From 135afd02518e3d976a9dc83e6e7aae0166ed20dd Mon Sep 17 00:00:00 2001
From: Aiden McClelland <me@drbonez.dev>
Date: Thu, 19 Feb 2026 23:26:16 -0700
Subject: [PATCH] fix: publish script dpkg-name, s3cfg fallback, and
 --reinstall for apply

---
 apt/start9.gpg            | Bin 0 -> 224 bytes
 build/apt/publish-deb.sh  |  24 ++++++++++++++++--------
 core/src/tunnel/update.rs |  11 ++---------
 3 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/apt/start9.gpg b/apt/start9.gpg
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..bb3bc2d3d19a7a624da6ba83b44d0b4bb003f3e0 100644
GIT binary patch
literal 224
zcmbPX%#u0%XR8>eHX9=g<1Kf7Mn-lA)e8?^XPGZ3QhXG8gsVPb#gn+72O4wgf4w=n
z*jR|?jKvo5;F83m5=#Y}l+-eZVlZ1TIX~B~V*-n?7#D+um?BF^*zNz)bAPh3$S*Go
zid_3gH~Ek_D-*~rCTV3>ZcYw%CN@znP7ZD+7BMDfMkYB%Ch-OaE=~cMV%}&*hHJ5z
zD-9W{{z@1dbSye{_KQl%WPPVK>ilnB?U0-y?5fM~S7b)*e8rAeJCFCvR6Kve+;ge!
T%&r=RMR!)D*;M+@@?!@81ng2X

literal 0
HcmV?d00001

diff --git a/build/apt/publish-deb.sh b/build/apt/publish-deb.sh
index 597c75cf9..b049e2796 100755
--- a/build/apt/publish-deb.sh
+++ b/build/apt/publish-deb.sh
@@ -38,8 +38,9 @@ if [ -n "$GPG_PRIVATE_KEY" ]; then
 fi
 
 # Configure s3cmd
-S3CMD_CONFIG="$(mktemp)"
-cat > "$S3CMD_CONFIG" <<EOF
+if [ -n "$S3_ACCESS_KEY" ] && [ -n "$S3_SECRET_KEY" ]; then
+    S3CMD_CONFIG="$(mktemp)"
+    cat > "$S3CMD_CONFIG" <<EOF
 [default]
 access_key = ${S3_ACCESS_KEY}
 secret_key = ${S3_SECRET_KEY}
@@ -47,10 +48,16 @@ host_base = $(echo "$ENDPOINT" | sed 's|https://||')
 host_bucket = %(bucket)s.$(echo "$ENDPOINT" | sed 's|https://||')
 use_https = True
 EOF
-
-s3() {
-    s3cmd -c "$S3CMD_CONFIG" "$@"
-}
+    s3() {
+        s3cmd -c "$S3CMD_CONFIG" "$@"
+    }
+else
+    # Fall back to default ~/.s3cfg
+    S3CMD_CONFIG=""
+    s3() {
+        s3cmd "$@"
+    }
+fi
 
 # Sync existing repo from S3
 echo "Syncing existing repo from s3://${BUCKET}/ ..."
@@ -75,12 +82,13 @@ if [ ${#DEB_FILES[@]} -eq 0 ]; then
     exit 1
 fi
 
-# Copy each deb to the pool
+# Copy each deb to the pool, renaming to standard format
 for deb in "${DEB_FILES[@]}"; do
     PKG_NAME="$(dpkg-deb --field "$deb" Package)"
     POOL_DIR="$REPO_DIR/pool/${COMPONENT}/${PKG_NAME:0:1}/${PKG_NAME}"
     mkdir -p "$POOL_DIR"
     cp "$deb" "$POOL_DIR/"
+    dpkg-name -o "$POOL_DIR/$(basename "$deb")" 2>/dev/null || true
     echo "Added: $(basename "$deb") -> pool/${COMPONENT}/${PKG_NAME:0:1}/${PKG_NAME}/"
 done
 
@@ -126,5 +134,5 @@ fi
 echo "Uploading to s3://${BUCKET}/ ..."
 s3 sync --acl-public --no-mime-magic "$REPO_DIR/" "s3://${BUCKET}/"
 
-rm -f "$S3CMD_CONFIG"
+[ -n "$S3CMD_CONFIG" ] && rm -f "$S3CMD_CONFIG"
 echo "Done."
diff --git a/core/src/tunnel/update.rs b/core/src/tunnel/update.rs
index 58739cf26..fe4a2b748 100644
--- a/core/src/tunnel/update.rs
+++ b/core/src/tunnel/update.rs
@@ -63,23 +63,16 @@ pub async fn apply_update(_ctx: TunnelContext, _: Empty) -> Result<TunnelUpdateR
     let installed = parse_version_field(&policy_str, "Installed:");
     let candidate = parse_version_field(&policy_str, "Candidate:");
 
-    if installed == candidate {
-        return Ok(TunnelUpdateResult {
-            status: "up-to-date".to_string(),
-            installed: installed.unwrap_or_default(),
-            candidate: candidate.unwrap_or_default(),
-        });
-    }
-
     // Spawn in a separate cgroup via systemd-run so the process survives
     // when the postinst script restarts start-tunneld.service.
     // After the install completes, reboot the system.
+    // Uses --reinstall so the update applies even when versions match.
     Command::new("systemd-run")
         .arg("--scope")
         .arg("--")
         .arg("sh")
         .arg("-c")
-        .arg("apt-get install --only-upgrade -y start-tunnel && reboot")
+        .arg("apt-get install --reinstall -y start-tunnel && reboot")
         .env("DEBIAN_FRONTEND", "noninteractive")
         .stdin(Stdio::null())
         .stdout(Stdio::null())