diff --git a/.gitignore b/.gitignore
index c7ece3e..eccf252 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,4 @@
 /clevis-18.tar.xz
 /clevis-20.tar.xz
 /clevis-21.tar.xz
+/clevis-22.tar.xz
diff --git a/0001-PKCS-11-pin-fix-dracut-for-unconfigured-device.patch b/0001-PKCS-11-pin-fix-dracut-for-unconfigured-device.patch
deleted file mode 100644
index a80fe03..0000000
--- a/0001-PKCS-11-pin-fix-dracut-for-unconfigured-device.patch
+++ /dev/null
@@ -1,288 +0,0 @@
-From 691b4136d6077ed7b079a38459b6844dbc584776 Mon Sep 17 00:00:00 2001
-From: Sergio Arroutbi <sarroutb@redhat.com>
-Date: Mon, 30 Sep 2024 11:27:57 +0200
-Subject: [PATCH] PKCS#11 pin: fix dracut for unconfigured device
-
-Signed-off-by: Sergio Arroutbi <sarroutb@redhat.com>
----
- .../clevis-pin-pkcs11/module-setup.sh.in      |  2 +-
- src/luks/systemd/clevis-luks-pkcs11-askpin.in | 72 +++++--------------
- .../clevis-pkcs11-afunix-socket-unlock.c      |  9 ++-
- src/pins/pkcs11/clevis-pkcs11-common          | 52 +++++++++++++-
- 4 files changed, 74 insertions(+), 61 deletions(-)
-
-diff --git a/src/luks/dracut/clevis-pin-pkcs11/module-setup.sh.in b/src/luks/dracut/clevis-pin-pkcs11/module-setup.sh.in
-index 39d06a0..a7a6d6b 100755
---- a/src/luks/dracut/clevis-pin-pkcs11/module-setup.sh.in
-+++ b/src/luks/dracut/clevis-pin-pkcs11/module-setup.sh.in
-@@ -23,7 +23,7 @@ depends() {
- }
- 
- install() {
--    inst_hook initqueue 60 "${moddir}/clevis-pkcs11-prehook.sh"
-+    inst_hook pre-trigger 60 "${moddir}/clevis-pkcs11-prehook.sh"
-     inst_hook initqueue/settled 60 "${moddir}/clevis-pkcs11-hook.sh"
-     inst_hook initqueue/online 60 "${moddir}/clevis-pkcs11-hook.sh"
- 
-diff --git a/src/luks/systemd/clevis-luks-pkcs11-askpin.in b/src/luks/systemd/clevis-luks-pkcs11-askpin.in
-index 8f4092f..b860efa 100755
---- a/src/luks/systemd/clevis-luks-pkcs11-askpin.in
-+++ b/src/luks/systemd/clevis-luks-pkcs11-askpin.in
-@@ -52,6 +52,7 @@ get_pkcs11_error() {
-     return 0
- }
- 
-+
- if command -v pcscd; then
-     echo "clevis-pkcs11: starting pcscd if not available ..."
-     PCSCD_PID=$(ps auxf | grep "[p]cscd")
-@@ -72,51 +73,6 @@ if [ "${dracut_mode}" != true ]; then
-     pkcs11-tool -L
- fi
- 
--if ! pkcs11_device=$(pkcs11-tool -L 2>/dev/null | grep "Slot" | head -1 | \
--	                 awk -F ":" '{print $2}' | sed -e 's@^ *@@g'); then
--    echo "No PKCS11 device detected (without module option) / pkcs11-tool error"
--    exit 1
--fi
--
--if ! pkcs11-tool -O 2>/dev/null 1>/dev/null; then
--    pkcs11_device=""
--    echo "No objects in PKCS11 device detected"
--fi
--
--while [ -z "${pkcs11_device}" ]; do
--    if [ "${dracut_mode}" != true ]; then
--        module_paths=$(clevis_get_module_path_from_pkcs11_config "/etc/crypttab")
--        if [ -n "${module_paths}" ]; then
--            modules=$(echo ${module_paths} | tr ";" "\n")
--            for module in $modules; do
--                pkcs11_device=$(pkcs11-tool -L --module ${module} | grep "Slot" \
--                                | head -1 | awk -F ":" '{print $2}' | sed -e 's@^ *@@g')
--                if [ -n "${pkcs11_device}" ]; then
--                    break;
--                fi
--            done
--        fi
--    fi
--    if [ -z "${pkcs11_device}" ]; then
--        if [ "${retry_mode}" == true ]; then
--            option=$(systemd-ask-password --echo "Detected no PKCS#11 device, retry PKCS#11 detection? [yY/nN]")
--            if [ "${option}" == "N" ] || [ "${option}" == "n" ] ; then
--                echo "Won't continue PKCS11 device detection"
--                exit 0
--            fi
--            pkcs11_device=$(pkcs11-tool -L | grep "Slot" \
--                                | head -1 | awk -F ":" '{print $2}' | sed -e 's@^ *@@g')
--            if ! pkcs11-tool -O 2>/dev/null; then
--                pkcs11_device=""
--                echo "No objects in PKCS11 device detected"
--            fi
