Fix pcr extend

Using the subshell prevented variable from being set.

No longer use a subshell.

confluent_osdeploy/el10-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh

@@ -1,3 +1,32 @@
+
+pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+pcrhashalgo=sha256
+
+set_tpm_hashalgo() {
+    if [ -n "$confluent_tpm_hashalgo" ]; then
+        return 0
+    fi
+    tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null)
+    for algo in sha256 sha512 sha384; do
+        # Match only banks that actually have PCRs allocated (a digit in [ ... ]).
+        if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
+            confluent_tpm_hashalgo="$algo"
+            pcrhashalgo="$algo"
+            if [[ "$algo" == "sha256" ]]; then
+                pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+            elif [[ "$algo" == "sha384" ]]; then
+                pcrextendvalue=20aaa1073c215c8bc97ff8dc509dd63ff09eef9d2dfa4d8ef224ce372d80e5417e53840ef2fb72924c195f69396a27b9
+            elif [[ "$algo" == "sha512" ]]; then
+                pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb
+            fi
+            echo "$confluent_tpm_hashalgo"
+            return 0
+        fi
+    done
+    return 1
+}
+
+
 get_remote_apikey() {
     while [ -z "$confluent_apikey" ]; do
         /opt/confluent/bin/clortho $nodename $confluent_mgr > /etc/confluent/confluent.apikey
@@ -14,10 +43,10 @@ get_remote_apikey() {
             tmpdir=$(mktemp -d)
             cd $tmpdir
             tpm2_startauthsession --session=session.ctx
-            tpm_pcrbank=$(get_tpm_hashalgo)
-            tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy
+            set_tpm_hashalgo
+            tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy
             tpm2_createprimary -G ecc -Q --key-context=prim.ctx
-            (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${tpm_pcrbank}.policy --public=data.pub --private=data.priv -i - -C prim.ctx
+            (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${pcrhashalgo}.policy --public=data.pub --private=data.priv -i - -C prim.ctx
             tpm2_load -Q --parent-context=prim.ctx --public=data.pub --private=data.priv --name=confluent.apikey --key-context=data.ctx
             tpm2_evictcontrol -Q -c data.ctx
             tpm2_flushcontext session.ctx
@@ -27,32 +56,6 @@ get_remote_apikey() {
     done
 }
 
-pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
-
-get_tpm_hashalgo() {
-    if [ -n "$confluent_tpm_hashalgo" ]; then
-        echo "$confluent_tpm_hashalgo"
-        return 0
-    fi
-    tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null)
-    for algo in sha256 sha512 sha384; do
-        # Match only banks that actually have PCRs allocated (a digit in [ ... ]).
-        if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
-            confluent_tpm_hashalgo="$algo"
-            if [[ "$algo" == "sha256" ]]; then
-                pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
-            elif [[ "$algo" == "sha384" ]]; then
-                pcrextendvalue=20aaa1073c215c8bc97ff8dc509dd63ff09eef9d2dfa4d8ef224ce372d80e5417e53840ef2fb72924c195f69396a27b9
-            elif [[ "$algo" == "sha512" ]]; then
-                pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb
-            fi
-            echo "$confluent_tpm_hashalgo"
-            return 0
-        fi
-    done
-    return 1
-}
-
 root=1
 rootok=1
 netroot=confluent
@@ -108,8 +111,8 @@ lasthdl=""
 if [ -c /dev/tpmrm0 ]; then
     for hdl in $(tpm2_getcap handles-persistent|awk '{print $2}'); do
         tpm2_startauthsession --policy-session --session=session.ctx
-        tpm_pcrbank=$(get_tpm_hashalgo)
-        tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy
+        set_tpm_hashalgo
+        tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy
         unsealeddata=$(tpm2_unseal --auth=session:session.ctx -Q -c $hdl 2>/dev/null)
         tpm2_flushcontext session.ctx
         if [[ $unsealeddata == "CONFLUENT_APIKEY:"* ]]; then
@@ -184,7 +187,8 @@ while [ $ready = "0" ]; do
 done
 if [ ! -z "$autocons" ] && grep "textconsole: true" /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi
 if [ -c /dev/tpmrm0 ]; then
-    tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue}
+    set_tpm_hashalgo
+    tpm2_pcrextend 15:${pcrhashalgo}=${pcrextendvalue}
 fi
 umask $oldumask
 mkdir -p /run/NetworkManager/system-connections

