diff --git a/app-crypt/clevis/Manifest b/app-crypt/clevis/Manifest
index 87942abebb..f3dea06463 100644
--- a/app-crypt/clevis/Manifest
+++ b/app-crypt/clevis/Manifest
@@ -1,3 +1,4 @@
DIST clevis-19.tar.gz 81324 BLAKE2B 75323940d0b53e307f5dbc197e3117e7ddc900d76ae1043bac3d17cc3af0264ba00a5f840c5c9dd3c2dd9c8fbde2cf05934b8ab3e89cd403ad8a8eb28609bb78 SHA512 dee19354c908c3843fc295a84b431780d5d6062c77766ee7ce9550636d3623d92b0cd1f6d4c40d57bef14debddc161da2b72289a5d6185cdd17b09a1ef67409a
DIST clevis-20.tar.gz 83668 BLAKE2B df00752f630762e8d52fb3fb9e0cd76129a53cf3c85300eb2c3967f9cb39139eb2b38e434e72dd879a5062555d7b5933558b87bba2dd01533bf92d0c059fbc5e SHA512 bee42f1e44b8ca8b1be7b9abf265d1bef14a8ecca6e18f48fbc33f3624b6633c5d150a83745eb8ea13a9a343235de07b0754b6ff9b462a1e7376964e7672a80d
DIST clevis-21.tar.gz 101599 BLAKE2B 3c02b409e3571d73ad46383da1863e2e2af33786e5a4d4a671b0423133442f379cd42e63f0d8c907604f3339bbf253c255eeefc7567b636ccf1cdb9993efa6dd SHA512 f069969a45195679cc5e521ed0b4ec2199d774aab59ec1d60533a3e9af70468aa2c75dfc695e9d48a255828971a3cf199388c92ffa999faadfc16d7c80eb9fde
+DIST clevis-23.tar.gz 137146 BLAKE2B d3a3a898ecc5124f40bb19cadda7e3ae395426a537d843f303dd552f92c69691c0121f817cd9453f081ce9d3084a8f2d13b4de150da46975a26474eca9286751 SHA512 305d9ee4d180314a646e6010ee2755c9e6dc981dbebc3c3194c53980d14fbf78a48427ccd15c2b7c89465ab5389550c53a47065866ce97afc604d9fdee86c546
diff --git a/app-crypt/clevis/clevis-23.ebuild b/app-crypt/clevis/clevis-23.ebuild
new file mode 100644
index 0000000000..a656ab3177
--- /dev/null
+++ b/app-crypt/clevis/clevis-23.ebuild
@@ -0,0 +1,93 @@
+# Copyright 2022-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit meson shell-completion
+
+DESCRIPTION="Automated Encryption Framework"
+HOMEPAGE="https://github.com/latchset/clevis"
+SRC_URI="https://github.com/latchset/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE="dracut pkcs11 test tpm tpm1 udisks"
+
+BDEPEND="app-text/asciidoc
+ test? ( tpm? ( app-crypt/swtpm )
+ tpm1? ( app-crypt/swtpm )
+ net-misc/socat
+ sys-process/lsof
+ )
+ udisks? ( dev-util/glib-utils )
+"
+
+# dev-libs/openssl is an automagic dependency for clevis sss pin
+# net-misc/curl is an automagic dependency for clevis tang pin
+# app-crypt/tpm2-tools is an automagic dependency for clevis tpm2 pin
+# Even though they are only invoked at rum time, the build process will not include
+# support if they are not on the build host, hance they must be DEPEND.
