From ae664717e4bcaeff112774e95a515a9a6618f425 Mon Sep 17 00:00:00 2001 From: Jarrod Johnson Date: Tue, 11 Aug 2026 11:46:37 -0400 Subject: [PATCH] Fix Ubuntu encrypted OS volume setup Actually install the dependencies needed, and correct path to detect need to re-seal when PCRs requested --- .../ubuntu22.04/profiles/default/scripts/firstboot.sh | 2 +- confluent_osdeploy/ubuntu22.04/profiles/default/scripts/post.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/confluent_osdeploy/ubuntu22.04/profiles/default/scripts/firstboot.sh b/confluent_osdeploy/ubuntu22.04/profiles/default/scripts/firstboot.sh index 8677b0b7..dc8bbb0c 100755 --- a/confluent_osdeploy/ubuntu22.04/profiles/default/scripts/firstboot.sh +++ b/confluent_osdeploy/ubuntu22.04/profiles/default/scripts/firstboot.sh @@ -24,7 +24,7 @@ source /etc/confluent/functions confluent_profile=$(grep ^profile: /etc/confluent/confluent.deploycfg|awk '{print $2}') if [ -e /etc/confluent/luks.key ]; then tpm2pcrs="" - encryptboot=$(grep ^encryptboot: /target/etc/confluent/confluent.deploycfg | sed -e 's/^encryptboot://' -e 's/ //g') + encryptboot=$(grep ^encryptboot: /etc/confluent/confluent.deploycfg | sed -e 's/^encryptboot://' -e 's/ //g') case "$encryptboot" in *pcrs=*) tpm2pcrs=$(echo "$encryptboot" | sed -e 's/.*pcrs=//' -e 's/:.*//') diff --git a/confluent_osdeploy/ubuntu22.04/profiles/default/scripts/post.sh b/confluent_osdeploy/ubuntu22.04/profiles/default/scripts/post.sh index 1d68fa07..14b0e6a4 100755 --- a/confluent_osdeploy/ubuntu22.04/profiles/default/scripts/post.sh +++ b/confluent_osdeploy/ubuntu22.04/profiles/default/scripts/post.sh @@ -111,7 +111,7 @@ if [ -f /etc/confluent_lukspass ]; then cp /etc/confluent_lukspass /target/etc/confluent/luks.key chmod 000 /target/etc/confluent/luks.key lukspass=$(cat /etc/confluent_lukspass) - chroot /target apt install libtss2-rc0 tpm2-tools + chroot /target apt-get install -y libtss2-rc0 tpm2-tools PASSWORD=$lukspass chroot /target systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs="" $CRYPTTAB_SOURCE fetch_remote systemdecrypt mv systemdecrypt /target/etc/initramfs-tools/scripts/local-top/systemdecrypt