From 07807b3a1ac3a2ce3c12abf6ec994165170d79f0 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:07:18 +0000
Subject: [PATCH 001/122] app-admin/sudo: Sync with Gentoo

It's from Gentoo commit 68d4d1a6160d6d06148acb3a1667b3dd314d2a05.
---
 .../portage-stable/app-admin/sudo/Manifest    |   2 +
 .../app-admin/sudo/sudo-1.9.17_p2.ebuild      | 292 ++++++++++++++++++
 2 files changed, 294 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/app-admin/sudo/sudo-1.9.17_p2.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/app-admin/sudo/Manifest b/sdk_container/src/third_party/portage-stable/app-admin/sudo/Manifest
index 67dd2c6a6c1..17da9698ff2 100644
--- a/sdk_container/src/third_party/portage-stable/app-admin/sudo/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-admin/sudo/Manifest
@@ -1,2 +1,4 @@
 DIST sudo-1.9.17p1.tar.gz 5449076 BLAKE2B 21771348a8de392767c366bb938951327dcc64a4cedee716a802435899e5135c218468271833a9e3ab9d90bda29e36c0870e27dd333d3a5c64fb8e3a5ebbff58 SHA512 1a9fb27a117b54adf5c99443b3375f7e0eaaf3a2d5a3d409f7c7b10c43432eb301d721df93fb1a8a2e45bf4a4957288d4f153359fc018af00973be57f62a1ebc
 DIST sudo-1.9.17p1.tar.gz.sig 566 BLAKE2B b6380c84b82740455a28388925d27bdf9296ddef943653c1883af3c7684ab53571053ef333ac9747ee11330b06fd23adf477856f70bd5fcaa6dbda1c9e432675 SHA512 714ce7c613683689e9d166171b04c03220e21d06f2e66d800f2d075927830014447611933d7293d9c763beeea66fc02255d8175c9ac8cba6d62166750aab50a6
+DIST sudo-1.9.17p2.tar.gz 5451682 BLAKE2B dd42ff4fd571ba8489cc59d71a09c7e0483d21daf9faf7e697beedc04d9f170b01e60446af179c949a3da115b616fbec07aff8fbf8b7d502161c24d1b35b7a69 SHA512 c8abd6ca56e54a081c9ef1e9f6579d1db5b93ff857e60d1f58d1f425d7dc23c31c58d40b7819780688f66dfdf87a1f3bbe0a78387b007e2beb1b0e546203ea93
+DIST sudo-1.9.17p2.tar.gz.sig 566 BLAKE2B b778061533cd2778eec1093fc37e89f45ea4b2a5e97a71f85fc00fbfc1b550a194e4faa410bc072e3ecbd233a3834f004d7451e020d2be148a36336b35d462e5 SHA512 7ca1949a7ffe0481d7c0f9215fdeae54fff34f0156f06c72a090515b1a97d052e63ce94cffe5a92ca23a723ddd0b0186fabc957cdc22120482c6f9f87d65a5f6
diff --git a/sdk_container/src/third_party/portage-stable/app-admin/sudo/sudo-1.9.17_p2.ebuild b/sdk_container/src/third_party/portage-stable/app-admin/sudo/sudo-1.9.17_p2.ebuild
new file mode 100644
index 00000000000..4bc530f28c2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-admin/sudo/sudo-1.9.17_p2.ebuild
@@ -0,0 +1,292 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit pam tmpfiles toolchain-funcs
+
+MY_P="${P/_/}"
+MY_P="${MY_P/beta/b}"
+
+DESCRIPTION="Allows users or groups to run commands as other users"
+HOMEPAGE="https://www.sudo.ws/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="
+		https://github.com/sudo-project/sudo
+		https://git.sudo.ws/sudo
+	"
+	inherit autotools git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/sudo.ws.asc
+	inherit libtool verify-sig
+
+	uri_prefix=
+	case ${P} in
+		*_beta*|*_rc*) uri_prefix=beta/ ;;
+	esac
+
+	SRC_URI="
+		https://www.sudo.ws/sudo/dist/${uri_prefix}${MY_P}.tar.gz
+		verify-sig? (
+			https://www.sudo.ws/sudo/dist/${uri_prefix}${MY_P}.tar.gz.sig
+		)
+	"
+
+	if [[ ${PV} != *_beta* && ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	fi
+
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-sudo )"
+fi
+
+S="${WORKDIR}/${MY_P}"
+
+# Basic license is ISC-style as-is, some files are released under
+# 3-clause BSD license
+LICENSE="ISC BSD"
+SLOT="0"
+IUSE="gcrypt ldap nls offensive pam sasl +secure-path selinux +sendmail skey ssl sssd"
+
+DEPEND="
+	sys-libs/zlib:=
+	virtual/libcrypt:=
+	gcrypt? ( dev-libs/libgcrypt:= )
+	ldap? (
+		>=net-nds/openldap-2.1.30-r1:=
+		sasl? (
+			dev-libs/cyrus-sasl
+			net-nds/openldap:=[sasl]
+		)
+	)
+	pam? ( sys-libs/pam )
+	sasl? ( dev-libs/cyrus-sasl )
+	selinux? ( sys-libs/libselinux )
+	skey? ( >=sys-auth/skey-1.1.5-r1 )
+	ssl? ( dev-libs/openssl:= )
+	sssd? ( sys-auth/sssd[sudo(+)] )
+"
+RDEPEND="
+	${DEPEND}
+	>=app-misc/editor-wrapper-3
+	virtual/editor
+	ldap? ( dev-lang/perl )
+	pam? ( sys-auth/pambase )
+	selinux? ( sec-policy/selinux-sudo )
+	sendmail? ( virtual/mta )
+"
+BDEPEND+="
+	app-alternatives/yacc
+	virtual/pkgconfig
+"
+
+REQUIRED_USE="
+	?? ( pam skey )
+	?? ( gcrypt ssl )
+"
+
+MAKEOPTS+=" SAMPLES="
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]] ; then
+		eautoreconf
+	else
+		elibtoolize
+	fi
+}
+
+set_secure_path() {
+	# First extract the default ROOTPATH from build env
+	SECURE_PATH=$(unset ROOTPATH; . "${EPREFIX}"/etc/profile.env; echo "${ROOTPATH}")
+
+	case "${SECURE_PATH}" in
+		*/usr/sbin*)
+			;;
+		*)
+			SECURE_PATH=$(unset PATH; . "${EPREFIX}"/etc/profile.env; echo "${PATH}")
+			;;
+	esac
+
+	if [[ -z ${SECURE_PATH} ]] ; then
+		ewarn "	Failed to detect SECURE_PATH, please report this"
+	fi
+
+	# Then remove duplicate path entries
+	cleanpath() {
+		local newpath thisp IFS=:
+		for thisp in $1 ; do
+			if [[ :${newpath}: != *:${thisp}:* ]] ; then
+				newpath+=:${thisp}
+			else
+				einfo "   Duplicate entry ${thisp} removed..."
+			fi
+		done
+		SECURE_PATH=${newpath#:}
+	}
+	cleanpath /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin${SECURE_PATH:+:${SECURE_PATH}}
+
+	# Finally, strip gcc paths, bug #136027
+	rmpath() {
+		local e newpath thisp IFS=:
+		for thisp in ${SECURE_PATH} ; do
+			for e ; do
+				[[ ${thisp} == ${e} ]] && continue 2 ;
+			done
+			newpath+=:${thisp}
+		done
+		SECURE_PATH=${newpath#:}
+	}
+	rmpath '*/gcc-bin/*' '*/gnat-gcc-bin/*' '*/gnat-gcc/*'
+}
+
+src_configure() {
+	local SECURE_PATH
+
+	set_secure_path
+
+	# bug #767712
+	tc-export PKG_CONFIG
+
+	# - audit: somebody got to explain me how I can test this before I
+	# enable it.. - Diego
+	# - plugindir: autoconf code is crappy and does not delay evaluation
+	# until `make` time, so we have to use a full path here rather than
+	# basing off other values.
+	local myeconfargs=(
+		# We set all of the relevant options by ourselves (patched
+		# into the toolchain) and setting these in the build system
+		# actually causes a downgrade when using e.g. -D_FORTIFY_SOURCE=3
+		# (it'll downgrade to =2). So, this has no functional effect on
+		# the hardening for users. It's safe.
+		--disable-hardening
+
+		# requires some python eclass
+		--disable-python
+		--enable-tmpfiles.d="${EPREFIX}"/usr/lib/tmpfiles.d
+		--enable-zlib=system
+		--with-editor="${EPREFIX}"/usr/libexec/editor
+		--with-env-editor
+		--with-plugindir="${EPREFIX}"/usr/$(get_libdir)/sudo
+		--with-rundir="${EPREFIX}"/run/sudo
+		--with-vardir="${EPREFIX}"/var/db/sudo
+		--without-linux-audit
+		--without-opie
+		$(use_enable gcrypt)
+		$(use_enable nls)
+		$(use_enable sasl)
+		$(use_enable ssl openssl)
+		$(use_with ldap)
+		$(use_with ldap ldap_conf_file /etc/ldap.conf.sudo)
+		$(use_with offensive insults)
+		$(use_with offensive all-insults)
+		$(use_with pam)
+		$(use_with pam pam-login)
+		$(use_with secure-path)
+		"$(use_with secure-path secure-path-value "${SECURE_PATH}")"
+		$(use_with selinux)
+		$(use_with sendmail)
+		$(use_with skey)
+		$(use_with sssd)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	if use ldap ; then
+		dodoc README.LDAP.md
+
+		cat <<-EOF > "${T}"/ldap.conf.sudo
+		# See ldap.conf(5) and README.LDAP.md for details
+		# This file should only be readable by root
+
+		# supported directives: host, port, ssl, ldap_version
+		# uri, binddn, bindpw, sudoers_base, sudoers_debug
+		# tls_{checkpeer,cacertfile,cacertdir,randfile,ciphers,cert,key}
+		EOF
+
+		if use sasl ; then
+			cat <<-EOF >> "${T}"/ldap.conf.sudo
+
+			# SASL directives: use_sasl, sasl_mech, sasl_auth_id
+			# sasl_secprops, rootuse_sasl, rootsasl_auth_id, krb5_ccname
+			EOF
+		fi
+
+		insinto /etc
+		doins "${T}"/ldap.conf.sudo
+		fperms 0440 /etc/ldap.conf.sudo
+
+		insinto /etc/openldap/schema
+		newins docs/schema.OpenLDAP sudo.schema
+	fi
+
+	if use pam ; then
+		pamd_mimic system-auth sudo auth account session
+		pamd_mimic system-auth sudo-i auth account session
+	fi
+
+	keepdir /var/db/sudo/lectured
+	fperms 0700 /var/db/sudo/lectured
+	# bug #652958
+	fperms 0711 /var/db/sudo
+
+	# Don't install into /run as that is a tmpfs most of the time
+	# (bug #504854)
+	rm -rf "${ED}"/run || die
+
+	# bug #697812
+	find "${ED}" -type f -name "*.la" -delete || die
+}
+
+pkg_postinst() {
+	tmpfiles_process sudo.conf
+
+	# bug #652958
+	local sudo_db="${EROOT}/var/db/sudo"
+	if [[ "$(stat -c %a "${sudo_db}")" -ne 711 ]] ; then
+		chmod 711 "${sudo_db}" || die
+	fi
+
+	if use ldap ; then
+		ewarn
+		ewarn "sudo uses the ${ROOT}/etc/ldap.conf.sudo file for ldap configuration."
+		ewarn
+		if grep -qs '^[[:space:]]*sudoers:' "${ROOT}"/etc/nsswitch.conf ; then
+			ewarn "In 1.7 series, LDAP is no more consulted, unless explicitly"
+			ewarn "configured in ${ROOT}/etc/nsswitch.conf."
+			ewarn
+			ewarn "To make use of LDAP, add this line to your ${ROOT}/etc/nsswitch.conf:"
+			ewarn "  sudoers: ldap files"
+			ewarn
+		fi
+	fi
+	if use prefix ; then
+		ewarn
+		ewarn "To use sudo on Prefix, you need to change file ownership and permissions"
+		ewarn "with root privileges, as follows:"
+		ewarn
+		ewarn "  # chown root:root ${EPREFIX}/usr/bin/sudo"
+		ewarn "  # chown root:root ${EPREFIX}/usr/lib/sudo/sudoers.so"
+		ewarn "  # chown root:root ${EPREFIX}/etc/sudoers"
+		ewarn "  # chown root:root ${EPREFIX}/etc/sudoers.d"
+		ewarn "  # chown root:root ${EPREFIX}/var/db/sudo"
+		ewarn "  # chmod 4111 ${EPREFIX}/usr/bin/sudo"
+		ewarn
+	fi
+
+	elog "To use the -A (askpass) option, you need to install a compatible"
+	elog "password program from the following list. Starred packages will"
+	elog "automatically register for the use with sudo (but will not force"
+	elog "the -A option):"
+	elog ""
+	elog " [*] net-misc/ssh-askpass-fullscreen"
+	elog "     net-misc/x11-ssh-askpass"
+	elog ""
+	elog "You can override the choice by setting the SUDO_ASKPASS environmnent"
+	elog "variable to the program you want to use."
+}