+
+PINS_AUTOMAGIC_DEPEND="
+ dev-libs/openssl:=
+ net-misc/curl
+ app-crypt/tpm2-tools
+"
+
+# sys-fs/cryptsetup and dev-libs/luksmeta are automagic dependencies for LUKS support
+DEPEND="
+ ${PINS_AUTOMAGIC_DEPEND}
+ dev-libs/jansson
+ dev-libs/jose
+ dev-libs/luksmeta
+ sys-fs/cryptsetup
+ dracut? ( sys-kernel/dracut )
+ pkcs11? (
+ dev-libs/opensc
+ sys-apps/pcsc-lite[policykit]
+ )
+ tpm1? ( app-crypt/tpm-tools )
+ udisks? (
+ dev-libs/glib
+ sys-fs/udisks
+ sys-process/audit
+ )
+"
+
+# clevis-luks-edit has an RDEPEND on app-misc/jq
+RDEPEND="
+ ${DEPEND}
+ app-misc/jq
+ app-crypt/tpm2-tools
+"
+
+RESTRICT="!test? ( test )"
+
+PATCHES=(
+ "${FILESDIR}/${PN}-23-openrc-fixes.patch"
+ "${FILESDIR}/${PN}-23-cleanup-meson-deprecation-warnings.patch"
+ "${FILESDIR}/${PN}-23-disable-automagic.patch"
+ "${FILESDIR}/${PN}-23-disable-pkcs11-automagic.patch"
+)
+
+src_configure() {
+ local emesonargs=(
+ $(meson_feature dracut)
+ $(meson_feature pkcs11)
+ $(meson_feature tpm1)
+ $(meson_feature udisks)
+ "-Dbashcompdir=$(get_bashcompdir)"
+ )
+ meson_src_configure
+}
+
+# Most of the tests require root (FEATURES="-userpriv")
+# To run the tang pin tests, install app-crypt/tang beforehand
+src_test() {
+ local excludedtests=(
+# Doesn't work in the sandbox or without root
+ "pin-tpm2-sw"
+ )
+ meson_src_test $(meson test -C "${BUILD_DIR}" --list | grep -v "${excludedtests[@]}")
+}
diff --git a/app-crypt/clevis/files/clevis-23-cleanup-meson-deprecation-warnings.patch b/app-crypt/clevis/files/clevis-23-cleanup-meson-deprecation-warnings.patch
new file mode 100644
index 0000000000..ae67a91359
--- /dev/null
+++ b/app-crypt/clevis/files/clevis-23-cleanup-meson-deprecation-warnings.patch
@@ -0,0 +1,425 @@
+diff --git a/meson.build b/meson.build
+index 8c45872..cd786d7 100644
+--- a/meson.build
++++ b/meson.build
+@@ -1,6 +1,10 @@
+ project('clevis', 'c', license: 'GPL3+',
+ version: '23',
+- default_options: 'c_std=c99'
++ default_options: [
++ 'c_std=c99',
++ 'warning_level=2',
++ 'werror=true'
++ ]
+ )
+
+ libexecdir = join_paths(get_option('prefix'), get_option('libexecdir'))
+@@ -15,9 +19,6 @@ data.set('bindir', bindir)
+ data.set('libdir', libdir)
+
+ add_project_arguments(
+- '-Wall',
+- '-Wextra',
+- '-Werror',
+ '-Wstrict-aliasing',
+ '-Wchar-subscripts',
+ '-Wformat-security',
+diff --git a/src/bash/meson.build b/src/bash/meson.build
+index 89ba746..e9e597a 100644
+--- a/src/bash/meson.build
++++ b/src/bash/meson.build
+@@ -1,7 +1,7 @@
+ bashcomp = dependency('bash-completion', required: false)
+
+ if bashcomp.found()
+- bashcompdir = bashcomp.get_pkgconfig_variable('completionsdir')
++ bashcompdir = bashcomp.get_variable(pkgconfig : 'completionsdir')
+ install_data('clevis', install_dir: bashcompdir)
+ else
+ warning('Will not install bash completion due to missing dependencies!')
+diff --git a/src/luks/dracut/clevis-pin-null/meson.build b/src/luks/dracut/clevis-pin-null/meson.build
+index 57278f7..0c7e172 100644
+--- a/src/luks/dracut/clevis-pin-null/meson.build
++++ b/src/luks/dracut/clevis-pin-null/meson.build
+@@ -1,7 +1,7 @@
+ dracut = dependency('dracut', required: false)
+
+ if dracut.found()
+- dracutdir = dracut.get_pkgconfig_variable('dracutmodulesdir') + '/50' + meson.project_name() + '-pin-null'
++ dracutdir = dracut.get_variable(pkgconfig : 'dracutmodulesdir') + '/50' + meson.project_name() + '-pin-null'
+
+ configure_file(
+ input: 'module-setup.sh.in',
+diff --git a/src/luks/dracut/clevis-pin-pkcs11/meson.build b/src/luks/dracut/clevis-pin-pkcs11/meson.build
+index 689222b..ecd1421 100644
+--- a/src/luks/dracut/clevis-pin-pkcs11/meson.build
++++ b/src/luks/dracut/clevis-pin-pkcs11/meson.build
+@@ -1,7 +1,7 @@
+ dracut = dependency('dracut', required: false)
+
+ if dracut.found()
+- dracutdir = dracut.get_pkgconfig_variable('dracutmodulesdir') + '/50' + meson.project_name() + '-pin-pkcs11'