--        else
--            exit 0
--        fi
--    fi
--done
--echo "Detected PKCS11 device:${pkcs11_device}"
--
- devices_array=()
- # Let's analyze all entries from /etc/crypttab that contain clevis-pkcs11.sock entries
- while read -r line;
-@@ -126,6 +82,8 @@ do
-         next_device=0
-         errors=0
-         msg=""
-+        # Store passphrases to send to control socket
-+        systemd_device=$(echo "${line}" | awk '{print $1}')
-         while [ ${next_device} -ne 1 ]; do
-             uuid=$(echo "${line}" | awk '{print $2}')
-             if ! mapped_device=$(clevis_map_device "${uuid}"); then
-@@ -141,15 +99,23 @@ do
-             fi
-             # If no PKCS#11 configuration, advance to next device
-             if ! clevis luks list -d "${mapped_device}" | grep pkcs11 >/dev/null 2>&1; then
--                echo "Device:${mapped_device} does not contain PKCS#11 configuration"
-+                echo "Device:${mapped_device} does not contain PKCS#11 configuration" >&2
-+                # Send a wrong passphrase
-+                echo -n "${systemd_device},NOPASSWORDFOR${systemd_device}" | socat UNIX-CONNECT:/run/systemd/clevis-pkcs11.control.sock -
-                 next_device=1
-                 continue
-             fi
-+            if ! pkcs11_device=$(clevis_detect_pkcs11_device "${dracut_mode}" "${retry_mode}"); then
-+                echo "No PKCS11 device detected" >&2
-+                exit 0
-+            else
-+                echo "Detected PKCS11 device:${pkcs11_device}" >&2
-+            fi
-             # Get configuration PKCS#11 URI
-             uri=$(clevis luks list -d "${mapped_device}" | awk -F '"uri":' '{print $2}' | awk -F '"' '{print $2}' | awk -F '"' '{print $1}')
-             slot_opt=""
-             if ! slot=$(clevis_get_pkcs11_final_slot_from_uri "${uri}"); then
--                echo "Could not find slot for uri:${uri}"
-+                echo "Could not find slot for uri:${uri}" >&2
-             else
-                 slot_opt="--slot-index ${slot}"
-             fi
-@@ -159,8 +125,9 @@ do
-                 module_opt="--module ${module}"
-             fi
-             echo "Device:${mapped_device}, slot_opt:${slot_opt}, module_opt:${module_opt}"
--            if ! pkcs11-tool -O ${module_opt} ${slot_opt}; then
--                echo "No objects on slot:${slot}, module_opt:${module_opt}"
-+            if ! pkcs11-tool -O ${module_opt} ${slot_opt} 2>/dev/null 1>/dev/null; then
-+                echo "No objects on slot:${slot}, module_opt:${module_opt}" >&2
-+                echo -n "${systemd_device},NOPASSWORDFOR${systemd_device}" | socat UNIX-CONNECT:/run/systemd/clevis-pkcs11.control.sock -
-                 next_device=1
-                 continue
-             fi
-@@ -175,22 +142,21 @@ do
-             # Get key from PKCS11 pin here and feed AF_UNIX socket program
-             echo "${pin}" > /run/systemd/clevis-pkcs11.pin
-             if ! passphrase=$(clevis_luks_unlock_device "${mapped_device}") || [ -z "${passphrase}" ]; then
--                echo "Could not unlock device:${mapped_device}"
-+                echo "Could not unlock device:${mapped_device}" >&2
-                 msg="$(get_pkcs11_error)"
-                 ((errors++))
-                 if [ ${errors} -eq ${too_many_errors} ]; then
--                    echo "Too many errors !!!" 1>&2
-+                    echo "Too many errors !!!" >&2
-                     next_device=1
-                 fi
-                 continue
-             fi
-             next_device=1
--            echo "Device:${mapped_device} unlocked successfully by clevis"
-+            echo "Device:${mapped_device} unlocked successfully by clevis" >&2
-             if [ "${dracut_mode}" == true ]; then
-                 echo "${mapped_device}" >> /run/systemd/clevis-pkcs11-dracut.devices
-             fi
-             # Store passphrases to send to control socket