From ff9d1970bc287a4a8b6b4d65657cf063b441e89e Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:07:47 +0000
Subject: [PATCH 002/122] app-cdr/cdrtools: Sync with Gentoo

It's from Gentoo commit 8fe22b1486a956678591ef57fcbde38facd9f79b.
---
 .../cdrtools/cdrtools-3.02_alpha09-r5.ebuild        | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/app-cdr/cdrtools/cdrtools-3.02_alpha09-r5.ebuild b/sdk_container/src/third_party/portage-stable/app-cdr/cdrtools/cdrtools-3.02_alpha09-r5.ebuild
index 839f4e9fdf7..c64a69223c1 100644
--- a/sdk_container/src/third_party/portage-stable/app-cdr/cdrtools/cdrtools-3.02_alpha09-r5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-cdr/cdrtools/cdrtools-3.02_alpha09-r5.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -15,7 +15,7 @@ S=${WORKDIR}/${P/_alpha[0-9][0-9]}
 
 LICENSE="GPL-2 LGPL-2.1 CDDL-Schily"
 SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos"
 IUSE="acl caps nls unicode selinux"
 
 BDEPEND="
@@ -33,9 +33,9 @@ DEPEND="
 "
 
 FILECAPS=(
-	cap_sys_resource,cap_dac_override,cap_sys_admin,cap_sys_nice,cap_net_bind_service,cap_ipc_lock,cap_sys_rawio+ep usr/bin/cdrecord --
-	cap_dac_override,cap_sys_admin,cap_sys_nice,cap_net_bind_service,cap_sys_rawio+ep usr/bin/cdda2wav --
-	cap_dac_override,cap_sys_admin,cap_net_bind_service,cap_sys_rawio+ep usr/bin/readcd
+	-m u+s cap_sys_resource,cap_dac_override,cap_sys_admin,cap_sys_nice,cap_net_bind_service,cap_ipc_lock,cap_sys_rawio+ep usr/bin/cdrecord --
+	-m u+s cap_dac_override,cap_sys_admin,cap_sys_nice,cap_net_bind_service,cap_sys_rawio+ep usr/bin/cdda2wav --
+	-m u+s cap_dac_override,cap_sys_admin,cap_net_bind_service,cap_sys_rawio+ep usr/bin/readcd
 )
 
 cdrtools_os() {
@@ -278,6 +278,9 @@ src_install() {
 	emake -j1 CPPOPTX="${CPPFLAGS}" COPTX="${CFLAGS}" C++OPTX="${CXXFLAGS}" \
 		LDOPTX="${LDFLAGS}" GMAKE_NOWARN="true" install
 
+	# Let fcaps handle this
+	fperms 0755 /usr/bin/{cdda2wav,cdrecord,readcd}
+
 	# These symlinks are for compat with cdrkit.
 	dosym schily /usr/include/scsilib
 	dosym ../scg /usr/include/schily/scg

From 4a7b07977cb66afd61db78ac0dac6c5dd688ecc1 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:07:52 +0000
Subject: [PATCH 003/122] app-containers/docker-cli: Sync with Gentoo

It's from Gentoo commit 81a1608d6ff538e5eea1c64a49a56a7a18daf10c.
---
 .../app-containers/docker-cli/docker-cli-28.0.1.ebuild    | 8 +++-----
 .../app-containers/docker-cli/docker-cli-28.0.4.ebuild    | 8 +++-----
 .../app-containers/docker-cli/docker-cli-28.1.1.ebuild    | 8 +++-----
 .../app-containers/docker-cli/docker-cli-28.2.2.ebuild    | 8 +++-----
 4 files changed, 12 insertions(+), 20 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.1.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.1.ebuild
index 98528da0064..518b752ba8f 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.1.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit bash-completion-r1 go-module
+inherit shell-completion go-module
 MY_PV=${PV/_/-}
 
 # update this on every bump
@@ -54,10 +54,8 @@ src_install() {
 	doman "${WORKDIR}"/man/man?/*
 	dobashcomp contrib/completion/bash/docker
 	bashcomp_alias docker dockerd
-	insinto /usr/share/fish/vendor_completions.d/
-	doins contrib/completion/fish/docker.fish
-	insinto /usr/share/zsh/site-functions
-	doins contrib/completion/zsh/_*
+	dofishcomp contrib/completion/fish/docker.fish
+	dozshcomp contrib/completion/zsh/_*
 }
 
 pkg_postinst() {
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.4.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.4.ebuild
index 5fc6a3e9f2a..cd99b755cc6 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.4.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit bash-completion-r1 go-module
+inherit shell-completion go-module
 MY_PV=${PV/_/-}
 
 # update this on every bump
@@ -60,10 +60,8 @@ src_install() {
 	doman "${WORKDIR}"/man/man?/*
 	dobashcomp contrib/completion/bash/docker
 	bashcomp_alias docker dockerd
-	insinto /usr/share/fish/vendor_completions.d/
-	doins contrib/completion/fish/docker.fish
-	insinto /usr/share/zsh/site-functions
-	doins contrib/completion/zsh/_*
+	dofishcomp contrib/completion/fish/docker.fish
+	dozshcomp contrib/completion/zsh/_*
 }
 
 pkg_postinst() {
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.1.1.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.1.1.ebuild
index f08eff27086..930b7abefbd 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.1.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.1.1.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit bash-completion-r1 go-module
+inherit shell-completion go-module
 MY_PV=${PV/_/-}
 
 # update this on every bump
@@ -60,10 +60,8 @@ src_install() {
 	doman "${WORKDIR}"/man/man?/*
 	dobashcomp contrib/completion/bash/docker
 	bashcomp_alias docker dockerd
-	insinto /usr/share/fish/vendor_completions.d/
-	doins contrib/completion/fish/docker.fish
-	insinto /usr/share/zsh/site-functions
-	doins contrib/completion/zsh/_*
+	dofishcomp contrib/completion/fish/docker.fish
+	dozshcomp contrib/completion/zsh/_*
 }
 
 pkg_postinst() {
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.2.2.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.2.2.ebuild
index c8bba3f996d..9eafb3a45d2 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.2.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.2.2.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit bash-completion-r1 go-module
+inherit shell-completion go-module
 MY_PV=${PV/_/-}
 
 # update this on every bump
@@ -60,10 +60,8 @@ src_install() {
 	doman "${WORKDIR}"/man/man?/*
 	dobashcomp contrib/completion/bash/docker
 	bashcomp_alias docker dockerd
-	insinto /usr/share/fish/vendor_completions.d/
-	doins contrib/completion/fish/docker.fish
-	insinto /usr/share/zsh/site-functions
-	doins contrib/completion/zsh/_*
+	dofishcomp contrib/completion/fish/docker.fish
+	dozshcomp contrib/completion/zsh/_*
 }
 
 pkg_postinst() {

From 9fa20a44ec48ccbc8a8da37a519a0ae06f5581ec Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:07:53 +0000
Subject: [PATCH 004/122] app-containers/incus: Sync with Gentoo