++ dracutdir = dracut.get_variable(pkgconfig : 'dracutmodulesdir') + '/50' + meson.project_name() + '-pin-pkcs11'
+
+ configure_file(
+ input: 'module-setup.sh.in',
+diff --git a/src/luks/dracut/clevis-pin-sss/meson.build b/src/luks/dracut/clevis-pin-sss/meson.build
+index c652a9e..34a7345 100644
+--- a/src/luks/dracut/clevis-pin-sss/meson.build
++++ b/src/luks/dracut/clevis-pin-sss/meson.build
+@@ -1,7 +1,7 @@
+ dracut = dependency('dracut', required: false)
+
+ if dracut.found()
+- dracutdir = dracut.get_pkgconfig_variable('dracutmodulesdir') + '/50' + meson.project_name() + '-pin-sss'
++ dracutdir = dracut.get_variable(pkgconfig : 'dracutmodulesdir') + '/50' + meson.project_name() + '-pin-sss'
+
+ configure_file(
+ input: 'module-setup.sh.in',
+diff --git a/src/luks/dracut/clevis-pin-tang/meson.build b/src/luks/dracut/clevis-pin-tang/meson.build
+index 8e1cfca..92af675 100644
+--- a/src/luks/dracut/clevis-pin-tang/meson.build
++++ b/src/luks/dracut/clevis-pin-tang/meson.build
+@@ -1,7 +1,7 @@
+ dracut = dependency('dracut', required: false)
+
+ if dracut.found()
+- dracutdir = dracut.get_pkgconfig_variable('dracutmodulesdir') + '/50' + meson.project_name() + '-pin-tang'
++ dracutdir = dracut.get_variable(pkgconfig : 'dracutmodulesdir') + '/50' + meson.project_name() + '-pin-tang'
+
+ configure_file(
+ input: 'module-setup.sh.in',
+diff --git a/src/luks/dracut/clevis-pin-tpm1/meson.build b/src/luks/dracut/clevis-pin-tpm1/meson.build
+index 8e5a675..6515b6a 100644
+--- a/src/luks/dracut/clevis-pin-tpm1/meson.build
++++ b/src/luks/dracut/clevis-pin-tpm1/meson.build
+@@ -1,7 +1,7 @@
+ dracut = dependency('dracut', required: false)
+
+ if dracut.found()
+- dracutdir = dracut.get_pkgconfig_variable('dracutmodulesdir') + '/50' + meson.project_name() + '-pin-tpm1'
++ dracutdir = dracut.get_variable(pkgconfig : 'dracutmodulesdir') + '/50' + meson.project_name() + '-pin-tpm1'
+
+ configure_file(
+ input: 'module-setup.sh.in',
+diff --git a/src/luks/dracut/clevis-pin-tpm2/meson.build b/src/luks/dracut/clevis-pin-tpm2/meson.build
+index 7863f8b..58990e7 100644
+--- a/src/luks/dracut/clevis-pin-tpm2/meson.build
++++ b/src/luks/dracut/clevis-pin-tpm2/meson.build
+@@ -1,7 +1,7 @@
+ dracut = dependency('dracut', required: false)
+
+ if dracut.found()
+- dracutdir = dracut.get_pkgconfig_variable('dracutmodulesdir') + '/50' + meson.project_name() + '-pin-tpm2'
++ dracutdir = dracut.get_variable(pkgconfig : 'dracutmodulesdir') + '/50' + meson.project_name() + '-pin-tpm2'
+
+ configure_file(
+ input: 'module-setup.sh.in',
+diff --git a/src/luks/dracut/clevis/meson.build b/src/luks/dracut/clevis/meson.build
+index e6230f3..ca21624 100644
+--- a/src/luks/dracut/clevis/meson.build
++++ b/src/luks/dracut/clevis/meson.build
+@@ -1,7 +1,7 @@
+ dracut = dependency('dracut', required: false)
+
+ if dracut.found()
+- dracutdir = dracut.get_pkgconfig_variable('dracutmodulesdir') + '/50' + meson.project_name()
++ dracutdir = dracut.get_variable(pkgconfig : 'dracutmodulesdir') + '/50' + meson.project_name()
+
+ dracut_data = configuration_data()
+ dracut_data.merge_from(data)
+diff --git a/src/luks/meson.build b/src/luks/meson.build
+index 6c7b035..5469c3b 100644
+--- a/src/luks/meson.build
++++ b/src/luks/meson.build
+@@ -42,7 +42,7 @@ clevis_luks_unbind = configure_file(input: 'clevis-luks-unbind.in',
+
+ # SystemD dependencies checked here, used both in systemd and dracut subdirs
+ systemd = dependency('systemd', required: false)
+-systemdutildir = systemd.found() ? systemd.get_pkgconfig_variable('systemdutildir', default: '') : ''
++systemdutildir = systemd.found() ? systemd.get_variable(pkgconfig : 'systemdutildir', default_value: '') : ''
+
+ sd_reply_pass = find_program(
+ (systemdutildir != '') ? join_paths(systemdutildir, 'systemd-reply-password') : '',
+diff --git a/src/luks/tests/meson.build b/src/luks/tests/meson.build
