Change Ubuntu to seal to pcrs on firstboot

Consistent with changes for EL, seal PCRs on firstboot to extend the usefulness of some sealing.

confluent_osdeploy/ubuntu22.04/profiles/default/scripts/firstboot.sh

@@ -22,6 +22,18 @@ hostnamectl set-hostname $(grep ^NODENAME: /etc/confluent/confluent.info | awk '
 touch /etc/cloud/cloud-init.disabled
 source /etc/confluent/functions
 confluent_profile=$(grep ^profile: /etc/confluent/confluent.deploycfg|awk '{print $2}')
+if [ -e /etc/confluent/luks.key ]; then
+	tpm2pcrs=""
+	encryptboot=$(grep ^encryptboot: /target/etc/confluent/confluent.deploycfg | sed -e 's/^encryptboot://' -e 's/ //g')
+	case "$encryptboot" in
+		*pcrs=*)
+			tpm2pcrs=$(echo "$encryptboot" | sed -e 's/.*pcrs=//' -e 's/:.*//')
+			;;
+	esac
+	if [ -n "$tpm2pcrs" ]; then
+		run_remote tpm_luks_reseal.sh
+	fi
+fi
 export confluent_mgr confluent_profile
 run_remote_python confignet
 run_remote_parts firstboot.d

confluent_osdeploy/ubuntu22.04/profiles/default/scripts/post.sh

@@ -112,16 +112,7 @@ if [ -f /etc/confluent_lukspass ]; then
     chmod 000 /target/etc/confluent/luks.key
     lukspass=$(cat /etc/confluent_lukspass)
     chroot /target apt install libtss2-rc0
-
-    tpm2pcrs=""
-    encryptboot=$(grep ^encryptboot: /target/etc/confluent/confluent.deploycfg | sed -e 's/^encryptboot://' -e 's/ //g')
-    case "$encryptboot" in
-        *pcrs=*)
-            tpm2pcrs=$(echo "$encryptboot" | sed -e 's/.*pcrs=//' -e 's/:.*//')
-            ;;
-    esac
-
-    PASSWORD=$lukspass chroot /target  systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs="$tpm2pcrs" $CRYPTTAB_SOURCE
+    PASSWORD=$lukspass chroot /target  systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs="" $CRYPTTAB_SOURCE
     fetch_remote  systemdecrypt
     mv systemdecrypt /target/etc/initramfs-tools/scripts/local-top/systemdecrypt
     fetch_remote systemdecrypt-hook