comment about token location ordering

Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)

trustmanager/yubikeystore.go

@@ -38,6 +38,8 @@ const (
 // what key mode to use when generating keys
 var (
 	yubikeyKeymode = KeymodeTouch | KeymodePinOnce
+	// order in which to prefer token locations on the yubikey.
+	// corresponds to: 9c, 9e, 9d, 9a
 	slotIDs = []int{2, 1, 3, 0}
 )
 
@@ -525,9 +527,11 @@ func getNextEmptySlot(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) ([]byte, er
 			}
 		}
 	}
-	for _, i := range slotIDs {
-		if !taken[i] {
-			return []byte{byte(i)}, nil
+	// iterate the token locations in our preferred order and use the first
+	// available one. Otherwise exit the loop and return an error.
+	for _, loc := range slotIDs {
+		if !taken[loc] {
+			return []byte{byte(loc)}, nil
 		}
 	}
 	return nil, errors.New("Yubikey has no available slots.")