From 7677267adafaa0f721fe1909b465afb7c5b66d7a Mon Sep 17 00:00:00 2001
From: Jarrod Johnson <jjohnson2@lenovo.com>
Date: Tue, 11 Aug 2026 09:23:36 -0400
Subject: [PATCH] Change TPM reseal to be more generic

The crypttab in Ubuntu does not have that indication.  Instead just iterate through
crypttab devices and for any tpm2 sealed ones, reseal them.
---
 .../common/profile/scripts/tpm_luks_reseal.sh | 33 ++++++++++---------
 1 file changed, 18 insertions(+), 15 deletions(-)

diff --git a/confluent_osdeploy/common/profile/scripts/tpm_luks_reseal.sh b/confluent_osdeploy/common/profile/scripts/tpm_luks_reseal.sh
index d5b02b6f..349d6da7 100644
--- a/confluent_osdeploy/common/profile/scripts/tpm_luks_reseal.sh
+++ b/confluent_osdeploy/common/profile/scripts/tpm_luks_reseal.sh
@@ -99,22 +99,25 @@ while IFS= read -r line; do
     [[ "$line" =~ ^[[:space:]]*# ]] && continue
     [[ -z "$line" ]] && continue
     
-    # Check if line contains tpm2-device
-    if [[ "$line" =~ tpm2-device ]]; then
-        # Extract the second column (device or UUID)
-        device=$(echo "$line" | awk '{print $2}')
+   
+    device=$(echo "$line" | awk '{print $2}')
+    
+    # If it's a UUID, convert to device name
+    if [[ "$device" =~ ^UUID= ]]; then
+        device=$(blkid -U "${device#UUID=}")
+    fi
+
+    if [ -e /bin/systemd-cryptenroll ]; then
+        systemd-cryptenroll "$device" | grep -q "tpm2" || continue
+    else
+        clevis luks list -d "$device" | grep -q "tpm2" || continue
+    fi
         
-        # If it's a UUID, convert to device name
-        if [[ "$device" =~ ^UUID= ]]; then
-            device=$(blkid -U "${device#UUID=}")
-        fi
-        
-        # Process the device
-        if [[ -n "$device" ]]; then
-            reseal_luks "$device"
-        else
-            echo "Warning: Could not determine device for line: $line" >&2
-        fi
+    # Process the device
+    if [[ -n "$device" ]]; then
+        reseal_luks "$device"
+    else
+        echo "Warning: Could not determine device for line: $line" >&2
     fi
 done < /etc/crypttab