--            systemd_device=$(echo "${line}" | awk '{print $1}')
-             devices_array+=("${systemd_device},${passphrase}")
-         done
-     fi
-diff --git a/src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c b/src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c
-index a6ecc63..24bad83 100644
---- a/src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c
-+++ b/src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c
-@@ -146,7 +146,6 @@ static void* control_thread(void *targ) {
-         }
-         char* t = control_msg;
-         int is_device = 1;
--        fprintf(logfile, "Received control message:[%s]\n", t);
-         while((t = strtok(t, ","))) {
-             if (is_device) {
-                 fprintf(logfile, "Adding device:%s\n", t);
-@@ -185,7 +184,7 @@ static void dump_wide_version(void) {
- 
- static void int_handler(int s) {
-     if(logfile) {
--        fprintf(logfile, "Closing, signal:[%d]\n", s);
-+        fprintf(logfile, "Closing, received signal:[%d]\n", s);
-         fclose(logfile);
-     }
-     exit(EXIT_FAILURE);
-@@ -222,6 +221,7 @@ int main(int argc, char* argv[]) {
-             break;
-         case 'f':
-             strncpy(sock_file, optarg, MAX_PATH - 1);
-+            unlink(sock_file);
-             break;
-         case 'k':
-             strncpy(key, optarg, MAX_KEY - 1);
-@@ -275,7 +275,6 @@ int main(int argc, char* argv[]) {
-     memset(&sock_addr, 0, sizeof(sock_addr));
-     sock_addr.sun_family = AF_UNIX;
-     strncpy(sock_addr.sun_path, sock_file, sizeof(sock_addr.sun_path)-1);
--    unlink(sock_file);
-     s = socket(AF_UNIX, SOCK_STREAM, 0);
-     if (s == -1) {
-         perror("socket");
-@@ -346,8 +345,8 @@ int main(int argc, char* argv[]) {
-                     perror("key entry send error");
-                     goto efailure;
-                 }
--                fprintf(logfile, "Sending:[%s] to device:[%s]\n",
--                        entry_key, unlocking_device);
-+                fprintf(logfile, "Sending passphrase to device:[%s]\n",
-+                        unlocking_device);
-             } else {
-                 fprintf(logfile, "Device not found: [%s]\n", unlocking_device);
-             }
-diff --git a/src/pins/pkcs11/clevis-pkcs11-common b/src/pins/pkcs11/clevis-pkcs11-common
-index 4c0629c..571a2be 100755
---- a/src/pins/pkcs11/clevis-pkcs11-common
-+++ b/src/pins/pkcs11/clevis-pkcs11-common
-@@ -27,6 +27,56 @@ serial_devices_array=""
- URI_EXPECTED_FORMAT="pkcs11:"
- DEFAULT_CRYPTTAB_FILE="/etc/crypttab"
- 
-+clevis_detect_pkcs11_device() {
-+    dracut_mode="${1:false}"
-+    retry_mode="${2:false}"
-+    if ! pkcs11_device=$(pkcs11-tool -L 2>/dev/null | grep "Slot" | head -1 | \
-+                         awk -F ":" '{print $2}' | sed -e 's@^ *@@g'); then
-+        echo ""
-+        return 1
-+    fi
-+
-+    if ! pkcs11-tool -O 2>/dev/null 1>/dev/null; then
-+        pkcs11_device=""
-+        echo "No objects in PKCS11 device detected" >&2
-+    fi
-+
-+    while [ -z "${pkcs11_device}" ]; do
-+        if [ "${dracut_mode}" != true ]; then
-+            module_paths=$(clevis_get_module_path_from_pkcs11_config "/etc/crypttab")
-+            if [ -n "${module_paths}" ]; then
-+                modules=$(echo ${module_paths} | tr ";" "\n")
-+                for module in $modules; do
-+                    pkcs11_device=$(pkcs11-tool -L --module ${module} | grep "Slot" \
-+                                    | head -1 | awk -F ":" '{print $2}' | sed -e 's@^ *@@g')
-+                    if [ -n "${pkcs11_device}" ]; then
-+                        break;
-+                    fi
-+                done
-+            fi
-+        fi
-+        if [ -z "${pkcs11_device}" ]; then
-+            if [ "${retry_mode}" == true ]; then
-+                option=$(systemd-ask-password --echo "Detected no PKCS#11 device, retry PKCS#11 detection? [yY/nN]")