It's from Gentoo commit f9d8e9897a51e98f26b4642568c7bc687648c715.
---
 .../app-containers/incus/Manifest             |   4 +
 .../app-containers/incus/incus-6.0.5.ebuild   | 252 +++++++++++++++++
 .../app-containers/incus/incus-6.15.ebuild    | 253 ++++++++++++++++++
 3 files changed, 509 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.0.5.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.15.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/app-containers/incus/Manifest b/sdk_container/src/third_party/portage-stable/app-containers/incus/Manifest
index 449e318ef1b..9419b545f9e 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/incus/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-containers/incus/Manifest
@@ -2,5 +2,9 @@ DIST incus-6.0.3.tar.xz 11916020 BLAKE2B d3d998bd50124604c52ff007eefed586c216ce1
 DIST incus-6.0.3.tar.xz.asc 833 BLAKE2B 38835ab036709161150992cb40df4ff1ae1887d4f3e0b037d0415f75d2bb711cb3c5945bffe1b91d289acfb7e19e726964278e5c2ab31731ba9f7534f139dec7 SHA512 7d5360ab91aafe1d047a60e38a07e24c3c7b158e753087a943ec5e59d6a27c19a872080c9007b6cf592040d3408845bc188d76f6e732408d0680a3782cebce47
 DIST incus-6.0.4.tar.xz 12000208 BLAKE2B 99a4ba40d2eea48515b88f4534c282adc925fe1b5487dc98901f000894b3781aec89f617d2246314cf9a95a7d65531e486c4092f8939722e1b3c2bf7d33063c8 SHA512 14a5cdad3f9365d58e526c8f451d9e7a57729010073caff31256e0b94d28206adc82ead4820278e7eac17b74d22a76d9f3b9f5f8424ddbfa6b74a5cea13e019f
 DIST incus-6.0.4.tar.xz.asc 833 BLAKE2B 96c94cde55cd2e9f7f28db7adb098adf4895437d300dfd42aeac540cdab6677fb604831c28f40f8581e60b89b228557d81696cd64950a1c2147b445a5ec58b30 SHA512 1ef2063eab424467c805f8c86b5b0caca848f46d2ef7ebf602049fe32ee15a7e1006d5a2710b355604aef73802b4333cd0428c772e1c5fc4da588c2cd7ee1694
+DIST incus-6.0.5.tar.xz 12532820 BLAKE2B a256c37c309d82f6326ede3d90e20522ff91317b1bce0a4dc1c391c2694599c7f3f6ab06368757a12e85133f82bd85ea4d50906dc250f43563a6ff765850b874 SHA512 b209dde671b13e101ccdf0daf975ae8547d050ec95e67ad1ee17aa99761e8ed3327e7edace0c4394aa79932d11b846e0f1edf5f95b2ad0b56eafca9905e844c8
+DIST incus-6.0.5.tar.xz.asc 833 BLAKE2B 1e8818fdb2edf9ff0d0288d2a7d61585571a0fdfe514e1bdf05b27b607560115168c07d420f8384d07d216fdc8dc1f31113fa5afa4838042743636974bf76151 SHA512 d0412fe8850ff5783d4c3cee982ff8beac74f19c5dc538438fc210b9f7421bcb6e663e4c32f9a2604f1a5e2f42d8bb8d3f8e599f15a0fa1b5fa6f1bc1982b1dd
 DIST incus-6.14.tar.xz 12509468 BLAKE2B ec3bb614088d82e07c13169a6b26d8c83214fddbdf30049d58f2cca2678a16ccb6acca7bba68d4e15a514dad71639a144a7b2f4b9f3efdf9c8ca8d750692e250 SHA512 186abb32dcfbe851f04131ea7a9256fafaa465d40379e825554275697e04f005920c09939a8cb199b499b60df667921900c4a2d5b9a7ab9bd20b3e473468dbf1
 DIST incus-6.14.tar.xz.asc 833 BLAKE2B c9cfa631bb316234a6958f2aa3e708e32ea2fca34357700e7d1e38723be539f5b6b1484597c18baca1f22d922c7aca148463dfc0b818f7809126e6873e4826b5 SHA512 6a2f4ceeab44462cca74799a1c135eeb17cbece3d270c5195c3eacda8ea24419fc34cab6d157dbfed803bb269df42a02abc417b98887cec5f10b0ec70b430644
+DIST incus-6.15.tar.xz 12716184 BLAKE2B bc821575f7f24b42054028ce628a29f38ef41b8a31a94f34381019306681f9279ae6c36cb00b7f84d62f5ddc89d27216d753e5c0f5ec1d327bbd283ab5fe1e15 SHA512 7561abce8eb9c01764aca9bb5477028439c05f6c1c20637f288028be93f4bc0d74a36af76f7ad0e35028dfe40e2a0bb2d7b4a363d1da35fe657072f5d847c78e
+DIST incus-6.15.tar.xz.asc 833 BLAKE2B ccab84a2fd3f9d6971ff0fd7cba9afc23dbe0fc0bcb8738656f9071db7c773840566009d5014dc15d37be26bff018e3faf8af59dd5d50b629aebd2e79cf3dc5e SHA512 b1bf43ffff719a3f1c6be7a8d32e44f418efb8e926914dea5479ba1175768910fa38b4e5b83c51e90ec34d2d345629597beb286215b9658a611cf568b8e43122
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.0.5.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.0.5.ebuild
new file mode 100644
index 00000000000..be073032ec8
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.0.5.ebuild
@@ -0,0 +1,252 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-env go-module linux-info optfeature systemd toolchain-funcs verify-sig
+
+DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
+HOMEPAGE="https://linuxcontainers.org/incus/introduction/ https://github.com/lxc/incus"
+SRC_URI="https://linuxcontainers.org/downloads/incus/${P}.tar.xz
+	verify-sig? ( https://linuxcontainers.org/downloads/incus/${P}.tar.xz.asc )"
+
+LICENSE="Apache-2.0 BSD LGPL-3 MIT"
+SLOT="0/lts"
+KEYWORDS="~amd64 ~arm64"
+IUSE="apparmor fuidshift nls qemu"
+
+DEPEND="acct-group/incus
+	acct-group/incus-admin
+	app-arch/xz-utils
+	>=app-containers/lxc-5.0.0:=[apparmor?,seccomp(+)]
+	dev-db/sqlite:3
+	>=dev-libs/cowsql-1.15.9
+	dev-libs/lzo
+	>=dev-libs/raft-0.22.1:=[lz4]
+	>=dev-util/xdelta-3.0[lzma(+)]
+	net-dns/dnsmasq[dhcp]
+	sys-libs/libcap
+	virtual/udev"
+RDEPEND="${DEPEND}
+	|| (
+		net-firewall/iptables
+		net-firewall/nftables[json]
+	)
+	fuidshift? ( !app-containers/lxd )
+	net-firewall/ebtables
+	sys-apps/iproute2
+	sys-fs/fuse:*
+	>=sys-fs/lxcfs-5.0.0
+	sys-fs/squashfs-tools[lzma]
+	virtual/acl
+	apparmor? ( sec-policy/apparmor-profiles )
+	qemu? (
+		app-cdr/cdrtools
+		app-emulation/qemu[spice,usbredir,virtfs]
+		sys-apps/gptfdisk
+	)"
+BDEPEND=">=dev-lang/go-1.21
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+CONFIG_CHECK="
+	~AIO
+	~CGROUPS
+	~IPC_NS
+	~NET_NS
+	~PID_NS
+
+	~SECCOMP
+	~USER_NS
+	~UTS_NS
+
+	~KVM
+	~MACVTAP
+	~VHOST_VSOCK
+"
+
+ERROR_AIO="CONFIG_AIO is required."
+ERROR_IPC_NS="CONFIG_IPC_NS is required."
+ERROR_NET_NS="CONFIG_NET_NS is required."
+ERROR_PID_NS="CONFIG_PID_NS is required."
+ERROR_SECCOMP="CONFIG_SECCOMP is required."
+ERROR_UTS_NS="CONFIG_UTS_NS is required."
+
+WARNING_KVM="CONFIG_KVM and CONFIG_KVM_AMD/-INTEL is required for virtual machines."
+WARNING_MACVTAP="CONFIG_MACVTAP is required for virtual machines."
+WARNING_VHOST_VSOCK="CONFIG_VHOST_VSOCK is required for virtual machines."
+
+# Go magic.
+QA_PREBUILT="/usr/bin/incus
+	/usr/bin/incus-agent
+	/usr/bin/incus-benchmark
+	/usr/bin/incus-migrate
+	/usr/bin/lxc-to-incus
+	/usr/sbin/fuidshift
+	/usr/sbin/incusd
+	/usr/sbin/lxd-to-incus"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+# The testsuite must be run as root.
+# make: *** [Makefile:156: check] Error 1
+RESTRICT="test"
+
+GOPATH="${S}/_dist"
+
+src_unpack() {
+	verify-sig_src_unpack
+	go-module_src_unpack
+}
+
+src_prepare() {
+	export GOPATH="${S}/_dist"
+
+	default
+
+	sed -i \
+		-e "s:\./configure:./configure --prefix=/usr --libdir=${EPREFIX}/usr/lib/incus:g" \
+		-e "s:make:make ${MAKEOPTS}:g" \
+		Makefile || die
+
+	sed -i \
+		-e "s:/usr/share/OVMF:/usr/share/edk2/OvmfX64:g" \
+		-e "s:OVMF_VARS.ms.fd:OVMF_VARS.fd:g" \
+		internal/server/instance/drivers/edk2/driver_edk2.go || die "Failed to fix hardcoded ovmf paths."
+
+	cp "${FILESDIR}"/incus-6.14-r1.service "${T}"/incus.service || die
+	if use apparmor; then
+		sed -i \
+			'/^EnvironmentFile=.*/a ExecStartPre=\/usr\/libexec\/lxc\/lxc-apparmor-load' \
+			"${T}"/incus.service || die
+	fi
+
+	# Disable -Werror's from go modules.
+	find "${S}" -name "cgo.go" -exec sed -i "s/ -Werror / /g" {} + || die
+}
+
+src_configure() { :; }
+
+src_compile() {
+	export GOPATH="${S}/_dist"
+	export CGO_LDFLAGS_ALLOW="-Wl,-z,now"
+
+	for k in incus-benchmark incus-simplestreams incus-user incus lxc-to-incus lxd-to-incus ; do
+		ego install -v -x "${S}/cmd/${k}"
+	done
+
+	if use fuidshift ; then
+		ego install -v -x "${S}/cmd/fuidshift"
+	fi
+
+	ego install -v -x -tags libsqlite3 "${S}"/cmd/incusd
+
+	CGO_ENABLED=0 go install -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-migrate
+
+	# Build the VM agents, statically too
+	if use amd64 ; then
+		GOARCH=amd64 CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.linux.x86_64 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.linux.i686 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=amd64 GOOS=windows CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.windows.x86_64 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 GOOS=windows CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.windows.i686 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	elif use arm64 ; then
+		GOARCH=arm64 CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.linux.aarch64 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=arm64 GOOS=windows CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.windows.aarch64 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	else
+		echo "No VM support for this arch."
+		return
+	fi
+
+	use nls && emake build-mo
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	export GOPATH="${S}/_dist"
+
+	export GOHOSTARCH=$(go-env_goarch "${CBUILD}")
+	if [[ "${GOARCH}" != "${GOHOSTARCH}" ]]; then
+		local bindir="_dist/bin/linux_${GOARCH}"
+	else
+		local bindir="_dist/bin"
+	fi
+
+	newsbin "${FILESDIR}"/incus-startup-0.4.sh incus-startup
+
+	# Admin tools
+	for l in incusd incus-user lxd-to-incus ; do
+		dosbin "${bindir}/${l}"
+	done
+
+	# User tools
+	for m in incus-benchmark incus-migrate incus-simplestreams incus lxc-to-incus ; do
+		dobin "${bindir}/${m}"
+	done
+
+	# VM Agents
+	if use amd64 ; then
+		exeinto /usr/libexec/incus/agents
+		doexe ${bindir}/incus-agent.linux.x86_64
+		doexe ${bindir}/incus-agent.linux.i686
+		doexe ${bindir}/incus-agent.windows.x86_64
+		doexe ${bindir}/incus-agent.windows.i686
+	elif use arm64 ; then
+		exeinto /usr/libexec/incus
+		doexe ${bindir}/incus-agent.linux.aarch64
+		doexe ${bindir}/incus-agent.windows.aarch64
+	fi
+
+	# fuidshift, should be moved under admin tools at some point
+	if use fuidshift ; then
+		dosbin ${bindir}/fuidshift
+	fi
+
+	newconfd "${FILESDIR}"/incus-6.0.confd incus
+	newinitd "${FILESDIR}"/incus-6.0.initd incus
+	newinitd "${FILESDIR}"/incus-user-0.4.initd incus-user
+
+	systemd_dounit "${T}"/incus.service
+	systemd_newunit "${FILESDIR}"/incus-0.4.socket incus.socket
+	systemd_newunit "${FILESDIR}"/incus-startup-0.4.service incus-startup.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.service incus-user.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.socket incus-user.socket
+
+	if ! tc-is-cross-compiler; then
+		# Generate and install shell completion files.
+		mkdir -p "${D}"/usr/share/{bash-completion/completions/,fish/vendor_completions.d/,zsh/site-functions/} || die
+		"${bindir}"/incus completion bash > "${D}"/usr/share/bash-completion/completions/incus || die
+		"${bindir}"/incus completion fish > "${D}"/usr/share/fish/vendor_completions.d/incus.fish || die
+		"${bindir}"/incus completion zsh > "${D}"/usr/share/zsh/site-functions/_incus || die
+	else
+		ewarn "Shell completion files not installed! Install them manually with incus completion --help"
+	fi
+
+	dodoc AUTHORS
+	dodoc -r doc/*
+	use nls && domo po/*.mo
+
+	# Incus needs INCUS_EDK2_PATH in env to find OVMF files for virtual machines, #946184,
+	# and INCUS_AGENT_PATH to find multi-setup agents for VMs, #959878.
+	newenvd "${FILESDIR}"/90incus.envd 90incus
+}
+
+pkg_postinst() {
+	elog
+	elog "Please see"
+	elog "  https://wiki.gentoo.org/wiki/Incus"
+	elog "  https://wiki.gentoo.org/wiki/Incus#Migrating_from_LXD"
+	elog
+	optfeature "OCI container images support" app-containers/skopeo app-containers/umoci
+	optfeature "support for ACME certificate issuance" app-crypt/lego
+	optfeature "ipv6 support" net-dns/dnsmasq[ipv6]
+	optfeature "full incus-migrate support" net-misc/rsync
+	optfeature "btrfs storage backend" sys-fs/btrfs-progs
+	optfeature "lvm2 storage backend" sys-fs/lvm2
+	optfeature "zfs storage backend" sys-fs/zfs
+	elog
+	elog "Be sure to add your local user to the incus group."
+	elog
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.15.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.15.ebuild
new file mode 100644
index 00000000000..29786771bf1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.15.ebuild
@@ -0,0 +1,253 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-env go-module linux-info optfeature systemd toolchain-funcs verify-sig
+
+DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
+HOMEPAGE="https://linuxcontainers.org/incus/introduction/ https://github.com/lxc/incus"
+SRC_URI="https://linuxcontainers.org/downloads/incus/${P}.tar.xz
+	verify-sig? ( https://linuxcontainers.org/downloads/incus/${P}.tar.xz.asc )"
+
+LICENSE="Apache-2.0 BSD LGPL-3 MIT"
+SLOT="0/stable"
+KEYWORDS="~amd64 ~arm64"
+IUSE="apparmor fuidshift nls qemu"
+
+DEPEND="acct-group/incus
+	acct-group/incus-admin
+	app-arch/xz-utils
+	>=app-containers/lxc-5.0.0:=[apparmor?,seccomp(+)]
+	dev-db/sqlite:3
+	>=dev-libs/cowsql-1.15.7
+	dev-libs/lzo
+	>=dev-libs/raft-0.22.1:=[lz4]
+	>=dev-util/xdelta-3.0[lzma(+)]
+	net-dns/dnsmasq[dhcp]
+	sys-libs/libcap
+	virtual/udev"
+RDEPEND="${DEPEND}
+	|| (
+		net-firewall/iptables
+		net-firewall/nftables[json]
+	)
+	fuidshift? ( !app-containers/lxd )
+	net-firewall/ebtables
+	sys-apps/iproute2
+	sys-fs/fuse:*
+	>=sys-fs/lxcfs-5.0.0
+	sys-fs/squashfs-tools[lzma]
+	virtual/acl
+	apparmor? ( sec-policy/apparmor-profiles )
+	qemu? (
+		app-cdr/cdrtools
+		app-emulation/qemu[spice,usbredir,virtfs]
+		sys-apps/gptfdisk
+	)"
+BDEPEND=">=dev-lang/go-1.21
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+CONFIG_CHECK="
+	~AIO
+	~CGROUPS
+	~IPC_NS
+	~NET_NS
+	~PID_NS
+
+	~SECCOMP
+	~USER_NS
+	~UTS_NS
+
+	~KVM
+	~MACVTAP
+	~VHOST_VSOCK
+"
+
+ERROR_AIO="CONFIG_AIO is required."
+ERROR_IPC_NS="CONFIG_IPC_NS is required."
+ERROR_NET_NS="CONFIG_NET_NS is required."
+ERROR_PID_NS="CONFIG_PID_NS is required."
+ERROR_SECCOMP="CONFIG_SECCOMP is required."
+ERROR_UTS_NS="CONFIG_UTS_NS is required."
+
+WARNING_KVM="CONFIG_KVM and CONFIG_KVM_AMD/-INTEL is required for virtual machines."
+WARNING_MACVTAP="CONFIG_MACVTAP is required for virtual machines."
+WARNING_VHOST_VSOCK="CONFIG_VHOST_VSOCK is required for virtual machines."
+
+# Go magic.
+QA_PREBUILT="/usr/bin/incus
+	/usr/bin/incus-agent
+	/usr/bin/incus-benchmark
+	/usr/bin/incus-migrate
+	/usr/bin/lxc-to-incus
+	/usr/sbin/fuidshift
+	/usr/sbin/incusd
+	/usr/sbin/lxd-to-incus"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+# The testsuite must be run as root.
+# make: *** [Makefile:156: check] Error 1
+RESTRICT="test"
+
+GOPATH="${S}/_dist"
+
+src_unpack() {
+	verify-sig_src_unpack
+	go-module_src_unpack
+}
+
+src_prepare() {
+	export GOPATH="${S}/_dist"
+
+	default
+
+	sed -i \
+		-e "s:\./configure:./configure --prefix=/usr --libdir=${EPREFIX}/usr/lib/incus:g" \
+		-e "s:make:make ${MAKEOPTS}:g" \
+		Makefile || die
+
+	sed -i \
+		-e "s:/usr/share/OVMF:/usr/share/edk2/OvmfX64:g" \
+		-e "s:OVMF_VARS.ms.fd:OVMF_VARS.fd:g" \
+		internal/server/instance/drivers/edk2/driver_edk2.go || die "Failed to fix hardcoded ovmf paths."
+
+	cp "${FILESDIR}"/incus-6.14-r1.service "${T}"/incus.service || die
+	if use apparmor; then
+		sed -i \
+			'/^EnvironmentFile=.*/a ExecStartPre=\/usr\/libexec\/lxc\/lxc-apparmor-load' \
+			"${T}"/incus.service || die
+	fi
+
+	# Disable -Werror's from go modules.
+	find "${S}" -name "cgo.go" -exec sed -i "s/ -Werror / /g" {} + || die
+}
+
+src_configure() { :; }
+
+src_compile() {
+	export GOPATH="${S}/_dist"
+	export CGO_LDFLAGS_ALLOW="-Wl,-z,now"
+
+	for k in incus-benchmark incus-simplestreams incus-user incus lxc-to-incus lxd-to-incus ; do
+		ego install -v -x "${S}/cmd/${k}"
+	done
+
+	if use fuidshift ; then
+		ego install -v -x "${S}/cmd/fuidshift"
+	fi
+
+	ego install -v -x -tags libsqlite3 "${S}"/cmd/incusd
+
+	# Needs to be built statically
+	CGO_ENABLED=0 go install -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-migrate
+
+	# Build the VM agents, statically too
+	if use amd64 ; then
+		GOARCH=amd64 CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.linux.x86_64 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.linux.i686 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=amd64 GOOS=windows CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.windows.x86_64 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 GOOS=windows CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.windows.i686 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	elif use arm64 ; then
+		GOARCH=arm64 CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.linux.aarch64 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=arm64 GOOS=windows CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.windows.aarch64 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	else
+		echo "No VM support for this arch."
+		return
+	fi
+
+	use nls && emake build-mo
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	export GOPATH="${S}/_dist"
+
+	export GOHOSTARCH=$(go-env_goarch "${CBUILD}")
+	if [[ "${GOARCH}" != "${GOHOSTARCH}" ]]; then
+		local bindir="_dist/bin/linux_${GOARCH}"
+	else
+		local bindir="_dist/bin"
+	fi
+
+	newsbin "${FILESDIR}"/incus-startup-0.4.sh incus-startup
+
+	# Admin tools
+	for l in incusd incus-user lxd-to-incus ; do
+		dosbin "${bindir}/${l}"
+	done
+
+	# User tools
+	for m in incus-benchmark incus-migrate incus-simplestreams incus lxc-to-incus ; do
+		dobin "${bindir}/${m}"
+	done
+
+	# VM Agents
+	if use amd64 ; then
+		exeinto /usr/libexec/incus/agents
+		doexe ${bindir}/incus-agent.linux.x86_64
+		doexe ${bindir}/incus-agent.linux.i686
+		doexe ${bindir}/incus-agent.windows.x86_64
+		doexe ${bindir}/incus-agent.windows.i686
+	elif use arm64 ; then
+		exeinto /usr/libexec/incus
+		doexe ${bindir}/incus-agent.linux.aarch64
+		doexe ${bindir}/incus-agent.windows.aarch64
+	fi
+
+	# fuidshift, should be moved under admin tools at some point
+	if use fuidshift ; then
+		dosbin ${bindir}/fuidshift
+	fi
+
+	newconfd "${FILESDIR}"/incus-6.0.confd incus
+	newinitd "${FILESDIR}"/incus-6.0.initd incus
+	newinitd "${FILESDIR}"/incus-user-0.4.initd incus-user
+
+	systemd_dounit "${T}"/incus.service
+	systemd_newunit "${FILESDIR}"/incus-0.4.socket incus.socket
+	systemd_newunit "${FILESDIR}"/incus-startup-0.4.service incus-startup.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.service incus-user.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.socket incus-user.socket
+
+	if ! tc-is-cross-compiler; then
+		# Generate and install shell completion files.
+		mkdir -p "${D}"/usr/share/{bash-completion/completions/,fish/vendor_completions.d/,zsh/site-functions/} || die
+		"${bindir}"/incus completion bash > "${D}"/usr/share/bash-completion/completions/incus || die
+		"${bindir}"/incus completion fish > "${D}"/usr/share/fish/vendor_completions.d/incus.fish || die
+		"${bindir}"/incus completion zsh > "${D}"/usr/share/zsh/site-functions/_incus || die
+	else
+		ewarn "Shell completion files not installed! Install them manually with incus completion --help"
+	fi
+
+	dodoc AUTHORS
+	dodoc -r doc/*
+	use nls && domo po/*.mo
+
+	# Incus needs INCUS_EDK2_PATH in env to find OVMF files for virtual machines, #946184,
+	# and INCUS_AGENT_PATH to find multi-setup agents for VMs, #959878.
+	newenvd "${FILESDIR}"/90incus.envd 90incus
+}
+
+pkg_postinst() {
+	elog
+	elog "Please see"
+	elog "  https://wiki.gentoo.org/wiki/Incus"
+	elog "  https://wiki.gentoo.org/wiki/Incus#Migrating_from_LXD"
+	elog
+	optfeature "OCI container images support" app-containers/skopeo app-containers/umoci
+	optfeature "support for ACME certificate issuance" app-crypt/lego
+	optfeature "btrfs storage backend" sys-fs/btrfs-progs
+	optfeature "ipv6 support" net-dns/dnsmasq[ipv6]
+	optfeature "full incus-migrate support" net-misc/rsync
+	optfeature "lvm2 storage backend" sys-fs/lvm2
+	optfeature "zfs storage backend" sys-fs/zfs
+	elog
+	elog "Be sure to add your local user to the incus group."
+	elog
+}