confluent_osdeploy/el7-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh

@@ -1,8 +1,8 @@
 pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+pcrchashalgo=sha256
 
-get_tpm_hashalgo() {
+set_tpm_hashalgo() {
     if [ -n "$confluent_tpm_hashalgo" ]; then
-        echo "$confluent_tpm_hashalgo"
         return 0
     fi
     tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null)
@@ -10,6 +10,7 @@ get_tpm_hashalgo() {
         # Match only banks that actually have PCRs allocated (a digit in [ ... ]).
         if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
             confluent_tpm_hashalgo="$algo"
+            pcrhashalgo="$algo"
             if [[ "$algo" == "sha256" ]]; then
                 pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
             elif [[ "$algo" == "sha384" ]]; then
@@ -17,7 +18,6 @@ get_tpm_hashalgo() {
             elif [[ "$algo" == "sha512" ]]; then
                 pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb
             fi
-            echo "$confluent_tpm_hashalgo"
             return 0
         fi
     done
@@ -39,10 +39,10 @@ get_remote_apikey() {
             tmpdir=$(mktemp -d)
             cd $tmpdir
             tpm2_startauthsession --session=session.ctx
-            tpm_pcrbank=$(get_tpm_hashalgo)
-            tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy
+            set_tpm_hashalgo
+            tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy
             tpm2_createprimary -G ecc -Q --key-context=prim.ctx
-            (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${tpm_pcrbank}.policy --public=data.pub --private=data.priv -i - -C prim.ctx
+            (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${pcrhashalgo}.policy --public=data.pub --private=data.priv -i - -C prim.ctx
             tpm2_load -Q --parent-context=prim.ctx --public=data.pub --private=data.priv --name=confluent.apikey --key-context=data.ctx
             tpm2_evictcontrol -Q -c data.ctx
             tpm2_flushcontext session.ctx
@@ -105,8 +105,8 @@ lasthdl=""
 if [ -c /dev/tpmrm0 -a -x /usr/bin/tpm2_getcap ]; then
     for hdl in $(tpm2_getcap handles-persistent|awk '{print $2}'); do
         tpm2_startauthsession --policy-session --session=session.ctx
-        tpm_pcrbank=$(get_tpm_hashalgo)
-        tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy
+        set_tpm_hashalgo
+        tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy
         unsealeddata=$(tpm2_unseal --auth=session:session.ctx -Q -c $hdl 2>/dev/null)
         tpm2_flushcontext session.ctx
         if [[ $unsealeddata == "CONFLUENT_APIKEY:"* ]]; then
@@ -167,7 +167,8 @@ while [ $ready = "0" ]; do
 done
 if [ ! -z "$autocons" ] && grep textconsole: true /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi
 if [ -c /dev/tpmrm0 -a -x /usr/bin/tpm2_pcrextend ]; then
-    tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue}
+    set_tpm_hashalgo
+    tpm2_pcrextend 15:${pcrhashalgo}=${pcrextendvalue}
 fi
 umask $oldumask
 autoconfigmethod=$(grep ^ipv4_method: /etc/confluent/confluent.deploycfg |awk '{print $2}')

confluent_osdeploy/el8-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh

@@ -1,8 +1,8 @@
 pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+pcrhashalgo=sha256
 