-+                if [ "${option}" == "N" ] || [ "${option}" == "n" ] ; then
-+                    echo ""
-+		    # Straight Forward Mode
-+                    return 0
-+                fi
-+                pkcs11_device=$(pkcs11-tool -L | grep "Slot" \
-+                                    | head -1 | awk -F ":" '{print $2}' | sed -e 's@^ *@@g')
-+                if ! pkcs11-tool -O 2>/dev/null 1>/dev/null; then
-+                    pkcs11_device=""
-+                    echo "No objects in PKCS11 device detected" >&2
-+                fi
-+            else
-+		echo "${pkcs11_device}"
-+                return 0
-+            fi
-+        fi
-+    done
-+}
-+
- clevis_parse_devices_array() {
-     INPUT_ARRAY=$(pkcs11-tool -L | grep Slot)
-     counter=0
-@@ -64,12 +114,10 @@ clevis_get_module_path_from_pkcs11_config() {
-     while read -r line; do
-         uuid=$(echo "${line}" | awk '{print $2}')
-         if ! mapped_device=$(clevis_map_device "${uuid}"); then
--            echo "Could not check mapped device for UID:${uuid}"
-             continue
-         fi
-         # If no PKCS#11 configuration, advance to next device
-         if ! clevis luks list -d "${mapped_device}" | grep pkcs11 >/dev/null 2>&1; then
--            echo "Device:${mapped_device} does not contain PKCS#11 configuration"
-             continue
-         fi
-         # Get configuration PKCS#11 URI
--- 
-2.46.2
-
diff --git a/0002-Fix-potential-race-condition.patch b/0002-Fix-potential-race-condition.patch
deleted file mode 100644
index 029ea36..0000000
--- a/0002-Fix-potential-race-condition.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 5feea5da42b98302006f2c82ab9c22d43779e0c8 Mon Sep 17 00:00:00 2001
-From: Sergio Arroutbi <sarroutb@redhat.com>
-Date: Fri, 27 Sep 2024 12:12:48 +0200
-Subject: [PATCH] Fix potential race condition
-
-Guard the modification of "entry_counter" and the read
-used to decide whether to modify "entry_counter" with the
-same set of locks
-
-Resolves: #478
-
-Signed-off-by: Sergio Arroutbi <sarroutb@redhat.com>
----
- src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c b/src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c
-index a6ecc63..b1e2004 100644
---- a/src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c
-+++ b/src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c
-@@ -70,21 +70,23 @@ get_control_socket_name(const char* file_sock, char* control_sock, uint32_t cont
- }
- 
- static void insert_device(const char* dev) {
-+    pthread_mutex_lock(&mutex);
-     if(MAX_ENTRIES == entry_counter) {
-+        pthread_mutex_unlock(&mutex);
-         perror("No more entries accepted\n");
-         return;
-     }
--    pthread_mutex_lock(&mutex);
-     strncpy(keys[entry_counter].dev, dev, MAX_DEVICE);
-     pthread_mutex_unlock(&mutex);
- }
- 
- static void insert_key(const char* key) {
-+    pthread_mutex_lock(&mutex);
-     if(MAX_ENTRIES == entry_counter) {
-+        pthread_mutex_unlock(&mutex);
-         perror("No more entries accepted\n");
-         return;
-     }
--    pthread_mutex_lock(&mutex);
-     strncpy(keys[entry_counter++].key, key, MAX_KEY);
-     pthread_mutex_unlock(&mutex);
- }
--- 
-2.46.2
-
diff --git a/0003-Fix-to-start-pcscd-appropriately.patch b/0003-Fix-to-start-pcscd-appropriately.patch
deleted file mode 100644
index 19cd4be..0000000
--- a/0003-Fix-to-start-pcscd-appropriately.patch
+++ /dev/null
@@ -1,106 +0,0 @@
-diff --git a/src/luks/dracut/clevis-pin-pkcs11/clevis-pkcs11-hook.sh b/src/luks/dracut/clevis-pin-pkcs11/clevis-pkcs11-hook.sh
-index 01a3062..9922bbc 100755
---- a/src/luks/dracut/clevis-pin-pkcs11/clevis-pkcs11-hook.sh
-+++ b/src/luks/dracut/clevis-pin-pkcs11/clevis-pkcs11-hook.sh
-@@ -16,9 +16,11 @@
- # You should have received a copy of the GNU General Public License
- # along with this program.  If not, see <http://www.gnu.org/licenses/>.
