From 07dd7dd4d2efe102f15cfa452c6f045c642f1e71 Mon Sep 17 00:00:00 2001
From: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
Date: Sat, 5 Sep 2026 01:02:56 +0200
Subject: [PATCH] deploy-dev.sh: install the config that was asked for, not the
 one left in /tmp

CONFIG=<path> copied the file to /tmp under its own basename, while the remote
half installed /tmp/fingerprintd.json. A config named anything else therefore
left the PREVIOUS deploy's fingerprintd.json in place and installed that, while
printing ">> config installed" either way.

It went unnoticed until the printed config hash did not move after a deliberate
change, which is the only reason the hashes are printed at all. An experiment had
already been deployed against the wrong config by then.

The file now crosses under a fixed name, and a deploy with no CONFIG removes any
stale one on the phone rather than leaving something for a later run to pick up
by accident.
---
 packaging/deploy-dev.sh | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/packaging/deploy-dev.sh b/packaging/deploy-dev.sh
index de999f0..0c8956e 100755
--- a/packaging/deploy-dev.sh
+++ b/packaging/deploy-dev.sh
@@ -43,14 +43,29 @@ echo "   $(sha256sum "$BIN" | cut -c1-16)"
 #
 # The phone also drops off the network transiently, which IS worth retrying.
 cp "$BIN" /tmp/fingerprintd.new
+# The config is copied under a FIXED name, because the remote half installs
+# /tmp/fingerprintd.json and a file arriving under its own basename would leave
+# a STALE fingerprintd.json in place -- which reads as ">> config installed"
+# while installing the previous config. That silently invalidated one
+# experiment before it was caught by the printed hash not moving.
+CFGTMP=""
+if [ -n "$CONFIG" ]; then
+    [ -f "$CONFIG" ] || { echo "config not found: $CONFIG" >&2; exit 1; }
+    CFGTMP=/tmp/fingerprintd.json.deploy
+    cp "$CONFIG" "$CFGTMP"
+    echo ">> config $CONFIG ($(sha256sum "$CONFIG" | cut -c1-16))"
+else
+    # Nothing to install, and nothing stale must be left behind to install.
+    ssh -o ConnectTimeout=8 -o BatchMode=yes "$HOST" 'rm -f /tmp/fingerprintd.json' 2>/dev/null || true
+fi
 i=0
 until scp -o ConnectTimeout=8 -o BatchMode=yes -q \
         /tmp/fingerprintd.new packaging/fpenrol.sh packaging/fptrial.sh packaging/fplearn.sh \
-        ${CONFIG:+"$CONFIG"} "$HOST:/tmp/"; do
+        ${CFGTMP:+"$CFGTMP"} "$HOST:/tmp/"; do
     i=$((i+1)); [ $i -lt 6 ] || { echo "scp failed 6 times" >&2; rm -f /tmp/fingerprintd.new; exit 1; }
     echo "   scp retry $i"; sleep 5
 done
-rm -f /tmp/fingerprintd.new
+rm -f /tmp/fingerprintd.new "$CFGTMP"
 echo ">> copied"
 
 # EXTRA crosses into the single-quoted remote script as a prefixed assignment.
@@ -59,8 +74,9 @@ $SSH "EXTRA='$EXTRA'; "'set -e
 sudo systemctl stop fingerprintd-test 2>/dev/null || true
 sudo mv /tmp/fingerprintd.new /tmp/fingerprintd
 sudo chmod +x /tmp/fingerprintd /tmp/fpenrol.sh /tmp/fptrial.sh /tmp/fplearn.sh
-if [ -f /tmp/fingerprintd.json ]; then
-    sudo cp /tmp/fingerprintd.json /lib/firmware/fingerprintd.json
+if [ -f /tmp/fingerprintd.json.deploy ]; then
+    sudo cp /tmp/fingerprintd.json.deploy /lib/firmware/fingerprintd.json
+    rm -f /tmp/fingerprintd.json.deploy
     echo ">> config installed"
 fi
 if ! lsmod | grep -q "^qcomtee"; then