+index aebc481..0735219 100644
+--- a/src/luks/tests/meson.build
++++ b/src/luks/tests/meson.build
+@@ -28,21 +28,21 @@ common_functions = configure_file(input: 'luks-common-test-functions.in',
+
+ env = environment()
+ env.prepend('PATH',
+- join_paths(meson.source_root(), 'src'),
+- join_paths(meson.source_root(), 'src', 'luks'),
+- join_paths(meson.source_root(), 'src', 'pins', 'sss'),
+- join_paths(meson.source_root(), 'src', 'pins', 'tang'),
+- join_paths(meson.source_root(), 'src', 'pins', 'tpm1'),
+- join_paths(meson.source_root(), 'src', 'pins', 'tpm2'),
++ join_paths(meson.project_source_root(), 'src'),
++ join_paths(meson.project_source_root(), 'src', 'luks'),
++ join_paths(meson.project_source_root(), 'src', 'pins', 'sss'),
++ join_paths(meson.project_source_root(), 'src', 'pins', 'tang'),
++ join_paths(meson.project_source_root(), 'src', 'pins', 'tpm1'),
++ join_paths(meson.project_source_root(), 'src', 'pins', 'tpm2'),
+ meson.current_source_dir(),
+ meson.current_build_dir(),
+- join_paths(meson.build_root(), 'src'),
+- join_paths(meson.build_root(), 'src', 'luks'),
+- join_paths(meson.build_root(), 'src', 'pins', 'sss'),
+- join_paths(meson.build_root(), 'src', 'pins', 'tang'),
+- join_paths(meson.build_root(), 'src', 'pins', 'tang', 'tests'),
+- join_paths(meson.build_root(), 'src', 'pins', 'tpm1'),
+- join_paths(meson.build_root(), 'src', 'pins', 'tpm2'),
++ join_paths(meson.project_build_root(), 'src'),
++ join_paths(meson.project_build_root(), 'src', 'luks'),
++ join_paths(meson.project_build_root(), 'src', 'pins', 'sss'),
++ join_paths(meson.project_build_root(), 'src', 'pins', 'tang'),
++ join_paths(meson.project_build_root(), 'src', 'pins', 'tang', 'tests'),
++ join_paths(meson.project_build_root(), 'src', 'pins', 'tpm1'),
++ join_paths(meson.project_build_root(), 'src', 'pins', 'tpm2'),
+ separator: ':'
+ )
+
+diff --git a/src/pins/file/meson.build b/src/pins/file/meson.build
+index dbd9a56..fd43e14 100644
+--- a/src/pins/file/meson.build
++++ b/src/pins/file/meson.build
+@@ -8,7 +8,7 @@ mans += join_paths(meson.current_source_dir(), 'clevis-encrypt-file.1')
+
+ env = environment()
+ env.append('PATH',
+- join_paths(meson.source_root(), 'src'),
++ join_paths(meson.project_source_root(), 'src'),
+ meson.current_source_dir(),
+ '/usr/libexec',
+ libexecdir,
+@@ -18,7 +18,7 @@ env.append('PATH',
+ test('pin-file', find_program('./pin-file'), env: env)
+
+ if dracut.found()
+- dracutdir = dracut.get_pkgconfig_variable('dracutmodulesdir') + '/50' + meson.project_name() + '-pin-file'
++ dracutdir = dracut.get_variable(pkgconfig : 'dracutmodulesdir') + '/50' + meson.project_name() + '-pin-file'
+ configure_file(
+ input: 'dracut.module-setup.sh.in',
+ output: 'module-setup.sh',
+diff --git a/src/pins/pkcs11/tests/meson.build b/src/pins/pkcs11/tests/meson.build
+index 73ca2f7..998562d 100644
+--- a/src/pins/pkcs11/tests/meson.build
++++ b/src/pins/pkcs11/tests/meson.build
+@@ -1,22 +1,22 @@
+ env = environment()
+ env.prepend('PATH',
+- join_paths(meson.source_root(), 'src'),
+- join_paths(meson.source_root(), 'src', 'pins', 'pkcs11'),
+- join_paths(meson.source_root(), 'src', 'pins', 'pkcs11', 'tests'),
+- join_paths(meson.build_root(), 'src'),
+- join_paths(meson.build_root(), 'src', 'pins'),
+- join_paths(meson.build_root(), 'src', 'pins', 'pkcs11'),
+- join_paths(meson.build_root(), 'src', 'pins', 'pkcs11', 'tests'),
+- join_paths(meson.source_root(), 'src'),
+- join_paths(meson.source_root(), 'src', 'luks'),
+- join_paths(meson.source_root(), 'src', 'luks', 'tests'),
+- join_paths(meson.build_root(), 'src'),
+- join_paths(meson.build_root(), 'src', 'luks'),
+- join_paths(meson.build_root(), 'src', 'luks', 'tests'),
+- join_paths(meson.source_root(), 'src', 'pins', 'tang'),
+- join_paths(meson.source_root(), 'src', 'pins', 'tang', 'tests'),
