xCAT/confluent
2
0
Fork 0
mirror of https://github.com/xcat2/confluent.git synced 2026-09-02 07:26:04 +00:00
Code Issues Projects Releases Wiki Activity

Change extend to change extend by appropriate hash size.

Browse Source
This commit is contained in:
Jarrod Johnson
2026-08-12 14:48:57 -04:00
parent b37af50c3f
commit d175d06b8d
7 changed files with 121 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
confluent_osdeploy/el10-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
+10 -1
View File
@@ -27,6 +27,8 @@ get_remote_apikey() {
done
}
pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
get_tpm_hashalgo() {
if [ -n "$confluent_tpm_hashalgo" ]; then
echo "$confluent_tpm_hashalgo"
@@ -37,6 +39,13 @@ get_tpm_hashalgo() {
# Match only banks that actually have PCRs allocated (a digit in [ ... ]).
if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
confluent_tpm_hashalgo="$algo"
if [[ "$algo" == "sha256" ]]; then
pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
elif [[ "$algo" == "sha384" ]]; then
pcrextendvalue=20aaa1073c215c8bc97ff8dc509dd63ff09eef9d2dfa4d8ef224ce372d80e5417e53840ef2fb72924c195f69396a27b9
elif [[ "$algo" == "sha512" ]]; then
pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb
fi
echo "$confluent_tpm_hashalgo"
return 0
fi
@@ -175,7 +184,7 @@ while [ $ready = "0" ]; do
done
if [ ! -z "$autocons" ] && grep "textconsole: true" /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi
if [ -c /dev/tpmrm0 ]; then
tpm2_pcrextend 15:$(get_tpm_hashalgo)=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue}
fi
umask $oldumask
mkdir -p /run/NetworkManager/system-connections
confluent_osdeploy/el7-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
+27 -18
View File
@@ -1,3 +1,29 @@
pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
get_tpm_hashalgo() {
if [ -n "$confluent_tpm_hashalgo" ]; then
echo "$confluent_tpm_hashalgo"
return 0
fi
tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null)
for algo in sha256 sha512 sha384; do
# Match only banks that actually have PCRs allocated (a digit in [ ... ]).
if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
confluent_tpm_hashalgo="$algo"
if [[ "$algo" == "sha256" ]]; then
pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
elif [[ "$algo" == "sha384" ]]; then
pcrextendvalue=20aaa1073c215c8bc97ff8dc509dd63ff09eef9d2dfa4d8ef224ce372d80e5417e53840ef2fb72924c195f69396a27b9
elif [[ "$algo" == "sha512" ]]; then
pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb
fi
echo "$confluent_tpm_hashalgo"
return 0
fi
done
return 1
}
get_remote_apikey() {
while [ -z "$confluent_apikey" ]; do
/opt/confluent/bin/clortho $nodename $confluent_mgr > /etc/confluent/confluent.apikey
@@ -26,23 +52,6 @@ get_remote_apikey() {
done
}
get_tpm_hashalgo() {
if [ -n "$confluent_tpm_hashalgo" ]; then
echo "$confluent_tpm_hashalgo"
return 0
fi
tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null)
for algo in sha256 sha512 sha384; do
# Match only banks that actually have PCRs allocated (a digit in [ ... ]).
if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
confluent_tpm_hashalgo="$algo"
echo "$confluent_tpm_hashalgo"
return 0
fi
done
return 1
}
root=1
rootok=1
netroot=confluent
@@ -158,7 +167,7 @@ while [ $ready = "0" ]; do
done
if [ ! -z "$autocons" ] && grep textconsole: true /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi
if [ -c /dev/tpmrm0 -a -x /usr/bin/tpm2_pcrextend ]; then
tpm2_pcrextend 15:$(get_tpm_hashalgo)=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue}
fi
umask $oldumask
autoconfigmethod=$(grep ^ipv4_method: /etc/confluent/confluent.deploycfg |awk '{print $2}')
confluent_osdeploy/el8-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
+28 -17
View File
@@ -1,3 +1,29 @@
pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
get_tpm_hashalgo() {
if [ -n "$confluent_tpm_hashalgo" ]; then
echo "$confluent_tpm_hashalgo"
return 0
fi
tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null)