- #
-+. /usr/bin/clevis-pkcs11-common
-+
- if [ ! -f /run/systemd/clevis-pkcs11.run ] && [ -d /run/systemd ];
- then
--  pcscd --disable-polkit
--  echo "" > /run/systemd/clevis-pkcs11.run
--  /usr/libexec/clevis-luks-pkcs11-askpin -d -r
-+    clevis_start_pcscd_server
-+    echo "" > /run/systemd/clevis-pkcs11.run
-+    /usr/libexec/clevis-luks-pkcs11-askpin -d -r
- fi
-diff --git a/src/luks/systemd/clevis-luks-pkcs11-askpin.in b/src/luks/systemd/clevis-luks-pkcs11-askpin.in
-index b860efa..468ca3c 100755
---- a/src/luks/systemd/clevis-luks-pkcs11-askpin.in
-+++ b/src/luks/systemd/clevis-luks-pkcs11-askpin.in
-@@ -52,22 +52,7 @@ get_pkcs11_error() {
-     return 0
- }
- 
--
--if command -v pcscd; then
--    echo "clevis-pkcs11: starting pcscd if not available ..."
--    PCSCD_PID=$(ps auxf | grep "[p]cscd")
--    echo -e "clevis-pkcs11: pcscd running?:[${PCSCD_PID}]\n"
--    if ! ps auxf | grep "[p]cscd";
--    then
--        if pcscd pcscd --help | grep disable-polkit 1>/dev/null 2>/dev/null; then
--            echo "clevis-pkcs11: starting pcscd with --disable-polkit option ..."
--            pcscd --disable-polkit
--        else
--            echo "clevis-pkcs11: starting pcscd ..."
--            pcscd
--        fi
--    fi
--fi
-+clevis_start_pcscd_server
- 
- if [ "${dracut_mode}" != true ]; then
-     pkcs11-tool -L
-diff --git a/src/pins/pkcs11/clevis-pkcs11-common b/src/pins/pkcs11/clevis-pkcs11-common
-index 571a2be..b6328f5 100755
---- a/src/pins/pkcs11/clevis-pkcs11-common
-+++ b/src/pins/pkcs11/clevis-pkcs11-common
-@@ -27,6 +27,25 @@ serial_devices_array=""
- URI_EXPECTED_FORMAT="pkcs11:"
- DEFAULT_CRYPTTAB_FILE="/etc/crypttab"
- 
-+
-+clevis_start_pcscd_server() {
-+    if command -v pcscd; then
-+        echo "clevis-pkcs11: starting pcscd if not available ..."
-+        PCSCD_PID=$(ps auxf | grep "[p]cscd")
-+        echo -e "clevis-pkcs11: pcscd running?:[${PCSCD_PID}]\n"
-+        if ! ps auxf | grep "[p]cscd";
-+        then
-+            if pcscd --help | grep disable-polkit 1>/dev/null 2>/dev/null; then
-+                echo "clevis-pkcs11: starting pcscd with --disable-polkit option ..."
-+                pcscd --disable-polkit
-+            else
-+                echo "clevis-pkcs11: starting pcscd ..."
-+                pcscd
-+            fi
-+        fi
-+    fi
-+}
-+
- clevis_detect_pkcs11_device() {
-     dracut_mode="${1:false}"
-     retry_mode="${2:false}"
-diff --git a/src/pins/pkcs11/tests/pin-pkcs11 b/src/pins/pkcs11/tests/pin-pkcs11
-index 94e1548..c876ca4 100755
---- a/src/pins/pkcs11/tests/pin-pkcs11
-+++ b/src/pins/pkcs11/tests/pin-pkcs11
-@@ -20,6 +20,7 @@
- . pkcs11-common-tests
- . tests-common-functions
- . clevis-luks-common-functions
-+. clevis-pkcs11-common
- 
- on_exit() {
-     exit_status=$?