-get_tpm_hashalgo() {
+set_tpm_hashalgo() {
     if [ -n "$confluent_tpm_hashalgo" ]; then
-        echo "$confluent_tpm_hashalgo"
         return 0
     fi
     tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null)
@@ -10,6 +10,7 @@ get_tpm_hashalgo() {
         # Match only banks that actually have PCRs allocated (a digit in [ ... ]).
         if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
             confluent_tpm_hashalgo="$algo"
+            pcrhashalgo="$algo"
             if [[ "$algo" == "sha256" ]]; then
                 pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
             elif [[ "$algo" == "sha384" ]]; then
@@ -17,7 +18,6 @@ get_tpm_hashalgo() {
             elif [[ "$algo" == "sha512" ]]; then
                 pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb
             fi
-            echo "$confluent_tpm_hashalgo"
             return 0
         fi
     done
@@ -40,10 +40,10 @@ get_remote_apikey() {
             tmpdir=$(mktemp -d)
             cd $tmpdir
             tpm2_startauthsession --session=session.ctx
-            tpm2_pcrbank=$(get_tpm_hashalgo)
-            tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm2_pcrbank}:15" --policy=pcr15.${tpm2_pcrbank}.policy
+            set_tpm_hashalgo
+            tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy
             tpm2_createprimary -G ecc -Q --key-context=prim.ctx
-            (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${tpm2_pcrbank}.policy --public=data.pub --private=data.priv -i - -C prim.ctx
+            (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${pcrhashalgo}.policy --public=data.pub --private=data.priv -i - -C prim.ctx
             tpm2_load -Q --parent-context=prim.ctx --public=data.pub --private=data.priv --name=confluent.apikey --key-context=data.ctx
             tpm2_evictcontrol -Q -c data.ctx
             tpm2_flushcontext session.ctx
@@ -109,8 +109,8 @@ lasthdl=""
 if [ -c /dev/tpmrm0 ]; then
     for hdl in $(tpm2_getcap handles-persistent|awk '{print $2}'); do
         tpm2_startauthsession --policy-session --session=session.ctx
-        tpm_pcrbank=$(get_tpm_hashalgo)
-        tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy
+        set_tpm_hashalgo
+        tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy
         unsealeddata=$(tpm2_unseal --auth=session:session.ctx -Q -c $hdl 2>/dev/null)
         tpm2_flushcontext session.ctx
         if [[ $unsealeddata == "CONFLUENT_APIKEY:"* ]]; then
@@ -216,7 +216,8 @@ while [ $ready = "0" ]; do
 done
 if [ ! -z "$autocons" ] && grep "textconsole: true" /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi
 if [ -c /dev/tpmrm0 ]; then
-    tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue}
+    set_tpm_hashalgo
+    tpm2_pcrextend 15:${pcrhashalgo}=${pcrextendvalue}
 fi
 umask $oldumask
 mkdir -p /run/NetworkManager/system-connections

confluent_osdeploy/el9-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh

@@ -1,8 +1,9 @@
 pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+pcrhashalgo=sha256
 