for algo in sha256 sha512 sha384; do
# Match only banks that actually have PCRs allocated (a digit in [ ... ]).
if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
confluent_tpm_hashalgo="$algo"
if [[ "$algo" == "sha256" ]]; then
pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
elif [[ "$algo" == "sha384" ]]; then
pcrextendvalue=20aaa1073c215c8bc97ff8dc509dd63ff09eef9d2dfa4d8ef224ce372d80e5417e53840ef2fb72924c195f69396a27b9
elif [[ "$algo" == "sha512" ]]; then
pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb
fi
echo "$confluent_tpm_hashalgo"
return 0
fi
done
return 1
}
get_remote_apikey() {
while [ -z "$confluent_apikey" ]; do
/opt/confluent/bin/clortho $nodename $confluent_mgr > /etc/confluent/confluent.apikey
@@ -27,22 +53,7 @@ get_remote_apikey() {
done
}
get_tpm_hashalgo() {
if [ -n "$confluent_tpm_hashalgo" ]; then
echo "$confluent_tpm_hashalgo"
return 0
fi
tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null)
for algo in sha256 sha512 sha384; do
# Match only banks that actually have PCRs allocated (a digit in [ ... ]).
if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
confluent_tpm_hashalgo="$algo"
echo "$confluent_tpm_hashalgo"
return 0
fi
done
return 1
}
. /lib/dracut-lib.sh
root=1
rootok=1
@@ -205,7 +216,7 @@ while [ $ready = "0" ]; do
done
if [ ! -z "$autocons" ] && grep "textconsole: true" /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi
if [ -c /dev/tpmrm0 ]; then
tpm2_pcrextend 15:$(get_tpm_hashalgo)=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue}
fi
umask $oldumask
mkdir -p /run/NetworkManager/system-connections
confluent_osdeploy/el9-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
+10 -3
View File
@@ -1,3 +1,5 @@
pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
get_tpm_hashalgo() {
if [ -n "$confluent_tpm_hashalgo" ]; then
echo "$confluent_tpm_hashalgo"
@@ -8,14 +10,19 @@ get_tpm_hashalgo() {
# Match only banks that actually have PCRs allocated (a digit in [ ... ]).
if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
confluent_tpm_hashalgo="$algo"
if [[ "$algo" == "sha256" ]]; then
pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
elif [[ "$algo" == "sha384" ]]; then
pcrextendvalue=20aaa1073c215c8bc97ff8dc509dd63ff09eef9d2dfa4d8ef224ce372d80e5417e53840ef2fb72924c195f69396a27b9
elif [[ "$algo" == "sha512" ]]; then
pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb
fi
echo "$confluent_tpm_hashalgo"
return 0
fi
done
return 1
}
get_remote_apikey() {
while [ -z "$confluent_apikey" ]; do
/opt/confluent/bin/clortho $nodename $confluent_mgr > /etc/confluent/confluent.apikey
@@ -175,7 +182,7 @@ while [ $ready = "0" ]; do
done
if [ ! -z "$autocons" ] && grep "textconsole: true" /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi
if [ -c /dev/tpmrm0 ]; then
tpm2_pcrextend 15:$(get_tpm_hashalgo)=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue}