-@@ -150,5 +151,16 @@ then
- (${WRONGCFG})"
- fi
- 
-+if command -v ps && command -v killall; then
-+    if ! clevis_start_pcscd_server;
-+    then
-+        error "${TEST}: Could not start pcscd server"
-+    fi
-+    if ! killall -9 pcscd;
-+    then
-+        error "${TEST}: Could not kill pcscd server"
-+    fi
-+fi
-+
- softhsm_lib_cleanup
- test "$?" == 0
diff --git a/0004-tpm2-use-first-pcr-algorithm-bank-supported-by.patch b/0004-tpm2-use-first-pcr-algorithm-bank-supported-by.patch
deleted file mode 100644
index 5b0df2b..0000000
--- a/0004-tpm2-use-first-pcr-algorithm-bank-supported-by.patch
+++ /dev/null
@@ -1,65 +0,0 @@
---- clevis-21.old/src/pins/tpm2/clevis-encrypt-tpm2	2024-09-24 10:27:06.000000000 +0200
-+++ clevis-21/src/pins/tpm2/clevis-encrypt-tpm2	2024-11-05 15:54:16.209993587 +0100
-@@ -58,7 +58,7 @@
-     echo
-     echo "  key: <string>   Algorithm type for the generated key (default: ecc)"
-     echo
--    echo "  pcr_bank: <string>   PCR algorithm bank to use for policy (default: sha1)"
-+    echo "  pcr_bank: <string>   PCR algorithm bank to use for policy (default: first supported by TPM)"
-     echo
-     echo "  pcr_ids: <string>   PCR list used for policy. If not present, no policy is used"
-     echo
-@@ -130,7 +130,15 @@
- 
- key="$(jose fmt -j- -Og key -u- <<< "$cfg")" || key="ecc"
- 
--pcr_bank="$(jose fmt -j- -Og pcr_bank -u- <<< "$cfg")" || pcr_bank="sha1"
-+pcr_bank="$(jose fmt -j- -Og pcr_bank -u- <<< "$cfg")" || {
-+    if ! pcr_bank=$(tpm2_getcap pcrs |
-+            awk '/^[[:space:]]*-[[:space:]]*([^:]+):[[:space:]]*\[[[:space:]]*[^][:space:]]/ \
-+                     {found=1; split($0, m, /[-:[:space:]]+/); print m[2]; exit}
-+                 END {exit !found}'); then
-+        echo "Unable to find non-empty PCR algorithm bank, please check output of tpm2_getcap pcrs" >&2
-+        exit 1
-+    fi
-+}
- 
- # Trim the spaces from the config, so that we will not have issues parsing
- # the PCR IDs.
---- clevis-21.old/src/pins/tpm2/clevis-encrypt-tpm2.1.adoc	2024-09-24 10:27:06.000000000 +0200
-+++ clevis-21/src/pins/tpm2/clevis-encrypt-tpm2.1.adoc	2024-11-05 15:54:16.209993587 +0100
-@@ -91,13 +91,17 @@
-   - *symcipher*
- 
- * *pcr_bank*  (string) :
--  PCR algorithm bank to use for policy (default: sha1)
-+  PCR algorithm bank to use for policy (default: first supported by TPM)
- 
--  It must be one of the following:
-+  Examples of PCR algorithm banks, support depends on TPM chip:
- 
-   - *sha1*
-   - *sha256*
- 
-+  For the full list of algorithms supported by the TPM chip check output of
-+  `tpm2_getcap pcrs` and use the algorithm which shows non-empty list of PCR
-+  numbers.
-+
- * *pcr_ids*  (string) :
-   Comma separated list of PCR used for policy. If not present, no policy is used
- 
---- clevis-21.old/src/pins/tpm2/pin-tpm2	2024-09-24 10:27:06.000000000 +0200
-+++ clevis-21/src/pins/tpm2/pin-tpm2	2024-11-05 15:54:16.209993587 +0100
-@@ -142,8 +142,10 @@
- # arrays and check if we get the expected pcr_ids.
- 
- # Let's first make sure this would be a valid configuration.