-get_tpm_hashalgo() {
+set_tpm_hashalgo() {
     if [ -n "$confluent_tpm_hashalgo" ]; then
-        echo "$confluent_tpm_hashalgo"
+        pcrhashalgo="$confluent_tpm_hashalgo"
         return 0
     fi
     tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null)
@@ -10,6 +11,7 @@ get_tpm_hashalgo() {
         # Match only banks that actually have PCRs allocated (a digit in [ ... ]).
         if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
             confluent_tpm_hashalgo="$algo"
+            pcrhashalgo="$algo"
             if [[ "$algo" == "sha256" ]]; then
                 pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
             elif [[ "$algo" == "sha384" ]]; then
@@ -23,6 +25,7 @@ get_tpm_hashalgo() {
     done
     return 1
 }
+
 get_remote_apikey() {
     while [ -z "$confluent_apikey" ]; do
         /opt/confluent/bin/clortho $nodename $confluent_mgr > /etc/confluent/confluent.apikey
@@ -39,10 +42,10 @@ get_remote_apikey() {
             tmpdir=$(mktemp -d)
             cd $tmpdir
             tpm2_startauthsession --session=session.ctx
-            tpm_pcrbank=$(get_tpm_hashalgo)
-            tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy
+            set_tpm_hashalgo
+            tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy
             tpm2_createprimary -G ecc -Q --key-context=prim.ctx
-            (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${tpm_pcrbank}.policy --public=data.pub --private=data.priv -i - -C prim.ctx
+            (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${pcrhashalgo}.policy --public=data.pub --private=data.priv -i - -C prim.ctx
             tpm2_load -Q --parent-context=prim.ctx --public=data.pub --private=data.priv --name=confluent.apikey --key-context=data.ctx
             tpm2_evictcontrol -Q -c data.ctx
             tpm2_flushcontext session.ctx
@@ -106,8 +109,8 @@ lasthdl=""
 if [ -c /dev/tpmrm0 ]; then
     for hdl in $(tpm2_getcap handles-persistent|awk '{print $2}'); do
         tpm2_startauthsession --policy-session --session=session.ctx
-        tpm_pcrbank=${get_tpm_hashalgo}
-        tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy
+        set_tpm_hashalgo
+        tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy
         unsealeddata=$(tpm2_unseal --auth=session:session.ctx -Q -c $hdl 2>/dev/null)
         tpm2_flushcontext session.ctx
         if [[ $unsealeddata == "CONFLUENT_APIKEY:"* ]]; then
@@ -182,7 +185,8 @@ while [ $ready = "0" ]; do
 done
 if [ ! -z "$autocons" ] && grep "textconsole: true" /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi
 if [ -c /dev/tpmrm0 ]; then
-    tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue}
+    set_tpm_hashalgo
+    tpm2_pcrextend 15:${pcrhashalgo}=${pcrextendvalue}
 fi
 umask $oldumask
 mkdir -p /run/NetworkManager/system-connections

confluent_osdeploy/genesis/initramfs/opt/confluent/bin/rungenesis

@@ -8,10 +8,10 @@ export LANG=en_US.utf8
 (while :; do TERM=linux tmux a <> /dev/tty1 >&0 2>&1; done) &
 
 pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+pcrhashalgo=sha256
 
-get_tpm_hashalgo() {
+set_tpm_hashalgo() {
     if [ -n "$confluent_tpm_hashalgo" ]; then
-        echo "$confluent_tpm_hashalgo"
         return 0
     fi
     tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null)
@@ -19,6 +19,7 @@ get_tpm_hashalgo() {
         # Match only banks that actually have PCRs allocated (a digit in [ ... ]).
         if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
             confluent_tpm_hashalgo="$algo"
+            pcrhashalgo="$algo"
             if [[ "$algo" == "sha256" ]]; then
                 pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
             elif [[ "$algo" == "sha384" ]]; then
@@ -26,7 +27,6 @@ get_tpm_hashalgo() {
             elif [[ "$algo" == "sha512" ]]; then
                 pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb
             fi
-            echo "$confluent_tpm_hashalgo"
             return 0
         fi
     done
@@ -137,8 +137,8 @@ oldumask=$(umask)
 umask 0077
 for hdl in $(tpm2_getcap handles-persistent|awk '{print $2}'); do
     tpm2_startauthsession --policy-session --session=session.ctx
-    tpm2_pcrbank=$(get_tpm_hashalgo)
-    tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm2_pcrbank}:15" --policy=pcr15.${tpm2_pcrbank}.policy
+    set_tpm_hashalgo
+    tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy
     unsealeddata=$(tpm2_unseal --auth=session:session.ctx -Q -c $hdl 2>/dev/null)
     tpm2_flushcontext session.ctx
     if [[ $unsealeddata == "CONFLUENT_APIKEY:"* ]]; then
@@ -165,8 +165,8 @@ if [ "$new_apikey" != "$confluent_apikey" ]; then
     tmpdir=$(mktemp -d)
     cd $tmpdir
     tpm2_startauthsession --session=session.ctx
-    tpm2_pcrbank=$(get_tpm_hashalgo)
-    tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm2_pcrbank}:15" --policy=pcr15.${tpm2_pcrbank}.policy
+    set_tpm_hashalgo
+    tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy
     tpm2_createprimary -G ecc -Q --key-context=prim.ctx
     (echo -n "CONFLUENT_APIKEY:$new_apikey") | tpm2_create -Q --policy=pcr15.${tpm2_pcrbank}.policy --public=data.pub --private=data.priv -i - -C prim.ctx
     tpm2_load -Q --parent-context=prim.ctx --public=data.pub --private=data.priv --name=confluent.apikey --key-context=data.ctx
@@ -175,7 +175,8 @@ if [ "$new_apikey" != "$confluent_apikey" ]; then
     cd - > /dev/null
     rm -rf $tmpdir
 fi
-tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue} 2> /dev/null
+set_tpm_hashalgo
+tpm2_pcrextend 15:${pcrhashalgo}=${pcrextendvalue} 2> /dev/null
 ifidx=$(cat /tmp/confluent.ifidx)
 ifname=$(ip link |grep ^$ifidx:|awk '{print $2}')
 ifname=${ifname%:}