+- join_paths(meson.build_root(), 'src', 'pins', 'tang'),
+- join_paths(meson.build_root(), 'src', 'pins', 'tang', 'tests'),
++ join_paths(meson.project_source_root(), 'src'),
++ join_paths(meson.project_source_root(), 'src', 'pins', 'pkcs11'),
++ join_paths(meson.project_source_root(), 'src', 'pins', 'pkcs11', 'tests'),
++ join_paths(meson.project_build_root(), 'src'),
++ join_paths(meson.project_build_root(), 'src', 'pins'),
++ join_paths(meson.project_build_root(), 'src', 'pins', 'pkcs11'),
++ join_paths(meson.project_build_root(), 'src', 'pins', 'pkcs11', 'tests'),
++ join_paths(meson.project_source_root(), 'src'),
++ join_paths(meson.project_source_root(), 'src', 'luks'),
++ join_paths(meson.project_source_root(), 'src', 'luks', 'tests'),
++ join_paths(meson.project_build_root(), 'src'),
++ join_paths(meson.project_build_root(), 'src', 'luks'),
++ join_paths(meson.project_build_root(), 'src', 'luks', 'tests'),
++ join_paths(meson.project_source_root(), 'src', 'pins', 'tang'),
++ join_paths(meson.project_source_root(), 'src', 'pins', 'tang', 'tests'),
++ join_paths(meson.project_build_root(), 'src', 'pins', 'tang'),
++ join_paths(meson.project_build_root(), 'src', 'pins', 'tang', 'tests'),
+ separator: ':'
+ )
+
+diff --git a/src/pins/sss/meson.build b/src/pins/sss/meson.build
+index 2a5295a..d77fa24 100644
+--- a/src/pins/sss/meson.build
++++ b/src/pins/sss/meson.build
+@@ -19,8 +19,8 @@ if jansson.found() and libcrypto.found()
+
+ env = environment()
+ env.prepend('PATH',
+- join_paths(meson.source_root(), 'src'),
+- join_paths(meson.source_root(), 'src', 'pins', 'tang'),
++ join_paths(meson.project_source_root(), 'src'),
++ join_paths(meson.project_source_root(), 'src', 'pins', 'tang'),
+ meson.current_build_dir(),
+ '/usr/libexec',
+ libexecdir,
+diff --git a/src/pins/tang/tests/meson.build b/src/pins/tang/tests/meson.build
+index 47fa5d6..feb02a9 100644
+--- a/src/pins/tang/tests/meson.build
++++ b/src/pins/tang/tests/meson.build
+@@ -23,15 +23,15 @@ tang_data.set('TANGD_KEYGEN', '')
+ tang_data.set('TANGD', '')
+
+ if socat.found()
+- tang_data.set('SOCAT', socat.path())
++ tang_data.set('SOCAT', socat.full_path())
+ endif
+
+ if kgen.found()
+- tang_data.set('TANGD_KEYGEN', kgen.path())
++ tang_data.set('TANGD_KEYGEN', kgen.full_path())
+ endif
+
+ if tang.found()
+- tang_data.set('TANGD', tang.path())
++ tang_data.set('TANGD', tang.full_path())
+ endif
+
+ tang_tests_common = configure_file(
+@@ -42,10 +42,10 @@ tang_tests_common = configure_file(
+
+ env = environment()
+ env.prepend('PATH',
+- join_paths(meson.source_root(), 'src'),
+- join_paths(meson.source_root(), 'src', 'pins', 'tang'),
+- join_paths(meson.build_root(), 'src', 'luks', 'tests'),
+- join_paths(meson.build_root(), 'src', 'pins', 'tang', 'tests'),
++ join_paths(meson.project_source_root(), 'src'),
++ join_paths(meson.project_source_root(), 'src', 'pins', 'tang'),
++ join_paths(meson.project_build_root(), 'src', 'luks', 'tests'),
++ join_paths(meson.project_build_root(), 'src', 'pins', 'tang', 'tests'),
+ separator: ':'
+ )
+
+diff --git a/src/pins/template/meson.build b/src/pins/template/meson.build
+index e307526..5a84aa9 100644
+--- a/src/pins/template/meson.build
++++ b/src/pins/template/meson.build
+@@ -20,7 +20,7 @@ if curl.found()
+ #%# Set up a test environment
+ env = environment()
+ env.append('PATH',
+- join_paths(meson.source_root(), 'src'),
++ join_paths(meson.project_source_root(), 'src'),
+ meson.current_source_dir(),
+ '/usr/libexec',
+ libexecdir,
+@@ -35,7 +35,7 @@ endif
+
+ #%# dracut support
+ if dracut.found()
+- dracutdir = dracut.get_pkgconfig_variable('dracutmodulesdir') + '/50' + meson.project_name() + '-pin-@pin@'
++ dracutdir = dracut.get_variable(pkgconfig : 'dracutmodulesdir') + '/50' + meson.project_name() + '-pin-@pin@'
+ #?# In general, substituation is not needed but it's better to
+ #?# stay flexible.