--_default_pcr_bank="sha1"
--if validate_pcrs "${_default_pcr_bank}" "4,16"; then
-+_default_pcr_bank=$(tpm2_getcap pcrs |
-+    awk '/^[[:space:]]*-[[:space:]]*([^:]+):[[:space:]]*\[[[:space:]]*[^][:space:]]/ \
-+             {split($0, m, /[-:[:space:]]+/); print m[2]; exit}')
-+if [ -n "$_default_pcr_bank" ] && validate_pcrs "${_default_pcr_bank}" "4,16"; then
-     test_pcr_ids "${orig}" '{"pcr_ids": "16"}' "16" || exit 1
-     test_pcr_ids "${orig}" '{"pcr_ids": ["16"]}' "16"  || exit 1
-     test_pcr_ids "${orig}" '{"pcr_ids": "4,  16"}' "4,16" || exit 1
diff --git a/0005-Include-tpm2_getcap-as-dracut-required-binary.patch b/0005-Include-tpm2_getcap-as-dracut-required-binary.patch
deleted file mode 100644
index 69d248b..0000000
--- a/0005-Include-tpm2_getcap-as-dracut-required-binary.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From fc371d25a72806109e9a5c0205d67ba2232a6f17 Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Wed, 20 Nov 2024 18:45:56 +0100
-Subject: [PATCH] Include tpm2_getcap as dracut required binary
-
----
- src/luks/dracut/clevis-pin-tpm2/module-setup.sh.in | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/src/luks/dracut/clevis-pin-tpm2/module-setup.sh.in b/src/luks/dracut/clevis-pin-tpm2/module-setup.sh.in
-index 5ff0640..723df7a 100755
---- a/src/luks/dracut/clevis-pin-tpm2/module-setup.sh.in
-+++ b/src/luks/dracut/clevis-pin-tpm2/module-setup.sh.in
-@@ -19,7 +19,8 @@
- #
- 
- check() {
--    require_binaries clevis-decrypt-tpm2 tpm2_createprimary tpm2_flushcontext tpm2_load tpm2_unseal || return 1
-+    require_binaries clevis-decrypt-tpm2 tpm2_createprimary tpm2_flushcontext \
-+        tpm2_load tpm2_unseal tpm2_pcrread tpm2_getcap || return 1
-     require_any_binary tpm2_pcrread tpm2_pcrlist || return 1
-     return 0
- }
-@@ -30,7 +31,8 @@ depends() {
- }
- 
- install() {
--    inst_multiple clevis-decrypt-tpm2 tpm2_createprimary tpm2_flushcontext tpm2_load tpm2_unseal
-+    inst_multiple clevis-decrypt-tpm2 tpm2_createprimary tpm2_flushcontext \
-+        tpm2_load tpm2_unseal tpm2_getcap
-     inst_multiple -o tpm2_pcrread tpm2_pcrlist
-     inst_libdir_file "libtss2-tcti-device.so*"
- }
--- 
-2.47.0
-
diff --git a/clevis.spec b/clevis.spec
index 017f885..dd7aefe 100644
--- a/clevis.spec
+++ b/clevis.spec
@@ -1,6 +1,6 @@
 Name:           clevis
-Version:        21
-Release:        209%{?dist}
+Version:        22
+Release:        1%{?dist}
 Summary:        Automated decryption framework
 
 License:        GPLv3+
@@ -8,12 +8,6 @@ URL:            https://github.com/latchset/%{name}
 Source0:        https://github.com/latchset/%{name}/releases/download/v%{version}/%{name}-%{version}.tar.xz
 Source1:        clevis.sysusers
 
-Patch0:         0001-PKCS-11-pin-fix-dracut-for-unconfigured-device.patch
-Patch1:         0002-Fix-potential-race-condition.patch
-Patch2:         0003-Fix-to-start-pcscd-appropriately.patch
-Patch3:         0004-tpm2-use-first-pcr-algorithm-bank-supported-by.patch
-Patch4:         0005-Include-tpm2_getcap-as-dracut-required-binary.patch
