the other, that might be a sign that the common piece of functionality should be in core?

Maybe... 🤔

FWIW, the main reason it was split originally was it required newer PHP version than WMF had at the time, so it was easier to split it and allow development in a seperate (non deployed, at the time) repo...