+ configure_file(
+diff --git a/src/pins/tpm1/tests/meson.build b/src/pins/tpm1/tests/meson.build
+index 4f7ebbd..ca1be7d 100644
+--- a/src/pins/tpm1/tests/meson.build
++++ b/src/pins/tpm1/tests/meson.build
+@@ -1,14 +1,14 @@
+ # Tests
+ env = environment()
+ env.prepend('PATH',
+- join_paths(meson.source_root(), 'src'),
+- join_paths(meson.source_root(), 'src', 'pins', 'tpm1'),
+- join_paths(meson.source_root(), 'src', 'pins', 'tpm1', 'tests'),
+- join_paths(meson.build_root(), 'src'),
+- join_paths(meson.build_root(), 'src', 'luks', 'tests'),
+- join_paths(meson.build_root(), 'src', 'pins', 'tang', 'tests'),
+- join_paths(meson.build_root(), 'src', 'pins', 'tpm1'),
+- join_paths(meson.build_root(), 'src', 'pins', 'tpm1', 'tests'),
++ join_paths(meson.project_source_root(), 'src'),
++ join_paths(meson.project_source_root(), 'src', 'pins', 'tpm1'),
++ join_paths(meson.project_source_root(), 'src', 'pins', 'tpm1', 'tests'),
++ join_paths(meson.project_build_root(), 'src'),
++ join_paths(meson.project_build_root(), 'src', 'luks', 'tests'),
++ join_paths(meson.project_build_root(), 'src', 'pins', 'tang', 'tests'),
++ join_paths(meson.project_build_root(), 'src', 'pins', 'tpm1'),
++ join_paths(meson.project_build_root(), 'src', 'pins', 'tpm1', 'tests'),
+ separator: ':'
+ )
+
+@@ -23,14 +23,14 @@ tcsd = find_program('tcsd', '/usr/sbin/tcsd', required: false)
+ swtpm = find_program('swtpm', '/usr/bin/swtpm', required: false)
+ swtpm_setup = find_program('swtpm_setup', '/usr/bin/swtpm_setup', required: false)
+
+-tpm1_data.set('TPM_VERSION_BIN', tpm_version.found() ? tpm_version.path() : '')
+-tpm1_data.set('TPM_SEALDATA_BIN', tpm_sealdata.found() ? tpm_sealdata.path() : '')
+-tpm1_data.set('TPM_UNSEALDATA_BIN', tpm_unsealdata.found() ? tpm_unsealdata.path() : '')
+-tpm1_data.set('TPM_TAKEOWNERSHIP_BIN', tpm_takeownership.found() ? tpm_takeownership.path() : '')
+-tpm1_data.set('TCSD_BIN', tcsd.found() ? tcsd.path() : '')
+-tpm1_data.set('SWTPM_BIN', swtpm.found() ? swtpm.path() : '')
+-tpm1_data.set('SWTPM_SETUP_BIN', swtpm_setup.found() ? swtpm_setup.path() : '')
+-tpm1_data.set('LIBCLEVIS_TPM1_TCSD_PRELOAD', libclevis_tpm1_tcsd_preload.path())
++tpm1_data.set('TPM_VERSION_BIN', tpm_version.found() ? tpm_version.full_path() : '')
++tpm1_data.set('TPM_SEALDATA_BIN', tpm_sealdata.found() ? tpm_sealdata.full_path() : '')
++tpm1_data.set('TPM_UNSEALDATA_BIN', tpm_unsealdata.found() ? tpm_unsealdata.full_path() : '')
++tpm1_data.set('TPM_TAKEOWNERSHIP_BIN', tpm_takeownership.found() ? tpm_takeownership.full_path() : '')
++tpm1_data.set('TCSD_BIN', tcsd.found() ? tcsd.full_path() : '')
++tpm1_data.set('SWTPM_BIN', swtpm.found() ? swtpm.full_path() : '')
++tpm1_data.set('SWTPM_SETUP_BIN', swtpm_setup.found() ? swtpm_setup.full_path() : '')
++tpm1_data.set('LIBCLEVIS_TPM1_TCSD_PRELOAD', libclevis_tpm1_tcsd_preload.full_path())
+
+ configure_file(
+ input: 'tpm1-common-test-functions.in',
+diff --git a/src/pins/tpm2/tests/meson.build b/src/pins/tpm2/tests/meson.build
+index f3e21e1..cd0d15d 100644
+--- a/src/pins/tpm2/tests/meson.build
++++ b/src/pins/tpm2/tests/meson.build
+@@ -1,20 +1,20 @@
+ # Tests.