-
 BuildRequires:  git-core
 BuildRequires:  gcc
 BuildRequires:  meson
@@ -162,10 +156,13 @@ systemctl preset %{name}-luks-askpass.path >/dev/null 2>&1 || :
 %{_bindir}/%{name}-encrypt-tpm2
 %{_bindir}/%{name}-encrypt-sss
 %{_bindir}/%{name}-encrypt-null
+%{_bindir}/%{name}-decrypt-file
+%{_bindir}/%{name}-encrypt-file
 %{_bindir}/%{name}
 %{_mandir}/man1/%{name}-encrypt-tang.1*
 %{_mandir}/man1/%{name}-encrypt-tpm2.1*
 %{_mandir}/man1/%{name}-encrypt-sss.1*
+%{_mandir}/man1/%{name}-encrypt-file.1*
 %{_mandir}/man1/%{name}-decrypt.1*
 %{_mandir}/man1/%{name}.1*
 %{_sysusersdir}/clevis.conf
@@ -197,11 +194,12 @@ systemctl preset %{name}-luks-askpass.path >/dev/null 2>&1 || :
 %{_unitdir}/%{name}-luks-askpass.service
 
 %files dracut
-%{_prefix}/lib/dracut/modules.d/60%{name}
-%{_prefix}/lib/dracut/modules.d/60%{name}-pin-null/module-setup.sh
-%{_prefix}/lib/dracut/modules.d/60%{name}-pin-sss/module-setup.sh
-%{_prefix}/lib/dracut/modules.d/60%{name}-pin-tang/module-setup.sh
-%{_prefix}/lib/dracut/modules.d/60%{name}-pin-tpm2/module-setup.sh
+%{_prefix}/lib/dracut/modules.d/50%{name}
+%{_prefix}/lib/dracut/modules.d/50%{name}-pin-null/module-setup.sh
+%{_prefix}/lib/dracut/modules.d/50%{name}-pin-sss/module-setup.sh
+%{_prefix}/lib/dracut/modules.d/50%{name}-pin-tang/module-setup.sh
+%{_prefix}/lib/dracut/modules.d/50%{name}-pin-tpm2/module-setup.sh
+%{_prefix}/lib/dracut/modules.d/50%{name}-pin-file/module-setup.sh
 
 %files pin-pkcs11
 %{_libexecdir}/%{name}-luks-pkcs11-askpass
@@ -213,15 +211,19 @@ systemctl preset %{name}-luks-askpass.path >/dev/null 2>&1 || :
 %{_unitdir}/%{name}-luks-pkcs11-askpass.service
 %{_unitdir}/%{name}-luks-pkcs11-askpass.socket
 %{_mandir}/man1/%{name}-encrypt-pkcs11.1*
-%{_prefix}/lib/dracut/modules.d/60%{name}-pin-pkcs11/module-setup.sh
-%{_prefix}/lib/dracut/modules.d/60%{name}-pin-pkcs11/%{name}-pkcs11-hook.sh
-%{_prefix}/lib/dracut/modules.d/60%{name}-pin-pkcs11/%{name}-pkcs11-prehook.sh
+%{_prefix}/lib/dracut/modules.d/50%{name}-pin-pkcs11/module-setup.sh
+%{_prefix}/lib/dracut/modules.d/50%{name}-pin-pkcs11/%{name}-pkcs11-hook.sh
+%{_prefix}/lib/dracut/modules.d/50%{name}-pin-pkcs11/%{name}-pkcs11-prehook.sh
 
 %files udisks2
 %{_sysconfdir}/xdg/autostart/%{name}-luks-udisks2.desktop
 %attr(4755, root, root) %{_libexecdir}/%{name}-luks-udisks2
 
 %changelog
+* Mon Apr 13 2026 Sergio Arroutbi <sarroutb@redhat.com> - 22-1
+- Rebase to clevis-22 upstream version
+  Resolves: #RHEL-944
+
 * Mon Jan 12 2026 Sergio Correia <scorreia@redhat.com> - 21-209
 - Add clevis user to tss group via sysusers
   Resolves: RHEL-132187
diff --git a/sources b/sources
index 85f0289..f8900a4 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (clevis-21.tar.xz) = 66f141b9d0c35ec3bb975b49053ee11f8fd5492b2af0377797892d6e28f4491b146e48477107dcf0ae5860ed1b08920bc95ed69893664689077c1342169cd399
+SHA512 (clevis-22.tar.xz) = d91e917af4b90c47aba77169bdaa9d3f73ced1951487a92d11a251f9de3e2947fb89d6bc2d4aa768493c3439336d4f2f541625a8b8cbe8de7f03a2b70b927c01