From 2da9eee7fb1c942ae378bed2401853f402b05bf0 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:07:53 +0000
Subject: [PATCH 005/122] app-containers/lxc: Sync with Gentoo

It's from Gentoo commit 98228404d87c96702113702085c7d218ad8f06bf.
---
 .../app-containers/lxc/Manifest               |   2 +
 .../app-containers/lxc/lxc-6.0.5.ebuild       | 168 ++++++++++++++++++
 2 files changed, 170 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/app-containers/lxc/lxc-6.0.5.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/app-containers/lxc/Manifest b/sdk_container/src/third_party/portage-stable/app-containers/lxc/Manifest
index 3c6c266789c..be6193a899d 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/lxc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-containers/lxc/Manifest
@@ -4,3 +4,5 @@ DIST lxc-6.0.3.tar.gz 964210 BLAKE2B 8d5dec7f088111a2ca82aadd6cd90eb30a3a1b61900
 DIST lxc-6.0.3.tar.gz.asc 833 BLAKE2B 3a23eacfdd248a95c9fa41a6edcb55abb07abc81314fa227649663ac264a9e5fdcf81cb38b79f1bd51b9172a70a0aee5bf65ecfdaf438c944c25f11c882ab562 SHA512 5de32e772bd2864e3b688a90fd9f08d98829d61ba3e1cc76a9b403fc005256149f55ad034e186c3329f3abe52a8815f60c5027b16de46be0bc81b14d0134babd
 DIST lxc-6.0.4.tar.gz 964064 BLAKE2B f8911993ce333300e68fe3d817cceb49d6c18f83e5fec1ab2da8ba6f0820808883cf73ce1f7dea2725c6279d87e6fcc0a3feeaeadad76112a47ef69265dbef50 SHA512 8ccdd9cf37b8b75e1e58021bc9bd7841faf3a2790d07f0214b6c8bde7a23e579345f576079a541dba5e71361bf5672af9d482a9e82323068ca0f7291f6063aaf
 DIST lxc-6.0.4.tar.gz.asc 833 BLAKE2B 4600373e9534515fe3ec0c41ebe5b17ee8c4e7ab125e3a211ed300f0fdd79a04a9c183b903e1b6600d7b7ce4d9f2e66451326c473beb02b4a83a7200764e56e7 SHA512 2efe6e06b33a34fdf7ba1393b5e07aa1a18f189b2e43673b4f9bbdc7cf0fcb9ad47b99ebbd08e910e139047d54b1104f098cbbef586796767b9dd1a4a99ca748
+DIST lxc-6.0.5.tar.gz 958966 BLAKE2B 74ee775f8a23467049f38f0973a24eb12b34b7c758549294342470b7b6b8e95eaef118c493f62b6394c435a5c86389fde4454199107e90743dd40d3a5bf373fd SHA512 3674397e789ed9eda7e37d4e22c42ab02687c0ab6a12f6c234a3393bdfb3f048aa0ded419c5c2f435d653d3dd70f47ae19d28b7a46838f12004d00b05c54a26d
+DIST lxc-6.0.5.tar.gz.asc 833 BLAKE2B ac1480c0b5588b290ab1ec81bf7bf85990df98a650832363529e9ede8afb7594bd21b58a4a79e7fe9519c381d4860d7a33f4090582612ffff7c448c77e641929 SHA512 8c28da0ebc280ae491bab815105f3c58f2c9cd742586ce86f9b1d2032724db4893811d689f7278bfc8c5570dc45ca6071e4c25b77647d762c77eca59249a15b5
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/lxc/lxc-6.0.5.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/lxc/lxc-6.0.5.ebuild
new file mode 100644
index 00000000000..d418449a796
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-containers/lxc/lxc-6.0.5.ebuild
@@ -0,0 +1,168 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit bash-completion-r1 linux-info meson optfeature systemd verify-sig
+
+DESCRIPTION="A userspace interface for the Linux kernel containment features"
+HOMEPAGE="https://linuxcontainers.org/ https://github.com/lxc/lxc"
+SRC_URI="https://linuxcontainers.org/downloads/lxc/${P}.tar.gz
+	verify-sig? ( https://linuxcontainers.org/downloads/lxc/${P}.tar.gz.asc )"
+
+LICENSE="GPL-2 LGPL-2.1 LGPL-3"
+SLOT="0/1.8" # SONAME liblxc.so.1 + ${PV//./} _if_ breaking ABI change while bumping.
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor +caps examples io-uring man pam seccomp selinux ssl systemd test +tools"
+
+RDEPEND="acct-group/lxc
+	acct-user/lxc
+	apparmor? ( sys-libs/libapparmor )
+	caps? ( sys-libs/libcap )
+	io-uring? ( >=sys-libs/liburing-2:= )
+	pam? ( sys-libs/pam )
+	seccomp? ( sys-libs/libseccomp )
+	selinux? ( sys-libs/libselinux )
+	ssl? ( dev-libs/openssl:0= )
+	systemd? (
+		sys-apps/dbus
+		sys-apps/systemd:=
+	)
+	tools? ( sys-libs/libcap )"
+DEPEND="${RDEPEND}
+	caps? ( sys-libs/libcap[static-libs] )
+	tools? ( sys-libs/libcap[static-libs] )
+	sys-kernel/linux-headers"
+BDEPEND="virtual/pkgconfig
+	man? ( app-text/docbook2X )
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+RESTRICT="!test? ( test )"
+
+CONFIG_CHECK="~!NETPRIO_CGROUP
+	~CGROUPS
+	~CGROUP_CPUACCT
+	~CGROUP_DEVICE
+	~CGROUP_FREEZER
+
+	~CGROUP_SCHED
+	~CPUSETS
+	~IPC_NS
+	~MACVLAN
+
+	~MEMCG
+	~NAMESPACES
+	~NET_NS
+	~PID_NS
+
+	~POSIX_MQUEUE
+	~USER_NS
+	~UTS_NS
+	~VETH"
+
+ERROR_CGROUP_FREEZER="CONFIG_CGROUP_FREEZER: needed to freeze containers"
+ERROR_MACVLAN="CONFIG_MACVLAN: needed for internal (inter-container) networking"
+ERROR_MEMCG="CONFIG_MEMCG: needed for memory resource control in containers"
+ERROR_NET_NS="CONFIG_NET_NS: needed for unshared network"
+ERROR_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: needed for lxc-execute command"
+ERROR_UTS_NS="CONFIG_UTS_NS: needed to unshare hostnames and uname info"
+ERROR_VETH="CONFIG_VETH: needed for internal (host-to-container) networking"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+DOCS=( AUTHORS CONTRIBUTING MAINTAINERS README.md doc/FAQ.txt )
+
+pkg_setup() {
+	linux-info_pkg_setup
+}
+
+src_configure() {
+
+	# -Dtools-multicall=false: will create a single binary called 'lxc' that conflicts with LXD.
+	local emesonargs=(
+		--localstatedir "${EPREFIX}/var"
+
+		-Dcoverity-build=false
+		-Dinstall-state-dirs=false
+		-Doss-fuzz=false
+		-Dspecfile=false
+		-Dtools-multicall=false
+
+		-Dcommands=true
+		-Dinstall-init-files=true
+		-Dmemfd-rexec=true
+		-Dthread-safety=true
+
+		$(meson_use apparmor)
+		$(meson_use caps capabilities)
+		$(meson_use examples)
+		$(meson_use io-uring io-uring-event-loop)
+		$(meson_use man)
+		$(meson_use pam pam-cgroup)
+		$(meson_use seccomp)
+		$(meson_use selinux)
+		$(meson_use ssl openssl)
+		$(meson_use test tests)
+		$(meson_use tools)
+
+		$(usex systemd -Ddbus=true -Ddbus=false)
+		$(usex systemd -Dinit-script="systemd" -Dinit-script="sysvinit")
+
+		-Ddata-path=/var/lib/lxc
+		-Ddoc-path=/usr/share/doc/${PF}
+		-Dlog-path=/var/log/lxc
+		-Drootfs-mount-path=/var/lib/lxc/rootfs
+		-Druntime-path=/run
+	)
+
+	use tools && local emesonargs+=( -Dcapabilities=true )
+
+	meson_src_configure
+}
+
+src_install() {
+	meson_src_install
+
+	# The main bash-completion file will collide with lxd, need to relocate and update symlinks.
+	local lxcbashcompdir="${D}/$(get_bashcompdir)"
+	mkdir -p "${lxcbashcompdir}" || die "Failed to create bashcompdir."
+	mv "${lxcbashcompdir}"/_lxc "${lxcbashcompdir}"/lxc-start || die "Failed to move _lxc bash completion file."
+
+	# Build system will install all bash completion files regardless of our 'tools' use flag.
+	# Though installing them all will add bash completions for commands that don't exist, it's
+	# cleaner than dealing with individual files based on the use flag status.
+	bashcomp_alias lxc-start lxc-{attach,autostart,cgroup,checkpoint,config,console,copy,create,destroy,device,execute,freeze,info,ls,monitor,snapshot,stop,top,unfreeze,unshare,update-config,usernsexec,wait}
+
+	find "${ED}" -name '*.la' -delete -o -name '*.a' -delete || die
+
+	# Replace upstream sysvinit/systemd files.
+	if use systemd ; then
+		rm -r "${D}$(systemd_get_systemunitdir)" || die "Failed to remove systemd lib dir"
+	else
+		rm "${ED}"/etc/init.d/lxc-{containers,net} || die "Failed to remove sysvinit scripts"
+	fi
+
+	newinitd "${FILESDIR}/${PN}.initd.9" ${PN}
+	systemd_newunit "${FILESDIR}"/lxc-monitord.service.5.0.0 lxc-monitord.service
+	systemd_newunit "${FILESDIR}"/lxc-net.service.5.0.0 lxc-net.service
+	systemd_newunit "${FILESDIR}"/lxc.service-5.0.0 lxc.service
+	systemd_newunit "${FILESDIR}"/lxc_at.service.5.0.0 "lxc@.service"
+
+	if ! use apparmor; then
+		sed -i '/lxc-apparmor-load/d' "${D}$(systemd_get_systemunitdir)/lxc.service" ||
+			die "Failed to remove apparmor references from lxc.service systemd unit."
+	fi
+}
+
+pkg_postinst() {
+	elog "Please refer to "
+	elog "https://wiki.gentoo.org/wiki/LXC for introduction and usage guide."
+	elog
+	elog "Run 'lxc-checkconfig' to see optional kernel features."
+	elog
+
+	optfeature "creating your own LXC containers" app-containers/distrobuilder
+	optfeature "automatic template scripts" app-containers/lxc-templates
+	optfeature "Debian-based distribution container image support" dev-util/debootstrap
+	optfeature "snapshot & restore functionality" sys-process/criu
+}