+ env = environment()
+ env.prepend('PATH',
+- join_paths(meson.source_root(), 'src'),
+- join_paths(meson.source_root(), 'src', 'luks'),
+- join_paths(meson.source_root(), 'src', 'luks', 'tests'),
+- join_paths(meson.source_root(), 'src', 'pins', 'sss'),
+- join_paths(meson.source_root(), 'src', 'pins', 'tang'),
+- join_paths(meson.source_root(), 'src', 'pins', 'tpm2'),
+- join_paths(meson.source_root(), 'src', 'pins', 'tpm2', 'tests'),
+- join_paths(meson.build_root(), 'src'),
+- join_paths(meson.build_root(), 'src', 'luks'),
+- join_paths(meson.build_root(), 'src', 'luks', 'tests'),
+- join_paths(meson.build_root(), 'src', 'pins', 'sss'),
+- join_paths(meson.build_root(), 'src', 'pins', 'tang'),
+- join_paths(meson.build_root(), 'src', 'pins', 'tpm2'),
+- join_paths(meson.build_root(), 'src', 'pins', 'tpm2', 'tests'),
++ join_paths(meson.project_source_root(), 'src'),
++ join_paths(meson.project_source_root(), 'src', 'luks'),
++ join_paths(meson.project_source_root(), 'src', 'luks', 'tests'),
++ join_paths(meson.project_source_root(), 'src', 'pins', 'sss'),
++ join_paths(meson.project_source_root(), 'src', 'pins', 'tang'),
++ join_paths(meson.project_source_root(), 'src', 'pins', 'tpm2'),
++ join_paths(meson.project_source_root(), 'src', 'pins', 'tpm2', 'tests'),
++ join_paths(meson.project_build_root(), 'src'),
++ join_paths(meson.project_build_root(), 'src', 'luks'),
++ join_paths(meson.project_build_root(), 'src', 'luks', 'tests'),
++ join_paths(meson.project_build_root(), 'src', 'pins', 'sss'),
++ join_paths(meson.project_build_root(), 'src', 'pins', 'tang'),
++ join_paths(meson.project_build_root(), 'src', 'pins', 'tpm2'),
++ join_paths(meson.project_build_root(), 'src', 'pins', 'tpm2', 'tests'),
+ separator: ':'
+ )
+
+@@ -25,9 +25,9 @@ socat = find_program('socat', required: false)
+ swtpm = find_program('swtpm', '/usr/bin/swtpm', required: false)
+ swtpm_setup = find_program('swtpm_setup', '/usr/bin/swtpm_setup', required: false)
+
+-tpm2_data.set('SOCAT_BIN', socat.found() ? socat.path() : '')
+-tpm2_data.set('SWTPM_BIN', swtpm.found() ? swtpm.path() : '')
+-tpm2_data.set('SWTPM_SETUP_BIN', swtpm_setup.found() ? swtpm_setup.path() : '')
++tpm2_data.set('SOCAT_BIN', socat.found() ? socat.full_path() : '')
++tpm2_data.set('SWTPM_BIN', swtpm.found() ? swtpm.full_path() : '')
++tpm2_data.set('SWTPM_SETUP_BIN', swtpm_setup.found() ? swtpm_setup.full_path() : '')
+
+ configure_file(
+ input: 'tpm2-common-test-functions.in',
diff --git a/app-crypt/clevis/files/clevis-23-disable-automagic.patch b/app-crypt/clevis/files/clevis-23-disable-automagic.patch
new file mode 100644
index 0000000000..96d294f682
--- /dev/null
+++ b/app-crypt/clevis/files/clevis-23-disable-automagic.patch
@@ -0,0 +1,77 @@
+diff --git a/meson_options.txt b/meson_options.txt
+index 0c22fd6..11a810b 100644
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -1,3 +1,6 @@
+ option('user', type: 'string', value: 'clevis', description: 'Unprivileged user for secure clevis operations')
+ option('group', type: 'string', value: 'clevis', description: 'Unprivileged group for secure clevis operations')
+ option('tpm1', type: 'feature', value: 'auto', description: 'Enable TPM 1.2 pin support')
++option('dracut', type: 'feature', value: 'auto', description: 'Enable dracut support for clevis')
++option('udisks', type: 'feature', value: 'auto', description: 'Enable udisks2 support for clevis')
++option('bashcompdir', type: 'string', value: '', description: 'Directory for bash completion files')
+diff --git a/src/bash/meson.build b/src/bash/meson.build
+index e9e597a..c353361 100644
+--- a/src/bash/meson.build
++++ b/src/bash/meson.build
+@@ -1,7 +1,11 @@
+ bashcomp = dependency('bash-completion', required: false)
+
+-if bashcomp.found()
+- bashcompdir = bashcomp.get_variable(pkgconfig : 'completionsdir')
++if get_option('bashcompdir') != '' or bashcomp.found()
++ if get_option('bashcompdir') != ''
++ bashcompdir = get_option('bashcompdir')
++ else
++ bashcompdir = bashcomp.get_variable(pkgconfig: 'completionsdir')
++ endif
+ install_data('clevis', install_dir: bashcompdir)
+ else
+ warning('Will not install bash completion due to missing dependencies!')
