From a3d3dcb4af6b09d23acd3b0653d6441c042e1e00 Mon Sep 17 00:00:00 2001
From: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
Date: Fri, 4 Sep 2026 22:58:22 +0200
Subject: [PATCH] Print the trustlet's rc on every enrol press, and let
 deploy-dev.sh pass extra flags

A refused enrolment sample is one of two things: an image the algorithm saw and
turned down (rc=0, samples remaining unchanged) or an error the trustlet never
got past (a negative rc). The touch line printed the count and the fid but not
the rc, so a run of twenty-two refusals in a row said nothing about which it was.
It does now.

EXTRA=... on deploy-dev.sh appends daemon flags, so a diagnostic session can
come up with --ta-log without editing the script or the unit by hand.
---
 implementations/main.cpp | 8 +++++++-
 packaging/deploy-dev.sh  | 7 +++++--
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/implementations/main.cpp b/implementations/main.cpp
index fa8bf03..fbe640e 100644
--- a/implementations/main.cpp
+++ b/implementations/main.cpp
@@ -1296,7 +1296,13 @@ public:
                     // exactly like "finished".
                     enrol.Observe(r.samplesRemaining, true);
                     if (r.fid != 0 && r.fid != ta::FidPoison) out.fid = r.fid;
-                    std::println("  touch: rem={} fid={:#x}", r.samplesRemaining, r.fid);
+                    // The rc is the trustlet's own word on the press. A refused
+                    // sample with rc=0 was seen and turned down by the
+                    // algorithm; a negative rc is an error it never got past.
+                    // Without this a run of 22 refusals says nothing about
+                    // which of the two it was.
+                    std::println("  touch: rem={} fid={:#x} rc={}{}", r.samplesRemaining,
+                                 r.fid, r.rc, r.rc ? std::format(" ({})", ta::StrError(r.rc)) : "");
                 }
                 if (ev == ta::Event::FingerReleased && pressHadTouch) {
                     // The press is over. Did it move the count?
diff --git a/packaging/deploy-dev.sh b/packaging/deploy-dev.sh
index 2cab772..de999f0 100755
--- a/packaging/deploy-dev.sh
+++ b/packaging/deploy-dev.sh
@@ -26,6 +26,7 @@ set -eu
 
 HOST=${1:-fp6usb4}
 CONFIG=${CONFIG:-}    # optional: a fingerprintd.json to install
+EXTRA=${EXTRA:-}      # optional: extra daemon flags, e.g. EXTRA=--ta-log
 SSH="ssh -o ConnectTimeout=8 -o BatchMode=yes $HOST"
 
 cd "$(dirname "$0")/.."
@@ -52,7 +53,8 @@ done
 rm -f /tmp/fingerprintd.new
 echo ">> copied"
 
-$SSH 'set -e
+# EXTRA crosses into the single-quoted remote script as a prefixed assignment.
+$SSH "EXTRA='$EXTRA'; "'set -e
 # Stop before the swap so the new binary is what starts, not the old inode.
 sudo systemctl stop fingerprintd-test 2>/dev/null || true
 sudo mv /tmp/fingerprintd.new /tmp/fingerprintd
@@ -76,7 +78,8 @@ sudo systemctl stop fingerprintd-test 2>/dev/null || true
 sleep 1
 sudo systemd-run --unit=fingerprintd-test --collect \
     /tmp/fingerprintd --daemon --verbose --edge-wake \
-    --sfs-root=/var/lib/fingerprintd/sfs --sfs-writable --rpmb-write >/dev/null
+    --sfs-root=/var/lib/fingerprintd/sfs --sfs-writable --rpmb-write $EXTRA >/dev/null
+[ -z "$EXTRA" ] || echo ">> extra daemon flags: $EXTRA"
 printf ">> daemon starting"
 # Scope the readiness check to THIS invocation. The journal persists across
 # restarts and reboots, so grepping the whole unit history matches the ready