clevis: update to 23

[louiszn]

Testing the changes

• I tested the changes in this PR: YES

Local build testing

• I built this PR locally for my native architecture, x86_64-glibc

Additional testing:

• Updated clevis to 23.
• Applied upstream dracut fixes from dracut: fix some portability issues in non-systemd environments latchset/clevis#561:
  • avoid requiring systemd-reply-password at build time on non-systemd systems
  • include chmod in the dracut module for the password unlocker scripts
• Set b_ndebug=false because Clevis 23's test-token-to-jwe uses assert(). With Void's default b_ndebug=true, NDEBUG is defined, the assertions are compiled out, and the test fails to build under -Werror due to unused variables.
• Added a patch for test-token-to-jwe to avoid using assert(). With Void's default b_ndebug=true, NDEBUG is defined, so assert() is compiled out and the test fails to build under -Werror due to unused variables. The patch uses an explicit CHECK() helper instead.
• Tested on Void Linux x86_64 with runit, dracut, and a TPM2-bound LUKS root volume.
• Confirmed Clevis 23 builds successfully.
• Confirmed TPM2-bound LUKS auto-unlock works after regenerating the initramfs with dracut.
• Confirmed the previous early-boot chmod: command not found warning is gone.

[Duncaen]

• Set b_ndebug=false because Clevis 23's test-token-to-jwe uses assert(). With Void's default b_ndebug=true, NDEBUG is defined, the assertions are compiled out, and the test fails to build under -Werror due to unused variables.

Wouldn't it be better to fix the patch instead or disable -Werror?

[louiszn]

• Set b_ndebug=false because Clevis 23's test-token-to-jwe uses assert(). With Void's default b_ndebug=true, NDEBUG is defined, the assertions are compiled out, and the test fails to build under -Werror due to unused variables.

Wouldn't it be better to fix the patch instead or disable -Werror?

Thanks, fixed in a follow-up commit. I dropped b_ndebug=false and added a patch for test-token-to-jwe instead.

The test relied on assert(), so with NDEBUG enabled the assertions were compiled out and the variables became unused under -Werror. The patch replaces assert() with an explicit CHECK() helper so the test still works with the default build flags.

[louiszn]

Hi @Duncaen, I think the previous review comments should be addressed now. Could you take another look when you have time?

[Duncaen]

Looks ok, commits need to be squashed and it would probably be good if @mmdbalkhi and some others tired it.

[mmdbalkhi]

LGTM

[louiszn]

Squashed the commits into one. Thanks for the review and testing.