From 0746b843d27af89ded7e6e29c5c6361bdaa5df7f Mon Sep 17 00:00:00 2001
From: Jarrod Johnson <jjohnson2@lenovo.com>
Date: Tue, 11 Aug 2026 08:43:25 -0400
Subject: [PATCH] Change Ubuntu to seal to pcrs on firstboot

Consistent with changes for EL, seal PCRs on firstboot to extend the usefulness of some sealing.
---
 .../profile}/scripts/tpm_luks_reseal.sh              |  0
 .../profiles/default/scripts/firstboot.sh            | 12 ++++++++++++
 .../ubuntu22.04/profiles/default/scripts/post.sh     | 11 +----------
 3 files changed, 13 insertions(+), 10 deletions(-)
 rename confluent_osdeploy/{el8/profiles/default => common/profile}/scripts/tpm_luks_reseal.sh (100%)

diff --git a/confluent_osdeploy/el8/profiles/default/scripts/tpm_luks_reseal.sh b/confluent_osdeploy/common/profile/scripts/tpm_luks_reseal.sh
similarity index 100%
rename from confluent_osdeploy/el8/profiles/default/scripts/tpm_luks_reseal.sh
rename to confluent_osdeploy/common/profile/scripts/tpm_luks_reseal.sh
diff --git a/confluent_osdeploy/ubuntu22.04/profiles/default/scripts/firstboot.sh b/confluent_osdeploy/ubuntu22.04/profiles/default/scripts/firstboot.sh
index 59560481..8677b0b7 100755
--- a/confluent_osdeploy/ubuntu22.04/profiles/default/scripts/firstboot.sh
+++ b/confluent_osdeploy/ubuntu22.04/profiles/default/scripts/firstboot.sh
@@ -22,6 +22,18 @@ hostnamectl set-hostname $(grep ^NODENAME: /etc/confluent/confluent.info | awk '
 touch /etc/cloud/cloud-init.disabled
 source /etc/confluent/functions
 confluent_profile=$(grep ^profile: /etc/confluent/confluent.deploycfg|awk '{print $2}')
+if [ -e /etc/confluent/luks.key ]; then
+	tpm2pcrs=""
+	encryptboot=$(grep ^encryptboot: /target/etc/confluent/confluent.deploycfg | sed -e 's/^encryptboot://' -e 's/ //g')
+	case "$encryptboot" in
+		*pcrs=*)
+			tpm2pcrs=$(echo "$encryptboot" | sed -e 's/.*pcrs=//' -e 's/:.*//')
+			;;
+	esac
+	if [ -n "$tpm2pcrs" ]; then
+		run_remote tpm_luks_reseal.sh
+	fi
+fi
 export confluent_mgr confluent_profile
 run_remote_python confignet
 run_remote_parts firstboot.d
diff --git a/confluent_osdeploy/ubuntu22.04/profiles/default/scripts/post.sh b/confluent_osdeploy/ubuntu22.04/profiles/default/scripts/post.sh
index 4b1d92f2..78e6b411 100755
--- a/confluent_osdeploy/ubuntu22.04/profiles/default/scripts/post.sh
+++ b/confluent_osdeploy/ubuntu22.04/profiles/default/scripts/post.sh
@@ -112,16 +112,7 @@ if [ -f /etc/confluent_lukspass ]; then
     chmod 000 /target/etc/confluent/luks.key
     lukspass=$(cat /etc/confluent_lukspass)
     chroot /target apt install libtss2-rc0
-
-    tpm2pcrs=""
-    encryptboot=$(grep ^encryptboot: /target/etc/confluent/confluent.deploycfg | sed -e 's/^encryptboot://' -e 's/ //g')
-    case "$encryptboot" in
-        *pcrs=*)
-            tpm2pcrs=$(echo "$encryptboot" | sed -e 's/.*pcrs=//' -e 's/:.*//')
-            ;;
-    esac
-
-    PASSWORD=$lukspass chroot /target  systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs="$tpm2pcrs" $CRYPTTAB_SOURCE
+    PASSWORD=$lukspass chroot /target  systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs="" $CRYPTTAB_SOURCE
     fetch_remote  systemdecrypt
     mv systemdecrypt /target/etc/initramfs-tools/scripts/local-top/systemdecrypt
     fetch_remote systemdecrypt-hook