diff --git a/configure.ac b/configure.ac
index 477013cfa1..6289973250 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,2114 +1,2115 @@
 dnl
 dnl autoconf for Pacemaker
 dnl
 dnl Copyright 2009-2024 the Pacemaker project contributors
 dnl
 dnl The version control history for this file may have further details.
 dnl
 dnl This source code is licensed under the GNU General Public License version 2
 dnl or later (GPLv2+) WITHOUT ANY WARRANTY.
 
 
 dnl ==============================================
 dnl Bootstrap autotools
 dnl ==============================================
 
 # Require a minimum version of autoconf itself
 AC_PREREQ(2.64)
 
 dnl AC_CONFIG_MACRO_DIR is deprecated as of autoconf 2.70 (2020-12-08).
 dnl Once we can require that version, we can simplify this, and no longer
 dnl need ACLOCAL_AMFLAGS in Makefile.am.
 m4_ifdef([AC_CONFIG_MACRO_DIRS],
          [AC_CONFIG_MACRO_DIRS([m4])],
          [AC_CONFIG_MACRO_DIR([m4])])
 
 m4_include([m4/version.m4])
 AC_INIT([pacemaker], VERSION_NUMBER, [users@clusterlabs.org], [pacemaker],
         PCMK_URL)
 
 LT_CONFIG_LTDL_DIR([libltdl])
 AC_CONFIG_AUX_DIR([libltdl/config])
 
 dnl Where #defines that autoconf makes (e.g. HAVE_whatever) go
 dnl
 dnl include/config.h
 dnl   - Internal API
 dnl   - Contains all defines
 dnl   - include/config.h.in is generated automatically by autoheader
 dnl   - Not to be included in any header files except crm_internal.h
 dnl     (which is also not to be included in any other header files)
 dnl
 dnl include/crm_config.h
 dnl   - External API
 dnl   - Contains a subset of defines
 dnl   - include/crm_config.h.in is manually edited to select the subset
 dnl   - Should not include HAVE_* defines
 dnl   - Safe to include anywhere
 AC_CONFIG_HEADERS([include/config.h include/crm_config.h])
 
 dnl 1.13:           minimum automake version required
 dnl foreign:        don't require GNU-standard top-level files
 dnl tar-ustar:      use (older) POSIX variant of generated tar rather than v7
 dnl subdir-objects: keep .o's with their .c's (no-op in 2.0+)
 AM_INIT_AUTOMAKE([1.13 foreign tar-ustar subdir-objects])
 
 dnl Require minimum version of pkg-config
 PKG_PROG_PKG_CONFIG(0.28)
 AS_IF([test x"${PKG_CONFIG}" != x""], [],
       [AC_MSG_FAILURE([Could not find required build tool pkg-config (0.28 or later)])])
 PKG_INSTALLDIR
 PKG_NOARCH_INSTALLDIR
 
 
 dnl ==============================================
 dnl Compiler checks and helpers
 dnl ==============================================
 
 dnl A particular compiler can be forced by setting the CC environment variable
 AC_PROG_CC
 
 dnl C++ is needed only to run maintainer utilities, not to build
 AC_PROG_CXX
 
 dnl Use at least C99 if possible (automatic for autoconf >= 2.70)
 m4_version_prereq([2.70], [:], [AC_PROG_CC_STDC])
 
 # cc_supports_flag <compiler-flag>
 #  Return success if the C compiler supports the given flag
 cc_supports_flag() {
     local CFLAGS="-Werror $@"
     AC_MSG_CHECKING([whether $CC supports $@])
     AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ ]], [[ ]])],
                       [RC=0; AC_MSG_RESULT([yes])],
                       [RC=1; AC_MSG_RESULT([no])])
     return $RC
 }
 
 # cc_temp_flags <compiler-flags>
 #  Use the given flags for subsequent C compilation. These can be reverted to
 #  what was used previously with cc_restore_flags. This allows certain tests to
 #  use specific flags without affecting anything else.
 cc_temp_flags() {
     ac_save_CFLAGS="$CFLAGS"
     CFLAGS="$*"
 }
 
 # cc_restore_flags
 #  Restore C compiler flags to what they were before the last cc_temp_flags
 #  call.
 cc_restore_flags() {
     CFLAGS=$ac_save_CFLAGS
 }
 
 # Check for fatal warning support
 AS_IF([test $enable_fatal_warnings -ne $DISABLED dnl
        && test x"$GCC" = x"yes" && cc_supports_flag -Werror],
       [WERROR="-Werror"],
       [
           WERROR=""
           AS_CASE([$enable_fatal_warnings],
                   [$REQUIRED], [AC_MSG_ERROR([Compiler does not support fatal warnings])],
                   [$OPTIONAL], [enable_fatal_warnings=$DISABLED])
       ])
 
 
 dnl ==============================================
 dnl Linker checks
 dnl ==============================================
 
 # Check whether linker supports --enable-new-dtags to use RUNPATH instead of
 # RPATH. It is necessary to do this before libtool does linker detection.
 # See also: https://github.com/kronosnet/kronosnet/issues/107
 AX_CHECK_LINK_FLAG([-Wl,--enable-new-dtags],
                   [AM_LDFLAGS=-Wl,--enable-new-dtags],
                   [AC_MSG_ERROR(["Linker support for --enable-new-dtags is required"])])
 AC_SUBST([AM_LDFLAGS])
 
 saved_LDFLAGS="$LDFLAGS"
 LDFLAGS="$AM_LDFLAGS $LDFLAGS"
 LT_INIT([dlopen])
 LDFLAGS="$saved_LDFLAGS"
 LTDL_INIT([convenience])
 
 
 dnl ==============================================
 dnl Define configure options
 dnl ==============================================
 
 # yes_no_try <user-response> <default>
 #  Map a yes/no/try user selection to $REQUIRED for yes, $DISABLED for no, and
 #  $OPTIONAL for try.
 DISABLED=0
 REQUIRED=1
 OPTIONAL=2
 yes_no_try() {
     local value
     AS_IF([test x"$1" = x""], [value="$2"], [value="$1"])
     AS_CASE(["`echo "$value" | tr '[A-Z]' '[a-z]'`"],
             [0|no|false|disable], [return $DISABLED],
             [1|yes|true|enable], [return $REQUIRED],
             [try|check], [return $OPTIONAL]
     )
     AC_MSG_ERROR([Invalid option value "$value"])
 }
 
 #
 # Fix the defaults of certain built-in variables so they can be used in the
 # defaults for our custom arguments
 #
 
 AC_MSG_NOTICE([Sanitizing prefix: ${prefix}])
 AS_IF([test x"$prefix" = x"NONE"],
       [
           prefix=/usr
           dnl Fix default variables - "prefix" variable if not specified
           AS_IF([test x"$localstatedir" = x"\${prefix}/var"],
                 [localstatedir="/var"])
           AS_IF([test x"$sysconfdir" = x"\${prefix}/etc"],
                 [sysconfdir="/etc"])
       ])
 
 AC_MSG_NOTICE([Sanitizing exec_prefix: ${exec_prefix}])
 AS_CASE([$exec_prefix],
         [prefix|NONE], [exec_prefix=$prefix])
 
 AC_MSG_NOTICE([Sanitizing libdir: ${libdir}])
 AS_CASE([$libdir],
         [prefix|NONE], [
             AC_MSG_CHECKING([which lib directory to use])
             for aDir in lib64 lib
             do
                 trydir="${exec_prefix}/${aDir}"
                 AS_IF([test -d ${trydir}],
                       [
                           libdir=${trydir}
                           break
                       ])
             done
             AC_MSG_RESULT([$libdir])
         ])
 
 # Start a list of optional features this build supports
 PCMK_FEATURES=""
 
 dnl This section should include only the definition of configure script
 dnl options and determining their values. Processing should be done later when
 dnl possible, other than what's needed to determine values and defaults.
 
 dnl Per the autoconf docs, --enable-*/--disable-* options should control
 dnl features inherent to Pacemaker, while --with-*/--without-* options should
 dnl control the use of external software. However, --enable-*/--disable-* may
 dnl implicitly require additional external dependencies, and
 dnl --with-*/--without-* may implicitly enable or disable features, so the
 dnl line is blurry.
 dnl
 dnl We also use --with-* options for custom file, directory, and path
 dnl locations, since autoconf does not provide an option type for those.
 
 dnl --enable-* options: build process
 
 AC_ARG_ENABLE([quiet],
     [AS_HELP_STRING([--enable-quiet],
         [suppress make output unless there is an error @<:@no@:>@])]
 )
 yes_no_try "$enable_quiet" "no"
 enable_quiet=$?
 
 AC_ARG_ENABLE([fatal-warnings],
     [AS_HELP_STRING([--enable-fatal-warnings],
         [enable pedantic and fatal warnings for gcc @<:@try@:>@])],
 )
 yes_no_try "$enable_fatal_warnings" "try"
 enable_fatal_warnings=$?
 
 AC_ARG_ENABLE([hardening],
     [AS_HELP_STRING([--enable-hardening],
         [harden the resulting executables/libraries @<:@try@:>@])]
 )
 yes_no_try "$enable_hardening" "try"
 enable_hardening=$?
 
 dnl --enable-* options: features
 
 AC_ARG_ENABLE([systemd],
     [AS_HELP_STRING([--enable-systemd],
         [enable support for managing resources via systemd @<:@try@:>@])]
 )
 yes_no_try "$enable_systemd" "try"
 enable_systemd=$?
 
 dnl --enable-* options: features inherent to Pacemaker
 
 # AM_GNU_GETTEXT calls AM_NLS which defines the nls option, but it defaults
 # to enabled. We override the definition of AM_NLS to flip the default and mark
 # it as experimental in the help text.
 AC_DEFUN([AM_NLS],
     [AC_MSG_CHECKING([whether NLS is requested])
     AC_ARG_ENABLE([nls],
         [AS_HELP_STRING([--enable-nls],
             [use Native Language Support (experimental)])],
         USE_NLS=$enableval, USE_NLS=no)
     AC_MSG_RESULT([$USE_NLS])
     AC_SUBST([USE_NLS])]
 )
 AM_GNU_GETTEXT([external])
 AM_GNU_GETTEXT_VERSION([0.18])
 
 dnl --with-* options: external software support, and custom locations
 
 dnl This argument is defined via an M4 macro so default can be a variable
 AC_DEFUN([VERSION_ARG],
     [AC_ARG_WITH([version],
         [AS_HELP_STRING([--with-version=VERSION],
             [override package version @<:@$1@:>@])],
         [ PACEMAKER_VERSION="$withval" ],
         [ PACEMAKER_VERSION="$PACKAGE_VERSION" ])]
 )
 VERSION_ARG(VERSION_NUMBER)
 
 CRM_DAEMON_USER=""
 AC_ARG_WITH([daemon-user],
     [AS_HELP_STRING([--with-daemon-user=USER],
         [user to run unprivileged Pacemaker daemons as (advanced option: changing this may break other cluster components unless similarly configured) @<:@hacluster@:>@])],
     [ CRM_DAEMON_USER="$withval" ]
 )
 AS_IF([test x"${CRM_DAEMON_USER}" = x""],
       [CRM_DAEMON_USER="hacluster"])
 
 CRM_DAEMON_GROUP=""
 AC_ARG_WITH([daemon-group],
     [AS_HELP_STRING([--with-daemon-group=GROUP],
         [group to run unprivileged Pacemaker daemons as (advanced option: changing this may break other cluster components unless similarly configured) @<:@haclient@:>@])],
     [ CRM_DAEMON_GROUP="$withval" ]
 )
 AS_IF([test x"${CRM_DAEMON_GROUP}" = x""],
       [CRM_DAEMON_GROUP="haclient"])
 
 BUG_URL=""
 AC_ARG_WITH([bug-url],
     [AS_HELP_STRING([--with-bug-url=DIR], m4_normalize([
         address where users should submit bug reports
         @<:@https://bugs.clusterlabs.org/enter_bug.cgi?product=Pacemaker@:>@]))],
     [ BUG_URL="$withval" ]
 )
 AS_IF([test x"${BUG_URL}" = x""],
       [BUG_URL="https://bugs.clusterlabs.org/enter_bug.cgi?product=Pacemaker"])
 
 dnl --with-* options: features
 
 AC_ARG_WITH([cibsecrets],
     [AS_HELP_STRING([--with-cibsecrets],
         [support separate file for CIB secrets @<:@no@:>@])]
 )
 yes_no_try "$with_cibsecrets" "no"
 with_cibsecrets=$?
 
 PCMK__GNUTLS_PRIORITIES="NORMAL"
 AC_ARG_WITH([gnutls-priorities],
     [AS_HELP_STRING([--with-gnutls-priorities],
         [default GnuTLS cipher priorities @<:@NORMAL@:>@])],
     [ test x"$withval" = x"no" || PCMK__GNUTLS_PRIORITIES="$withval" ]
 )
 
 AC_ARG_WITH([concurrent-fencing-default],
     [AS_HELP_STRING([--with-concurrent-fencing-default], m4_normalize([
         default value for concurrent-fencing cluster option (deprecated)
         @<:@true@:>@]))],
 )
 AS_CASE([$with_concurrent_fencing_default],
         [""], [with_concurrent_fencing_default="true"],
         [true], [],
         [false], [PCMK_FEATURES="$PCMK_FEATURES concurrent-fencing-default-false"],
         [AC_MSG_ERROR([Invalid value "$with_concurrent_fencing_default" for --with-concurrent-fencing-default])]
 )
 
 AC_ARG_WITH([sbd-sync-default],
     [AS_HELP_STRING([--with-sbd-sync-default], m4_normalize([
         default value used by sbd if SBD_SYNC_RESOURCE_STARTUP
         environment variable is not set @<:@false@:>@]))],
 )
 AS_CASE([$with_sbd_sync_default],
         [""], [with_sbd_sync_default=false],
         [false], [],
         [true], [PCMK_FEATURES="$PCMK_FEATURES default-sbd-sync"],
         [AC_MSG_ERROR([Invalid value "$with_sbd_sync_default" for --with-sbd-sync-default])]
 )
 
 AC_ARG_WITH([resource-stickiness-default],
     [AS_HELP_STRING([--with-resource-stickiness-default],
         [If positive, value to add to new CIBs as explicit resource default for resource-stickiness @<:@0@:>@])],
 )
 errmsg="Invalid value \"$with_resource_stickiness_default\" for --with-resource-stickiness-default"
 AS_CASE([$with_resource_stickiness_default],
         [0|""], [with_resource_stickiness_default="0"],
         [*[[!0-9]]*], [AC_MSG_ERROR([$errmsg])],
         [PCMK_FEATURES="$PCMK_FEATURES default-resource-stickiness"]
 )
 
 AC_ARG_WITH([corosync],
     [AS_HELP_STRING([--with-corosync],
         [support the Corosync messaging and membership layer @<:@try@:>@])]
 )
 yes_no_try "$with_corosync" "try"
 with_corosync=$?
 
 dnl Get default from Corosync if possible
 PKG_CHECK_VAR([PCMK__COROSYNC_CONF], [corosync], [corosysconfdir],
               [PCMK__COROSYNC_CONF="$PCMK__COROSYNC_CONF/corosync.conf"],
               [PCMK__COROSYNC_CONF="${sysconfdir}/corosync/corosync.conf"])
 AC_ARG_WITH([corosync-conf],
     [AS_HELP_STRING([--with-corosync-conf], m4_normalize([
         location of Corosync configuration file
         @<:@value from Corosync package if available otherwise
         SYSCONFDIR/corosync/corosync.conf@:>@]))],
     [ PCMK__COROSYNC_CONF="$withval" ]
 )
 
 dnl --with-* options: directory locations
 
 INITDIR=""
 AC_ARG_WITH([initdir],
     [AS_HELP_STRING([--with-initdir=DIR], m4_normalize([
         directory for lsb resources (init scripts), or "try" to check for
         common locations, or "no" to disable] @<:@try@:>@))],
     [ INITDIR="$withval" ]
 )
 AS_IF([test x"$INITDIR" = x""], [INITDIR="try"])
 
 systemdsystemunitdir="${systemdsystemunitdir-}"
 AC_ARG_WITH([systemdsystemunitdir],
     [AS_HELP_STRING([--with-systemdsystemunitdir=DIR],
         [directory for systemd unit files (advanced option: must match what systemd uses)])],
     [ systemdsystemunitdir="$withval" ]
 )
 
 CONFIGDIR=""
 AC_ARG_WITH([configdir],
     [AS_HELP_STRING([--with-configdir=DIR],
         [directory for Pacemaker configuration file @<:@SYSCONFDIR/sysconfig@:>@])],
     [ CONFIGDIR="$withval" ]
 )
 
 dnl --runstatedir is available as of autoconf 2.70 (2020-12-08). When users
 dnl have an older version, they can use our --with-runstatedir.
 pcmk_runstatedir=""
 AC_ARG_WITH([runstatedir],
     [AS_HELP_STRING([--with-runstatedir=DIR],
         [modifiable per-process data @<:@LOCALSTATEDIR/run@:>@ (ignored if --runstatedir is available)])],
     [ pcmk_runstatedir="$withval" ]
 )
 
 CRM_LOG_DIR=""
 AC_ARG_WITH([logdir],
     [AS_HELP_STRING([--with-logdir=DIR],
         [directory for Pacemaker log file @<:@LOCALSTATEDIR/log/pacemaker@:>@])],
     [ CRM_LOG_DIR="$withval" ]
 )
 
 CRM_BUNDLE_DIR=""
 AC_ARG_WITH([bundledir],
     [AS_HELP_STRING([--with-bundledir=DIR],
         [directory for Pacemaker bundle logs @<:@LOCALSTATEDIR/log/pacemaker/bundles@:>@])],
     [ CRM_BUNDLE_DIR="$withval" ]
 )
 
 dnl Get default from resource-agents if possible. Otherwise, the default uses
 dnl /usr/lib rather than libdir because it's determined by the OCF project and
 dnl not Pacemaker. Even if a user wants to install Pacemaker to /usr/local or
 dnl such, the OCF agents will be expected in their usual location. However, we
 dnl do give the user the option to override it.
 PKG_CHECK_VAR([PCMK_OCF_ROOT], [resource-agents], [ocfrootdir], [],
               [PCMK_OCF_ROOT="/usr/lib/ocf"])
 AC_ARG_WITH([ocfdir],
     [AS_HELP_STRING([--with-ocfdir=DIR], m4_normalize([
         OCF resource agent root directory (advanced option: changing this
         may break other cluster components unless similarly configured)
         @<:@value from resource-agents package if available otherwise
         /usr/lib/ocf@:>@]))],
     [ PCMK_OCF_ROOT="$withval" ]
 )
 
 dnl Get default from resource-agents if possible
 PKG_CHECK_VAR([PCMK__OCF_RA_PATH], [resource-agents], [ocfrapath], [],
               [PCMK__OCF_RA_PATH="$PCMK_OCF_ROOT/resource.d"])
 AC_ARG_WITH([ocfrapath],
     [AS_HELP_STRING([--with-ocfrapath=DIR], m4_normalize([
         OCF resource agent directories (colon-separated) to search
         @<:@value from resource-agents package if available otherwise
         OCFDIR/resource.d@:>@]))],
     [ PCMK__OCF_RA_PATH="$withval" ]
 )
 
 OCF_RA_INSTALL_DIR="$PCMK_OCF_ROOT/resource.d"
 AC_ARG_WITH([ocfrainstalldir],
     [AS_HELP_STRING([--with-ocfrainstalldir=DIR], m4_normalize([
         OCF installation directory for Pacemakers resource agents
         @<:@OCFDIR/resource.d@:>@]))],
     [ OCF_RA_INSTALL_DIR="$withval" ]
 )
 
 dnl Get default from fence-agents if available
 PKG_CHECK_VAR([FA_PREFIX], [fence-agents], [prefix],
               [PCMK__FENCE_BINDIR="${FA_PREFIX}/sbin"],
               [PCMK__FENCE_BINDIR="$sbindir"])
 AC_ARG_WITH([fence-bindir],
     [AS_HELP_STRING([--with-fence-bindir=DIR], m4_normalize([
         directory for executable fence agents @<:@value from fence-agents
         package if available otherwise SBINDIR@:>@]))],
     [ PCMK__FENCE_BINDIR="$withval" ]
 )
 
 dnl --with-* options: non-production testing
 
 AC_ARG_WITH([profiling],
     [AS_HELP_STRING([--with-profiling],
         [disable optimizations, for effective profiling @<:@no@:>@])]
 )
 yes_no_try "$with_profiling" "no"
 with_profiling=$?
 