From af839f1f6b519f2d76f549dfe7a423dbb4b4213b Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:07:58 +0000
Subject: [PATCH 006/122] app-crypt/gpgme: Sync with Gentoo

It's from Gentoo commit bc7d682588bb389e7af62d041d5cd4ad1867adc5.
---
 .../portage-stable/app-crypt/gpgme/Manifest   |   2 -
 .../app-crypt/gpgme/gpgme-1.24.2.ebuild       | 178 ------------------
 2 files changed, 180 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.2.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/Manifest
index 9b1df9b06a1..1725c921564 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/Manifest
@@ -1,5 +1,3 @@
-DIST gpgme-1.24.2.tar.bz2 1891804 BLAKE2B 3d112fe3401c6143d09474eefcc3fda00394b0db61c37d7da79ddf3352c71b67e2972800efbefa89bba4726a4997ef473c3dbdac8c5d42612a73332711cf4d4a SHA512 ad69101d1fceef6cd1dd6d5348f6f2be06912da6b6a7d0fece3ce08cf35054e6953b80ca9c4748554882892faa44e7c54e705cf25bbf2b796cd4ad12b09da185
-DIST gpgme-1.24.2.tar.bz2.sig 119 BLAKE2B 015c8243e84b36110985c1524c8ce124d2756bdcbb4a74ad046620516f3fba8a93e2d9d5aedbb720ed096d171bce71b4bc24e6fdf8b6ba59c263dd4c3c672c5a SHA512 1010067b40f2720e278577ae7599c957e26fdf81d35e21ea878813f2a2bdb618a4be636726252068438c9ef89cae9c1cd3e4acaf27243359abc3e5cfd7a87855
 DIST gpgme-1.24.3.tar.bz2 1892862 BLAKE2B ace04d4fc803f6ce96f850a46b4b383ebdcbfe51d55fbe2a5ced10451310553c15ee5a603d1e6ffb78a8de75461fafacc296fec3e4f38d4908171a095cab185f SHA512 3b5fc22a2f83576058ac14e744333f46df362b39f742d6c9e54a5a66828194a1312f5f365bdc15683e148821f5d591fa92a2daad83fc116f65dccf14e817ca48
 DIST gpgme-1.24.3.tar.bz2.sig 238 BLAKE2B 5b8402b011899faae26bcba428e45a7bb7baf9b16e4c605cdae3d84dc1cbf52ccd524181ef0726e25075c42f9ccb72cd996707a2f96c04b7054cc9050270b586 SHA512 056b28b041dd83c86984e73c31403ea45d33db30c1b2b05e45b0cfb5bb723b25a0fa21ddee192c135cea5d93d934502085bc0fc94fa3c29858513e260c332948
 DIST gpgme-2.0.0.tar.bz2 1383911 BLAKE2B 7053955f80f9a69c62d8b4bb6cc80ea259e6854857b340577c4a68fac1d34c0f2aff1dbbf88b503dd2b021c48d9fff67709593817f3b0e74f72df913d7e3de0d SHA512 ee58dc2a4273c740d5b9ef13cc655d5e600ddddd137fb85a781c31e8854829283b4ce241d7810a963d9a125d603213600f37e7d0c1ce3b3cf1b935e62cf60777
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.2.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.2.ebuild
deleted file mode 100644
index 32458e4c9b7..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.2.ebuild
+++ /dev/null
@@ -1,178 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Maintainers should:
-# 1. Join the "Gentoo" project at https://dev.gnupg.org/project/view/27/
-# 2. Subscribe to release tasks like https://dev.gnupg.org/T6159
-# (find the one for the current release then subscribe to it +
-# any subsequent ones linked within so you're covered for a while.)
-
-DISTUTILS_EXT=1
-DISTUTILS_OPTIONAL=1
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{11..13} )
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
-
-# in-source builds are not supported:
-# * https://dev.gnupg.org/T6313#166339
-# * https://dev.gnupg.org/T6673#174545
-inherit distutils-r1 libtool flag-o-matic out-of-source qmake-utils toolchain-funcs verify-sig
-
-DESCRIPTION="GnuPG Made Easy is a library for making GnuPG easier to use"
-HOMEPAGE="https://www.gnupg.org/related_software/gpgme"
-SRC_URI="
-	mirror://gnupg/gpgme/${P}.tar.bz2
-	verify-sig? ( mirror://gnupg/gpgme/${P}.tar.bz2.sig )
-"
-
-LICENSE="GPL-2 LGPL-2.1"
-# Please check ABI on each bump, even if SONAMEs didn't change: bug #833355
-# Use e.g. app-portage/iwdevtools integration with dev-libs/libabigail's abidiff.
-# Subslot: SONAME of each: <libgpgme.libgpgmepp.libqgpgme.FUDGE>
-# Bump FUDGE if a release is made which breaks ABI without changing SONAME.
-# (Reset to 0 if FUDGE != 0 if libgpgme/libgpgmepp/libqpggme change.)
-SLOT="1/11.6.15.2"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="common-lisp static-libs +cxx python qt5 qt6 test"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="
-	qt5? ( cxx )
-	qt6? ( cxx )
-	python? ( ${PYTHON_REQUIRED_USE} )
-"
-
-# - On each bump, update dep bounds on each version from configure.ac!
-RDEPEND="
-	>=app-crypt/gnupg-2
-	>=dev-libs/libassuan-2.5.3:=
-	>=dev-libs/libgpg-error-1.46-r1:=
-	python? ( ${PYTHON_DEPS} )
-	qt5? ( dev-qt/qtcore:5 )
-	qt6? ( dev-qt/qtbase:6 )
-"
-DEPEND="
-	${RDEPEND}
-	test? (
-		qt5? ( dev-qt/qttest:5 )
-	)
-"
-#doc? ( app-text/doxygen[dot] )
-BDEPEND="
-	python? (
-		${PYTHON_DEPS}
-		${DISTUTILS_DEPS}
-		dev-lang/swig
-	)
-	verify-sig? ( sec-keys/openpgp-keys-gnupg )
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-1.18.0-tests-start-stop-agent-use-command-v.patch
-	"${FILESDIR}"/${PN}-1.23.1-tests-gnupg-no-tofu.patch
-)
-
-src_prepare() {
-	default
-
-	elibtoolize
-
-	# bug #697456
-	addpredict /run/user/$(id -u)/gnupg
-
-	local MAX_WORKDIR=66
-	if use test && [[ "${#WORKDIR}" -gt "${MAX_WORKDIR}" ]]; then
-		eerror "Unable to run tests as WORKDIR='${WORKDIR}' is longer than ${MAX_WORKDIR} which causes failure!"
-		die "Could not run tests as requested with too-long WORKDIR."
-	fi
-
-	# Make best effort to allow longer PORTAGE_TMPDIR
-	# as usock limitation fails build/tests
-	ln -s "${P}" "${WORKDIR}/b" || die
-	S="${WORKDIR}/b"
-}
-
-my_src_configure() {
-	# bug #847955
-	append-lfs-flags
-
-	cd "${BUILD_DIR}" || die
-
-	local languages=(
-		$(usev common-lisp 'cl')
-		$(usev cxx 'cpp')
-		$(usev qt5 'qt5')
-		$(usev qt6 'qt6')
-	)
-
-	use qt5 && export MOC5="$(qt5_get_bindir)/moc"
-	use qt6 && export MOC6="$(qt6_get_libdir)/qt6/libexec/moc"
-
-	local myeconfargs=(
-		$(use test || echo "--disable-gpgconf-test --disable-gpg-test --disable-gpgsm-test --disable-g13-test")
-		--enable-languages="${languages[*]}"
-		$(use_enable static-libs static)
-		GPGRT_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpgrt-config"
-	)
-
-	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-
-	if use python ; then
-		emake -C lang/python prepare
-
-		pushd lang/python > /dev/null || die
-		top_builddir="../.." srcdir="${S}/lang/python" CPP="$(tc-getCPP)" distutils-r1_src_configure
-		popd > /dev/null || die
-	fi
-}
-
-my_src_compile() {
-	cd "${BUILD_DIR}" || die
-
-	emake
-
-	if use python ; then
-		pushd lang/python > /dev/null || die
-		top_builddir="../.." srcdir="${S}/lang/python" CPP="$(tc-getCPP)" distutils-r1_src_compile
-		popd > /dev/null || die
-	fi
-}
-
-my_src_test() {
-	cd "${BUILD_DIR}" || die
-
-	emake check
-
-	if use python ; then
-		distutils-r1_src_test
-	fi
-}
-
-python_test() {
-	emake -C lang/python/tests check \
-		PYTHON=${EPYTHON} \
-		PYTHONS=${EPYTHON} \
-		TESTFLAGS="--python-libdir=${BUILD_DIR}/lib"
-}
-
-my_src_install() {
-	einstalldocs
-
-	cd "${BUILD_DIR}" || die
-
-	emake DESTDIR="${D}" install
-
-	if use python ; then
-		pushd lang/python > /dev/null || die
-		top_builddir="../.." srcdir="${S}/lang/python" CPP="$(tc-getCPP)" distutils-r1_src_install
-		popd > /dev/null || die
-	fi
-
-	find "${ED}" -type f -name '*.la' -delete || die
-
-	# Backward compatibility for gentoo
-	# (in the past, we had slots)
-	dodir /usr/include/gpgme
-	dosym -r /usr/include/gpgme.h /usr/include/gpgme/gpgme.h
-}

From 99c291500b7b3e458007e919f2275a3837facf09 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:01 +0000
Subject: [PATCH 007/122] app-crypt/mit-krb5: Sync with Gentoo

