Let build-deb.sh build with Cargo features, and mark the version when it does

A measurement run needs the .deb built with a non-default feature, and the
script had no way to express that: its argument loop took only --target,
--version and --no-build, and nothing forwarded a feature list or read one
from the environment. --features <list> now forwards to cargo-deb's native
-F.

The marking is the half that is easy to skip and matters more. The
auto-derived dev Version is built from the crate version, the commit date
and the sha, none of which change when a feature is enabled, so an
instrumented package and a default package of the same commit carried
byte-identical versions. Two consequences, and the second is worse than
the first: the node offers no way to tell which one it is running, and
reverting is an install of a version already present, which no-ops
silently and leaves the instrumented binary in place. That is precisely
the failure the per-commit version was introduced to prevent, reappearing
one level down. The Version now carries a +<features> marker, folded to
dots since underscores and commas are not legal there.

The marker sorts above the unmarked build, checked with dpkg
--compare-versions rather than assumed, so installing a feature build is
an upgrade and reverting is a downgrade: revert with dpkg -i, not apt
install. The ~dev ordering below a tagged release is preserved.

--features is refused together with --no-build, which would stamp the
marker onto whatever binaries happened to be sitting in target/ while
claiming the features had reached them.

Verified end to end rather than by reading: a real --features profiling
build produces a package whose fipsctl accepts the profile subcommand and
whose daemon carries the capture-file header text that only exists under
the feature gate. The release packaging path is untouched, shown by
diffing the cargo invocation the old and new scripts produce across five
argument shapes including the --version/--no-build pair the packaging
workflow uses; all five are identical.

Authored on master rather than maint, which takes bug fixes and CI or
tooling changes but not new capability, so the three copies of this
script now differ by design.

CHANGELOG.md

@@ -21,6 +21,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `LogsDirectory=fips` was added to the packaged systemd units so the capture
   directory is created and cleaned up declaratively.
 
+- `packaging/debian/build-deb.sh --features <list>` builds the `.deb` with a
+  Cargo feature list, which is how an instrumented package is produced for a
+  measurement run. The auto-derived dev Version gains a matching `+<features>`
+  marker, so a feature build and a default build of the same commit are no
+  longer indistinguishable: without it the two carry byte-identical versions,
+  an install of one over the other is an apt no-op, and the running node offers
+  no way to tell which one it has. The marker sorts above the unmarked build, so
+  installing a feature build is an upgrade and reverting to the default build is
+  a downgrade — revert with `dpkg -i` rather than `apt install`. `--features` is
+  refused together with `--no-build`, which would stamp the marker onto binaries
+  the features never reached.
+
 ### Changed
 
 - The Ethernet transport's per-interface `discovery` flag was renamed to

packaging/debian/build-deb.sh

@@ -2,6 +2,7 @@
 # Build a .deb package for FIPS using cargo-deb.
 #
 # Usage: ./build-deb.sh [--target <triple>] [--version <version>] [--no-build]
+#                       [--features <list>]
 #
 # Prerequisites: cargo-deb (install with: cargo install cargo-deb)
 # Output: deploy/fips_<version>_<arch>.deb
@@ -19,6 +20,9 @@ Options:
   --target <triple>   Rust target triple to build/package
   --version <version> Override Debian package version
   --no-build          Package existing binaries without running cargo build
+  --features <list>   Cargo features to build with (comma-separated). Marks the
+                      auto-derived Version so the package is distinguishable
+                      from a default build of the same commit.
   -h, --help          Show this help
 EOF
 }
@@ -26,6 +30,7 @@ EOF
 TARGET_TRIPLE=""
 VERSION_OVERRIDE=""
 NO_BUILD=0
+FEATURES=""
 
 while [[ $# -gt 0 ]]; do
     case "$1" in
@@ -41,6 +46,10 @@ while [[ $# -gt 0 ]]; do
             NO_BUILD=1
             shift
             ;;
+        --features)
+            FEATURES="${2:?missing value for --features}"
+            shift 2
+            ;;
         -h|--help)
             usage
             exit 0
@@ -53,6 +62,16 @@ while [[ $# -gt 0 ]]; do
     esac
 done
 
+# A feature build that skips the build step would stamp a feature-marked Version
+# onto whatever binaries already sit in target/, which is the one outcome the
+# marking exists to prevent. Refuse rather than emit a package that misdescribes
+# itself.
+if [[ -n "${FEATURES}" && "${NO_BUILD}" -eq 1 ]]; then
+    echo "--features cannot be combined with --no-build: the features would not" >&2
+    echo "reach the binaries, but the Version would claim they had." >&2
+    exit 1
+fi
+
 cd "${PROJECT_ROOT}"
 
 # Ensure cargo-deb is available
@@ -81,13 +100,33 @@ if [[ -z "${VERSION_OVERRIDE}" ]]; then
         if [[ -n "$(git status --porcelain 2>/dev/null)" ]]; then
             DIRTY_SUFFIX=".dirty"
         fi
-        # Debian Version: <upstream>~dev+git<YYYYMMDD>.<sha>[.dirty]-1
+        # A feature build of a given commit is a different package from the
+        # default build of that same commit, but nothing else in this version
+        # says so: the crate version, the date and the sha are all identical.
+        # Without a marker the two are byte-identical versions, so installing
+        # one over the other is an apt no-op (the very failure the per-commit
+        # version above exists to prevent) and the node offers no way to tell
+        # which one it is running. Underscores and commas are not legal in a
+        # Debian version, so the feature list is folded to dots.
+        FEATURE_SUFFIX=""
+        if [[ -n "${FEATURES}" ]]; then
+            FEATURE_SUFFIX="+$(printf '%s' "${FEATURES}" | tr -c 'a-zA-Z0-9.' '.')"
+        fi
+        # Debian Version: <upstream>~dev+git<YYYYMMDD>.<sha>[.dirty][+<features>]-1
         # The "~" makes every dev build sort BEFORE the eventual tagged
         # release; the date+sha makes consecutive dev builds compare as
         # different versions; the trailing "-1" is the Debian revision.
-        VERSION_OVERRIDE="${BASE_VERSION}~dev+git${GIT_DATE}.${GIT_SHA}${DIRTY_SUFFIX}-1"
+        # The feature suffix sorts ABOVE the unsuffixed build, so installing a
+        # feature build is an upgrade and reverting to the default build is a
+        # downgrade — which apt refuses without being told to, and `dpkg -i`
+        # performs. Revert with `dpkg -i`, not `apt install`.
+        VERSION_OVERRIDE="${BASE_VERSION}~dev+git${GIT_DATE}.${GIT_SHA}${DIRTY_SUFFIX}${FEATURE_SUFFIX}-1"
         echo "Auto-derived dev Version: ${VERSION_OVERRIDE}"
     fi
+elif [[ -n "${FEATURES}" ]]; then
+    echo "Warning: --version was given with --features, so the Version carries no" >&2
+    echo "feature marker and this package is indistinguishable from a default" >&2
+    echo "build of the same commit. Mark it yourself if that matters." >&2
 fi
 
 # Build the .deb package
@@ -105,6 +144,9 @@ fi
 if [[ "${NO_BUILD}" -eq 1 ]]; then
     cargo_args+=(--no-build)
 fi
+if [[ -n "${FEATURES}" ]]; then
+    cargo_args+=(--features "${FEATURES}")
+fi
 cargo "${cargo_args[@]}"
 
 # Move output to deploy/