 AC_ARG_WITH([coverage],
     [AS_HELP_STRING([--with-coverage],
         [disable optimizations, for effective profiling and coverage testing @<:@no@:>@])]
 )
 yes_no_try "$with_coverage" "no"
 with_coverage=$?
 
 AC_DEFINE_UNQUOTED([PCMK__WITH_COVERAGE], [$with_coverage], [Build with code coverage])
 AM_CONDITIONAL([BUILD_COVERAGE], [test $with_coverage -ne $DISABLED])
 
 AC_ARG_WITH([sanitizers],
   [AS_HELP_STRING([--with-sanitizers=...,...],
     [enable SANitizer build, do *NOT* use for production. Only ASAN/UBSAN/TSAN are currently supported])],
   [ SANITIZERS="$withval" ],
   [ SANITIZERS="" ])
 
 dnl Environment variable options
 
 AC_ARG_VAR([CFLAGS_HARDENED_LIB], [extra C compiler flags for hardened libraries])
 AC_ARG_VAR([LDFLAGS_HARDENED_LIB], [extra linker flags for hardened libraries])
 
 AC_ARG_VAR([CFLAGS_HARDENED_EXE], [extra C compiler flags for hardened executables])
 AC_ARG_VAR([LDFLAGS_HARDENED_EXE], [extra linker flags for hardened executables])
 
 
 dnl ==============================================
 dnl Locate essential tools
 dnl ==============================================
 
 PATH="$PATH:/sbin:/usr/sbin:/usr/local/sbin:/usr/local/bin"
 export PATH
 
 dnl Pacemaker's executable python scripts will invoke the python specified by
 dnl configure's PYTHON variable. If not specified, AM_PATH_PYTHON will check a
 dnl built-in list with (unversioned) "python" having precedence. To configure
 dnl Pacemaker to use a specific python interpreter version, define PYTHON
 dnl when calling configure, for example: ./configure PYTHON=/usr/bin/python3.6
 
 dnl If PYTHON was specified, ensure it is an absolute path
 AS_IF([test x"${PYTHON}" != x""], [AC_PATH_PROG([PYTHON], [$PYTHON])])
 
 dnl Require a minimum Python version
 AM_PATH_PYTHON([3.6])
 
 AC_PROG_LN_S
 AC_PROG_MKDIR_P
 
 AC_PATH_PROG([GIT], [git], [false])
 
 dnl Bash is needed for building man pages and running regression tests.
 dnl We set "BASH_PATH" because "BASH" is already an environment variable.
 REQUIRE_PROG([BASH_PATH], [bash])
 
 AC_PATH_PROGS(PCMK__VALGRIND_EXEC, valgrind, /usr/bin/valgrind)
 AC_DEFINE_UNQUOTED(PCMK__VALGRIND_EXEC, "$PCMK__VALGRIND_EXEC", Valgrind command)
 
 
 dnl ==============================================
 dnl Package and schema versioning
 dnl ==============================================
 
 # Redefine PACKAGE_VERSION and VERSION according to PACEMAKER_VERSION in case
 # the user used --with-version. Unfortunately, this can only affect the
 # substitution variables and later uses in this file, not the config.h
 # constants, so we have to be careful to use only PACEMAKER_VERSION in C code.
 PACKAGE_VERSION=$PACEMAKER_VERSION
 VERSION=$PACEMAKER_VERSION
 
 AC_DEFINE_UNQUOTED(PACEMAKER_VERSION, "$VERSION",
                    [Version number of this Pacemaker build])
 
 AC_MSG_CHECKING([build version])
 AS_IF([test "$GIT" != "false" && test -d .git],
       [
           BUILD_VERSION=`"$GIT" log --pretty="format:%h" -n 1`
           AC_MSG_RESULT([$BUILD_VERSION (git hash)])
       ],
       [
           # The current directory name make a reasonable default
           # Most generated archives will include the hash or tag
           BASE=`basename $PWD`
           BUILD_VERSION=`echo $BASE | sed s:.*[[Pp]]acemaker-::`
           AC_MSG_RESULT([$BUILD_VERSION (directory name)])
       ])
 AC_DEFINE_UNQUOTED(BUILD_VERSION, "$BUILD_VERSION", Build version)
 AC_SUBST(BUILD_VERSION)
 
 # schema_files <schema-dir>
 #  List all manually edited RNG schemas (as opposed to auto-generated via make)
 #  in the given directory. Use git if available to list managed RNGs, in case
 #  there are leftover schema files from an earlier build of a different
 #  version. Otherwise, check all RNGs.
 schema_files() {
     local files="$("$GIT" ls-files "$1"/*.rng 2>/dev/null)"
 
     AS_IF([test x"$files" = x""],
           [
               files="$(ls -1 "$1"/*.rng | grep -E -v    \
                        '/(pacemaker|api-result|crm_mon|versions)[^/]*\.rng')"
           ])
     echo "$files"
 }
 
 # latest_schema_version <schema-dir>
 #  Determine highest RNG version in the given schema directory.
 latest_schema_version() {
     schema_files "$1" | sed -n -e 's/^.*-\([[0-9]][[0-9.]]*\).rng$/\1/p' dnl
                       | sort -V | tail -1
 }
 
 # schemas_for_make <schema-dir>
 #  Like schema_files, but suitable for use in make variables.
 schemas_for_make() {
     local file
 
     for file in $(schema_files "$1"); do
         AS_ECHO_N(["\$(top_srcdir)/$file "])
     done
 }
 
 # Detect highest API schema version
 API_VERSION=$(latest_schema_version "xml/api")
 AC_DEFINE_UNQUOTED([PCMK__API_VERSION], ["$API_VERSION"],
                    [Highest API schema version])
 
 # Detect highest CIB schema version
 CIB_VERSION=$(latest_schema_version "xml")
 AC_SUBST(CIB_VERSION)
 
 # Re-run configure at next make if schema files change, to re-detect versions
 cib_schemas="$(schemas_for_make "xml")"
 api_schemas="$(schemas_for_make "xml/api")"
 CONFIG_STATUS_DEPENDENCIES="$cib_schemas $api_schemas"
 AC_SUBST(CONFIG_STATUS_DEPENDENCIES)
 
 
 dnl ==============================================
 dnl Process simple options
 dnl ==============================================
 
 AS_IF([test x"$enable_nls" = x"yes"], [PCMK_FEATURES="$PCMK_FEATURES nls"])
 
 AS_IF([test x"$with_concurrent_fencing_default" = x"true"],
       [PCMK__CONCURRENT_FENCING_DEFAULT_TRUE="1"],
       [PCMK__CONCURRENT_FENCING_DEFAULT_TRUE="0"])
 AC_DEFINE_UNQUOTED([PCMK__CONCURRENT_FENCING_DEFAULT_TRUE],
                    [$PCMK__CONCURRENT_FENCING_DEFAULT_TRUE],
                    [Whether concurrent-fencing cluster option default is true])
 
 AC_DEFINE_UNQUOTED([PCMK__SBD_SYNC_DEFAULT],
                    [$with_sbd_sync_default],
                    [Default value for SBD_SYNC_RESOURCE_STARTUP environment variable])
 
 AC_DEFINE_UNQUOTED([PCMK__RESOURCE_STICKINESS_DEFAULT],
                    [$with_resource_stickiness_default],
                    [Default value for resource-stickiness resource meta-attribute])
 
 AS_IF([test x"${PCMK__GNUTLS_PRIORITIES}" != x""], [],
       [AC_MSG_ERROR([--with-gnutls-priorities value must not be empty])])
 AC_DEFINE_UNQUOTED([PCMK__GNUTLS_PRIORITIES], ["$PCMK__GNUTLS_PRIORITIES"],
                    [GnuTLS cipher priorities])
 AC_SUBST(PCMK__GNUTLS_PRIORITIES)
 
 AC_SUBST(BUG_URL)
 AC_DEFINE_UNQUOTED([PCMK__BUG_URL], ["$BUG_URL"],
                    [Where bugs should be reported])
 
 AC_DEFINE_UNQUOTED([CRM_DAEMON_USER], ["$CRM_DAEMON_USER"],
                    [User to run Pacemaker daemons as])
 AC_SUBST(CRM_DAEMON_USER)
 
 AC_DEFINE_UNQUOTED([CRM_DAEMON_GROUP], ["$CRM_DAEMON_GROUP"],
                    [Group to run Pacemaker daemons as])
 AC_SUBST(CRM_DAEMON_GROUP)
 
 
 dnl ==============================================
 dnl Process file paths
 dnl ==============================================
 
 # expand_path_option <path-variable-name> [<default>]
 #  Given the name of a file path variable, expand any variable references
 #  inside it, use the specified default if it is not specified, and ensure it
 #  is a full path.
 expand_path_option() {
     # The first argument is the variable *name* (not value)
     ac_path_varname="$1"
 
     # Get the original value of the variable
     ac_path_value=$(eval echo "\${${ac_path_varname}}")
 
     # Expand any literal variable expressions in the value so that we don't
     # end up with something like '${prefix}' in #defines etc.
     #
     # Autoconf deliberately leaves values unexpanded to allow overriding
     # the configure script choices in make commands (for example,
     # "make exec_prefix=/foo install"). No longer being able to do this seems
     # like no great loss.
     eval ac_path_value=$(eval echo "${ac_path_value}")
 
     # Use (expanded) default if necessary
     AS_IF([test x"${ac_path_value}" = x""],
           [eval ac_path_value=$(eval echo "$2")])
 
     # Require a full path
     AS_CASE(["$ac_path_value"],
             [/*], [eval ${ac_path_varname}="$ac_path_value"],
             [*], [AC_MSG_ERROR([$ac_path_varname value "$ac_path_value" is not a full path])]
     )
 }
 
 dnl Expand values of autoconf-provided directory options
 expand_path_option prefix
 expand_path_option exec_prefix
 expand_path_option bindir
 expand_path_option sbindir
 expand_path_option libexecdir
 expand_path_option datarootdir
 expand_path_option datadir
 expand_path_option sysconfdir
 expand_path_option sharedstatedir
 expand_path_option localstatedir
 expand_path_option libdir
 expand_path_option includedir
 expand_path_option oldincludedir
 expand_path_option infodir
 expand_path_option mandir
 
 AC_DEFUN([AC_DATAROOTDIR_CHECKED])
 
 dnl Expand values of custom directory options
 
 AS_IF([test x"$INITDIR" = x"try"],
       [
           AC_MSG_CHECKING([for an init directory])
           INITDIR=no
           for initdir in /etc/init.d /etc/rc.d/init.d /sbin/init.d \
                          /usr/local/etc/rc.d /etc/rc.d ${sysconfdir}/init.d
           do
               AS_IF([test -d $initdir],
                     [
                         INITDIR=$initdir
                         break
                     ])
           done
           AC_MSG_RESULT([$INITDIR])
       ])
 support_lsb=$DISABLED
 AM_CONDITIONAL([BUILD_LSB], [test x"${INITDIR}" != x"no"])
 AM_COND_IF([BUILD_LSB],
            [
                support_lsb=$REQUIRED
                expand_path_option INITDIR
                PCMK_FEATURES="$PCMK_FEATURES lsb"
            ],
            [ INITDIR="" ])
 AC_SUBST(INITDIR)
 AC_DEFINE_UNQUOTED([PCMK__ENABLE_LSB], [$support_lsb],
                    [Whether to support LSB resource agents])
 AC_DEFINE_UNQUOTED([PCMK__LSB_INIT_DIR], ["$INITDIR"],
                    [Location for LSB init scripts])
 
 expand_path_option localedir "${datadir}/locale"
 AC_DEFINE_UNQUOTED([PCMK__LOCALE_DIR],["$localedir"],
                    [Base directory for message catalogs])
 
 AS_IF([test x"${runstatedir}" = x""], [runstatedir="${pcmk_runstatedir}"])
 expand_path_option runstatedir "${localstatedir}/run"
 AC_DEFINE_UNQUOTED([PCMK__RUN_DIR], ["$runstatedir"],
                    [Location for modifiable per-process data])
 AC_SUBST(runstatedir)
 
 expand_path_option docdir "${datadir}/doc/${PACKAGE}-${VERSION}"
 AC_SUBST(docdir)
 
 expand_path_option CONFIGDIR "${sysconfdir}/sysconfig"
 AC_SUBST(CONFIGDIR)
 
 expand_path_option PCMK__COROSYNC_CONF "${sysconfdir}/corosync/corosync.conf"
 AC_SUBST(PCMK__COROSYNC_CONF)
 
 expand_path_option CRM_LOG_DIR "${localstatedir}/log/pacemaker"
 AC_DEFINE_UNQUOTED([CRM_LOG_DIR], ["$CRM_LOG_DIR"],
                    [Location for Pacemaker log file])
 AC_SUBST(CRM_LOG_DIR)
 
 expand_path_option CRM_BUNDLE_DIR "${localstatedir}/log/pacemaker/bundles"
 AC_DEFINE_UNQUOTED([CRM_BUNDLE_DIR], ["$CRM_BUNDLE_DIR"],
                    [Location for Pacemaker bundle logs])
 AC_SUBST(CRM_BUNDLE_DIR)
 
 expand_path_option PCMK__FENCE_BINDIR
 AC_SUBST(PCMK__FENCE_BINDIR)
 AC_DEFINE_UNQUOTED([PCMK__FENCE_BINDIR], ["$PCMK__FENCE_BINDIR"],
                    [Location for executable fence agents])
 
 expand_path_option PCMK_OCF_ROOT
 AC_SUBST(PCMK_OCF_ROOT)
 AC_DEFINE_UNQUOTED([PCMK_OCF_ROOT], ["$PCMK_OCF_ROOT"],
                    [OCF root directory for resource agents and libraries])
 
 expand_path_option PCMK__OCF_RA_PATH
 AC_SUBST(PCMK__OCF_RA_PATH)
 AC_DEFINE_UNQUOTED([PCMK__OCF_RA_PATH], ["$PCMK__OCF_RA_PATH"],
                    [OCF directories to search for resource agents ])
 
 expand_path_option OCF_RA_INSTALL_DIR
 AC_SUBST(OCF_RA_INSTALL_DIR)
 
 # Derived paths
 
 PCMK_SCHEMA_DIR="${datadir}/pacemaker"
 AC_DEFINE_UNQUOTED([PCMK_SCHEMA_DIR], ["$PCMK_SCHEMA_DIR"],
                    [Location for the Pacemaker Relax-NG Schema])
 AC_SUBST(PCMK_SCHEMA_DIR)
 
 PCMK__REMOTE_SCHEMA_DIR="${localstatedir}/lib/pacemaker/schemas"
 AC_DEFINE_UNQUOTED([PCMK__REMOTE_SCHEMA_DIR], ["$PCMK__REMOTE_SCHEMA_DIR"],
                    [Location to store Relax-NG Schema files on remote nodes])
 AC_SUBST(PCMK__REMOTE_SCHEMA_DIR)
 
 CRM_CORE_DIR="${localstatedir}/lib/pacemaker/cores"
 AC_DEFINE_UNQUOTED([CRM_CORE_DIR], ["$CRM_CORE_DIR"],
                    [Directory Pacemaker daemons should change to (without systemd, core files will go here)])
 AC_SUBST(CRM_CORE_DIR)
 
 PCMK__PERSISTENT_DATA_DIR="${localstatedir}/lib/pacemaker"
 AC_DEFINE_UNQUOTED([PCMK__PERSISTENT_DATA_DIR], ["$PCMK__PERSISTENT_DATA_DIR"],
                    [Location to store directory produced by Pacemaker daemons])
 AC_SUBST(PCMK__PERSISTENT_DATA_DIR)
 
 CRM_BLACKBOX_DIR="${localstatedir}/lib/pacemaker/blackbox"
 AC_DEFINE_UNQUOTED([CRM_BLACKBOX_DIR], ["$CRM_BLACKBOX_DIR"],
                    [Where to keep blackbox dumps])
 AC_SUBST(CRM_BLACKBOX_DIR)
 
 PCMK_SCHEDULER_INPUT_DIR="${localstatedir}/lib/pacemaker/pengine"
 AC_DEFINE_UNQUOTED([PCMK_SCHEDULER_INPUT_DIR], ["$PCMK_SCHEDULER_INPUT_DIR"],
                    [Where to keep scheduler outputs])
 AC_SUBST(PCMK_SCHEDULER_INPUT_DIR)
 
 CRM_CONFIG_DIR="${localstatedir}/lib/pacemaker/cib"
 AC_DEFINE_UNQUOTED([CRM_CONFIG_DIR], ["$CRM_CONFIG_DIR"],
                    [Where to keep configuration files])
 AC_SUBST(CRM_CONFIG_DIR)
 
 CRM_DAEMON_DIR="${libexecdir}/pacemaker"
 AC_DEFINE_UNQUOTED([CRM_DAEMON_DIR], ["$CRM_DAEMON_DIR"],
                    [Location for Pacemaker daemons])
 AC_SUBST(CRM_DAEMON_DIR)
 
 CRM_STATE_DIR="${runstatedir}/crm"
 AC_DEFINE_UNQUOTED([CRM_STATE_DIR], ["$CRM_STATE_DIR"],
                    [Where to keep state files and sockets])
 AC_SUBST(CRM_STATE_DIR)
 
 PCMK__OCF_TMP_DIR="${runstatedir}/resource-agents"
 AC_DEFINE_UNQUOTED([PCMK__OCF_TMP_DIR], ["$PCMK__OCF_TMP_DIR"],
                    [Where resource agents should keep state files])
 AC_SUBST(PCMK__OCF_TMP_DIR)
 
 PACEMAKER_CONFIG_DIR="${sysconfdir}/pacemaker"
 AC_DEFINE_UNQUOTED([PACEMAKER_CONFIG_DIR], ["$PACEMAKER_CONFIG_DIR"],
                    [Where to keep configuration files like authkey])
 AC_SUBST(PACEMAKER_CONFIG_DIR)
 
 AC_DEFINE_UNQUOTED([SBIN_DIR], ["$sbindir"], [Location for system binaries])
 
 # Warn about any directories that don't exist (which may be OK)
 for j in prefix exec_prefix bindir sbindir libexecdir datadir sysconfdir \
     sharedstatedir localstatedir libdir includedir oldincludedir infodir \
     mandir INITDIR docdir CONFIGDIR localedir
 do
     dirname=`eval echo '${'${j}'}'`
     AS_IF([test -n "$dirname" && test ! -d "$dirname"],
           [AC_MSG_WARN([$j directory ($dirname) does not exist (yet)])])
 done
 
 dnl ===============================================
 dnl General Processing
 dnl ===============================================
 
 us_auth=
 AC_CHECK_HEADER([sys/socket.h], [
     AC_CHECK_DECL([SO_PEERCRED], [
         # Linux
         AC_CHECK_TYPE([struct ucred], [
             us_auth=peercred_ucred;
             AC_DEFINE([HAVE_UCRED], [1],
                       [Define if Unix socket auth method is
                        getsockopt(s, SO_PEERCRED, &ucred, ...)])
         ], [
             # OpenBSD
             AC_CHECK_TYPE([struct sockpeercred], [
                 us_auth=localpeercred_sockepeercred;
                 AC_DEFINE([HAVE_SOCKPEERCRED], [1],
                           [Define if Unix socket auth method is
                            getsockopt(s, SO_PEERCRED, &sockpeercred, ...)])
             ], [], [[#include <sys/socket.h>]])
         ], [[#define _GNU_SOURCE
              #include <sys/socket.h>]])
     ], [], [[#include <sys/socket.h>]])
 ])
 