It's from Gentoo commit 750e46c53c31245eb054d98200ce9a462dbfe5b6.
---
 .../app-crypt/mit-krb5/Manifest               |   1 +
 .../app-crypt/mit-krb5/mit-krb5-1.22.ebuild   | 155 ++++++++++++++++++
 2 files changed, 156 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.22.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/Manifest
index a7af890014d..71190c6011c 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/Manifest
@@ -1,2 +1,3 @@
 DIST krb5-1.21.3.tar.gz 9136145 BLAKE2B e909a55eaedab68e5c829bb7bbd26cec5db2d7b8d97f3b034de94d8f957003f16977ac619afee3b862f288e59f05c5e44f41e65b8883961c8b22a26e2f4733bc SHA512 87bc06607f4d95ff604169cea22180703a42d667af05f66f1569b8bd592670c42820b335e5c279e8b4f066d1e7da20f1948a1e4def7c5d295c170cbfc7f49c71
+DIST krb5-1.22.tar.gz 8749616 BLAKE2B 41042e787be61b51a5e4886b3c22c8154069f8b45e193bffad93c0203000421296910b25fc9f6f0a410cf2f3ee7c92d6db85f13465d006c37f717f14de5a7e5f SHA512 660acdde4d778ed4ccba5f19e30b307671f70b4d2c0f44228aef97717825d6b74f31f89099eb1cc5a5119f42f4f8cf5f2cb0461612af3507747759c2c2ca0357
 DIST mit-krb5-1.21.3-c23.patch.xz 59948 BLAKE2B f611ccda16ee4e2bcfbdbaf72204f0ede6ebe3517f4df016ae7db9c364bc55d81e1e32aaaa0506197ddca09555a5a4d3ef75f7c33b6434115b6c57bd99f1bcb5 SHA512 35b226b351a81f4610e1ef2be9822a57f94f9cc5017ed082584fb8c85a0f0be78b8e9fda4fc5c78248421be39517df639cee9cae49ddccf3d62f1a0cff4224ae
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.22.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.22.ebuild
new file mode 100644
index 00000000000..008665a16e9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.22.ebuild
@@ -0,0 +1,155 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{12..14} )
+inherit autotools flag-o-matic python-any-r1 systemd toolchain-funcs multilib-minimal
+
+MY_P="${P/mit-}"
+P_DIR=$(ver_cut 1-2)
+DESCRIPTION="MIT Kerberos V"
+HOMEPAGE="https://web.mit.edu/kerberos/www/"
+SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz"
+S=${WORKDIR}/${MY_P}/src
+
+LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="cpu_flags_x86_aes doc +keyutils lmdb nls openldap +pkinit selinux test xinetd"
+
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	!!app-crypt/heimdal
+	>=sys-fs/e2fsprogs-1.46.4-r51[${MULTILIB_USEDEP}]
+	|| (
+		>=dev-libs/libverto-0.2.5[libev,${MULTILIB_USEDEP}]
+		>=dev-libs/libverto-0.2.5[libevent,${MULTILIB_USEDEP}]
+	)
+	keyutils? ( >=sys-apps/keyutils-1.5.8:=[${MULTILIB_USEDEP}] )
+	lmdb? ( dev-db/lmdb:= )
+	nls? ( sys-devel/gettext[${MULTILIB_USEDEP}] )
+	openldap? ( >=net-nds/openldap-2.4.38-r1:=[${MULTILIB_USEDEP}] )
+	pkinit? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] )
+	xinetd? ( sys-apps/xinetd )
+	"
+BDEPEND="
+	${PYTHON_DEPS}
+	app-alternatives/yacc
+	>=sys-fs/e2fsprogs-1.46.4-r51
+	cpu_flags_x86_aes? (
+		amd64? ( dev-lang/yasm )
+		x86? ( dev-lang/yasm )
+	)
+	doc? ( virtual/latex-base )
+	test? ( dev-util/cmocka )
+	"
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-kerberos )"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-1.12_warn_cflags.patch"
+	"${FILESDIR}/${PN}_dont_create_rundir.patch"
+	"${FILESDIR}/${PN}-1.18.2-krb5-config.patch"
+)
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/krb5-config
+)
+
+src_prepare() {
+	default
+	# Make sure we always use the system copies.
+	rm -rf util/{et,ss,verto}
+	sed -i 's:^[[:space:]]*util/verto$::' configure.ac || die
+
+	eautoreconf
+}
+
+src_configure() {
+	# lto-type-mismatch (bug #854225)
+	filter-lto
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	ECONF_SOURCE=${S} \
+	AR="$(tc-getAR)" \
+	WARN_CFLAGS="set" \
+	econf \
+		$(use_with openldap ldap) \
+		$(use_enable nls) \
+		$(use_enable pkinit) \
+		$(use_with lmdb) \
+		$(use_with keyutils) \
+		--without-hesiod \
+		--enable-shared \
+		--with-system-et \
+		--with-system-ss \
+		--enable-dns-for-realm \
+		--enable-kdc-lookaside-cache \
+		--with-system-verto \
+		--enable-thread-support \
+		--disable-rpath
+}
+
+multilib_src_compile() {
+	emake -j1
+}
+
+multilib_src_test() {
+	multilib_is_native_abi && emake -j1 check
+}
+
+multilib_src_install() {
+	emake \
+		DESTDIR="${D}" \
+		EXAMPLEDIR="${EPREFIX}/usr/share/doc/${PF}/examples" \
+		install
+}
+
+multilib_src_install_all() {
+	# default database dir
+	keepdir /var/lib/krb5kdc
+
+	cd ..
+	dodoc README
+
+	newinitd "${FILESDIR}"/mit-krb5kadmind.initd-r2 mit-krb5kadmind
+	newinitd "${FILESDIR}"/mit-krb5kdc.initd-r2 mit-krb5kdc
+	newinitd "${FILESDIR}"/mit-krb5kpropd.initd-r2 mit-krb5kpropd
+	newconfd "${FILESDIR}"/mit-krb5kadmind.confd mit-krb5kadmind
+	newconfd "${FILESDIR}"/mit-krb5kdc.confd mit-krb5kdc
+	newconfd "${FILESDIR}"/mit-krb5kpropd.confd mit-krb5kpropd
+
+	systemd_newunit "${FILESDIR}"/mit-krb5kadmind.service mit-krb5kadmind.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kdc.service mit-krb5kdc.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.service mit-krb5kpropd.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd_at.service "mit-krb5kpropd@.service"
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.socket mit-krb5kpropd.socket
+
+	insinto /etc
+	newins "${ED}/usr/share/doc/${PF}/examples/krb5.conf" krb5.conf.example
+	insinto /var/lib/krb5kdc
+	newins "${ED}/usr/share/doc/${PF}/examples/kdc.conf" kdc.conf.example
+
+	if use openldap ; then
+		dodoc "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.ldif"
+		dodoc "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.openldap.ldif"
+		insinto /etc/openldap/schema
+		doins "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.schema"
+	fi
+
+	if use xinetd ; then
+		insinto /etc/xinetd.d
+		newins "${FILESDIR}/kpropd.xinetd" kpropd
+	fi
+
+	if use doc; then
+		dodoc -r doc/html
+		docinto pdf
+		dodoc doc/pdf/*.pdf
+	fi
+}

From ebfa66fa2f4d14f167ca853f0ec43a809103b9ef Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:01 +0000
Subject: [PATCH 008/122] app-crypt/p11-kit: Sync with Gentoo

It's from Gentoo commit 03830e6a05a3ee4e3500d985b5a909ff2356b4cf.
---
 .../portage-stable/app-crypt/p11-kit/Manifest |   1 -
 .../files/p11-kit-0.25.3-pointer.patch        | 109 ------------------
 .../p11-kit/p11-kit-0.25.3-r2.ebuild          |  77 -------------
 3 files changed, 187 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/files/p11-kit-0.25.3-pointer.patch
 delete mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/p11-kit-0.25.3-r2.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/Manifest
index 851345f5f63..d7197f1d5ce 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/Manifest
@@ -1,2 +1 @@
-DIST p11-kit-0.25.3.tar.xz 991528 BLAKE2B 5c695c1ef95edf4bbbab001aa634076c433df0bc89cb8104deaec2ce00c6908640e467755b49c6900e5d7d5d81e1a3871f4978a212c6f6ae088386ac0b95289a SHA512 ad2d393bf122526cbba18dc9d5a13f2c1cad7d70125ec90ffd02059dfa5ef30ac59dfc0bb9bc6380c8f317e207c9e87e895f1945634f56ddf910c2958868fb4c
 DIST p11-kit-0.25.5.tar.xz 1002056 BLAKE2B 96d6a9c2807586abafae4da4df89f566672733963997d6a83e00aaf83a7a0c0e2995638f505e98fb87a90c60bde28814f1e8b7d5071bf0af96bb0467105a1ddc SHA512 177ec6ff5eb891901078306dce2bf3f5c1a0e5c2a8c493bdf5a08ae1ff1240fdf6952961e973c373f80ac3d1d5a9927e07f4da49e4ff92269d992e744889fc94
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/files/p11-kit-0.25.3-pointer.patch b/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/files/p11-kit-0.25.3-pointer.patch
deleted file mode 100644
index 9b316ee2fad..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/files/p11-kit-0.25.3-pointer.patch
+++ /dev/null
@@ -1,109 +0,0 @@
-https://bugs.gentoo.org/918982
-https://github.com/p11-glue/p11-kit/commit/d49c92c8420db6ee4c88515bdb014f68f4d471d9
-
-From d49c92c8420db6ee4c88515bdb014f68f4d471d9 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Sat, 2 Dec 2023 09:24:01 +0900
-Subject: [PATCH] import-object: Avoid integer truncation on 32-bit platforms
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The build fails when compiling for 32-bit platforms with
--Werror=incompatible-pointer-types:
-
-  CFLAGS="-m32 -march=i686 -Werror=incompatible-pointer-types -Werror=implicit -Werror=int-conversion" setarch i686 -- meson setup _build
-  setarch i686 -- meson compile -C _build -v
-  ...
-
-  ../p11-kit/import-object.c: In function ‘add_attrs_pubkey_rsa’:
-  ../p11-kit/import-object.c:223:62: error: passing argument 3 of ‘p11_asn1_read’ from incompatible pointer type [-Werror=incompatible-pointer-types]
-    223 |         attr_modulus.pValue = p11_asn1_read (asn, "modulus", &attr_modulus.ulValueLen);
-        |                                                              ^~~~~~~~~~~~~~~~~~~~~~~~
-        |                                                              |
-        |                                                              long unsigned int *
-
-Reported by Sam James in:
-https://github.com/p11-glue/p11-kit/issues/608
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
----
- p11-kit/import-object.c | 30 +++++++++++++++++++++++++++---
- 1 file changed, 27 insertions(+), 3 deletions(-)
-
-diff --git a/p11-kit/import-object.c b/p11-kit/import-object.c
-index feee0765..fb47b964 100644
---- a/p11-kit/import-object.c
-+++ b/p11-kit/import-object.c
-@@ -55,6 +55,7 @@
- #endif
- 
- #include <assert.h>
-+#include <limits.h>
- #include <stdbool.h>
- #include <stdlib.h>
- #include <string.h>
-@@ -201,6 +202,7 @@ add_attrs_pubkey_rsa (CK_ATTRIBUTE *attrs,
- 	CK_ATTRIBUTE attr_encrypt = { CKA_ENCRYPT, &tval, sizeof (tval) };
- 	CK_ATTRIBUTE attr_modulus = { CKA_MODULUS, };
- 	CK_ATTRIBUTE attr_exponent = { CKA_PUBLIC_EXPONENT, };
-+	size_t len = 0;
- 
- 	pubkey = p11_asn1_read (info, "subjectPublicKey", &pubkey_len);
- 	if (pubkey == NULL) {
-@@ -220,17 +222,31 @@ add_attrs_pubkey_rsa (CK_ATTRIBUTE *attrs,
- 		goto cleanup;
- 	}
- 
--	attr_modulus.pValue = p11_asn1_read (asn, "modulus", &attr_modulus.ulValueLen);
-+	attr_modulus.pValue = p11_asn1_read (asn, "modulus", &len);
- 	if (attr_modulus.pValue == NULL) {
- 		p11_message (_("failed to obtain modulus"));
- 		goto cleanup;
- 	}
-+#if ULONG_MAX < SIZE_MAX
-+	if (len > ULONG_MAX) {
-+		p11_message (_("failed to obtain modulus"));
-+		goto cleanup;
-+	}
-+#endif
-+	attr_modulus.ulValueLen = len;
- 
--	attr_exponent.pValue = p11_asn1_read (asn, "publicExponent", &attr_exponent.ulValueLen);
-+	attr_exponent.pValue = p11_asn1_read (asn, "publicExponent", &len);
- 	if (attr_exponent.pValue == NULL) {
- 		p11_message (_("failed to obtain exponent"));
- 		goto cleanup;
- 	}
-+#if ULONG_MAX < SIZE_MAX
-+	if (len > ULONG_MAX) {
-+		p11_message (_("failed to obtain exponent"));
-+		goto cleanup;
-+	}
-+#endif
-+	attr_exponent.ulValueLen = len;
- 
- 	result = p11_attrs_build (attrs, &attr_key_type, &attr_encrypt, &attr_modulus, &attr_exponent, NULL);
- 	if (result == NULL) {
-@@ -260,12 +276,20 @@ add_attrs_pubkey_ec (CK_ATTRIBUTE *attrs,
- 	CK_ATTRIBUTE attr_key_type = { CKA_KEY_TYPE, &key_type, sizeof (key_type) };
- 	CK_ATTRIBUTE attr_ec_params = { CKA_EC_PARAMS, };
- 	CK_ATTRIBUTE attr_ec_point = { CKA_EC_POINT, };
-+	size_t len = 0;
- 
--	attr_ec_params.pValue = p11_asn1_read (info, "algorithm.parameters", &attr_ec_params.ulValueLen);
-+	attr_ec_params.pValue = p11_asn1_read (info, "algorithm.parameters", &len);
- 	if (attr_ec_params.pValue == NULL) {
- 		p11_message (_("failed to obtain EC parameters"));
- 		goto cleanup;
- 	}
-+#if ULONG_MAX < SIZE_MAX
-+	if (len > ULONG_MAX) {
-+		p11_message (_("failed to obtain EC parameters"));
-+		goto cleanup;
-+	}
-+#endif
-+	attr_ec_params.ulValueLen = len;
- 
- 	/* subjectPublicKey is read as BIT STRING value which contains
- 	 * EC point data. We need to DER encode this data as OCTET STRING.
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/p11-kit-0.25.3-r2.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/p11-kit-0.25.3-r2.ebuild
deleted file mode 100644
index f27bbaf48cf..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/p11-kit-0.25.3-r2.ebuild
+++ /dev/null
@@ -1,77 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..13} )
-inherit bash-completion-r1 meson-multilib python-any-r1
-
-DESCRIPTION="Provides a standard configuration setup for installing PKCS#11"
-HOMEPAGE="https://p11-glue.github.io/p11-glue/p11-kit.html"
-SRC_URI="https://github.com/p11-glue/p11-kit/releases/download/${PV}/${P}.tar.xz"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="+libffi gtk-doc nls systemd test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	app-misc/ca-certificates
-	>=dev-libs/libtasn1-3.4:=[${MULTILIB_USEDEP}]
-	libffi? ( dev-libs/libffi:=[${MULTILIB_USEDEP}] )
-	systemd? ( sys-apps/systemd:= )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	${PYTHON_DEPS}
-	app-text/docbook-xsl-stylesheets
-	dev-libs/libxslt
-	virtual/pkgconfig
-	gtk-doc? ( dev-util/gtk-doc )
-	nls? ( sys-devel/gettext )
-"
-
-PATCHES=(
-	"${FILESDIR}"/p11-kit-0.25.3-pointer.patch
-)
-
-src_prepare() {
-	default
-
-	# Relies on dlopen which won't work for multilib tests (bug #913971)
-	cat <<-EOF > "${S}"/p11-kit/test-server.sh || die
-	#!/bin/sh
-	exit 77
-	EOF
-}
-
-multilib_src_configure() {
-	# Disable unsafe tests, bug#502088
-	export FAKED_MODE=1
-
-	local native_file="${T}"/meson.${CHOST}.${ABI}.ini.local
-
-	# p11-kit doesn't need this to build and castxml needs Clang. To get
-	# a deterministic non-automagic build, always disable the search for
-	# castxml.
-	cat >> ${native_file} <<-EOF || die
-	[binaries]
-	castxml='castxml-falseified'
-	EOF
-
-	local emesonargs=(
-		--native-file "${native_file}"
-		-Dbashcompdir="$(get_bashcompdir)"
-		-Dtrust_module=enabled
-		-Dtrust_paths="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt
-		$(meson_feature libffi)
-		$(meson_use nls)
-		$(meson_use test)
-		$(meson_native_use_bool gtk-doc gtk_doc)
-		$(meson_native_true man)
-		$(meson_native_use_feature systemd)
-	)
-
-	meson_src_configure
-}