confluent_osdeploy/suse15-diskless/initramfs/lib/dracut/hooks/cmdline/10-confluentdiskless.sh

@@ -1,8 +1,9 @@
 pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+pcrhashalgo=sha256
 
-get_tpm_hashalgo() {
+set_tpm_hashalgo() {
     if [ -n "$confluent_tpm_hashalgo" ]; then
-        echo "$confluent_tpm_hashalgo"
+        pcrhashalgo="$confluent_tpm_hashalgo"
         return 0
     fi
     tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null)
@@ -10,6 +11,7 @@ get_tpm_hashalgo() {
         # Match only banks that actually have PCRs allocated (a digit in [ ... ]).
         if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
             confluent_tpm_hashalgo="$algo"
+            pcrhashalgo="$algo"
             if [[ "$algo" == "sha256" ]]; then
                 pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
             elif [[ "$algo" == "sha384" ]]; then
@@ -17,7 +19,6 @@ get_tpm_hashalgo() {
             elif [[ "$algo" == "sha512" ]]; then
                 pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb
             fi
-            echo "$confluent_tpm_hashalgo"
             return 0
         fi
     done
@@ -38,11 +39,11 @@ get_remote_apikey() {
         else
             tmpdir=$(mktemp -d)
             cd $tmpdir
-            tpm_algo=$(get_tpm_hashalgo)
+            set_tpm_hashalgo
             tpm2_startauthsession --session=session.ctx
-            tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_algo}:15" --policy=pcr15.${tpm_algo}.policy
+            tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy
             tpm2_createprimary -G ecc -Q --key-context=prim.ctx
-            (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${tpm_algo}.policy --public=data.pub --private=data.priv -i - -C prim.ctx
+            (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${pcrhashalgo}.policy --public=data.pub --private=data.priv -i - -C prim.ctx
             tpm2_load -Q --parent-context=prim.ctx --public=data.pub --private=data.priv --name=confluent.apikey --key-context=data.ctx
             tpm2_evictcontrol -Q -c data.ctx
             tpm2_flushcontext session.ctx
@@ -105,8 +106,8 @@ cd $tpmdir
 lasthdl=""
 for hdl in $(tpm2_getcap handles-persistent|awk '{print $2}'); do
     tpm2_startauthsession --policy-session --session=session.ctx
-    tpm_algo=$(get_tpm_hashalgo)
-    tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_algo}:15" --policy=pcr15.${tpm_algo}.policy
+    set_tpm_hashalgo
+    tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy
     unsealeddata=$(tpm2_unseal --auth=session:session.ctx -Q -c $hdl 2>/dev/null)
     tpm2_flushcontext session.ctx
     if [[ $unsealeddata == "CONFLUENT_APIKEY:"* ]]; then
@@ -165,7 +166,8 @@ while [ $ready = "0" ]; do
     rm $tmperr
 done
 if [ ! -z "$autocons" ] && grep textconsole: true /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi
-tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue}
+set_tpm_hashalgo
+tpm2_pcrextend 15:${pcrhashalgo}=${pcrextendvalue}
 umask $oldumask
 autoconfigmethod=$(grep ipv4_method /etc/confluent/confluent.deploycfg |awk '{print $2}')
 if [ "$autoconfigmethod" = "dhcp" ]; then