 AS_IF([test -z "${us_auth}"], [
     # FreeBSD
     AC_CHECK_DECL([getpeereid], [
         us_auth=getpeereid;
         AC_DEFINE([HAVE_GETPEEREID], [1],
                   [Define if Unix socket auth method is
                    getpeereid(s, &uid, &gid)])
     ], [
         # Solaris/OpenIndiana
         AC_CHECK_DECL([getpeerucred], [
             us_auth=getpeerucred;
             AC_DEFINE([HAVE_GETPEERUCRED], [1],
                       [Define if Unix socket auth method is
                        getpeercred(s, &ucred)])
         ], [
             AC_MSG_FAILURE([No way to authenticate a Unix socket peer])
         ], [[#include <ucred.h>]])
     ])
 ])
 
 dnl OS-based decision-making is poor autotools practice; feature-based
 dnl mechanisms are strongly preferred. Keep this section to a bare minimum;
 dnl regard as a "necessary evil".
 
 dnl Set host_os and host_cpu
 AC_CANONICAL_HOST
 
 INIT_EXT=""
 PROCFS=0
 dnl Solaris and some *BSD versions support procfs but not files we need
 AS_CASE(["$host_os"],
         [*bsd*], [INIT_EXT=".sh"],
         [*linux*], [PROCFS=1],
         [darwin*], [
             LIBS="$LIBS -L${prefix}/lib"
             CFLAGS="$CFLAGS -I${prefix}/include"
         ])
 
 AC_SUBST(INIT_EXT)
 AM_CONDITIONAL([SUPPORT_PROCFS], [test $PROCFS -eq 1])
 AC_DEFINE_UNQUOTED([HAVE_LINUX_PROCFS], [$PROCFS],
                    [Define to 1 if procfs is supported])
 
 AS_CASE(["$host_cpu"],
         [ppc64|powerpc64], [
             AS_CASE([$CFLAGS],
                     [*powerpc64*], [],
                     [*], [AS_IF([test x"$GCC" = x"yes"], [CFLAGS="$CFLAGS -m64"])
                     ])
         ])
 
 
 dnl ==============================================
 dnl Documentation build dependencies and checks
 dnl ==============================================
 
 AC_PATH_PROGS([ASCIIDOC_CONV], [asciidoc asciidoctor])
 AC_PATH_PROG([HELP2MAN], [help2man])
 AC_PATH_PROG([SPHINX], [sphinx-build])
 AC_PATH_PROG([INKSCAPE], [inkscape])
 AC_PATH_PROG([XSLTPROC], [xsltproc])
 AC_PATH_PROG([XMLCATALOG], [xmlcatalog])
 
 AM_CONDITIONAL(BUILD_HELP, test x"${HELP2MAN}" != x"")
 AS_IF([test x"${HELP2MAN}" != x""],
       [PCMK_FEATURES="$PCMK_FEATURES generated-manpages"])
 
 MANPAGE_XSLT=""
 AS_IF([test x"${XSLTPROC}" != x""],
       [
           AC_MSG_CHECKING([for DocBook-to-manpage transform])
           # first try to figure out correct template using xmlcatalog query,
           # resort to extensive (semi-deterministic) file search if that fails
           DOCBOOK_XSL_URI='http://docbook.sourceforge.net/release/xsl/current'
           DOCBOOK_XSL_PATH='manpages/docbook.xsl'
           MANPAGE_XSLT=$(${XMLCATALOG} "" ${DOCBOOK_XSL_URI}/${DOCBOOK_XSL_PATH} \
                          | sed -n 's|^file://||p;q')
           AS_IF([test x"${MANPAGE_XSLT}" = x""],
                 [
                     DIRS=$(find "${datadir}" -name $(basename $(dirname ${DOCBOOK_XSL_PATH})) \
                            -type d 2>/dev/null | LC_ALL=C sort)
                     XSLT=$(basename ${DOCBOOK_XSL_PATH})
                     for d in ${DIRS}
                     do
                         AS_IF([test -f "${d}/${XSLT}"],
                               [
                                   MANPAGE_XSLT="${d}/${XSLT}"
                                   break
                               ])
                     done
                 ])
       ])
 AC_MSG_RESULT([$MANPAGE_XSLT])
 AC_SUBST(MANPAGE_XSLT)
 
 AM_CONDITIONAL(BUILD_XML_HELP, test x"${MANPAGE_XSLT}" != x"")
 AS_IF([test x"${MANPAGE_XSLT}" != x""],
       [PCMK_FEATURES="$PCMK_FEATURES agent-manpages"])
 
 AM_CONDITIONAL([IS_ASCIIDOC], [echo "${ASCIIDOC_CONV}" | grep -Eq 'asciidoc$'])
 AM_CONDITIONAL([BUILD_ASCIIDOC], [test "x${ASCIIDOC_CONV}" != x])
 AS_IF([test x"${ASCIIDOC_CONV}" != x""],
       [PCMK_FEATURES="$PCMK_FEATURES ascii-docs"])
 
 AM_CONDITIONAL([BUILD_SPHINX_DOCS],
                [test x"${SPHINX}" != x"" && test x"${INKSCAPE}" != x""])
 AM_COND_IF([BUILD_SPHINX_DOCS], [PCMK_FEATURES="$PCMK_FEATURES books"])
 
 dnl Pacemaker's shell scripts (and thus man page builders) rely on GNU getopt
 AC_MSG_CHECKING([for GNU-compatible getopt])
 IFS_orig=$IFS
 IFS=:
 for PATH_DIR in $PATH
 do
     IFS=$IFS_orig
     GETOPT_PATH="${PATH_DIR}/getopt"
     AS_IF([test -f "$GETOPT_PATH" && test -x "$GETOPT_PATH"],
           [
               $GETOPT_PATH -T >/dev/null 2>/dev/null
               AS_IF([test $? -eq 4], [break])
           ])
     GETOPT_PATH=""
 done
 IFS=$IFS_orig
 AS_IF([test -n "$GETOPT_PATH"], [AC_MSG_RESULT([$GETOPT_PATH])],
       [
           AC_MSG_RESULT([no])
           AC_MSG_ERROR([Could not find required build tool GNU-compatible getopt])
       ])
 AC_SUBST([GETOPT_PATH])
 
 
 dnl ===============================================
 dnl Libraries
 dnl ===============================================
 AC_SEARCH_LIBS([socket], [socket])
 
 save_LIBS="$LIBS"
 DL_LIBS=""
 LIBS=""
 AC_SEARCH_LIBS([dlopen], [dl],
                [test "$ac_cv_search_dlopen" = "none required" || DL_LIBS="$LIBS"])
 AC_SUBST(DL_LIBS)
 LIBS="$save_LIBS"
 
 save_LIBS="$LIBS"
 PAM_LIBS=""
 LIBS=""
 AC_SEARCH_LIBS([pam_start], [pam],
                [test "$ac_cv_search_pam_start" = "none required" || PAM_LIBS="$LIBS"])
 AC_SUBST(PAM_LIBS)
 LIBS="$save_LIBS"
 
 PKG_CHECK_MODULES([UUID], [uuid],
                   [CPPFLAGS="${CPPFLAGS} ${UUID_CFLAGS}"
                    LIBS="${LIBS} ${UUID_LIBS}"])
 
 # Require minimum glib version
 PKG_CHECK_MODULES([GLIB], [glib-2.0 >= 2.42.0],
                   [CPPFLAGS="${CPPFLAGS} ${GLIB_CFLAGS}"
                    LIBS="${LIBS} ${GLIB_LIBS}"])
 
 # Check whether high-resolution sleep function is available
 AC_CHECK_FUNCS([nanosleep usleep])
 
 PKG_CHECK_MODULES(LIBXML2, [libxml-2.0 >= 2.9.2],
                   [CPPFLAGS="${CPPFLAGS} ${LIBXML2_CFLAGS}"
                    LIBS="${LIBS} ${LIBXML2_LIBS}"])
 
 AC_PATH_PROGS(XMLLINT_PATH, xmllint, /usr/bin/xmllint)
 AC_DEFINE_UNQUOTED(XMLLINT_PATH, "$XMLLINT_PATH", xmllint command)
 
 REQUIRE_LIB([xslt], [xsltApplyStylesheet])
 
 AC_MSG_CHECKING([whether __progname and __progname_full are available])
 AC_LINK_IFELSE([AC_LANG_PROGRAM([[extern char *__progname, *__progname_full;]],
                                 [[__progname = "foo";
                                   __progname_full = "foo bar";]])],
                [
                    have_progname="yes"
                    AC_DEFINE(HAVE_PROGNAME, 1,
                              [Define to 1 if processes can change their name])
                ],
                [have_progname="no"])
 AC_MSG_RESULT([$have_progname])
 
 dnl ========================================================================
 dnl Headers
 dnl ========================================================================
 
 # Some distributions insert #warnings into deprecated headers. If we will
 # enable fatal warnings for the build, then enable them for the header checks
 # as well, otherwise the build could fail even though the header check
 # succeeds. (We should probably be doing this in more places.)
 cc_temp_flags "$CFLAGS $WERROR"
 
 # Optional headers (inclusion of these should be conditional in C code)
 AC_CHECK_HEADERS([linux/swab.h])
 AC_CHECK_HEADERS([stddef.h])
 AC_CHECK_HEADERS([sys/signalfd.h])
 AC_CHECK_HEADERS([uuid/uuid.h])
 AC_CHECK_HEADERS([security/pam_appl.h pam/pam_appl.h])
 
 AS_IF([test x"$ac_cv_lib_pam_pam_start" = x"yes"],
       AS_IF([test x"$ac_cv_header_security_pam_appl_h" = x"yes" dnl
             || test x"$ac_cv_header_pam_pam_appl_h" = x"yes"],
             [PCMK_FEATURES="$PCMK_FEATURES pam"]))
 
 # Required headers
 REQUIRE_HEADER([arpa/inet.h])
 REQUIRE_HEADER([ctype.h])
 REQUIRE_HEADER([dirent.h])
 REQUIRE_HEADER([dlfcn.h])
 REQUIRE_HEADER([errno.h])
 REQUIRE_HEADER([fcntl.h])
 REQUIRE_HEADER([float.h])
 REQUIRE_HEADER([glib.h])
 REQUIRE_HEADER([grp.h])
 REQUIRE_HEADER([inttypes.h])
 REQUIRE_HEADER([libgen.h])
 REQUIRE_HEADER([limits.h])
 REQUIRE_HEADER([locale.h])
 REQUIRE_HEADER([netdb.h])
 REQUIRE_HEADER([netinet/in.h])
 REQUIRE_HEADER([netinet/ip.h], [
     #include <sys/types.h>
     #include <netinet/in.h>
 ])
 REQUIRE_HEADER([netinet/tcp.h])
 REQUIRE_HEADER([pwd.h])
 REQUIRE_HEADER([regex.h])
 REQUIRE_HEADER([sched.h])
 REQUIRE_HEADER([signal.h])
 REQUIRE_HEADER([stdarg.h])
 REQUIRE_HEADER([stdbool.h])
 REQUIRE_HEADER([stdint.h])
 REQUIRE_HEADER([stdio.h])
 REQUIRE_HEADER([stdlib.h])
 REQUIRE_HEADER([string.h])
 REQUIRE_HEADER([strings.h])
 REQUIRE_HEADER([sys/ioctl.h])
 REQUIRE_HEADER([sys/param.h])
 REQUIRE_HEADER([sys/reboot.h])
 REQUIRE_HEADER([sys/resource.h])
 REQUIRE_HEADER([sys/socket.h])
 REQUIRE_HEADER([sys/stat.h])
 REQUIRE_HEADER([sys/time.h])
 REQUIRE_HEADER([sys/types.h])
 REQUIRE_HEADER([sys/uio.h])
 REQUIRE_HEADER([sys/utsname.h])
 REQUIRE_HEADER([sys/wait.h])
 REQUIRE_HEADER([termios.h])
 REQUIRE_HEADER([time.h])
 REQUIRE_HEADER([unistd.h])
 REQUIRE_HEADER([libxml/xpath.h])
 REQUIRE_HEADER([libxslt/xslt.h])
 
 cc_restore_flags
 
 dnl ========================================================================
 dnl Generic declarations
 dnl ========================================================================
 
 AC_CHECK_DECLS([CLOCK_MONOTONIC], [PCMK_FEATURES="$PCMK_FEATURES monotonic"], [], [[
     #include <time.h>
 ]])
 
 dnl ========================================================================
 dnl Unit test declarations
 dnl ========================================================================
 
 AC_CHECK_DECLS([assert_float_equal], [], [], [[
     #include <stdarg.h>
     #include <stddef.h>
     #include <setjmp.h>
     #include <cmocka.h>
 ]])
 
 dnl ========================================================================
 dnl Byte size
 dnl ========================================================================
 
 # Compile-time assert hack
 # https://jonjagger.blogspot.com/2017/07/compile-time-assertions-in-c.html
 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <limits.h>]],
                                    [[
                                         switch (0) {
                                             case 0:
                                             case (CHAR_BIT == 8):
                                                 break;
                                         }
                                    ]])],
                   [],
                   [AC_MSG_FAILURE(m4_normalize([Pacemaker is not supported on
                                                 platforms where char is not 8
                                                 bits]))])
 
 dnl ========================================================================
 dnl Structures
 dnl ========================================================================
 
 AC_CHECK_MEMBERS([struct tm.tm_gmtoff],,,[[#include <time.h>]])
 AC_CHECK_MEMBER([struct dirent.d_type],
     AC_DEFINE(HAVE_STRUCT_DIRENT_D_TYPE,1,[Define this if struct dirent has d_type]),,
     [#include <dirent.h>])
 
 dnl ========================================================================
 dnl Functions
 dnl ========================================================================
 
 REQUIRE_FUNC([alphasort])
 REQUIRE_FUNC([getopt])
 REQUIRE_FUNC([scandir])
 REQUIRE_FUNC([sched_getscheduler])
 REQUIRE_FUNC([setenv])
 REQUIRE_FUNC([strndup])
 REQUIRE_FUNC([strnlen])
 REQUIRE_FUNC([unsetenv])
 REQUIRE_FUNC([uuid_unparse])
 REQUIRE_FUNC([vasprintf])
 
 AC_CHECK_FUNCS([strchrnul])
 
 AC_CHECK_FUNCS([fopen64])
 AM_CONDITIONAL([WRAPPABLE_FOPEN64], [test x"$ac_cv_func_fopen64" = x"yes"])
 
 AC_MSG_CHECKING([whether strerror always returns non-NULL])
 AC_RUN_IFELSE([AC_LANG_PROGRAM([[
     #include <stdio.h>
     #include <string.h>
                                ]], [[
     return strerror(-1) == NULL;
                                ]])],
               [AC_MSG_RESULT([yes])],
               [AC_MSG_ERROR([strerror() is not C99-compliant])],
               [AC_MSG_ERROR([strerror() is not C99-compliant])])
 
 AC_RUN_IFELSE([AC_LANG_PROGRAM([[#include <stdio.h>]], [[
     const char *s = "some-command-line-arg";
     char *name = NULL;
     int n = sscanf(s, "%ms", &name);
     return n != 1;
                                ]])],
               [have_sscanf_m="yes"],
               [have_sscanf_m="no"],
               [have_sscanf_m="no"])
 AS_IF([test x"$have_sscanf_m" = x"yes"],
       [AC_DEFINE([HAVE_SSCANF_M], [1],
                  [Define to 1 if sscanf %m modifier is available])])
 
 dnl ========================================================================
 dnl   bzip2
 dnl ========================================================================
 REQUIRE_HEADER([bzlib.h])
 REQUIRE_LIB([bz2], [BZ2_bzBuffToBuffCompress])
 
 dnl ========================================================================
 dnl sighandler_t is missing from Illumos, Solaris11 systems
 dnl ========================================================================
 
 AC_MSG_CHECKING([for sighandler_t])
 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <signal.h>]], [[sighandler_t *f;]])],
                   [
                       AC_MSG_RESULT([yes])
                       AC_DEFINE([HAVE_SIGHANDLER_T], [1],
                                 [Define to 1 if sighandler_t is available])
                   ],
                   [AC_MSG_RESULT([no])])
 
 dnl ========================================================================
 dnl   ncurses
 dnl ========================================================================
 dnl
 dnl A few OSes (e.g. Linux) deliver a default "ncurses" alongside "curses".
 dnl Many non-Linux deliver "curses"; sites may add "ncurses".
 dnl
 dnl However, the source-code recommendation for both is to #include "curses.h"
 dnl (i.e. "ncurses" still wants the include to be simple, no-'n', "curses.h").
 dnl
 dnl ncurses takes precedence.
 dnl
 AC_CHECK_HEADERS([curses.h curses/curses.h ncurses.h ncurses/ncurses.h])
 
 save_LIBS="$LIBS"
 found_curses=0
 CURSES_LIBS=""
 LIBS=""
 AC_SEARCH_LIBS([printw], [ncurses curses],
                [test "$ac_cv_search_printw" = "none required" || CURSES_LIBS="$LIBS"
                 found_curses=1],
                [found_curses=0])
 LIBS="$save_LIBS"
 
 dnl Check for printw() prototype compatibility
 AS_IF([test $found_curses -eq 1 && cc_supports_flag -Wcast-qual], [
     ac_save_LIBS="$LIBS"
     LIBS="$CURSES_LIBS"
 
     # avoid broken test because of hardened build environment in Fedora 23+
     # - https://fedoraproject.org/wiki/Changes/Harden_All_Packages
     # - https://bugzilla.redhat.com/1297985
     AS_IF([cc_supports_flag -fPIC],
           [cc_temp_flags "-Wcast-qual $WERROR -fPIC"],
           [cc_temp_flags "-Wcast-qual $WERROR"])
 
     AC_MSG_CHECKING([whether curses library is compatible])
     AC_LINK_IFELSE(
         [AC_LANG_PROGRAM([
 #if defined(HAVE_NCURSES_H)
 #  include <ncurses.h>
 #elif defined(HAVE_NCURSES_NCURSES_H)
 #  include <ncurses/ncurses.h>
 #elif defined(HAVE_CURSES_H)
 #  include <curses.h>
 #elif defined(HAVE_CURSES_CURSES_H)
 #  include <curses/curses.h>
 #endif
                          ],
                          [printw((const char *)"Test");]
         )],
         [AC_MSG_RESULT([yes])
          PCMK_FEATURES="$PCMK_FEATURES ncurses"
         ],
         [
             found_curses=0
             CURSES_LIBS=""
             AC_MSG_RESULT([no])
             AC_MSG_WARN(m4_normalize([Disabling curses because the printw()
                                       function of your (n)curses library is old.
                                       If you wish to enable curses, update to a
                                       newer version (ncurses 5.4 or later is
                                       recommended, available from
                                       https://invisible-island.net/ncurses/)
                                      ]))
         ]
     )
 
     LIBS="$ac_save_LIBS"
     cc_restore_flags
 ])
 
 AC_DEFINE_UNQUOTED([PCMK__ENABLE_CURSES], [$found_curses], [have ncurses library])
 AC_SUBST(CURSES_LIBS)
 
 dnl ========================================================================
 dnl    Profiling and GProf
 dnl ========================================================================
 
 CFLAGS_ORIG="$CFLAGS"
 AS_IF([test $with_coverage -ne $DISABLED],
       [
         with_profiling=$REQUIRED
         PCMK_FEATURES="$PCMK_FEATURES coverage"
         CFLAGS="$CFLAGS -fprofile-arcs -ftest-coverage"
         dnl During linking, make sure to specify -lgcov or -coverage
       ]
 )
 
 AS_IF([test $with_profiling -ne $DISABLED],
       [
           with_profiling=$REQUIRED
           PCMK_FEATURES="$PCMK_FEATURES profile"
 
           dnl Disable various compiler optimizations
           CFLAGS="$CFLAGS -fno-omit-frame-pointer -fno-inline -fno-builtin"
           dnl CFLAGS="$CFLAGS -fno-inline-functions"
           dnl CFLAGS="$CFLAGS -fno-default-inline"
           dnl CFLAGS="$CFLAGS -fno-inline-functions-called-once"
           dnl CFLAGS="$CFLAGS -fno-optimize-sibling-calls"
 
           dnl Turn off optimization so tools can get accurate line numbers
           CFLAGS=`echo $CFLAGS | sed \
                   -e 's/-O.\ //g' \
                   -e 's/-Wp,-D_FORTIFY_SOURCE=.\ //g' \
                   -e 's/-D_FORTIFY_SOURCE=.\ //g'`
           CFLAGS="$CFLAGS -O0 -g3 -gdwarf-2"
 