+diff --git a/src/luks/dracut/meson.build b/src/luks/dracut/meson.build
+index d78af7d..fb61872 100644
+--- a/src/luks/dracut/meson.build
++++ b/src/luks/dracut/meson.build
+@@ -1,9 +1,12 @@
+-subdir('clevis')
+-subdir('clevis-pin-tang')
+-if not get_option('tpm1').disabled()
+- subdir('clevis-pin-tpm1')
++dracut = dependency('dracut', required: get_option('dracut'))
++if dracut.found()
++ subdir('clevis')
++ subdir('clevis-pin-tang')
++ if not get_option('tpm1').disabled()
++ subdir('clevis-pin-tpm1')
++ endif
++ subdir('clevis-pin-tpm2')
++ subdir('clevis-pin-sss')
++ subdir('clevis-pin-null')
++ subdir('clevis-pin-pkcs11')
+ endif
+-subdir('clevis-pin-tpm2')
+-subdir('clevis-pin-sss')
+-subdir('clevis-pin-null')
+-subdir('clevis-pin-pkcs11')
+diff --git a/src/luks/udisks2/meson.build b/src/luks/udisks2/meson.build
+index 866055b..8bf4a2d 100644
+--- a/src/luks/udisks2/meson.build
++++ b/src/luks/udisks2/meson.build
+@@ -1,6 +1,6 @@
+-audit = dependency('audit', version: '>=2.7.8', required: false)
+-udisks2 = dependency('udisks2', required: false)
+-gio = dependency('gio-2.0', required: false)
++udisks2 = dependency('udisks2', required: get_option('udisks'))
++audit = dependency('audit', version: '>=2.7.8', required: get_option('udisks'))
++gio = dependency('gio-2.0', required: get_option('udisks'))
+
+ if udisks2.found() and audit.found() and gio.found()
+ autostartdir = join_paths(sysconfdir, 'xdg', 'autostart')
+@@ -18,7 +18,7 @@ if udisks2.found() and audit.found() and gio.found()
+ install_dir: libexecdir,
+ install: true,
+ )
+-else
++elif get_option('udisks').auto()
+ warning('Will not build udisks2 support due to missing dependencies!')
+ endif
+
diff --git a/app-crypt/clevis/files/clevis-23-disable-pkcs11-automagic.patch b/app-crypt/clevis/files/clevis-23-disable-pkcs11-automagic.patch
new file mode 100644
index 0000000000..14e3688ce5
--- /dev/null
+++ b/app-crypt/clevis/files/clevis-23-disable-pkcs11-automagic.patch
@@ -0,0 +1,21 @@
+diff --git a/meson_options.txt b/meson_options.txt
+index 11a810b..0f1dd68 100644
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -4,3 +4,4 @@ option('tpm1', type: 'feature', value: 'auto', description: 'Enable TPM 1.2 pin
+ option('dracut', type: 'feature', value: 'auto', description: 'Enable dracut support for clevis')
+ option('udisks', type: 'feature', value: 'auto', description: 'Enable udisks2 support for clevis')
+ option('bashcompdir', type: 'string', value: '', description: 'Directory for bash completion files')
++option('pkcs11', type: 'feature', value: 'auto', description: 'Enable PKCS11 pin support')
+diff --git a/src/pins/pkcs11/meson.build b/src/pins/pkcs11/meson.build
+index 95182e9..6ca708d 100644
+--- a/src/pins/pkcs11/meson.build
++++ b/src/pins/pkcs11/meson.build
+@@ -1,5 +1,5 @@
+-pcscd = find_program('pcscd', required: false)
+-pkcs11tool = find_program('pkcs11-tool', required: false)
++pcscd = find_program('pcscd', required: get_option('pkcs11'))
++pkcs11tool = find_program('pkcs11-tool', required: get_option('pkcs11'))
+ pcscd_disable_polkit = false
+ git = find_program('git', required: false)
+
diff --git a/app-crypt/clevis/files/clevis-23-openrc-fixes.patch b/app-crypt/clevis/files/clevis-23-openrc-fixes.patch
new file mode 100644
index 0000000000..cb4da2883e
--- /dev/null
+++ b/app-crypt/clevis/files/clevis-23-openrc-fixes.patch
@@ -0,0 +1,25 @@
+diff --git a/src/luks/dracut/clevis/meson.build b/src/luks/dracut/clevis/meson.build
+index f37cc3ce..e6230f33 100644
+--- a/src/luks/dracut/clevis/meson.build
++++ b/src/luks/dracut/clevis/meson.build
+@@ -5,7 +5,7 @@ if dracut.found()
+
+ dracut_data = configuration_data()
+ dracut_data.merge_from(data)
+- dracut_data.set('SYSTEMD_REPLY_PASS', sd_reply_pass.path())
++ dracut_data.set('SYSTEMD_REPLY_PASS', sd_reply_pass.found() ? sd_reply_pass.path() : '')
+
+ configure_file(
+ input: 'module-setup.sh.in',
+diff --git a/src/luks/dracut/clevis/module-setup.sh.in b/src/luks/dracut/clevis/module-setup.sh.in
+index 32fac41f..cb0bd22f 100755
+--- a/src/luks/dracut/clevis/module-setup.sh.in
++++ b/src/luks/dracut/clevis/module-setup.sh.in
+@@ -52,6 +52,7 @@ install() {
+ inst_script "$moddir"/clevis-password-unlocker-prepare /bin/clevis-password-unlocker-prepare
+ inst_multiple \
+ clevis-luks-unlock \
++ chmod \
+ blkid
+ fi
+
diff --git a/app-crypt/clevis/metadata.xml b/app-crypt/clevis/metadata.xml
index d2b62a7828..49edd02196 100644
--- a/app-crypt/clevis/metadata.xml
+++ b/app-crypt/clevis/metadata.xml
@@ -13,7 +13,10 @@
latchset/clevis