From 9b5d73592b7f64b4772ecb4030842a2e416d841b Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:01 +0000
Subject: [PATCH 009/122] app-crypt/pinentry: Sync with Gentoo

It's from Gentoo commit e09d70c1291ed0bd2779ea2a172c5d0d9de12942.
---
 .../app-crypt/pinentry/Manifest               |   2 +
 .../app-crypt/pinentry/pinentry-1.3.2.ebuild  | 119 ++++++++++++++++++
 2 files changed, 121 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.2.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/Manifest
index 766326e43ae..09a2d15ba80 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/Manifest
@@ -1,2 +1,4 @@
 DIST pinentry-1.3.1.tar.bz2 611233 BLAKE2B 47a510b3746fc8cdd83b56302132f4f4d9c61324fc857ce0867387f70f79490dad375bca4dc72e5d1cdca707bf89a16e1c9a20bf1aa0e857d69e59dc59403afd SHA512 3b72034dc1792b1475acb6d605ff7c1bd7647a0f02d1b6bdcd475acdef24bc802f49e275055436c3271261c4b7a64168477a698aab812a145962146b2f67a0e2
 DIST pinentry-1.3.1.tar.bz2.sig 119 BLAKE2B ca562d2903c88c4297e641ddc39f6cd99db3e3fd40cf5d69e7b4335f006c7717c874fa4b5e47920af3ec97385a96c0c96aafb849cf399d11a7f9f1a6b693f479 SHA512 22bd94f74486300eb84c1c9c371a43b05fb6179118518004fba0d42b6d3e6731f94d79b37c2a3a6b0c5886578c4575f75d2460accd36cd4874342e7239521be9
+DIST pinentry-1.3.2.tar.bz2 612858 BLAKE2B 985bcf0b4f85d4e5001bfd714ddd064e05ba6d5bd6e1d3b6f1044f27ca148921d22148b301c91cce4fa7f2f7e7f3b743a9bc1383cb9d8e1d0583a595109a699e SHA512 3b4d50a42d412d649a7830f7378aa966342c2bc0157d03b0ad79cf0aed29d6698d48c734e23b1dccada5f6ef81d0c09d3ead6cd703eadfc8082987e6bea0aafc
+DIST pinentry-1.3.2.tar.bz2.sig 266 BLAKE2B 1c428abb285dd56566a83fe4ceef5e0efc3b2a9ed40a2a0b48e7dc06575d24044677091f6a042e1f08ac6308f2bb1e82eddc82f22b78f1a316ca78ed670745f3 SHA512 82352cb5183a7922ab27619e19fc4d7adaa461847040232610b002365db605200961d1d950887aa5b09d12488d70f432fe739e0e2501a28465a28fb428b62aad
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.2.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.2.ebuild
new file mode 100644
index 00000000000..751965cc73f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.2.ebuild
@@ -0,0 +1,119 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
+inherit autotools qmake-utils verify-sig
+
+DESCRIPTION="Simple passphrase entry dialogs which utilize the Assuan protocol"
+HOMEPAGE="https://gnupg.org/related_software/pinentry/"
+SRC_URI="mirror://gnupg/${PN}/${P}.tar.bz2"
+SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="caps efl emacs gtk keyring ncurses qt6 wayland X"
+
+DEPEND="
+	>=dev-libs/libassuan-2.1:=
+	>=dev-libs/libgcrypt-1.6.3
+	>=dev-libs/libgpg-error-1.17
+	efl? ( dev-libs/efl[X] )
+	keyring? ( app-crypt/libsecret )
+	ncurses? ( sys-libs/ncurses:= )
+	qt6? (
+		dev-qt/qtbase:6[gui,widgets]
+		wayland? (
+			kde-frameworks/kguiaddons:6
+			kde-frameworks/kwindowsystem:6
+		)
+	)
+"
+RDEPEND="
+	${DEPEND}
+	gtk? ( app-crypt/gcr:4[gtk] )
+"
+BDEPEND="
+	sys-devel/gettext
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-gnupg )
+"
+PDEPEND="emacs? ( app-emacs/pinentry )"
+IDEPEND=">=app-eselect/eselect-pinentry-0.7.4"
+
+DOCS=( AUTHORS ChangeLog NEWS README THANKS TODO )
+
+PATCHES=(
+	"${FILESDIR}/${PN}-1.0.0-AR.patch"
+	"${FILESDIR}/${PN}-1.3.0-automagic.patch" # bug #819939, bug #837719
+)
+
+src_prepare() {
+	default
+
+	eautoreconf
+}
+
+src_configure() {
+	unset FLTK_CONFIG
+
+	local myeconfargs=(
+		$(use_enable efl pinentry-efl)
+		$(use_enable emacs pinentry-emacs)
+		$(use_enable keyring libsecret)
+		$(use_enable gtk pinentry-gnome3)
+		$(use_enable ncurses fallback-curses)
+		$(use_enable ncurses pinentry-curses)
+		$(use_enable qt6 pinentry-qt)
+		$(use_with X x)
+
+		--enable-pinentry-tty
+		--disable-kf5-wayland
+		--disable-pinentry-fltk
+		--disable-pinentry-gtk2
+		--disable-pinentry-qt5
+		--disable-qtx11extras
+
+		ac_cv_path_GPGRT_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpgrt-config"
+
+		$("${S}/configure" --help | grep -- '--without-.*-prefix' | sed -e 's/^ *\([^ ]*\) .*/\1/g')
+	)
+
+	if use qt6 ; then
+		export PATH="$(qt6_get_bindir):${PATH}"
+		export QTLIB="$(qt6_get_libdir):${QTLIB}"
+		export MOC="$(qt6_get_libdir)/qt6/libexec/moc"
+
+		myeconfargs+=(
+			$(use_enable wayland kf6-wayland)
+		)
+	else
+		myeconfargs+=(
+			--disable-kf6-wayland
+		)
+	fi
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	rm "${ED}"/usr/bin/pinentry || die
+
+	# The preferred Qt implementation upstream gets installed as just 'qt'.
+	# Make a symlink for eselect-pinentry and friends.
+	if use qt6 ; then
+		dosym pinentry-qt /usr/bin/pinentry-qt6
+	fi
+}
+
+pkg_postinst() {
+	eselect pinentry update ifunset
+}
+
+pkg_postrm() {
+	eselect pinentry update ifunset
+}

From 6f64d2bb6d5293bbf2f0a3d520f705adb2438b69 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:02 +0000
Subject: [PATCH 010/122] app-crypt/sbsigntools: Sync with Gentoo

It's from Gentoo commit 419c54da6af063f13e3825bb90a56713e290dd11.
---
 .../app-crypt/sbsigntools/Manifest            |  1 -
 .../sbsigntools/sbsigntools-0.9.4-r1.ebuild   | 53 -------------------
 2 files changed, 54 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/sbsigntools/sbsigntools-0.9.4-r1.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/sbsigntools/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/sbsigntools/Manifest
index e0a935653e3..df797fca9df 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/sbsigntools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/sbsigntools/Manifest
@@ -1,3 +1,2 @@
 DIST sbsigntool-0.8-ccan.tar.gz 113537 BLAKE2B 8fbf27463d30c1895930628a145be2d521ae4f6adb7af3299bf2f5f4319fd643df0a07347ef6851bd41d233af4c3fc5f77002771af1c43aa0f20665aef2390b8 SHA512 6857096879f116f1802eb6b44789cbea7bb24440bc0f16503aeadf5f276fa45943f322f844dbb9abee717655205d82b830143be3a7f4424fd4146b9360674a09
-DIST sbsigntools-0.9.4.tar.gz 57714 BLAKE2B 94797af6c98a9c13cb71e52ba6f7ff07de70660af2194b14061e0cb618d6effff52ef7a4dd2fd4e44e75f022b979442d4290b1d65d63017b2fbebdca5951c5c9 SHA512 953d3d9a7f92b837da966eabe3572163a29c5292e792d5ef17cf842d7373ffaa901377cb4ec68006a6ef2f9c97d48db8ffdd3a6d2853be67016d3484a118bba9
 DIST sbsigntools-0.9.5.tar.gz 57876 BLAKE2B 677f87eac9fba9185acd7e25b8d7a3682083938313f3086aaaa6871e010bd403bdda5b9a5fe931151af75a344802c964918be8feb38ec6229d9a16c5b63416b6 SHA512 3b23bdf1855132a91e2063039bd4d14c5564e9cd8f551711aa89a91646ff783afb6e318479e9cf46eedbc914a1eade142398c774d8dbfef8fd1d65cbbe60aabd
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/sbsigntools/sbsigntools-0.9.4-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/sbsigntools/sbsigntools-0.9.4-r1.ebuild
deleted file mode 100644
index 0ce5dbbe30a..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-crypt/sbsigntools/sbsigntools-0.9.4-r1.ebuild
+++ /dev/null
@@ -1,53 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="7"
-
-MY_PN="${PN::-1}"
-
-inherit autotools toolchain-funcs
-
-DESCRIPTION="Utilities for signing and verifying files for UEFI Secure Boot"
-HOMEPAGE="https://git.kernel.org/cgit/linux/kernel/git/jejb/sbsigntools.git/"
-SRC_URI="https://git.kernel.org/pub/scm/linux/kernel/git/jejb/${PN}.git/snapshot/${P}.tar.gz
-	https://dev.gentoo.org/~tamiko/distfiles/${MY_PN}-0.8-ccan.tar.gz"
-
-LICENSE="GPL-3 LGPL-3 LGPL-2.1 CC0-1.0"
-SLOT="0"
-KEYWORDS="amd64 arm64 ~riscv x86"
-IUSE=""
-
-RDEPEND="
-	dev-libs/openssl:0=
-	sys-apps/util-linux"
-DEPEND="${RDEPEND}
-	sys-apps/help2man
-	sys-boot/gnu-efi
-	sys-libs/binutils-libs
-	virtual/pkgconfig"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-0.9.4-no-werror.patch
-	"${FILESDIR}"/${PN}-0.9.4-openssl3.patch
-)
-
-src_prepare() {
-	mv "${WORKDIR}"/lib/ccan "${S}"/lib || die "mv failed"
-	rmdir "${WORKDIR}"/lib || die "rmdir failed"
-
-	local iarch
-	case ${ARCH} in
-		amd64) iarch=x86_64 ;;
-		arm64) iarch=aarch64 ;;
-		ia64)  iarch=ia64 ;;
-		riscv) iarch=riscv64 ;;
-		x86)   iarch=ia32 ;;
-		*)     die "unsupported architecture: ${ARCH}" ;;
-	esac
-	sed -i "/^EFI_ARCH=/s:=.*:=${iarch}:" configure.ac || die
-	sed -i 's/-m64$/& -march=x86-64/' tests/Makefile.am || die
-	sed -i "/^AR /s:=.*:= $(tc-getAR):" lib/ccan/Makefile.in || die #481480
-
-	default
-	eautoreconf
-}