           AC_MSG_NOTICE([CFLAGS before adding profiling options: $CFLAGS_ORIG])
           AC_MSG_NOTICE([CFLAGS after: $CFLAGS])
       ]
 )
 AM_CONDITIONAL([BUILD_PROFILING], [test "$with_profiling" = "$REQUIRED"])
 
 dnl ========================================================================
 dnl    Cluster infrastructure - LibQB
 dnl ========================================================================
 
 PKG_CHECK_MODULES([libqb], [libqb >= 1.0.1])
 CPPFLAGS="$libqb_CFLAGS $CPPFLAGS"
 LIBS="$libqb_LIBS $LIBS"
 
 dnl libqb 2.0.5+ (2022-03)
 AC_CHECK_FUNCS([qb_ipcc_connect_async])
 
 dnl libqb 2.0.2+ (2020-10)
 AC_CHECK_FUNCS([qb_ipcc_auth_get])
 
 dnl libqb 2.0.0+ (2020-05)
 dnl also defines QB_FEATURE_LOG_HIRES_TIMESTAMPS
 CHECK_ENUM_VALUE([qb/qblog.h],[qb_log_conf],[QB_LOG_CONF_MAX_LINE_LEN])
 CHECK_ENUM_VALUE([qb/qblog.h],[qb_log_conf],[QB_LOG_CONF_ELLIPSIS])
 
 dnl Support Linux-HA fence agents if available
 AS_IF([test x"$cross_compiling" != x"yes"],
       [CPPFLAGS="$CPPFLAGS -I${prefix}/include/heartbeat"])
 AC_CHECK_HEADERS([stonith/stonith.h],
                  [
                      save_LIBS="$LIBS"
                      STONITH_LIBS=""
                      LIBS=""
                      AC_SEARCH_LIBS([PILLoadPlugin], [pils],
                                     [test "$ac_cv_search_PILLoadPlugin" = "none required" || STONITH_LIBS="$LIBS"])
 
                      LIBS=""
                      AC_SEARCH_LIBS([G_main_add_IPC_Channel], [plumb],
                                     [test "$ac_cv_search_G_main_add_IPC_Channel" = "none required" || STONITH_LIBS="$STONITH_LIBS $LIBS"])
                      AC_SUBST(STONITH_LIBS)
                      LIBS="$save_LIBS"
 
                      PCMK_FEATURES="$PCMK_FEATURES lha"
                  ])
 AM_CONDITIONAL([BUILD_LHA_SUPPORT], [test x"$ac_cv_header_stonith_stonith_h" = x"yes"])
 
 
 dnl ===============================
 dnl Detect DBus and systemd support
 dnl ===============================
 
 HAVE_dbus=0
 PC_NAME_DBUS=""
 PKG_CHECK_MODULES([DBUS],[dbus-1 >= 1.5.12],
                   [
                       HAVE_dbus=1
                       PC_NAME_DBUS="dbus-1"
                       CPPFLAGS="${CPPFLAGS} ${DBUS_CFLAGS}"
                   ],[])
 AC_DEFINE_UNQUOTED(HAVE_DBUS, $HAVE_dbus, Support dbus)
 AC_SUBST(PC_NAME_DBUS)
 
 check_systemdsystemunitdir() {
     AC_MSG_CHECKING([which system unit file directory to use])
     PKG_CHECK_VAR([systemdsystemunitdir], [systemd], [systemdsystemunitdir])
     AC_MSG_RESULT([${systemdsystemunitdir}])
     test x"$systemdsystemunitdir" != x""
     return $?
 }
 
 AS_CASE([$enable_systemd],
         [$REQUIRED], [
             AS_IF([test $HAVE_dbus = 0],
                   [AC_MSG_FAILURE([Cannot support systemd resources without DBus])])
             AS_IF([test "$ac_cv_have_decl_CLOCK_MONOTONIC" = "no"],
                   [AC_MSG_FAILURE([Cannot support systemd resources without monotonic clock])])
             AS_IF([check_systemdsystemunitdir], [],
                   [AC_MSG_FAILURE([Cannot support systemd resources without systemdsystemunitdir])])
         ],
         [$OPTIONAL], [
             AS_IF([test $HAVE_dbus = 0 \
                    || test x"$ac_cv_have_decl_CLOCK_MONOTONIC" = x"no"],
                   [enable_systemd=$DISABLED],
                   [
                       AC_MSG_CHECKING([for systemd version (using dbus-send)])
                       ret=$({ dbus-send --system --print-reply \
                                   --dest=org.freedesktop.systemd1 \
                                   /org/freedesktop/systemd1 \
                                   org.freedesktop.DBus.Properties.Get \
                                   string:org.freedesktop.systemd1.Manager \
                                   string:Version 2>/dev/null \
                               || echo "version unavailable"; } | tail -n1)
                       # sanitize output a bit (interested just in value, not type),
                       # ret is intentionally unenquoted so as to normalize whitespace
                       ret=$(echo ${ret} | cut -d' ' -f2-)
                       AC_MSG_RESULT([${ret}])
                       AS_IF([test x"$ret" != x"unavailable" \
                              || systemctl --version 2>/dev/null | grep -q systemd],
                             [
                                 AS_IF([check_systemdsystemunitdir],
                                       [enable_systemd=$REQUIRED],
                                       [enable_systemd=$DISABLED])
                             ],
                             [enable_systemd=$DISABLED]
                       )
                   ])
         ],
 )
 AC_MSG_CHECKING([whether to enable support for managing resources via systemd])
 AS_IF([test $enable_systemd -eq $DISABLED], [AC_MSG_RESULT([no])],
       [
           AC_MSG_RESULT([yes])
           PCMK_FEATURES="$PCMK_FEATURES systemd"
       ]
 )
 AC_SUBST([systemdsystemunitdir])
 AC_DEFINE_UNQUOTED([SUPPORT_SYSTEMD], [$enable_systemd],
                    [Support systemd resources])
 AM_CONDITIONAL([BUILD_SYSTEMD], [test $enable_systemd = $REQUIRED])
 AC_SUBST(SUPPORT_SYSTEMD)
 
 STACKS=""
 CLUSTERLIBS=""
 PC_NAME_CLUSTER=""
 
 dnl ========================================================================
 dnl Detect support for "service" alias
 dnl ========================================================================
 
 PCMK__ENABLE_SERVICE=$DISABLED
 AM_COND_IF([BUILD_LSB], [PCMK__ENABLE_SERVICE=$REQUIRED])
 AM_COND_IF([BUILD_SYSTEMD], [PCMK__ENABLE_SERVICE=$REQUIRED])
 AS_IF([test $PCMK__ENABLE_SERVICE -ne $DISABLED],
       [PCMK_FEATURES="$PCMK_FEATURES service"])
 AC_SUBST(PCMK__ENABLE_SERVICE)
 AC_DEFINE_UNQUOTED([PCMK__ENABLE_SERVICE], [$PCMK__ENABLE_SERVICE],
                    [Whether "service" is supported as an agent standard])
 
 dnl ========================================================================
 dnl    Cluster stack - Corosync
 dnl ========================================================================
 
 COROSYNC_LIBS=""
 
 AS_CASE([$with_corosync],
         [$REQUIRED], [
             # These will be fatal if unavailable
             PKG_CHECK_MODULES([cpg], [libcpg])
             PKG_CHECK_MODULES([cfg], [libcfg])
             PKG_CHECK_MODULES([cmap], [libcmap])
             PKG_CHECK_MODULES([quorum], [libquorum])
             PKG_CHECK_MODULES([libcorosync_common], [libcorosync_common])
         ]
         [$OPTIONAL], [
             PKG_CHECK_MODULES([cpg], [libcpg], [], [with_corosync=$DISABLED])
             PKG_CHECK_MODULES([cfg], [libcfg], [], [with_corosync=$DISABLED])
             PKG_CHECK_MODULES([cmap], [libcmap], [], [with_corosync=$DISABLED])
             PKG_CHECK_MODULES([quorum], [libquorum], [], [with_corosync=$DISABLED])
             PKG_CHECK_MODULES([libcorosync_common], [libcorosync_common], [], [with_corosync=$DISABLED])
             AS_IF([test $with_corosync -ne $DISABLED], [with_corosync=$REQUIRED])
         ]
 )
 AS_IF([test $with_corosync -ne $DISABLED],
       [
           AC_MSG_CHECKING([for Corosync 2 or later])
           AC_MSG_RESULT([yes])
           CFLAGS="$CFLAGS $libqb_CFLAGS $cpg_CFLAGS $cfg_CFLAGS $cmap_CFLAGS $quorum_CFLAGS $libcorosync_common_CFLAGS"
           CPPFLAGS="$CPPFLAGS `$PKG_CONFIG --cflags-only-I corosync`"
           COROSYNC_LIBS="$COROSYNC_LIBS $cpg_LIBS $cfg_LIBS $cmap_LIBS $quorum_LIBS $libcorosync_common_LIBS"
           CLUSTERLIBS="$CLUSTERLIBS $COROSYNC_LIBS"
           PC_NAME_CLUSTER="$PC_CLUSTER_NAME libcfg libcmap libcorosync_common libcpg libquorum"
           STACKS="$STACKS corosync-ge-2"
 
           dnl Shutdown tracking added (back) to corosync Jan 2021
           saved_LIBS="$LIBS"
           LIBS="$LIBS $COROSYNC_LIBS"
           AC_CHECK_FUNCS([corosync_cfg_trackstart])
           LIBS="$saved_LIBS"
       ]
 )
 AC_DEFINE_UNQUOTED([SUPPORT_COROSYNC], [$with_corosync],
                    [Support the Corosync messaging and membership layer])
 AM_CONDITIONAL([BUILD_CS_SUPPORT], [test $with_corosync -eq $REQUIRED])
 AC_SUBST([SUPPORT_COROSYNC])
 
 dnl
 dnl    Cluster stack - Sanity
 dnl
 
 AS_IF([test x"$STACKS" != x""], [AC_MSG_NOTICE([Supported stacks:${STACKS}])],
       [AC_MSG_FAILURE([At least one cluster stack must be supported])])
 
 PCMK_FEATURES="${PCMK_FEATURES}${STACKS}"
 
 AC_SUBST(CLUSTERLIBS)
 AC_SUBST(PC_NAME_CLUSTER)
 
 dnl ========================================================================
 dnl    CIB secrets
 dnl ========================================================================
 
 AS_IF([test $with_cibsecrets -ne $DISABLED],
       [
           with_cibsecrets=$REQUIRED
           PCMK_FEATURES="$PCMK_FEATURES cibsecrets"
           PCMK__CIB_SECRETS_DIR="${localstatedir}/lib/pacemaker/lrm/secrets"
           AC_DEFINE_UNQUOTED([PCMK__CIB_SECRETS_DIR], ["$PCMK__CIB_SECRETS_DIR"],
                              [Location for CIB secrets])
           AC_SUBST([PCMK__CIB_SECRETS_DIR])
       ]
 )
 AC_DEFINE_UNQUOTED([PCMK__ENABLE_CIBSECRETS], [$with_cibsecrets], [Support CIB secrets])
 AM_CONDITIONAL([BUILD_CIBSECRETS], [test $with_cibsecrets -eq $REQUIRED])
 
 dnl ========================================================================
 dnl    GnuTLS
 dnl ========================================================================
 
 PKG_CHECK_MODULES(GNUTLS, [gnutls >= 3.1.7],
                   [CPPFLAGS="${CPPFLAGS} ${GNUTLS_CFLAGS}"
                    LIBS="${LIBS} ${GNUTLS_LIBS}"])
 
 # --- ASAN/UBSAN/TSAN (see man gcc) ---
 # when using SANitizers, we need to pass the -fsanitize..
 # to both CFLAGS and LDFLAGS. The CFLAGS/LDFLAGS must be
 # specified as first in the list or there will be runtime
 # issues (for example user has to LD_PRELOAD asan for it to work
 # properly).
 
 AS_IF([test -n "${SANITIZERS}"], [
   SANITIZERS=$(echo $SANITIZERS | sed -e 's/,/ /g')
   for SANITIZER in $SANITIZERS
   do
     AS_CASE([$SANITIZER],
             [asan|ASAN], [
                 SANITIZERS_CFLAGS="$SANITIZERS_CFLAGS -fsanitize=address"
                 SANITIZERS_LDFLAGS="$SANITIZERS_LDFLAGS -fsanitize=address -lasan"
                 PCMK_FEATURES="$PCMK_FEATURES asan"
                 REQUIRE_LIB([asan],[main])
             ],
             [ubsan|UBSAN], [
                 SANITIZERS_CFLAGS="$SANITIZERS_CFLAGS -fsanitize=undefined"
                 SANITIZERS_LDFLAGS="$SANITIZERS_LDFLAGS -fsanitize=undefined -lubsan"
                 PCMK_FEATURES="$PCMK_FEATURES ubsan"
                 REQUIRE_LIB([ubsan],[main])
             ],
             [tsan|TSAN], [
                 SANITIZERS_CFLAGS="$SANITIZERS_CFLAGS -fsanitize=thread"
                 SANITIZERS_LDFLAGS="$SANITIZERS_LDFLAGS -fsanitize=thread -ltsan"
                 PCMK_FEATURES="$PCMK_FEATURES tsan"
                 REQUIRE_LIB([tsan],[main])
             ])
   done
 ])
 
 
 dnl ========================================================================
 dnl Compiler flags
 dnl ========================================================================
 
 dnl Make sure that CFLAGS is not exported. If the user did
 dnl not have CFLAGS in their environment then this should have
 dnl no effect. However if CFLAGS was exported from the user's
 dnl environment, then the new CFLAGS will also be exported
 dnl to sub processes.
 AS_IF([export | fgrep " CFLAGS=" > /dev/null],
       [
           SAVED_CFLAGS="$CFLAGS"
           unset CFLAGS
           CFLAGS="$SAVED_CFLAGS"
           unset SAVED_CFLAGS
       ])
 
 CC_EXTRAS=""
 
 AS_IF([test x"$GCC" != x"yes"], [CFLAGS="$CFLAGS -g"], [
     CFLAGS="$CFLAGS -ggdb"
 
 dnl When we don't have diagnostic push / pull, we can't explicitly disable
 dnl checking for nonliteral formats in the places where they occur on purpose
 dnl thus we disable nonliteral format checking globally as we are aborting
 dnl on warnings. 
 dnl what makes the things really ugly is that nonliteral format checking is 
 dnl obviously available as an extra switch in very modern gcc but for older
 dnl gcc this is part of -Wformat=2 
 dnl so if we have push/pull we can enable -Wformat=2 -Wformat-nonliteral
 dnl if we don't have push/pull but -Wformat-nonliteral we can enable -Wformat=2
 dnl otherwise none of both
 
     gcc_diagnostic_push_pull=no
     cc_temp_flags "$CFLAGS $WERROR"
     AC_MSG_CHECKING([for gcc diagnostic push / pull])
     AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
 #pragma GCC diagnostic push
 #pragma GCC diagnostic pop
                       ]])],
                       [
                           AC_MSG_RESULT([yes])
                           gcc_diagnostic_push_pull=yes
                       ], AC_MSG_RESULT([no]))
     cc_restore_flags
 
     AS_IF([cc_supports_flag "-Wformat-nonliteral"],
           [gcc_format_nonliteral=yes],
           [gcc_format_nonliteral=no])
         
     # We had to eliminate -Wnested-externs because of libtool changes
     # Make sure to order options so that the former stand for prerequisites
     # of the latter (e.g., -Wformat-nonliteral requires -Wformat).
     EXTRA_FLAGS="-fgnu89-inline"
     EXTRA_FLAGS="$EXTRA_FLAGS -Wall"
     EXTRA_FLAGS="$EXTRA_FLAGS -Waggregate-return"
     EXTRA_FLAGS="$EXTRA_FLAGS -Wbad-function-cast"
     EXTRA_FLAGS="$EXTRA_FLAGS -Wcast-align"
     EXTRA_FLAGS="$EXTRA_FLAGS -Wdeclaration-after-statement"
     EXTRA_FLAGS="$EXTRA_FLAGS -Wendif-labels"
     EXTRA_FLAGS="$EXTRA_FLAGS -Wfloat-equal"
     EXTRA_FLAGS="$EXTRA_FLAGS -Wformat-security"
     EXTRA_FLAGS="$EXTRA_FLAGS -Wimplicit-fallthrough"
     EXTRA_FLAGS="$EXTRA_FLAGS -Wmissing-prototypes"
     EXTRA_FLAGS="$EXTRA_FLAGS -Wmissing-declarations"
     EXTRA_FLAGS="$EXTRA_FLAGS -Wnested-externs"
     EXTRA_FLAGS="$EXTRA_FLAGS -Wno-long-long"
     EXTRA_FLAGS="$EXTRA_FLAGS -Wno-strict-aliasing"
     EXTRA_FLAGS="$EXTRA_FLAGS -Wpointer-arith"
     EXTRA_FLAGS="$EXTRA_FLAGS -Wstrict-prototypes"
     EXTRA_FLAGS="$EXTRA_FLAGS -Wwrite-strings"
     EXTRA_FLAGS="$EXTRA_FLAGS -Wunused-but-set-variable"
     EXTRA_FLAGS="$EXTRA_FLAGS -Wunsigned-char"
 
     AS_IF([test x"$gcc_diagnostic_push_pull" = x"yes"],
           [
               AC_DEFINE([HAVE_FORMAT_NONLITERAL], [],
                         [gcc can complain about nonliterals in format])
               EXTRA_FLAGS="$EXTRA_FLAGS -Wformat=2 -Wformat-nonliteral"
           ],
           [test x"$gcc_format_nonliteral" = x"yes"],
           [EXTRA_FLAGS="$EXTRA_FLAGS -Wformat=2"])
 
 # Additional warnings it might be nice to enable one day
 #                -Wshadow
 #                -Wunreachable-code
     for j in $EXTRA_FLAGS
     do
         AS_IF([cc_supports_flag $CC_EXTRAS $j], [CC_EXTRAS="$CC_EXTRAS $j"])
     done
 
     AC_MSG_NOTICE([Using additional gcc flags: ${CC_EXTRAS}])
 ])
 
 dnl
 dnl Hardening flags
 dnl
 dnl The prime control of whether to apply (targeted) hardening build flags and
 dnl which ones is --{enable,disable}-hardening option passed to ./configure:
 dnl
 dnl --enable-hardening=try (default):
 dnl     depending on whether any of CFLAGS_HARDENED_EXE, LDFLAGS_HARDENED_EXE,
 dnl     CFLAGS_HARDENED_LIB or LDFLAGS_HARDENED_LIB environment variables
 dnl     (see below) is set and non-null, all these custom flags (even if not
 dnl     set) are used as are, otherwise the best effort is made to offer
 dnl     reasonably strong hardening in several categories (RELRO, PIE,
 dnl     "bind now", stack protector) according to what the selected toolchain
 dnl     can offer
 dnl
 dnl --enable-hardening:
 dnl     same effect as --enable-hardening=try when the environment variables
 dnl     in question are suppressed
 dnl
 dnl --disable-hardening:
 dnl     do not apply any targeted hardening measures at all
 dnl
 dnl The user-injected environment variables that regulate the hardening in
 dnl default case are as follows:
 dnl
 dnl * CFLAGS_HARDENED_EXE, LDFLAGS_HARDENED_EXE
 dnl    compiler and linker flags (respectively) for daemon programs
 dnl    (pacemakerd, pacemaker-attrd, pacemaker-controld, pacemaker-execd,
 dnl    pacemaker-based, pacemaker-fenced, pacemaker-remoted,
 dnl    pacemaker-schedulerd)
 dnl
 dnl * CFLAGS_HARDENED_LIB, LDFLAGS_HARDENED_LIB
 dnl    compiler and linker flags (respectively) for libraries linked
 dnl    with the daemon programs
 dnl
 dnl Note that these are purposedly targeted variables (addressing particular
 dnl targets all over the scattered Makefiles) and have no effect outside of
 dnl the predestined scope (e.g., CLI utilities).  For a global reach,
 dnl use CFLAGS, LDFLAGS, etc. as usual.
 dnl
 dnl For guidance on the suitable flags consult, for instance:
 dnl https://fedoraproject.org/wiki/Changes/Harden_All_Packages#Detailed_Harden_Flags_Description
 dnl https://owasp.org/index.php/C-Based_Toolchain_Hardening#GCC.2FBinutils
 dnl
 
