From 486540d24dca667d17fa74787518c53b1c30526b Mon Sep 17 00:00:00 2001 From: Jarrod Johnson Date: Mon, 10 Aug 2026 14:22:12 -0400 Subject: [PATCH] Correct checking encryptboot pcrs in firstboot --- confluent_osdeploy/el8/profiles/default/scripts/firstboot.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/confluent_osdeploy/el8/profiles/default/scripts/firstboot.sh b/confluent_osdeploy/el8/profiles/default/scripts/firstboot.sh index 2ef8830e..cfa94615 100644 --- a/confluent_osdeploy/el8/profiles/default/scripts/firstboot.sh +++ b/confluent_osdeploy/el8/profiles/default/scripts/firstboot.sh @@ -47,7 +47,7 @@ while ! ping -c 1 $confluent_pingtarget >& /dev/null; do done if [ -e /etc/confluent/luks.key ]; then - pcrs=$(sed -n -e 's/.*tpm2:pcrs=\([0-9,]*\).*/\1/p' /tmp/cryptboot) + pcrs=$(grep ^encryptboot: /etc/confluent/confluent.deploycfg | awk '{print $2}' | grep -o 'pcrs=[^:]*' | cut -d= -f2) if [ -n "$pcrs" ]; then run_remote tpm_luks_reseal.sh fi