fi
umask $oldumask
mkdir -p /run/NetworkManager/system-connections
confluent_osdeploy/genesis/initramfs/opt/confluent/bin/rungenesis
+9 -2
View File
@@ -7,6 +7,7 @@ export LANG=en_US.utf8
(while :; do TERM=linux tmux a <> /dev/tty1 >&0 2>&1; done) &
pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
get_tpm_hashalgo() {
if [ -n "$confluent_tpm_hashalgo" ]; then
@@ -18,6 +19,13 @@ get_tpm_hashalgo() {
# Match only banks that actually have PCRs allocated (a digit in [ ... ]).
if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
confluent_tpm_hashalgo="$algo"
if [[ "$algo" == "sha256" ]]; then
pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
elif [[ "$algo" == "sha384" ]]; then
pcrextendvalue=20aaa1073c215c8bc97ff8dc509dd63ff09eef9d2dfa4d8ef224ce372d80e5417e53840ef2fb72924c195f69396a27b9
elif [[ "$algo" == "sha512" ]]; then
pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb
fi
echo "$confluent_tpm_hashalgo"
return 0
fi
@@ -25,7 +33,6 @@ get_tpm_hashalgo() {
return 1
}
mkdir -p /etc/confluent
if ! grep console= /proc/cmdline >& /dev/null; then
autocons=$(/opt/confluent/bin/autocons)
@@ -168,7 +175,7 @@ if [ "$new_apikey" != "$confluent_apikey" ]; then
cd - > /dev/null
rm -rf $tmpdir
fi
tpm2_pcrextend 15:$(get_tpm_hashalgo)=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 2> /dev/null
tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue} 2> /dev/null
ifidx=$(cat /tmp/confluent.ifidx)
ifname=$(ip link |grep ^$ifidx:|awk '{print $2}')
ifname=${ifname%:}
confluent_osdeploy/suse15-diskless/initramfs/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
+27 -17
View File
@@ -1,3 +1,29 @@
pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
get_tpm_hashalgo() {
if [ -n "$confluent_tpm_hashalgo" ]; then
echo "$confluent_tpm_hashalgo"
return 0
fi
tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null)
for algo in sha256 sha512 sha384; do
# Match only banks that actually have PCRs allocated (a digit in [ ... ]).
if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
confluent_tpm_hashalgo="$algo"
if [[ "$algo" == "sha256" ]]; then
pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
elif [[ "$algo" == "sha384" ]]; then
pcrextendvalue=20aaa1073c215c8bc97ff8dc509dd63ff09eef9d2dfa4d8ef224ce372d80e5417e53840ef2fb72924c195f69396a27b9
elif [[ "$algo" == "sha512" ]]; then
pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb
fi
echo "$confluent_tpm_hashalgo"
return 0
fi
done
return 1
}
get_remote_apikey() {
while [ -z "$confluent_apikey" ]; do
/opt/confluent/bin/clortho $nodename $confluent_mgr > /etc/confluent/confluent.apikey
@@ -26,22 +52,6 @@ get_remote_apikey() {
done
}
get_tpm_hashalgo() {
if [ -n "$confluent_tpm_hashalgo" ]; then
echo "$confluent_tpm_hashalgo"
return 0
fi
tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null)
for algo in sha256 sha512 sha384; do
# Match only banks that actually have PCRs allocated (a digit in [ ... ]).
if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
confluent_tpm_hashalgo="$algo"
echo "$confluent_tpm_hashalgo"
return 0
fi
done
return 1
}
root=1
rootok=1
netroot=confluent
@@ -155,7 +165,7 @@ while [ $ready = "0" ]; do
rm $tmperr
done
if [ ! -z "$autocons" ] && grep textconsole: true /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi
tpm2_pcrextend 15:$(get_tpm_hashalgo)=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue}
umask $oldumask
autoconfigmethod=$(grep ipv4_method /etc/confluent/confluent.deploycfg |awk '{print $2}')
if [ "$autoconfigmethod" = "dhcp" ]; then
confluent_osdeploy/ubuntu20.04-diskless/initramfs/scripts/init-premount/confluent
+10 -1
View File
@@ -1,5 +1,7 @@
#!/bin/sh
pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
get_tpm_hashalgo() {
if [ -n "$confluent_tpm_hashalgo" ]; then
echo "$confluent_tpm_hashalgo"
@@ -10,6 +12,13 @@ get_tpm_hashalgo() {
# Match only banks that actually have PCRs allocated (a digit in [ ... ]).
if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
confluent_tpm_hashalgo="$algo"
if [[ "$algo" == "sha256" ]]; then
pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
elif [[ "$algo" == "sha384" ]]; then
pcrextendvalue=20aaa1073c215c8bc97ff8dc509dd63ff09eef9d2dfa4d8ef224ce372d80e5417e53840ef2fb72924c195f69396a27b9
elif [[ "$algo" == "sha512" ]]; then
pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb
fi
echo "$confluent_tpm_hashalgo"
return 0
fi
@@ -165,7 +174,7 @@ done
mkdir -p /root/.ssh
cat /ssh/*pubkey > /root/.ssh/authorized_keys
if [ -c /dev/tpmrm0 ]; then
tpm2_pcrextend 15:$(get_tpm_hashalgo)=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue}
fi
confluent_profile=$(grep ^profile: /etc/confluent/confluent.deploycfg| awk '{print $2}')
confluent_proto=$(grep ^protocol: /etc/confluent/confluent.deploycfg| awk '{print $2}')