 AS_IF([test $enable_hardening -eq $OPTIONAL],
       [
           AS_IF([test "$(env | grep -Ec '^(C|LD)FLAGS_HARDENED_(EXE|LIB)=.')" = 0],
                 [enable_hardening=$REQUIRED],
                 [AC_MSG_NOTICE([Hardening: using custom flags from environment])]
           )
       ],
       [
           unset CFLAGS_HARDENED_EXE
           unset CFLAGS_HARDENED_LIB
           unset LDFLAGS_HARDENED_EXE
           unset LDFLAGS_HARDENED_LIB
       ]
 )
 AS_CASE([$enable_hardening],
         [$DISABLED], [AC_MSG_NOTICE([Hardening: explicitly disabled])],
         [$REQUIRED], [
             CFLAGS_HARDENED_EXE=
             CFLAGS_HARDENED_LIB=
             LDFLAGS_HARDENED_EXE=
             LDFLAGS_HARDENED_LIB=
             relro=0
             pie=0
             bindnow=0
             stackprot="none"
             # daemons incl. libs: partial RELRO
             flag="-Wl,-z,relro"
             CC_CHECK_LDFLAGS(["${flag}"],
                              [
                                  LDFLAGS_HARDENED_EXE="${LDFLAGS_HARDENED_EXE} ${flag}"
                                  LDFLAGS_HARDENED_LIB="${LDFLAGS_HARDENED_LIB} ${flag}"
                                  relro=1
                              ])
             # daemons: PIE for both CFLAGS and LDFLAGS
             AS_IF([cc_supports_flag -fPIE],
                   [
                       flag="-pie"
                       CC_CHECK_LDFLAGS(["${flag}"],
                                        [
                                            CFLAGS_HARDENED_EXE="${CFLAGS_HARDENED_EXE} -fPIE"
                                            LDFLAGS_HARDENED_EXE="${LDFLAGS_HARDENED_EXE} ${flag}"
                                            pie=1
                                        ])
                   ]
             )
             # daemons incl. libs: full RELRO if sensible + as-needed linking
             #                     so as to possibly mitigate startup performance
             #                     hit caused by excessive linking with unneeded
             #                     libraries
             AS_IF([test "${relro}" = 1 && test "${pie}" = 1],
                   [
                       flag="-Wl,-z,now"
                       CC_CHECK_LDFLAGS(["${flag}"],
                                        [
                                            LDFLAGS_HARDENED_EXE="${LDFLAGS_HARDENED_EXE} ${flag}"
                                            LDFLAGS_HARDENED_LIB="${LDFLAGS_HARDENED_LIB} ${flag}"
                                            bindnow=1
                                        ])
                   ]
             )
             AS_IF([test "${bindnow}" = 1],
                   [
                       flag="-Wl,--as-needed"
                       CC_CHECK_LDFLAGS(["${flag}"],
                                        [
                                            LDFLAGS_HARDENED_EXE="${LDFLAGS_HARDENED_EXE} ${flag}"
                                            LDFLAGS_HARDENED_LIB="${LDFLAGS_HARDENED_LIB} ${flag}"
                                        ])
                   ])
             # universal: prefer strong > all > default stack protector if possible
             flag=
             AS_IF([cc_supports_flag -fstack-protector-strong],
                   [
                       flag="-fstack-protector-strong"
                       stackprot="strong"
                   ],
                   [cc_supports_flag -fstack-protector-all],
                   [
                       flag="-fstack-protector-all"
                       stackprot="all"
                   ],
                   [cc_supports_flag -fstack-protector],
                   [
                       flag="-fstack-protector"
                       stackprot="default"
                   ]
             )
             AS_IF([test -n "${flag}"], [CC_EXTRAS="${CC_EXTRAS} ${flag}"])
             # universal: enable stack clash protection if possible
             AS_IF([cc_supports_flag -fstack-clash-protection],
                   [
                       CC_EXTRAS="${CC_EXTRAS} -fstack-clash-protection"
                       AS_IF([test "${stackprot}" = "none"],
                             [stackprot="clash-only"],
                             [stackprot="${stackprot}+clash"]
                       )
                   ]
             )
             # Log a summary
             AS_IF([test "${relro}" = 1 || test "${pie}" = 1 || test x"${stackprot}" != x"none"],
                   [AC_MSG_NOTICE(m4_normalize([Hardening:
                         relro=${relro}
                         pie=${pie}
                         bindnow=${bindnow}
                         stackprot=${stackprot}]))
                   ],
                   [AC_MSG_WARN([Hardening: no suitable features in the toolchain detected])]
             )
         ],
 )
 
 CFLAGS="$SANITIZERS_CFLAGS $CFLAGS $CC_EXTRAS"
 LDFLAGS="$SANITIZERS_LDFLAGS $LDFLAGS"
 CFLAGS_HARDENED_EXE="$SANITIZERS_CFLAGS $CFLAGS_HARDENED_EXE"
 LDFLAGS_HARDENED_EXE="$SANITIZERS_LDFLAGS $LDFLAGS_HARDENED_EXE"
 
 NON_FATAL_CFLAGS="$CFLAGS"
 AC_SUBST(NON_FATAL_CFLAGS)
 
 dnl
 dnl We reset CFLAGS to include our warnings *after* all function
 dnl checking goes on, so that our warning flags don't keep the
 dnl AC_*FUNCS() calls above from working.  In particular, -Werror will
 dnl *always* cause us troubles if we set it before here.
 dnl
 dnl
 AS_IF([test $enable_fatal_warnings -ne $DISABLED], [
     AC_MSG_NOTICE([Enabling fatal compiler warnings])
     CFLAGS="$CFLAGS $WERROR"
 ])
 AC_SUBST(CFLAGS)
 
 dnl This is useful for use in Makefiles that need to remove one specific flag
 CFLAGS_COPY="$CFLAGS"
 AC_SUBST(CFLAGS_COPY)
 
 AC_SUBST(LIBADD_DL)        dnl extra flags for dynamic linking libraries
 
 AC_SUBST(LOCALE)
 
 dnl Options for cleaning up the compiler output
 AS_IF([test $enable_quiet -ne $DISABLED],
       [
           AC_MSG_NOTICE([Suppressing make details])
           QUIET_LIBTOOL_OPTS="--silent"
           QUIET_MAKE_OPTS="-s"  # POSIX compliant
       ],
       [
           QUIET_LIBTOOL_OPTS=""
           QUIET_MAKE_OPTS=""
       ]
 )
 
 dnl Put the above variables to use
 LIBTOOL="${LIBTOOL} --tag=CC \$(QUIET_LIBTOOL_OPTS)"
 MAKEFLAGS="${MAKEFLAGS} ${QUIET_MAKE_OPTS}"
 
 # Make features list available (sorted alphabetically, without leading space)
 PCMK_FEATURES=`echo "$PCMK_FEATURES" | sed -e 's/^ //' -e 's/ /\n/g' | sort | xargs`
 AC_DEFINE_UNQUOTED(CRM_FEATURES, "$PCMK_FEATURES", Set of enabled features)
 AC_SUBST(PCMK_FEATURES)
 
 AC_SUBST(CC)
 AC_SUBST(MAKEFLAGS)
 AC_SUBST(LIBTOOL)
 AC_SUBST(QUIET_LIBTOOL_OPTS)
 
 dnl Files we output that need to be executable
 CONFIG_FILES_EXEC([agents/ocf/ClusterMon],
                   [agents/ocf/Dummy],
                   [agents/ocf/HealthCPU],
                   [agents/ocf/HealthIOWait],
                   [agents/ocf/HealthSMART],
                   [agents/ocf/Stateful],
                   [agents/ocf/SysInfo],
                   [agents/ocf/attribute],
                   [agents/ocf/controld],
                   [agents/ocf/ifspeed],
                   [agents/ocf/ping],
                   [agents/ocf/remote],
                   [agents/stonith/fence_legacy],
                   [agents/stonith/fence_watchdog],
                   [cts/cluster_test],
                   [cts/cts],
                   [cts/cts-attrd],
                   [cts/cts-cli],
                   [cts/cts-exec],
                   [cts/cts-fencing],
                   [cts/cts-lab],
                   [cts/cts-regression],
                   [cts/cts-scheduler],
                   [cts/cts-schemas],
                   [cts/benchmark/clubench],
                   [cts/support/LSBDummy],
                   [cts/support/cts-support],
                   [cts/support/fence_dummy],
                   [cts/support/pacemaker-cts-dummyd],
                   [doc/abi-check],
                   [maint/bumplibs],
                   [tools/cluster-clean],
                   [tools/cluster-helper],
                   [tools/crm_failcount],
                   [tools/crm_master],
                   [tools/crm_report],
                   [tools/crm_standby],
                   [tools/cibsecret],
                   [tools/pcmk_simtimes],
                   [xml/rng-helper])
 
 dnl Other files we output
 AC_CONFIG_FILES(Makefile                                            \
                 agents/Makefile                                     \
                 agents/alerts/Makefile                              \
                 agents/ocf/Makefile                                 \
                 agents/stonith/Makefile                             \
                 cts/Makefile                                        \
                 cts/benchmark/Makefile                              \
                 cts/scheduler/Makefile                              \
                 cts/scheduler/dot/Makefile                          \
                 cts/scheduler/exp/Makefile                          \
                 cts/scheduler/scores/Makefile                       \
                 cts/scheduler/stderr/Makefile                       \
                 cts/scheduler/summary/Makefile                      \
                 cts/scheduler/xml/Makefile                          \
                 cts/support/Makefile                                \
                 cts/support/pacemaker-cts-dummyd@.service           \
                 daemons/Makefile                                    \
                 daemons/attrd/Makefile                              \
                 daemons/based/Makefile                              \
                 daemons/controld/Makefile                           \
                 daemons/execd/Makefile                              \
                 daemons/execd/pacemaker_remote                      \
                 daemons/execd/pacemaker_remote.service              \
                 daemons/fenced/Makefile                             \
                 daemons/pacemakerd/Makefile                         \
                 daemons/pacemakerd/pacemaker.service                \
                 daemons/schedulerd/Makefile                         \
                 devel/Makefile                                      \
                 doc/Doxyfile                                        \
                 doc/Makefile                                        \
                 doc/sphinx/Makefile                                 \
                 etc/Makefile                                        \
                 etc/init.d/pacemaker                                \
                 etc/logrotate.d/pacemaker                           \
                 etc/sysconfig/pacemaker                             \
                 include/Makefile                                    \
                 include/crm/Makefile                                \
                 include/crm/cib/Makefile                            \
                 include/crm/common/Makefile                         \
                 include/crm/cluster/Makefile                        \
                 include/crm/fencing/Makefile                        \
                 include/crm/pengine/Makefile                        \
                 include/pcmki/Makefile                              \
                 lib/Makefile                                        \
                 lib/cib/Makefile                                    \
                 lib/cluster/Makefile                                \
                 lib/cluster/tests/Makefile                          \
                 lib/cluster/tests/cluster/Makefile                  \
                 lib/cluster/tests/cpg/Makefile                      \
                 lib/common/Makefile                                 \
                 lib/common/tests/Makefile                           \
                 lib/common/tests/acl/Makefile                       \
                 lib/common/tests/actions/Makefile                   \
                 lib/common/tests/agents/Makefile                    \
                 lib/common/tests/cmdline/Makefile                   \
                 lib/common/tests/digest/Makefile                    \
                 lib/common/tests/flags/Makefile                     \
                 lib/common/tests/health/Makefile                    \
                 lib/common/tests/io/Makefile                        \
                 lib/common/tests/iso8601/Makefile                   \
                 lib/common/tests/lists/Makefile                     \
                 lib/common/tests/messages/Makefile                  \
                 lib/common/tests/nodes/Makefile                     \
                 lib/common/tests/nvpair/Makefile                    \
                 lib/common/tests/options/Makefile                   \
                 lib/common/tests/output/Makefile                    \
                 lib/common/tests/patchset/Makefile                  \
                 lib/common/tests/probes/Makefile                    \
                 lib/common/tests/procfs/Makefile                    \
                 lib/common/tests/resources/Makefile                 \
                 lib/common/tests/results/Makefile                   \
                 lib/common/tests/rules/Makefile                     \
                 lib/common/tests/scheduler/Makefile                 \
                 lib/common/tests/schemas/Makefile                   \
                 lib/common/tests/scores/Makefile                    \
                 lib/common/tests/strings/Makefile                   \
                 lib/common/tests/utils/Makefile                     \
                 lib/common/tests/xml/Makefile                       \
                 lib/common/tests/xml_comment/Makefile               \
                 lib/common/tests/xml_element/Makefile               \
+                lib/common/tests/xml_idref/Makefile                 \
                 lib/common/tests/xpath/Makefile                     \
                 lib/fencing/Makefile                                \
                 lib/libpacemaker.pc                                 \
                 lib/lrmd/Makefile                                   \
                 lib/pacemaker/Makefile                              \
                 lib/pacemaker/tests/Makefile                        \
                 lib/pacemaker/tests/pcmk_resource/Makefile          \
                 lib/pacemaker/tests/pcmk_ticket/Makefile            \
                 lib/pacemaker.pc                                    \
                 lib/pacemaker-cib.pc                                \
                 lib/pacemaker-cluster.pc                            \
                 lib/pacemaker-fencing.pc                            \
                 lib/pacemaker-lrmd.pc                               \
                 lib/pacemaker-service.pc                            \
                 lib/pacemaker-pe_rules.pc                           \
                 lib/pacemaker-pe_status.pc                          \
                 lib/pengine/Makefile                                \
                 lib/pengine/tests/Makefile                          \
                 lib/pengine/tests/native/Makefile                   \
                 lib/pengine/tests/status/Makefile                   \
                 lib/pengine/tests/unpack/Makefile                   \
                 lib/pengine/tests/utils/Makefile                    \
                 lib/services/Makefile                               \
                 maint/Makefile                                      \
                 po/Makefile.in                                      \
                 python/Makefile                                     \
                 python/setup.py                                     \
                 python/pacemaker/Makefile                           \
                 python/pacemaker/_cts/Makefile                      \
                 python/pacemaker/_cts/tests/Makefile                \
                 python/pacemaker/buildoptions.py                    \
                 python/tests/Makefile                               \
                 rpm/Makefile                                        \
                 tests/Makefile                                      \
                 tools/Makefile                                      \
                 tools/crm_mon.service                               \
                 tools/report.collector                              \
                 tools/report.common                                 \
                 xml/Makefile                                        \
                 xml/pacemaker-schemas.pc                            \
 )
 
 dnl Now process the entire list of files added by previous
 dnl  calls to AC_CONFIG_FILES()
 AC_OUTPUT()
 
 dnl *****************
 dnl Configure summary
 dnl *****************
 
 AC_MSG_NOTICE([])
 AC_MSG_NOTICE([$PACKAGE configuration:])
 AC_MSG_NOTICE([  Version                  = ${VERSION} (Build: $BUILD_VERSION)])
 AC_MSG_NOTICE([  Features                 = ${PCMK_FEATURES}])
 AC_MSG_NOTICE([])
 AC_MSG_NOTICE([  Prefix                   = ${prefix}])
 AC_MSG_NOTICE([  Executables              = ${sbindir}])
 AC_MSG_NOTICE([  Man pages                = ${mandir}])
 AC_MSG_NOTICE([  Libraries                = ${libdir}])
 AC_MSG_NOTICE([  Header files             = ${includedir}])
 AC_MSG_NOTICE([  Arch-independent files   = ${datadir}])
 AC_MSG_NOTICE([  State information        = ${localstatedir}])
 AC_MSG_NOTICE([  System configuration     = ${sysconfdir}])
 AC_MSG_NOTICE([  OCF agents               = ${PCMK_OCF_ROOT}])
 AM_COND_IF([BUILD_LSB],
            [AC_MSG_NOTICE([  LSB agents               = ${INITDIR}])])
 AC_MSG_NOTICE([])
 AC_MSG_NOTICE([  HA group name            = ${CRM_DAEMON_GROUP}])
 AC_MSG_NOTICE([  HA user name             = ${CRM_DAEMON_USER}])
 AC_MSG_NOTICE([])
 AC_MSG_NOTICE([  CFLAGS                   = ${CFLAGS}])
 AC_MSG_NOTICE([  CFLAGS_HARDENED_EXE      = ${CFLAGS_HARDENED_EXE}])
 AC_MSG_NOTICE([  CFLAGS_HARDENED_LIB      = ${CFLAGS_HARDENED_LIB}])
 AC_MSG_NOTICE([  LDFLAGS_HARDENED_EXE     = ${LDFLAGS_HARDENED_EXE}])
 AC_MSG_NOTICE([  LDFLAGS_HARDENED_LIB     = ${LDFLAGS_HARDENED_LIB}])
 AC_MSG_NOTICE([  Libraries                = ${LIBS}])
 AC_MSG_NOTICE([  Stack Libraries          = ${CLUSTERLIBS}])
 AC_MSG_NOTICE([  Unix socket auth method  = ${us_auth}])
diff --git a/include/crm/common/nvpair_internal.h b/include/crm/common/nvpair_internal.h
index 11d2f862f4..6297147ea4 100644
--- a/include/crm/common/nvpair_internal.h
+++ b/include/crm/common/nvpair_internal.h
@@ -1,70 +1,73 @@
 /*
  * Copyright 2004-2024 the Pacemaker project contributors
  *
  * The version control history for this file may have further details.
  *
  * This source code is licensed under the GNU Lesser General Public License
  * version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
  */
 
 #ifndef PCMK__CRM_COMMON_NVPAIR_INTERNAL__H
 #define PCMK__CRM_COMMON_NVPAIR_INTERNAL__H
 
-#include <glib.h>                           // gboolean
+#include <stdbool.h>                        // bool
+#include <glib.h>                           // gboolean, gpointer, GHashTable
 #include <libxml/tree.h>                    // xmlNode
 
 #include <crm/common/rules.h>               // pcmk_rule_input_t
 #include <crm/common/iso8601.h>             // crm_time_t
 #include <crm/common/strings_internal.h>    // pcmk__str_eq(), etc.
 