confluent_osdeploy/ubuntu20.04-diskless/initramfs/scripts/init-premount/confluent

@@ -1,10 +1,10 @@
 #!/bin/sh
 
 pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+pcrhashalgo=sha256
 
-get_tpm_hashalgo() {
+set_tpm_hashalgo() {
     if [ -n "$confluent_tpm_hashalgo" ]; then
-        echo "$confluent_tpm_hashalgo"
         return 0
     fi
     tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null)
@@ -12,6 +12,7 @@ get_tpm_hashalgo() {
         # Match only banks that actually have PCRs allocated (a digit in [ ... ]).
         if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
             confluent_tpm_hashalgo="$algo"
+            pcrhashalgo="$algo"
             if [[ "$algo" == "sha256" ]]; then
                 pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
             elif [[ "$algo" == "sha384" ]]; then
@@ -19,7 +20,6 @@ get_tpm_hashalgo() {
             elif [[ "$algo" == "sha512" ]]; then
                 pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb
             fi
-            echo "$confluent_tpm_hashalgo"
             return 0
         fi
     done
@@ -32,8 +32,8 @@ get_tpm_apikey() {
     if [ -c /dev/tpmrm0 ]; then
         for hdl in $(tpm2_getcap handles-persistent|awk '{print $2}'); do
             tpm2_startauthsession --policy-session --session=session.ctx
-            tpm_pcrbank=$(get_tpm_hashalgo)
-            tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy
+            set_tpm_hashalgo
+            tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy
             unsealeddata=$(tpm2_unseal --auth=session:session.ctx -Q -c $hdl 2>/dev/null)
             tpm2_flushcontext session.ctx
             if echo $unsealeddata | grep "^CONFLUENT_APIKEY:" > /dev/null; then
@@ -69,10 +69,10 @@ get_remote_apikey() {
             tmpdir=$(mktemp -d)
             cd $tmpdir
             tpm2_startauthsession --session=session.ctx
-            tpm_pcrbank=$(get_tpm_hashalgo)
-            tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy
+            set_tpm_hashalgo
+            tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy
             tpm2_createprimary -G ecc -Q --key-context=prim.ctx
-            (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${tpm_pcrbank}.policy --public=data.pub --private=data.priv -i - -C prim.ctx
+            (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${pcrhashalgo}.policy --public=data.pub --private=data.priv -i - -C prim.ctx
             tpm2_load -Q --parent-context=prim.ctx --public=data.pub --private=data.priv --name=confluent.apikey --key-context=data.ctx
             tpm2_evictcontrol -Q -c data.ctx
             tpm2_flushcontext session.ctx
@@ -174,7 +174,8 @@ done
 mkdir -p /root/.ssh
 cat /ssh/*pubkey > /root/.ssh/authorized_keys
 if [ -c /dev/tpmrm0 ]; then
-    tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue}
+    set_tpm_hashalgo
+    tpm2_pcrextend 15:${pcrhashalgo}=${pcrextendvalue}
 fi
 confluent_profile=$(grep ^profile: /etc/confluent/confluent.deploycfg| awk '{print $2}')
 confluent_proto=$(grep ^protocol: /etc/confluent/confluent.deploycfg| awk '{print $2}')