From a36e00bdc5a3a22e923bf02b4ef109abc4a56501 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pascal=20Eng=C3=A9libert?= <tuxmain@zettascript.org>
Date: Fri, 5 Dec 2025 14:20:05 +0100
Subject: [PATCH] Fix cert command

---
 README.md |  2 +-
 exp.py    | 13 +++++++++----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index a44c4b8..a223fff 100644
--- a/README.md
+++ b/README.md
@@ -283,7 +283,7 @@ Add the domains the `/etc/hosts`:
 Install sa:
 
 ```bash
-sudo apt install acct
+sudo apt install acct python3-invoke python3-fabric
 sudo chmod +s /sbin/sa
 ```
 
diff --git a/exp.py b/exp.py
index 0f305ec..6aacece 100644
--- a/exp.py
+++ b/exp.py
@@ -244,6 +244,9 @@ for(var i in names) {
 }
 """
 
+for config in CONFIGS:
+	CONFIGS[config]["name"] = config
+
 def getargv(arg:str, default="", n:int=1, args:list=sys.argv):
 	if arg in args and len(args) > args.index(arg)+n:
 		return args[args.index(arg)+n]
@@ -557,6 +560,7 @@ def run_exp(config, only_record=None, idle=False):
 	expdir = config["expdir"]
 	log_backup_dir = config["log_backup_dir"]
 	p2_path = config["p2_repodir"]
+	config_name = config["name"]
 	wattmeter = None
 	if config["wattmeter"]:
 		errmsg = YRefParam()
@@ -636,10 +640,10 @@ def run_exp(config, only_record=None, idle=False):
 		first_set = True
 		for impl in exp["impls"]:
 			for alg in exp["cert"]:
+				choose_cert_alg(expdir, alg)
+				ssh_run(ssh, f"python {p2_path}/exp.py cert {config_name} {alg}")
 				for kex in exp["kexes"]:
 					for cipher in exp["ciphers"]:
-						choose_cert_alg(expdir, alg)
-						ssh_run(ssh, f"python {p2_path}/exp.py cert {alg}")
 						for setup in config["setups"]:
 							if SETUPS[setup]["tls_invariant"] and not first_set:
 								continue
@@ -783,7 +787,7 @@ if __name__ == "__main__":
 	if len(sys.argv) < 2 or sys.argv[1] in ["h", "help", "?", "-h", "-help", "--help", "/?"]:
 		print("""Options:
   make <config> [-c]     Create everything
-  cert <alg>             Select cert signature algorithm
+  cert <config> <alg>    Select cert signature algorithm
   send <config>          Send configs and certs to p2
   update-certs <config>  Update system's certs
   run <config>           Run experiment
@@ -816,10 +820,11 @@ Run options:
 		make_ca = "-c" in sys.argv
 		make_everything(config["expdir"], DOMAINS, make_ca, config["p3_suffix"], config["p3_port_plain"], config["p3_port_tls"])
 	elif opt == "cert":
-		alg = sys.argv[2]
+		alg = sys.argv[3]
 		if not alg in CERT_SIGN_ALGS:
 			print("Error: alg must be in", CERT_SIGN_ALGS)
 			exit(1)
+		config = CONFIGS[sys.argv[2]]
 		choose_cert_alg(config["expdir"], alg)
 	elif opt == "send":
 		config = CONFIGS[sys.argv[2]]