 #ifdef __cplusplus
 extern "C" {
 #endif
 
 // Data needed to sort XML blocks of name/value pairs
 typedef struct unpack_data_s {
     GHashTable *values;             // Where to put name/value pairs
     const char *first_id;           // Block with this XML ID should sort first
     pcmk_rule_input_t rule_input;   // Data used to evaluate rules
 
     /* Whether each block's values should overwrite any existing ones
      *
      * @COMPAT Only external call paths set this to true. Drop it when we drop
      * pe_eval_nvpairs() and pe_unpack_nvpairs() after replacing with a new
      * public API that doesn't overwrite.
      */
     bool overwrite;
 
     // If not NULL, this will be set to when rule evaluations will change next
     crm_time_t *next_change;
 } pcmk__nvpair_unpack_t;
 
 gint pcmk__cmp_nvpair_blocks(gconstpointer a, gconstpointer b,
                              gpointer user_data);
 
+void pcmk__unpack_nvpair_block(gpointer data, gpointer user_data);
+
 /*!
  * \internal
  * \brief Insert a meta-attribute into a hash table
  *
  * \param[in] obj    Resource (pcmk__resource_private_t)
  *                   or action (pcmk_action_t) to add to
  * \param[in] name   Meta-attribute name
  * \param[in] value  Value to add
  */
 #define pcmk__insert_meta(obj, name, value) do {                        \
         if (pcmk__str_eq((value), "#default", pcmk__str_casei)) {       \
             /* @COMPAT Deprecated since 2.1.8 */                        \
             pcmk__config_warn("Support for setting meta-attributes "    \
                               "(such as %s) to the explicit value "     \
                               "'#default' is deprecated and will be "   \
                               "removed in a future release", (name));   \
         } else if ((value) != NULL) {                                   \
             pcmk__insert_dup((obj)->meta, (name), (value));             \
         }                                                               \
     } while (0)
 
 #ifdef __cplusplus
 }
 #endif
 
 #endif // PCMK__CRM_COMMON_NVPAIR_INTERNAL__H
diff --git a/include/crm/common/xml_idref_internal.h b/include/crm/common/xml_idref_internal.h
index 58f1c1b9e3..4046cc4cea 100644
--- a/include/crm/common/xml_idref_internal.h
+++ b/include/crm/common/xml_idref_internal.h
@@ -1,26 +1,28 @@
 /*
  * Copyright 2024 the Pacemaker project contributors
  *
  * The version control history for this file may have further details.
  *
  * This source code is licensed under the GNU Lesser General Public License
  * version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
  */
 
 #ifndef PCMK__CRM_COMMON_XML_IDREF_INTERNAL__H
 #define PCMK__CRM_COMMON_XML_IDREF_INTERNAL__H
 
 #include <glib.h>           // gboolean, gpointer, GList, GHashTable
 #include <libxml/tree.h>    // xmlNode
 
 // An XML ID and references to it (used for tags and templates)
 typedef struct {
     char *id;       // XML ID of primary element
     GList *refs;    // XML IDs of elements that reference the primary element
 } pcmk__idref_t;
 
 void pcmk__add_idref(GHashTable *table, const char *id, const char *referrer);
 void pcmk__free_idref(gpointer data);
 xmlNode *pcmk__xe_resolve_idref(xmlNode *xml, xmlNode *search);
+GList *pcmk__xe_dereference_children(const xmlNode *xml,
+                                     const char *element_name);
 
 #endif // PCMK__CRM_COMMON_XML_IDREF_INTERNAL__H
diff --git a/lib/common/nvpair.c b/lib/common/nvpair.c
index 59f1b5ed54..37635e1cdd 100644
--- a/lib/common/nvpair.c
+++ b/lib/common/nvpair.c
@@ -1,610 +1,699 @@
 /*
  * Copyright 2004-2024 the Pacemaker project contributors
  *
  * The version control history for this file may have further details.
  *
  * This source code is licensed under the GNU Lesser General Public License
  * version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
  */
 
 #include <crm_internal.h>
 
 #include <stdio.h>
 #include <stdint.h>         // UINT32_MAX
 #include <inttypes.h>       // PRIu32
 #include <sys/types.h>
 #include <string.h>
 #include <ctype.h>
 #include <glib.h>
 #include <libxml/tree.h>
 
 #include <crm/crm.h>
 #include <crm/common/xml.h>
 #include <crm/common/xml_internal.h>
 #include "crmcommon_private.h"
 
 /*
  * This file isolates handling of various kinds of name/value pairs:
  *
  * - pcmk_nvpair_t data type
  * - name=value strings
  * - XML nvpair elements (<nvpair id=ID name=NAME value=VALUE>)
  * - Instance attributes and meta-attributes (for resources and actions)
  */
 
 // pcmk_nvpair_t handling
 
 /*!
  * \internal
  * \brief Allocate a new name/value pair
  *
  * \param[in] name   New name (required)
  * \param[in] value  New value
  *
  * \return Newly allocated name/value pair
  * \note The caller is responsible for freeing the result with
  *       \c pcmk__free_nvpair().
  */
 static pcmk_nvpair_t *
 pcmk__new_nvpair(const char *name, const char *value)
 {
     pcmk_nvpair_t *nvpair = NULL;
 
     pcmk__assert(name);
 
     nvpair = pcmk__assert_alloc(1, sizeof(pcmk_nvpair_t));
 
     nvpair->name = pcmk__str_copy(name);
     nvpair->value = pcmk__str_copy(value);
     return nvpair;
 }
 
 /*!
  * \internal
  * \brief Free a name/value pair
  *
  * \param[in,out] nvpair  Name/value pair to free
  */
 static void
 pcmk__free_nvpair(gpointer data)
 {
     if (data) {
         pcmk_nvpair_t *nvpair = data;
 
         free(nvpair->name);
         free(nvpair->value);
         free(nvpair);
     }
 }
 
 /*!
  * \brief Prepend a name/value pair to a list
  *
  * \param[in,out] nvpairs  List to modify
  * \param[in]     name     New entry's name
  * \param[in]     value    New entry's value
  *
  * \return New head of list
  * \note The caller is responsible for freeing the list with
  *       \c pcmk_free_nvpairs().
  */
 GSList *
 pcmk_prepend_nvpair(GSList *nvpairs, const char *name, const char *value)
 {
     return g_slist_prepend(nvpairs, pcmk__new_nvpair(name, value));
 }
 
 /*!
  * \brief Free a list of name/value pairs
  *
  * \param[in,out] list  List to free
  */
 void
 pcmk_free_nvpairs(GSList *nvpairs)
 {
     g_slist_free_full(nvpairs, pcmk__free_nvpair);
 }
 
 
 // name=value string handling
 
 /*!
  * \internal
  * \brief Extract the name and value from an input string formatted as "name=value".
  * If unable to extract them, they are returned as NULL.
  *
  * \param[in]  input The input string, likely from the command line
  * \param[out] name  Everything before the first '=' in the input string
  * \param[out] value Everything after the first '=' in the input string
  *
  * \return 2 if both name and value could be extracted, 1 if only one could, and
  *         and error code otherwise
  */
 int
 pcmk__scan_nvpair(const char *input, char **name, char **value)
 {
 #ifdef HAVE_SSCANF_M
     *name = NULL;
     *value = NULL;
     if (sscanf(input, "%m[^=]=%m[^\n]", name, value) <= 0) {
         return -pcmk_err_bad_nvpair;
     }
 #else
     char *sep = NULL;
     *name = NULL;
     *value = NULL;
 
     sep = strstr(optarg, "=");
     if (sep == NULL) {
         return -pcmk_err_bad_nvpair;
     }
 
     *name = strndup(input, sep-input);
 
     if (*name == NULL) {
         return -ENOMEM;
     }
 
     /* If the last char in optarg is =, the user gave no
      * value for the option.  Leave it as NULL.
      */
     if (*(sep+1) != '\0') {
         *value = strdup(sep+1);
 
         if (*value == NULL) {
             return -ENOMEM;
         }
     }
 #endif
 
     if (*name != NULL && *value != NULL) {
         return 2;
     } else if (*name != NULL || *value != NULL) {
         return 1;
     } else {
         return -pcmk_err_bad_nvpair;
     }
 }
 
 /*!
  * \internal
  * \brief Format a name/value pair.
  *
  * Units can optionally be provided for the value.  Note that unlike most
  * formatting functions, this one returns the formatted string.  It is
  * assumed that the most common use of this function will be to build up
  * a string to be output as part of other functions.
  *
  * \note The caller is responsible for freeing the return value after use.
  *
  * \param[in]     name  The name of the nvpair.
  * \param[in]     value The value of the nvpair.
  * \param[in]     units Optional units for the value, or NULL.
  *
  * \return Newly allocated string with name/value pair
  */
 char *
 pcmk__format_nvpair(const char *name, const char *value, const char *units)
 {
     return crm_strdup_printf("%s=\"%s%s\"", name, value, units ? units : "");
 }
 
 /*!
  * \brief Safely add hash table entry to XML as attribute or name-value pair
  *
  * Suitable for \c g_hash_table_foreach(), this function takes a hash table key
  * and value, with an XML node passed as user data, and adds an XML attribute
  * with the specified name and value if it does not already exist. If the key
  * name starts with a digit, then it's not a valid XML attribute name. In that
  * case, this will instead add a <tt><param name=NAME value=VALUE/></tt> child
  * to the XML.
  *
  * \param[in]     key        Key of hash table entry
  * \param[in]     value      Value of hash table entry
  * \param[in,out] user_data  XML node
  */
 void
 hash2smartfield(gpointer key, gpointer value, gpointer user_data)
 {
     /* @TODO Generate PCMK__XE_PARAM nodes for all keys that aren't valid XML
      * attribute names (not just those that start with digits), or possibly for
      * all keys to simplify parsing.
      *
      * Consider either deprecating as public API or exposing PCMK__XE_PARAM.
      * PCMK__XE_PARAM is currently private because it doesn't appear in any
      * output that Pacemaker generates.
      */
     const char *name = key;
     const char *s_value = value;
 
     xmlNode *xml_node = user_data;
 
     if (isdigit(name[0])) {
         xmlNode *tmp = pcmk__xe_create(xml_node, PCMK__XE_PARAM);
 
         crm_xml_add(tmp, PCMK_XA_NAME, name);
         crm_xml_add(tmp, PCMK_XA_VALUE, s_value);
 
     } else if (crm_element_value(xml_node, name) == NULL) {
         crm_xml_add(xml_node, name, s_value);
         crm_trace("dumped: %s=%s", name, s_value);
 
     } else {
         crm_trace("duplicate: %s=%s", name, s_value);
     }
 }
 
 /*!
  * \brief Set XML attribute based on hash table entry
  *
  * Suitable for \c g_hash_table_foreach(), this function takes a hash table key
  * and value, with an XML node passed as user data, and adds an XML attribute
  * with the specified name and value if it does not already exist.
  *
  * \param[in]     key        Key of hash table entry
  * \param[in]     value      Value of hash table entry
  * \param[in,out] user_data  XML node
  */
 void
 hash2field(gpointer key, gpointer value, gpointer user_data)
 {
     const char *name = key;
     const char *s_value = value;
 
     xmlNode *xml_node = user_data;
 
     if (crm_element_value(xml_node, name) == NULL) {
         crm_xml_add(xml_node, name, s_value);
 
     } else {
         crm_trace("duplicate: %s=%s", name, s_value);
     }
 }
 
 /*!
  * \brief Set XML attribute based on hash table entry, as meta-attribute name
  *
  * Suitable for \c g_hash_table_foreach(), this function takes a hash table key
  * and value, with an XML node passed as user data, and adds an XML attribute
  * with the meta-attribute version of the specified name and value if it does
  * not already exist and if the name does not appear to be cluster-internal.
  *
  * \param[in]     key        Key of hash table entry
  * \param[in]     value      Value of hash table entry
  * \param[in,out] user_data  XML node
  */
 void
 hash2metafield(gpointer key, gpointer value, gpointer user_data)
 {
     char *crm_name = NULL;
 
     if (key == NULL || value == NULL) {
         return;
     }
 
     /* Filter out cluster-generated attributes that contain a '#' or ':'
      * (like fail-count and last-failure).
      */
     for (crm_name = key; *crm_name; ++crm_name) {
         if ((*crm_name == '#') || (*crm_name == ':')) {
             return;
         }
     }
 
     crm_name = crm_meta_name(key);
     hash2field(crm_name, value, user_data);
     free(crm_name);
 }
 
 // nvpair handling
 
 /*!
  * \brief Create an XML name/value pair
  *
  * \param[in,out] parent  If not \c NULL, make new XML node a child of this one
  * \param[in]     id      Set this as XML ID (or NULL to auto-generate)
  * \param[in]     name    Name to use
  * \param[in]     value   Value to use
  *
  * \return New XML object on success, \c NULL otherwise
  */
 xmlNode *
 crm_create_nvpair_xml(xmlNode *parent, const char *id, const char *name,
                       const char *value)
 {
     xmlNode *nvp;
 
     /* id can be NULL so we auto-generate one, and name can be NULL if this
      * will be used to delete a name/value pair by ID, but both can't be NULL
      */
     CRM_CHECK(id || name, return NULL);
 
     nvp = pcmk__xe_create(parent, PCMK_XE_NVPAIR);
 
     if (id) {
         crm_xml_add(nvp, PCMK_XA_ID, id);
     } else {
         pcmk__xe_set_id(nvp, "%s-%s",
                         pcmk__s(pcmk__xe_id(parent), PCMK_XE_NVPAIR), name);
     }
     crm_xml_add(nvp, PCMK_XA_NAME, name);
     crm_xml_add(nvp, PCMK_XA_VALUE, value);
     return nvp;
 }
 
 /*!
  * \brief Retrieve XML attributes as a hash table
  *
  * Given an XML element, this will look for any \<attributes> element child,
  * creating a hash table of (newly allocated string) name/value pairs taken
  * first from the attributes element's NAME=VALUE XML attributes, and then
  * from any \<param name=NAME value=VALUE> children of attributes.
  *
  * \param[in]  XML node to parse
  *
  * \return Hash table with name/value pairs
  * \note It is the caller's responsibility to free the result using
  *       \c g_hash_table_destroy().
  */
 GHashTable *
 xml2list(const xmlNode *parent)
 {
     xmlNode *child = NULL;
     xmlAttrPtr pIter = NULL;
     xmlNode *nvpair_list = NULL;
     GHashTable *nvpair_hash = pcmk__strkey_table(free, free);
 
     CRM_CHECK(parent != NULL, return nvpair_hash);
 
     nvpair_list = pcmk__xe_first_child(parent, PCMK__XE_ATTRIBUTES, NULL, NULL);
     if (nvpair_list == NULL) {
         crm_trace("No attributes in %s", parent->name);
         crm_log_xml_trace(parent, "No attributes for resource op");
     }
 
     crm_log_xml_trace(nvpair_list, "Unpacking");
 
     for (pIter = pcmk__xe_first_attr(nvpair_list); pIter != NULL;
          pIter = pIter->next) {
 
         const char *p_name = (const char *)pIter->name;
         const char *p_value = pcmk__xml_attr_value(pIter);
 
         crm_trace("Added %s=%s", p_name, p_value);
 
         pcmk__insert_dup(nvpair_hash, p_name, p_value);
     }
 
     for (child = pcmk__xe_first_child(nvpair_list, PCMK__XE_PARAM, NULL, NULL);
          child != NULL; child = pcmk__xe_next(child, PCMK__XE_PARAM)) {
 
         const char *key = crm_element_value(child, PCMK_XA_NAME);
         const char *value = crm_element_value(child, PCMK_XA_VALUE);
 
         crm_trace("Added %s=%s", key, value);
         if (key != NULL && value != NULL) {
             pcmk__insert_dup(nvpair_hash, key, value);
         }
     }
 
     return nvpair_hash;
 }
 
+/*!
+ * \internal
+ * \brief Unpack a single nvpair XML element into a hash table
+ *
+ * \param[in]     nvpair    XML nvpair element to unpack
+ * \param[in,out] userdata  Unpack data
+ *
+ * \return pcmk_rc_ok (to always proceed to next nvpair)
+ */
+static int
+unpack_nvpair(xmlNode *nvpair, void *userdata)
+{
+    pcmk__nvpair_unpack_t *unpack_data = userdata;
+
+    const char *name = NULL;
+    const char *value = NULL;
+    const char *old_value = NULL;
+    const xmlNode *ref_nvpair = pcmk__xe_resolve_idref(nvpair, NULL);
+
+    if (ref_nvpair == NULL) {
+        /* Not possible with schema validation enabled (error already
+         * logged)
+         */
+        return pcmk_rc_ok;
+    }
+
+    name = crm_element_value(ref_nvpair, PCMK_XA_NAME);
+    value = crm_element_value(ref_nvpair, PCMK_XA_VALUE);
+    if ((name == NULL) || (value == NULL)) {
+        return pcmk_rc_ok; // Not possible with schema validation enabled
+    }
+
+    old_value = g_hash_table_lookup(unpack_data->values, name);
+
+    if (pcmk__str_eq(value, "#default", pcmk__str_casei)) {
+        // @COMPAT Deprecated since 2.1.8
+        pcmk__config_warn("Support for setting meta-attributes (such as "
+                          "%s) to the explicit value '#default' is "
+                          "deprecated and will be removed in a future "
+                          "release", name);
+        if (old_value != NULL) {
+            g_hash_table_remove(unpack_data->values, name);
+        }
+
+    } else if ((old_value == NULL) || unpack_data->overwrite) {
+        crm_trace("Setting %s=\"%s\" (was %s)",
+                  name, value, pcmk__s(old_value, "unset"));
+        pcmk__insert_dup(unpack_data->values, name, value);
+    }
+    return pcmk_rc_ok;
+}
+
+/*!
+ * \internal
+ * \brief Unpack an XML block of nvpair elements into a hash table,
+ *        evaluated for any rule
+ *
+ * \param[in]     data       XML block to unpack
+ * \param[in,out] user_data  Unpack data
+ *
+ * \note This is suitable for use as a GList iterator function
+ */
+void
+pcmk__unpack_nvpair_block(gpointer data, gpointer user_data)
+{
+    xmlNode *pair = data;
+    pcmk__nvpair_unpack_t *unpack_data = user_data;
+
+    xmlNode *rule_xml = NULL;
+
+    pcmk__assert((pair != NULL) && (unpack_data != NULL)
+                 && (unpack_data->values != NULL));
+
+    rule_xml = pcmk__xe_first_child(pair, PCMK_XE_RULE, NULL, NULL);
+    if ((rule_xml != NULL)
+        && (pcmk_evaluate_rule(rule_xml, &(unpack_data->rule_input),
+                               unpack_data->next_change) != pcmk_rc_ok)) {
+        return;
+    }
+
+    crm_trace("Adding name/value pairs from %s %s overwrite",
+              pcmk__xe_id(pair), (unpack_data->overwrite? "with" : "without"));
+    if (pcmk__xe_is(pair->children, PCMK__XE_ATTRIBUTES)) {
+        pair = pair->children;
+    }
+    pcmk__xe_foreach_child(pair, PCMK_XE_NVPAIR, unpack_nvpair, unpack_data);
+}
+
+
 // Meta-attribute handling
 
 /*!
  * \brief Get the environment variable equivalent of a meta-attribute name
  *
  * \param[in] attr_name  Name of meta-attribute
  *
  * \return Newly allocated string for \p attr_name with "CRM_meta_" prefix and
  *         underbars instead of dashes
  * \note This asserts on an invalid argument or memory allocation error, so
  *       callers can assume the result is non-NULL. The caller is responsible
  *       for freeing the result using free().
  */
 char *
 crm_meta_name(const char *attr_name)
 {
     char *env_name = NULL;
 
     pcmk__assert(!pcmk__str_empty(attr_name));
 
     env_name = crm_strdup_printf(CRM_META "_%s", attr_name);
     for (char *c = env_name; *c != '\0'; ++c) {
         if (*c == '-') {
             *c = '_';
         }
     }
     return env_name;
 }
 
 /*!
  * \brief Get the value of a meta-attribute
  *
  * Get the value of a meta-attribute from a hash table whose keys are
  * meta-attribute environment variable names (as crm_meta_name() would
  * create, like pcmk__graph_action_t:params, not pcmk_resource_t:meta).
  *
  * \param[in] meta       Hash table of meta-attributes
  * \param[in] attr_name  Name of meta-attribute to get
  *
  * \return Value of given meta-attribute
  */
 const char *
 crm_meta_value(GHashTable *meta, const char *attr_name)
 {
     if ((meta != NULL) && (attr_name != NULL)) {
         char *key = crm_meta_name(attr_name);
         const char *value = g_hash_table_lookup(meta, key);
 
         free(key);
         return value;
     }
     return NULL;
 }
 
 /*!
  * \internal
  * \brief Compare processing order of two XML blocks of name/value pairs
  *
  * \param[in] a          First XML block to compare
  * \param[in] b          Second XML block to compare
  * \param[in] user_data  pcmk__nvpair_unpack_t with first_id (whether a
  *                       particular XML ID should have priority) and overwrite
  *                       (whether later-processed blocks will overwrite values
  *                       from earlier ones) set as desired
  *
  * \return Standard comparison return code (a negative value if \p a should sort
  *         first, a positive value if \p b should sort first, and 0 if they
  *         should sort equally)
  * \note This is suitable for use as a GList sorting function.
  */
 gint
 pcmk__cmp_nvpair_blocks(gconstpointer a, gconstpointer b, gpointer user_data)
 {
     const xmlNode *pair_a = a;
     const xmlNode *pair_b = b;
     const pcmk__nvpair_unpack_t *unpack_data = user_data;
 
     int score_a = 0;
     int score_b = 0;
     int rc = pcmk_rc_ok;
 
     /* If we're overwriting values, we want to process blocks from
      * lowest priority to highest, so higher-priority values overwrite
      * lower-priority ones. If we're not overwriting values, we want to process
      * from highest priority to lowest.
      */
     const gint a_is_higher = ((unpack_data != NULL)
                               && unpack_data->overwrite)? 1 : -1;
     const gint b_is_higher = -a_is_higher;
 
     /* NULL values have lowest priority, regardless of the other's score
      * (it won't be possible in practice anyway, this is just a failsafe)
      */
     if (a == NULL) {
         return (b == NULL)? 0 : b_is_higher;
 
     } else if (b == NULL) {
         return a_is_higher;
     }
 
     /* A particular XML ID can be specified as having highest priority
      * regardless of score (schema validation, if enabled, prevents two blocks
      * from having the same ID, so we can ignore handling that case
      * specifically)
      */
     if ((unpack_data != NULL) && (unpack_data->first_id != NULL)) {
         if (pcmk__str_eq(pcmk__xe_id(pair_a), unpack_data->first_id,
                          pcmk__str_none)) {
             return a_is_higher;
 
         } else if (pcmk__str_eq(pcmk__xe_id(pair_b), unpack_data->first_id,
                                 pcmk__str_none)) {
             return b_is_higher;
         }
     }
 
     // Otherwise, check the scores
 
     rc = pcmk__xe_get_score(pair_a, PCMK_XA_SCORE, &score_a, 0);
     if (rc != pcmk_rc_ok) { // Not possible with schema validation enabled
         pcmk__config_warn("Using 0 as %s score because '%s' "
                           "is not a valid score: %s",
                           pcmk__xe_id(pair_a),
                           crm_element_value(pair_a, PCMK_XA_SCORE),
                           pcmk_rc_str(rc));
     }
 
     rc = pcmk__xe_get_score(pair_b, PCMK_XA_SCORE, &score_b, 0);
     if (rc != pcmk_rc_ok) { // Not possible with schema validation enabled
         pcmk__config_warn("Using 0 as %s score because '%s' "
                           "is not a valid score: %s",
                           pcmk__xe_id(pair_b),
                           crm_element_value(pair_b, PCMK_XA_SCORE),
                           pcmk_rc_str(rc));
     }
 
     if (score_a < score_b) {
         return b_is_higher;
 
     } else if (score_a > score_b) {
         return a_is_higher;
     }
     return 0;
 }
 
 // Deprecated functions kept only for backward API compatibility
 // LCOV_EXCL_START
 
 #include <crm/common/nvpair_compat.h>
 
 static gint
 pcmk__compare_nvpair(gconstpointer a, gconstpointer b)
 {
     int rc = 0;
     const pcmk_nvpair_t *pair_a = a;
     const pcmk_nvpair_t *pair_b = b;
 
     pcmk__assert((pair_a != NULL) && (pair_a->name != NULL)
                  && (pair_b != NULL) && (pair_b->name != NULL));
 
     rc = strcmp(pair_a->name, pair_b->name);
     if (rc < 0) {
         return -1;
     } else if (rc > 0) {
         return 1;
     }
     return 0;
 }
 
 GSList *
 pcmk_sort_nvpairs(GSList *list)
 {
     return g_slist_sort(list, pcmk__compare_nvpair);
 }
 
 GSList *
 pcmk_xml_attrs2nvpairs(const xmlNode *xml)
 {
     GSList *result = NULL;
 
     for (xmlAttrPtr iter = pcmk__xe_first_attr(xml); iter != NULL;
          iter = iter->next) {
 
         result = pcmk_prepend_nvpair(result,
                                      (const char *) iter->name,
                                      (const char *) pcmk__xml_attr_value(iter));
     }
     return result;
 }
 
 static void
 pcmk__nvpair_add_xml_attr(gpointer data, gpointer user_data)
 {
     pcmk_nvpair_t *pair = data;
     xmlNode *parent = user_data;
 
     crm_xml_add(parent, pair->name, pair->value);
 }
 
 void
 pcmk_nvpairs2xml_attrs(GSList *list, xmlNode *xml)
 {
     g_slist_foreach(list, pcmk__nvpair_add_xml_attr, xml);
 }
 
 void
 hash2nvpair(gpointer key, gpointer value, gpointer user_data)
 {
     const char *name = key;
     const char *s_value = value;
     xmlNode *xml_node = user_data;
 
     crm_create_nvpair_xml(xml_node, name, name, s_value);
     crm_trace("dumped: name=%s value=%s", name, s_value);
 }
 
 // LCOV_EXCL_STOP
 // End deprecated API
diff --git a/lib/common/tests/Makefile.am b/lib/common/tests/Makefile.am
index abefedaab5..bed5c46a5a 100644
--- a/lib/common/tests/Makefile.am
+++ b/lib/common/tests/Makefile.am
@@ -1,45 +1,46 @@
 #
 # Copyright 2020-2024 the Pacemaker project contributors
 #
 # The version control history for this file may have further details.
 #
 # This source code is licensed under the GNU General Public License version 2
 # or later (GPLv2+) WITHOUT ANY WARRANTY.
 #
 
 include $(top_srcdir)/mk/common.mk
 
 SUBDIRS = \
 	acl		\
 	actions		\
 	agents		\
 	cmdline		\
 	digest 		\
 	flags		\
 	health		\
 	io		\
 	iso8601		\
 	lists		\
 	messages	\
 	nodes  		\
 	nvpair 		\
 	options		\
 	output 		\
 	patchset 	\
 	probes 		\
 	resources	\
 	results		\
 	rules		\
 	scheduler	\
 	schemas		\
 	scores		\
 	strings		\
 	utils		\
 	xml 		\
 	xml_comment 	\
 	xml_element 	\
+	xml_idref 	\
 	xpath
 
 if SUPPORT_PROCFS
 SUBDIRS	+=	procfs
 endif
diff --git a/lib/common/tests/nvpair/Makefile.am b/lib/common/tests/nvpair/Makefile.am
index cfd800a7e1..c6f5984315 100644
--- a/lib/common/tests/nvpair/Makefile.am
+++ b/lib/common/tests/nvpair/Makefile.am
@@ -1,24 +1,25 @@
 #
 # Copyright 2021-2024 the Pacemaker project contributors
 #
 # The version control history for this file may have further details.
 #
 # This source code is licensed under the GNU General Public License version 2
 # or later (GPLv2+) WITHOUT ANY WARRANTY.
 #
 
 include $(top_srcdir)/mk/common.mk
 include $(top_srcdir)/mk/tap.mk
 include $(top_srcdir)/mk/unittest.mk
 
 # Add "_test" to the end of all test program names to simplify .gitignore.
 check_PROGRAMS = crm_meta_name_test		\
 		 crm_meta_value_test		\
 		 pcmk__cmp_nvpair_blocks_test	\
 		 pcmk__xe_attr_is_true_test 	\
 		 pcmk__xe_get_bool_attr_test 	\
 		 pcmk__xe_get_datetime_test	\
 		 pcmk__xe_get_flags_test	\
-		 pcmk__xe_set_bool_attr_test
+		 pcmk__xe_set_bool_attr_test	\
+		 pcmk__unpack_nvpair_block_test
 
 TESTS = $(check_PROGRAMS)
diff --git a/lib/common/tests/nvpair/pcmk__unpack_nvpair_block_test.c b/lib/common/tests/nvpair/pcmk__unpack_nvpair_block_test.c
new file mode 100644
index 0000000000..ec7ba2f499
--- /dev/null
+++ b/lib/common/tests/nvpair/pcmk__unpack_nvpair_block_test.c
@@ -0,0 +1,187 @@
+/*
+ * Copyright 2024 the Pacemaker project contributors
+ *
+ * The version control history for this file may have further details.
+ *
+ * This source code is licensed under the GNU General Public License version 2
+ * or later (GPLv2+) WITHOUT ANY WARRANTY.
+ */
+
+#include <crm_internal.h>
+
+#include <crm/common/unittest_internal.h>
+#include <crm/common/xml_internal.h>
+
+#define XML_PASSING_RULE                                    \
+    "<" PCMK_XE_RULE " " PCMK_XA_ID "='rp' >\n"             \
+      "<" PCMK_XE_DATE_EXPRESSION " " PCMK_XA_ID "='ep' "   \
+          PCMK_XA_OPERATION "='" PCMK_VALUE_GT "' "         \
+          PCMK_XA_START "='1950-01-01 00:00:00' />\n"       \
+    "</" PCMK_XE_RULE ">\n"
+
+#define XML_FAILING_RULE                                    \
+    "<" PCMK_XE_RULE " " PCMK_XA_ID "='rf' >\n"             \
+      "<" PCMK_XE_DATE_EXPRESSION " " PCMK_XA_ID "='ef' "   \
+          PCMK_XA_OPERATION "='" PCMK_VALUE_LT "' "         \
+          PCMK_XA_END "='1950-01-01 00:00:00' />\n"         \
+    "</" PCMK_XE_RULE ">\n"
+
+#define XML_NVPAIRS_1                                       \
+    "<" PCMK_XE_NVPAIR " " PCMK_XA_ID "='nvp1-1' "          \
+        PCMK_XA_NAME "='name1' " PCMK_XA_VALUE "='1' />\n"  \
+    "<" PCMK_XE_NVPAIR " " PCMK_XA_ID "='nvp1-2' "          \
+        PCMK_XA_NAME "='name2' " PCMK_XA_VALUE "='1' />\n"
+
+#define XML_NVPAIRS_2                                       \
+    "<" PCMK_XE_NVPAIR " " PCMK_XA_ID "='nvp2-1' "          \
+        PCMK_XA_NAME "='name1' " PCMK_XA_VALUE "='2' />\n"  \
+    "<" PCMK_XE_NVPAIR " " PCMK_XA_ID "='nvp2-2' "          \
+        PCMK_XA_NAME "='name2' " PCMK_XA_VALUE "='2' />\n"  \
+    "<" PCMK_XE_NVPAIR " " PCMK_XA_ID "='nvp2-3' "          \
+        PCMK_XA_NAME "='name3' " PCMK_XA_VALUE "='2' />\n"
+
+static void
+invalid_args(void **state)
+{
+    pcmk__nvpair_unpack_t unpack_data = {
+        .values = NULL,
+        .rule_input = {
+            .now = NULL,
+        },
+    };
+
+    xmlNode *xml = pcmk__xml_parse("<xml/>");
+
+    assert_non_null(xml);
+
+    pcmk__assert_asserts(pcmk__unpack_nvpair_block(NULL, NULL));
+    pcmk__assert_asserts(pcmk__unpack_nvpair_block(NULL, &unpack_data));
+    pcmk__assert_asserts(pcmk__unpack_nvpair_block(xml, NULL));
+    pcmk__assert_asserts(pcmk__unpack_nvpair_block(xml, &unpack_data));
+
+    unpack_data.values = g_hash_table_new(NULL, NULL);
+    pcmk__assert_asserts(pcmk__unpack_nvpair_block(NULL, &unpack_data));
+    g_hash_table_destroy(unpack_data.values);
+
+    pcmk__xml_free(xml);
+}
+
+static void
+with_rules(void **state) {
+    crm_time_t *now = crm_time_new("2024-01-01 15:00:00");
+    pcmk__nvpair_unpack_t unpack_data = {
+        .values = pcmk__strkey_table(free, free),
+        .rule_input = {
+            .now = now,
+        },
+    };
+
+    xmlNode *xml = NULL;
+
+    xml = pcmk__xml_parse("<xml>\n" XML_NVPAIRS_1 XML_PASSING_RULE "</xml>\n");
+    assert_non_null(xml);
+    pcmk__unpack_nvpair_block(xml, &unpack_data);
+    assert_int_equal(g_hash_table_size(unpack_data.values), 2);
+    assert_string_equal(g_hash_table_lookup(unpack_data.values, "name1"), "1");
+    assert_string_equal(g_hash_table_lookup(unpack_data.values, "name2"), "1");
+    pcmk__xml_free(xml);
+
+    xml = pcmk__xml_parse("<xml>\n" XML_NVPAIRS_2 XML_FAILING_RULE "</xml>\n");
+    assert_non_null(xml);
+    pcmk__unpack_nvpair_block(xml, &unpack_data);
+    assert_int_equal(g_hash_table_size(unpack_data.values), 2);
+    assert_string_equal(g_hash_table_lookup(unpack_data.values, "name1"), "1");
+    assert_string_equal(g_hash_table_lookup(unpack_data.values, "name2"), "1");
+    assert_null(g_hash_table_lookup(unpack_data.values, "name3"));
+
+    pcmk__xml_free(xml);
+    crm_time_free(now);
+    g_hash_table_destroy(unpack_data.values);
+}
+
+static void
+without_overwrite(void **state)
+{
+    pcmk__nvpair_unpack_t unpack_data = {
+        .values = pcmk__strkey_table(free, free),
+        .overwrite = false,
+    };
+
+    xmlNode *xml = NULL;
+
+    xml = pcmk__xml_parse("<xml>\n" XML_NVPAIRS_1 "</xml>\n");
+    assert_non_null(xml);
+    pcmk__unpack_nvpair_block(xml, &unpack_data);
+    assert_int_equal(g_hash_table_size(unpack_data.values), 2);
+    assert_string_equal(g_hash_table_lookup(unpack_data.values, "name1"), "1");
+    assert_string_equal(g_hash_table_lookup(unpack_data.values, "name2"), "1");
+    pcmk__xml_free(xml);
+
+    xml = pcmk__xml_parse("<xml>\n" XML_NVPAIRS_2 "</xml>\n");
+    assert_non_null(xml);
+    pcmk__unpack_nvpair_block(xml, &unpack_data);
+    assert_int_equal(g_hash_table_size(unpack_data.values), 3);
+    assert_string_equal(g_hash_table_lookup(unpack_data.values, "name1"), "1");
+    assert_string_equal(g_hash_table_lookup(unpack_data.values, "name2"), "1");
+    assert_string_equal(g_hash_table_lookup(unpack_data.values, "name3"), "2");
+    pcmk__xml_free(xml);
+
+    g_hash_table_destroy(unpack_data.values);
+}
+
+static void
+with_overwrite(void **state)
+{
+    pcmk__nvpair_unpack_t unpack_data = {
+        .values = pcmk__strkey_table(free, free),
+        .overwrite = true,
+    };
+
+    xmlNode *xml = NULL;
+
+    xml = pcmk__xml_parse("<xml>\n" XML_NVPAIRS_1 "</xml>\n");
+    assert_non_null(xml);
+    pcmk__unpack_nvpair_block(xml, &unpack_data);
+    assert_int_equal(g_hash_table_size(unpack_data.values), 2);
+    assert_string_equal(g_hash_table_lookup(unpack_data.values, "name1"), "1");
+    assert_string_equal(g_hash_table_lookup(unpack_data.values, "name2"), "1");
+    pcmk__xml_free(xml);
+
+    xml = pcmk__xml_parse("<xml>\n" XML_NVPAIRS_2 "</xml>\n");
+    assert_non_null(xml);
+    pcmk__unpack_nvpair_block(xml, &unpack_data);
+    assert_int_equal(g_hash_table_size(unpack_data.values), 3);
+    assert_string_equal(g_hash_table_lookup(unpack_data.values, "name1"), "2");
+    assert_string_equal(g_hash_table_lookup(unpack_data.values, "name2"), "2");
+    assert_string_equal(g_hash_table_lookup(unpack_data.values, "name3"), "2");
+    pcmk__xml_free(xml);
+
+    g_hash_table_destroy(unpack_data.values);
+}
+
+static void
+attributes_child(void **state)
+{
+    pcmk__nvpair_unpack_t unpack_data = {
+        .values = pcmk__strkey_table(free, free),
+    };
+
+    xmlNode *xml = pcmk__xml_parse("<xml>\n<" PCMK__XE_ATTRIBUTES ">\n"
+                                   XML_NVPAIRS_1
+                                   "</" PCMK__XE_ATTRIBUTES ">\n</xml>\n");
+    assert_non_null(xml);
+    pcmk__unpack_nvpair_block(xml, &unpack_data);
+    assert_int_equal(g_hash_table_size(unpack_data.values), 2);
+    assert_string_equal(g_hash_table_lookup(unpack_data.values, "name1"), "1");
+    assert_string_equal(g_hash_table_lookup(unpack_data.values, "name2"), "1");
+    pcmk__xml_free(xml);
+
+    g_hash_table_destroy(unpack_data.values);
+}
+
+PCMK__UNIT_TEST(pcmk__xml_test_setup_group, pcmk__xml_test_teardown_group,
+                cmocka_unit_test(invalid_args),
+                cmocka_unit_test(with_rules),
+                cmocka_unit_test(without_overwrite),
+                cmocka_unit_test(with_overwrite),
+                cmocka_unit_test(attributes_child))
diff --git a/lib/common/tests/nvpair/Makefile.am b/lib/common/tests/xml_idref/Makefile.am
similarity index 54%
copy from lib/common/tests/nvpair/Makefile.am
copy to lib/common/tests/xml_idref/Makefile.am
index cfd800a7e1..0ebb41e467 100644
--- a/lib/common/tests/nvpair/Makefile.am
+++ b/lib/common/tests/xml_idref/Makefile.am
@@ -1,24 +1,18 @@
 #
-# Copyright 2021-2024 the Pacemaker project contributors
+# Copyright 2024 the Pacemaker project contributors
 #
 # The version control history for this file may have further details.
 #
 # This source code is licensed under the GNU General Public License version 2
 # or later (GPLv2+) WITHOUT ANY WARRANTY.
 #
 
 include $(top_srcdir)/mk/common.mk
 include $(top_srcdir)/mk/tap.mk
 include $(top_srcdir)/mk/unittest.mk
 
-# Add "_test" to the end of all test program names to simplify .gitignore.
-check_PROGRAMS = crm_meta_name_test		\
-		 crm_meta_value_test		\
-		 pcmk__cmp_nvpair_blocks_test	\
-		 pcmk__xe_attr_is_true_test 	\
-		 pcmk__xe_get_bool_attr_test 	\
-		 pcmk__xe_get_datetime_test	\
-		 pcmk__xe_get_flags_test	\
-		 pcmk__xe_set_bool_attr_test
+# Add "_test" to the end of all test program names to simplify .gitignore
+check_PROGRAMS = \
+		 pcmk__xe_dereference_children_test
 
 TESTS = $(check_PROGRAMS)
diff --git a/lib/common/tests/xml_idref/pcmk__xe_dereference_children_test.c b/lib/common/tests/xml_idref/pcmk__xe_dereference_children_test.c
new file mode 100644
index 0000000000..70a35a4ae1
--- /dev/null
+++ b/lib/common/tests/xml_idref/pcmk__xe_dereference_children_test.c
@@ -0,0 +1,191 @@
+/*
+ * Copyright 2024 the Pacemaker project contributors
+ *
+ * The version control history for this file may have further details.
+ *
+ * This source code is licensed under the GNU General Public License version 2
+ * or later (GPLv2+) WITHOUT ANY WARRANTY.
+ */
+
+#include <crm_internal.h>
+
+#include <glib.h>   // GList, GHashTable, etc.
+
+#include <crm/common/unittest_internal.h>
+#include <crm/common/xml_internal.h>
+
+/*!
+ * \internal
+ * \brief Test an invocation of pcmk__xe_dereference_children()
+ *
+ * \param[in] xml_string    XML to parse, with "test" child to pass to tested
+ *                          function
+ * \param[in] element_name  Element name to pass to tested function
+ * \param[in] ...           NULL-terminated list of child "testattr" values to
+ *                          expect in tested function's returned list
+ */
+static void
+assert_deref(const char *xml_string, const char *element_name, ...)
+{
+    xmlNode *xml = NULL;
+    GList *list = NULL;
+    GHashTable *table = NULL;
+    va_list ap;
+
+    // Parse given XML
+    if (xml_string != NULL) {
+        xml = pcmk__xml_parse(xml_string);
+        assert_non_null(xml);
+    }
+
+    // Create a hash table with all expected child IDs
+    va_start(ap, element_name);
+    for (const char *value = va_arg(ap, const char *);
+         value != NULL; value = va_arg(ap, const char *)) {
+        if (table == NULL) {
+            table = pcmk__strkey_table(NULL, NULL);
+        }
+        g_hash_table_add(table, (gpointer) value);
+    }
+    va_end(ap);
+
+    // Call tested function on "test" child
+    list = pcmk__xe_dereference_children(pcmk__xe_first_child(xml, "test",
+                                                              NULL, NULL),
+                                         element_name);
+
+    // Ensure returned list has exactly the expected child IDs
+    if (table == NULL) {
+        assert_null(list);
+    } else {
+        while (list != NULL) {
+            const char *value = crm_element_value((xmlNode *) list->data,
+                                                  "testattr");
+
+            assert_true(g_hash_table_remove(table, value));
+            list = list->next;
+        }
+        assert_int_equal(g_hash_table_size(table), 0);
+    }
+
+    g_list_free(list);
+    if (table != NULL) {
+        g_hash_table_destroy(table);
+    }
+    pcmk__xml_free(xml);
+}
+
+static void
+null_for_null(void **state)
+{
+    assert_deref(NULL, NULL, NULL);
+    assert_deref(NULL, "test", NULL);
+}
+
+#define XML_NO_CHILDREN "<xml><test/></xml>"
+#define XML_NO_ELEMENT_CHILDREN "<xml><test><!-- comment -->text</test></xml>"
+
+static void
+null_for_no_children(void **state)
+{
+    assert_deref(XML_NO_CHILDREN, NULL, NULL);
+    assert_deref(XML_NO_CHILDREN, "test", NULL);
+    assert_deref(XML_NO_ELEMENT_CHILDREN, NULL, NULL);
+    assert_deref(XML_NO_ELEMENT_CHILDREN, "test", NULL);
+}
+
+#define XML_NO_IDREF                                        \
+    "<xml>\n"                                               \
+    "  <test>\n"                                            \
+    "    <!-- comment -->\n"                                \
+    "    <other id='other1' testattr='othervalue1' />\n"    \
+    "    <child id='child1' testattr='childvalue1' />\n"    \
+    "    <other id='other2' testattr='othervalue2' />\n"    \
+    "    <child id='child2' testattr='childvalue2' />\n"    \
+    "    <child id='child3' testattr='childvalue3' />\n"    \
+    "    <other id='other3' testattr='othervalue3' />\n"    \
+    "  </test>\n"                                           \
+    "</xml>\n"
+
+static void
+without_idref(void **state)
+{
+    assert_deref(XML_NO_IDREF, NULL,
+                 "othervalue1", "othervalue2", "othervalue3",
+                 "childvalue1", "childvalue2", "childvalue3", NULL);
+
+    assert_deref(XML_NO_IDREF, "other",
+                 "othervalue1", "othervalue2", "othervalue3", NULL);
+
+    assert_deref(XML_NO_IDREF, "child",
+                 "childvalue1", "childvalue2", "childvalue3", NULL);
+
+    assert_deref(XML_NO_IDREF, "nonexistent", NULL);
+}
+
+#define XML_WITH_IDREF                                      \
+    "<xml>\n"                                               \
+    "  <other id='other1' testattr='othervalue1' />\n"      \
+    "  <child id='child2' testattr='childvalue2' />\n"      \
+    "  <test>\n"                                            \
+    "    <!-- comment -->\n"                                \
+    "    <other id-ref='other1'/>\n"                        \
+    "    <child id='child1' testattr='childvalue1' />\n"    \
+    "    <other id='other2' testattr='othervalue2' />\n"    \
+    "    <child id-ref='child2' />\n"                       \
+    "    <child id='child3' testattr='childvalue3' />\n"    \
+    "    <other id='other3' testattr='othervalue3' />\n"    \
+    "  </test>\n"                                           \
+    "</xml>\n"
+
+static void
+with_idref(void **state)
+{
+    assert_deref(XML_WITH_IDREF, NULL,
+                 "othervalue1", "othervalue2", "othervalue3",
+                 "childvalue1", "childvalue2", "childvalue3", NULL);
+
+    assert_deref(XML_WITH_IDREF, "other",
+                 "othervalue1", "othervalue2", "othervalue3", NULL);
+
+    assert_deref(XML_WITH_IDREF, "child",
+                 "childvalue1", "childvalue2", "childvalue3", NULL);
+
+    assert_deref(XML_WITH_IDREF, "nonexistent", NULL);
+}
+
+#define XML_WITH_BROKEN_IDREF                               \
+    "<xml>\n"                                               \
+    "  <test>\n"                                            \
+    "    <!-- comment -->\n"                                \
+    "    <other id-ref='other1'/>\n"                        \
+    "    <child id='child1' testattr='childvalue1' />\n"    \
+    "    <other id='other2' testattr='othervalue2' />\n"    \
+    "    <child id-ref='child2' />\n"                       \
+    "    <child id='child3' testattr='childvalue3' />\n"    \
+    "    <other id='other3' testattr='othervalue3' />\n"    \
+    "  </test>\n"                                           \
+    "</xml>\n"
+
+static void
+with_broken_idref(void **state)
+{
+    assert_deref(XML_WITH_BROKEN_IDREF, NULL,
+                 "othervalue2", "othervalue3",
+                 "childvalue1", "childvalue3", NULL);
+
+    assert_deref(XML_WITH_BROKEN_IDREF, "other",
+                 "othervalue2", "othervalue3", NULL);
+
+    assert_deref(XML_WITH_BROKEN_IDREF, "child",
+                 "childvalue1", "childvalue3", NULL);
+
+    assert_deref(XML_WITH_BROKEN_IDREF, "nonexistent", NULL);
+}
+
+PCMK__UNIT_TEST(pcmk__xml_test_setup_group, pcmk__xml_test_teardown_group,
+                cmocka_unit_test(null_for_null),
+                cmocka_unit_test(null_for_no_children),
+                cmocka_unit_test(without_idref),
+                cmocka_unit_test(with_idref),
+                cmocka_unit_test(with_broken_idref))
diff --git a/lib/common/xml_idref.c b/lib/common/xml_idref.c
index 2721b8bf7e..7e3b8f5ecd 100644
--- a/lib/common/xml_idref.c
+++ b/lib/common/xml_idref.c
@@ -1,115 +1,146 @@
 /*
  * Copyright 2004-2024 the Pacemaker project contributors
  *
  * The version control history for this file may have further details.
  *
  * This source code is licensed under the GNU Lesser General Public License
  * version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
  */
 
 #include <crm_internal.h>
 
 #include <stdio.h>              // NULL
 #include <stdlib.h>             // free()
 #include <glib.h>               // GList, GHashTable, etc.
 #include <libxml/tree.h>        // xmlNode
 
 #include <crm/crm.h>
 #include <crm/common/xml.h>     // get_xpath_object(), PCMK_XA_ID_REF
 
 /*!
  * \internal
  * \brief Add an XML ID reference to a table
  *
  * \param[in,out] table      Table of ID references to add to
  * \param[in]     id         ID of primary element being referred to
  * \param[in]     referrer   ID of element referring to \p id
  *
  * \note This refers to an ID reference in general, not necessarily connected to
  *       an id-ref attribute.
  */
 void
 pcmk__add_idref(GHashTable *table, const char *id, const char *referrer)
 {
     pcmk__idref_t *idref = NULL;
 
     pcmk__assert((table != NULL) && (id != NULL) && (referrer != NULL));
 
     idref = g_hash_table_lookup(table, id);
     if (idref == NULL) {
         idref = pcmk__assert_alloc(1, sizeof(pcmk__idref_t));
         idref->id = pcmk__str_copy(id);
         g_hash_table_insert(table, pcmk__str_copy(id), idref);
     }
     for (GList *iter = idref->refs; iter != NULL; iter = iter->next) {
         if (pcmk__str_eq(referrer, (const char *) iter->data,
                          pcmk__str_none)) {
             return; // Already present
         }
     }
     idref->refs = g_list_append(idref->refs, pcmk__str_copy(referrer));
     crm_trace("Added ID %s referrer %s", id, referrer);
 }
 
 /*!
  * \internal
  * \brief Free a pcmk__idref_t
  *
  * \param[in,out] data  pcmk__idref_t to free
  */
 void
 pcmk__free_idref(gpointer data)
 {
     pcmk__idref_t *idref = data;
 
     if (idref != NULL) {
         free(idref->id);
         g_list_free_full(idref->refs, free);
         free(idref);
     }
 }
 
 /*!
  * \internal
  * \brief Get the XML element whose \c PCMK_XA_ID matches an \c PCMK_XA_ID_REF
  *
  * \param[in] xml     Element whose \c PCMK_XA_ID_REF attribute to check
  * \param[in] search  Node whose document to search for node with matching
  *                    \c PCMK_XA_ID (\c NULL to use \p xml)
  *
  * \return If \p xml has a \c PCMK_XA_ID_REF attribute, node in
  *         <tt>search</tt>'s document whose \c PCMK_XA_ID attribute matches;
  *         otherwise, \p xml
  */
 xmlNode *
 pcmk__xe_resolve_idref(xmlNode *xml, xmlNode *search)
 {
     char *xpath = NULL;
     const char *ref = NULL;
     xmlNode *result = NULL;
 
     if (xml == NULL) {
         return NULL;
     }
 
     ref = crm_element_value(xml, PCMK_XA_ID_REF);
     if (ref == NULL) {
         return xml;
     }
 
     if (search == NULL) {
         search = xml;
     }
 
     xpath = crm_strdup_printf("//%s[@" PCMK_XA_ID "='%s']", xml->name, ref);
     result = get_xpath_object(xpath, search, LOG_DEBUG);
     if (result == NULL) {
         // Not possible with schema validation enabled
         pcmk__config_err("Ignoring invalid %s configuration: "
                          PCMK_XA_ID_REF " '%s' does not reference "
                          "a valid object " QB_XS " xpath=%s",
                          xml->name, ref, xpath);
     }
     free(xpath);
     return result;
 }
+
+/*!
+ * \internal
+ * \brief Get list of resolved ID references for child elements of given element
+ *
+ * \param[in] xml           XML element to get list for
+ * \param[in] element_name  If not NULL, list only children of this element type
+ *
+ * \return Unordered list of XML elements corresponding to child elements of
+ *         \p xml with any ID references resolved to the referenced elements
+ */
+GList *
+pcmk__xe_dereference_children(const xmlNode *xml, const char *element_name)
+{
+    GList *result = NULL;
+
+    if (xml == NULL) {
+        return NULL;
+    }
+    for (xmlNode *child = pcmk__xe_first_child(xml, element_name, NULL, NULL);
+         child != NULL; child = pcmk__xe_next(child, element_name)) {
+
+        xmlNode *resolved = pcmk__xe_resolve_idref(child, NULL);
+
+        if (resolved == NULL) {
+            continue; // Not possible with schema validation enabled
+        }
+        result = g_list_prepend(result, resolved);
+    }
+    return result;
+}
diff --git a/lib/pengine/rules.c b/lib/pengine/rules.c
index a01d42f9c9..c534d05f4e 100644
--- a/lib/pengine/rules.c
+++ b/lib/pengine/rules.c
@@ -1,257 +1,151 @@
 /*
  * Copyright 2004-2024 the Pacemaker project contributors
  *
  * The version control history for this file may have further details.
  *
  * This source code is licensed under the GNU Lesser General Public License
  * version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
  */
 
 #include <crm_internal.h>
 
 #include <glib.h>
 
 #include <crm/crm.h>
 #include <crm/common/xml.h>
 #include <crm/pengine/rules.h>
 
 #include <crm/common/iso8601_internal.h>
 #include <crm/common/nvpair_internal.h>
 #include <crm/common/rules_internal.h>
 #include <crm/common/xml_internal.h>
 #include <crm/pengine/internal.h>
 #include <crm/pengine/rules_internal.h>
 
 #include <sys/types.h>
 #include <regex.h>
 
 CRM_TRACE_INIT_DATA(pe_rules);
 
 /*!
  * \internal
  * \brief Map pe_rule_eval_data_t to pcmk_rule_input_t
  *
  * \param[out] new  New data struct
  * \param[in]  old  Old data struct
  */
 static void
 map_rule_input(pcmk_rule_input_t *new, const pe_rule_eval_data_t *old)
 {
     if (old == NULL) {
         return;
     }
     new->now = old->now;
     new->node_attrs = old->node_hash;
     if (old->rsc_data != NULL) {
         new->rsc_standard = old->rsc_data->standard;
         new->rsc_provider = old->rsc_data->provider;
         new->rsc_agent = old->rsc_data->agent;
     }
     if (old->match_data != NULL) {
         new->rsc_params = old->match_data->params;
         new->rsc_meta = old->match_data->meta;
         if (old->match_data->re != NULL) {
             new->rsc_id = old->match_data->re->string;
             new->rsc_id_submatches = old->match_data->re->pmatch;
             new->rsc_id_nmatches = old->match_data->re->nregs;
         }
     }
     if (old->op_data != NULL) {
         new->op_name = old->op_data->op_name;
         new->op_interval_ms = old->op_data->interval;
     }
 }
 
-static void
-populate_hash(xmlNode *nvpair_list, GHashTable *hash, bool overwrite)
-{
-    if (pcmk__xe_is(nvpair_list->children, PCMK__XE_ATTRIBUTES)) {
-        nvpair_list = nvpair_list->children;
-    }
-
-    for (xmlNode *nvpair = pcmk__xe_first_child(nvpair_list, PCMK_XE_NVPAIR,
-                                                NULL, NULL);
-         nvpair != NULL; nvpair = pcmk__xe_next(nvpair, PCMK_XE_NVPAIR)) {
-
-        xmlNode *ref_nvpair = pcmk__xe_resolve_idref(nvpair, NULL);
-        const char *name = NULL;
-        const char *value = NULL;
-        const char *old_value = NULL;
-
-        if (ref_nvpair == NULL) {
-            /* Not possible with schema validation enabled (error already
-             * logged)
-             */
-            continue;
-        }
-
-        name = crm_element_value(ref_nvpair, PCMK_XA_NAME);
-        value = crm_element_value(ref_nvpair, PCMK_XA_VALUE);
-        if ((name == NULL) || (value == NULL)) {
-            continue;
-        }
-
-        old_value = g_hash_table_lookup(hash, name);
-
-        if (pcmk__str_eq(value, "#default", pcmk__str_casei)) {
-            // @COMPAT Deprecated since 2.1.8
-            pcmk__config_warn("Support for setting meta-attributes (such as "
-                              "%s) to the explicit value '#default' is "
-                              "deprecated and will be removed in a future "
-                              "release", name);
-            if (old_value != NULL) {
-                crm_trace("Letting %s default (removing explicit value \"%s\")",
-                          name, value);
-                g_hash_table_remove(hash, name);
-            }
-
-        } else if (old_value == NULL) {
-            crm_trace("Setting %s=\"%s\"", name, value);
-            pcmk__insert_dup(hash, name, value);
-
-        } else if (overwrite) {
-            crm_trace("Setting %s=\"%s\" (overwriting old value \"%s\")",
-                      name, value, old_value);
-            pcmk__insert_dup(hash, name, value);
-        }
-    }
-}
-
-static void
-unpack_attr_set(gpointer data, gpointer user_data)
-{
-    xmlNode *pair = data;
-    pcmk__nvpair_unpack_t *unpack_data = user_data;
-
-    xmlNode *rule_xml = pcmk__xe_first_child(pair, PCMK_XE_RULE, NULL, NULL);
-
-    if ((rule_xml != NULL)
-        && (pcmk_evaluate_rule(rule_xml, &(unpack_data->rule_input),
-                               unpack_data->next_change) != pcmk_rc_ok)) {
-        return;
-    }
-
-    crm_trace("Adding name/value pairs from %s %s overwrite",
-              pcmk__xe_id(pair), (unpack_data->overwrite? "with" : "without"));
-    populate_hash(pair, unpack_data->values, unpack_data->overwrite);
-}
-
-/*!
- * \internal
- * \brief Create a sorted list of nvpair blocks
- *
- * \param[in]     xml_obj       XML element containing blocks of nvpair elements
- * \param[in]     set_name      If not NULL, only get blocks of this element
- *
- * \return List of XML blocks of name/value pairs
- */
-static GList *
-make_pairs(const xmlNode *xml_obj, const char *set_name)
-{
-    GList *unsorted = NULL;
-
-    if (xml_obj == NULL) {
-        return NULL;
-    }
-    for (xmlNode *attr_set = pcmk__xe_first_child(xml_obj, NULL, NULL, NULL);
-         attr_set != NULL; attr_set = pcmk__xe_next(attr_set, NULL)) {
-
-        if ((set_name == NULL) || pcmk__xe_is(attr_set, set_name)) {
-            xmlNode *expanded_attr_set = pcmk__xe_resolve_idref(attr_set, NULL);
-
-            if (expanded_attr_set == NULL) {
-                continue; // Not possible with schema validation enabled
-            }
-            unsorted = g_list_prepend(unsorted, expanded_attr_set);
-        }
-    }
-    return unsorted;
-}
-
 /*!
  * \brief Extract nvpair blocks contained by an XML element into a hash table
  *
  * \param[in,out] top           Ignored
  * \param[in]     xml_obj       XML element containing blocks of nvpair elements
  * \param[in]     set_name      If not NULL, only use blocks of this element
  * \param[in]     rule_data     Matching parameters to use when unpacking
  * \param[out]    hash          Where to store extracted name/value pairs
  * \param[in]     always_first  If not NULL, process block with this ID first
  * \param[in]     overwrite     Whether to replace existing values with same
  *                              name (all internal callers pass \c FALSE)
  * \param[out]    next_change   If not NULL, set to when evaluation will change
  */
 void
 pe_eval_nvpairs(xmlNode *top, const xmlNode *xml_obj, const char *set_name,
                 const pe_rule_eval_data_t *rule_data, GHashTable *hash,
                 const char *always_first, gboolean overwrite,
                 crm_time_t *next_change)
 {
-    GList *pairs = make_pairs(xml_obj, set_name);
+    GList *pairs = pcmk__xe_dereference_children(xml_obj, set_name);
 
     if (pairs) {
         pcmk__nvpair_unpack_t data = {
             .values = hash,
             .first_id = always_first,
             .overwrite = overwrite,
             .next_change = next_change,
         };
 
         map_rule_input(&(data.rule_input), rule_data);
 
         pairs = g_list_sort_with_data(pairs, pcmk__cmp_nvpair_blocks, &data);
-        g_list_foreach(pairs, unpack_attr_set, &data);
+        g_list_foreach(pairs, pcmk__unpack_nvpair_block, &data);
         g_list_free(pairs);
     }
 }
 
 /*!
  * \brief Extract nvpair blocks contained by an XML element into a hash table
  *
  * \param[in,out] top           Ignored
  * \param[in]     xml_obj       XML element containing blocks of nvpair elements
  * \param[in]     set_name      Element name to identify nvpair blocks
  * \param[in]     node_hash     Node attributes to use when evaluating rules
  * \param[out]    hash          Where to store extracted name/value pairs
  * \param[in]     always_first  If not NULL, process block with this ID first
  * \param[in]     overwrite     Whether to replace existing values with same
  *                              name (all internal callers pass \c FALSE)
  * \param[in]     now           Time to use when evaluating rules
  * \param[out]    next_change   If not NULL, set to when evaluation will change
  */
 void
 pe_unpack_nvpairs(xmlNode *top, const xmlNode *xml_obj, const char *set_name,
                   GHashTable *node_hash, GHashTable *hash,
                   const char *always_first, gboolean overwrite,
                   crm_time_t *now, crm_time_t *next_change)
 {
     pe_rule_eval_data_t rule_data = {
         .node_hash = node_hash,
         .now = now,
         .match_data = NULL,
         .rsc_data = NULL,
         .op_data = NULL
     };
 
     pe_eval_nvpairs(NULL, xml_obj, set_name, &rule_data, hash,
                     always_first, overwrite, next_change);
 }
 
 // Deprecated functions kept only for backward API compatibility
 // LCOV_EXCL_START
 
 #include <crm/pengine/rules_compat.h>
 
 gboolean
 test_rule(xmlNode * rule, GHashTable * node_hash, enum rsc_role_e role, crm_time_t * now)
 {
     pcmk_rule_input_t rule_input = {
         .node_attrs = node_hash,
         .now = now,
     };
 
     return pcmk_evaluate_rule(rule, &rule_input, NULL) == pcmk_rc_ok;
 }
 
 // LCOV_EXCL_STOP
 // End deprecated API