From f927daada180745d72295066b1e59977ca0e2c14 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:06 +0000
Subject: [PATCH 011/122] app-doc/eclass-manpages: Sync with Gentoo

It's from Gentoo commit d0d0ce1fb165c06768af0c998d2637fe0fe17511.
---
 .../app-doc/eclass-manpages/Manifest          |  5 ++--
 .../eclass-manpages-20250705.ebuild           | 24 -------------------
 ...ebuild => eclass-manpages-20250730.ebuild} |  0
 ...ebuild => eclass-manpages-20250815.ebuild} |  0
 4 files changed, 2 insertions(+), 27 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250705.ebuild
 rename sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/{eclass-manpages-20250506.ebuild => eclass-manpages-20250730.ebuild} (100%)
 rename sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/{eclass-manpages-20250704.ebuild => eclass-manpages-20250815.ebuild} (100%)

diff --git a/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/Manifest b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/Manifest
index 7bb518a8779..c073b1ef67e 100644
--- a/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/Manifest
@@ -1,4 +1,3 @@
-DIST eclass-manpages-20250506.tar.xz 483068 BLAKE2B e4c2aacd5e2b1416c9deb337a0b8d74b664b1f38e7f0555f812c25de494d8c18628f08e065738e6cfd2082769fc8367478a53849f1923d461027acca16f2a66a SHA512 99a361f0c4a144bf89f3dfdd02d298ef6c3a7138cd2b4e151449559fafaf6e83403ad73334494239c827bbc25eef30e701945b1783c9cc16aeff94fdf29679bb
-DIST eclass-manpages-20250704.tar.xz 484052 BLAKE2B 9711ec8ba766335eb73cfa69cd406960055213eb7d29f7a1e7fd1fcef504e8becc4f638eb351a54dd5032725bdcb43342dba38d80929aa8843d31be03e8332d4 SHA512 a96be86457a9268e986e07496d4a0ac07737ee58e63d7b4e7d4538519b47795d0cbf164520ab253645befeafae35e79832386a0a6dfce5f686f5c25e62a0d413
-DIST eclass-manpages-20250705.tar.xz 498848 BLAKE2B 0a7907abaf983968c219ae26f3c5f0a0e33103b94ea7afdfad06cea22810094e0fdec2bfb150def85158922a444bdb675c0ae3d618d4a6a52175b83771f9e03a SHA512 2fb686403c8307e3a5259c15abdd23bf117ca9d4bcbda2b301e68755a0ba6dc3a2a4fac48d64803cca72626e410295e8684c0a45812788353cd11366b4df8f36
 DIST eclass-manpages-20250711.tar.xz 499388 BLAKE2B 7f4df3869449444fbc8805f468ea06754b8942eef3aec362765a54ed1e81d644e104847f1ded853321b79d45bfb5f818c5da49bfa8fec9c9d482016a4d2f540c SHA512 e4922972cd282d851405f9f9a3223924df27f7edfda40f0faabcbe5d072936039998cf63823faac8e50c6fcf2851cde7d57c0eee9d291a9469c7c11d70aa5672
+DIST eclass-manpages-20250730.tar.xz 502128 BLAKE2B f798b31c2ac69ab58015941c1cc4cb51b80d70e68f1b9eaf69dcbbe9cd0b488c3b66da2852eb0d8247b62ebfb7faddd13db7a9ddfc312162e3203b09d130263d SHA512 ef8514d5cf79b2549a0bf04deff844bf2bd039644f8a8f4c31201ee681ca94dc8182484685398b432169af7d6c93e3a2794329bc703635aa965414ab32f6823a
+DIST eclass-manpages-20250815.tar.xz 505524 BLAKE2B af3a3d4f98ed9de28c4c4555f556b03372a32a8e3d88d34f29917200a14347409f391736ea1eb60025fb8ac734d34de03407845c5d484ce99b0d6278f33ccc0d SHA512 3addcf0d7e24bb254bd720fb75a8385893174a4693dddab29a389e5a292e83a282abece87b1f237a2eab8f2c17227c9e3bea6bc6cbc7cc3d13cd0da03fc8af00
diff --git a/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250705.ebuild b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250705.ebuild
deleted file mode 100644
index 0e318cc5afd..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250705.ebuild
+++ /dev/null
@@ -1,24 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Instructions to make a dist tarball:
-# git clone https://github.com/projg2/eclass-to-manpage.git
-# cd eclass-to-manpage
-# make dist ECLASSDIR=~/g/eclass/
-
-DESCRIPTION="Collection of Gentoo eclass manpages"
-HOMEPAGE="https://github.com/projg2/eclass-to-manpage"
-SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
-
-LICENSE="GPL-2"
-SLOT="0"
-# Keep the keywords stable. No need to change to ~arch.
-KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~x64-macos"
-
-BDEPEND="sys-apps/gawk"
-
-src_install() {
-	emake install DESTDIR="${D}" PREFIX="${EPREFIX}/usr"
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250506.ebuild b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250730.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250506.ebuild
rename to sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250730.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250704.ebuild b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250815.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250704.ebuild
rename to sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250815.ebuild

From 78d084a8f07c1747e679b02e9b0957fc7e2c28a3 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:07 +0000
Subject: [PATCH 012/122] app-emulation/qemu: Sync with Gentoo

It's from Gentoo commit 92ed9add10a911d3dbf4343c06b21452e165abbe.
---
 .../app-emulation/qemu/Manifest               |   5 +-
 .../app-emulation/qemu/metadata.xml           |   1 -
 .../app-emulation/qemu/qemu-10.0.0.ebuild     |   6 +-
 ....2.10-r1.ebuild => qemu-10.0.2-r50.ebuild} |  84 ++++---
 .../app-emulation/qemu/qemu-10.0.2.ebuild     |   6 +-
 ...mu-7.2.17-r1.ebuild => qemu-10.0.3.ebuild} | 213 ++++++++++--------
 .../app-emulation/qemu/qemu-9.1.3-r2.ebuild   |   6 +-
 .../app-emulation/qemu/qemu-9.2.3-r3.ebuild   |   6 +-
 .../app-emulation/qemu/qemu-9.2.4.ebuild      |   6 +-
 .../app-emulation/qemu/qemu-9999.ebuild       |   6 +-
 10 files changed, 190 insertions(+), 149 deletions(-)
 rename sdk_container/src/third_party/portage-stable/app-emulation/qemu/{qemu-8.2.10-r1.ebuild => qemu-10.0.2-r50.ebuild} (92%)
 rename sdk_container/src/third_party/portage-stable/app-emulation/qemu/{qemu-7.2.17-r1.ebuild => qemu-10.0.3.ebuild} (85%)

diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
index 3ff296cc052..4814aa37301 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
@@ -4,10 +4,7 @@ DIST keycodemapdb-f5772a62ec52591ff6870b7e8ef32482371f22c6.tar.bz2 27971 BLAKE2B
 DIST qemu-10.0.0-docs.tar.xz 2651472 BLAKE2B 38be083c0c046e975a829df28089428425904cf66a3ea99cebc99b6f51eebdedf10a60be0c4f6bfb9e6f6cbc5dff1724dcd3b8d0982b5c421158258d869db4f3 SHA512 5f9332340bf68b3c0da4b48174330674f5235b98c3e275792fcbeec4bacca2faa84865c01c0cdd1e95388d9656a5dbf1d6baca2d1c8b2996c42511c966d9edd7
 DIST qemu-10.0.0.tar.xz 135618260 BLAKE2B 3408c7b2a38ace7f0b2e0912411a26cab96cb23bcb03d7095f7b081cb88db55f36b004ff6458281d73190b9cc9006da85dde2a0b4b068c80662a8de205c29fda SHA512 2215458ed8be3ab0b0032fe2a96e79183f5fc2da323d927018412ea3d980b022a07ba87d4f446229eaaa7d1b19a577d438dbcaa3af3bd537c7720b56734a2d8b
 DIST qemu-10.0.2.tar.xz 135678180 BLAKE2B be4ddf050d2102cefded5b4967222df749ee8af92c2427c31a9b29b3800fac8bb328daf2c38d11aa307b51eb7d7243f9b064b3bf24d446a001e5520359ee83c3 SHA512 7fda582c3845ea663aa5eda21bb38ebcfb6c25bccf8944ea6cdf8b5be6946b5a874b36674a7f5db3e325abb9cca0dd9bc0727837fdceb71a8c947d96169a9b20
-DIST qemu-7.2.0-docs.tar.xz 1984184 BLAKE2B 103900fb7903ed8d75f7f012bf61fa2d6fce345b657c851d0437c3384f5735bd1cfd3129320683ea7846ea0b0940e5af5b2663c9320f12fee74b058523a8ea06 SHA512 a7edd448982865e07533c300d3e44a8b50cefbdde1982b73c24d0b2aa74315439252c59b634c75de312860874c7b06c75aa72629da681b5105f28ee936794585
-DIST qemu-7.2.17.tar.xz 124405828 BLAKE2B 0613eb18a3dfc8af3c907110191eb1e639c8e4ed4ec80842f8a81e373800834ecae6701a8e87f54ea143f1d508b0799d6127ad2174cd5402ec8ad0bdc9e1e21a SHA512 8490fe388db6f72f56cf082eac6aeda6d9eed4749096d2b56dc2f878b058742b586f02fe9a13280eb408b563e8470da53e058505286683cf79a5805aefa2a06e
-DIST qemu-8.2.0-docs.tar.xz 2233352 BLAKE2B 22b9499fdf4ff93e72399dab3803f3171c855859dc7fe111612e2f9146db244ca6d2e0aad16aefdf29b231d2b3a2fbc22171fe6bac13b03445d54555ce798d16 SHA512 f57e78c28277c153fff00b25097d0df5c6ad36cb4e9f3acf30382bfb1c99508503c186c1bbecf266810ef24fd618428fdf3e0eee41c715a552918c9e6ef9e8e5
-DIST qemu-8.2.10.tar.xz 132685948 BLAKE2B a1e9a89ee8bdf36b597c7f59b18d19ea34a83bcbd0c3e6bc18b10b9bb1cfad50561af7814076c07da67b11ac280a1f4b39b55f80bbf715d49f264e6b67c69d2b SHA512 f847f4cf2e17b562fe974cf52ad623c516440344e708141913986130ef0436f6d31653250a458061eff7bbffacd1ec726f69964dddad08c9b907dfb90c3f48b6
+DIST qemu-10.0.3.tar.xz 135736600 BLAKE2B 382800d9a9f5241123ebeb43d8eaa6a4aaf9acae0df7a25f2c7831aa7eeb97014cff29886c53f03ea0a1ac98729b85bad1e4d5634e592a373af84f79a9219adc SHA512 7f37c2df5ac7048fb32f1d89a7c2da0929be9d2f5767bc209ca1e99167f196fb5867fc8b69f915c8c349c58089ce3d7e08c9a3f35a73223abff258b9a5bf3466
 DIST qemu-9.1.0-docs.tar.xz 2376072 BLAKE2B 31d13133b3a2e21a7d9b5af028407610ae8f2fa61dd296fc35e57fc12eb66cfd1a39ec5e3b5a3852095d10a388f424f8a38417b3ab58ca30d0817ece779328cf SHA512 5b705b577daad6aa010d5c713db9dc314114334b89901840ebcecc9032595a969f5ad9054e42b36b2be5ef9f5d6dc1159841ff46dbb08314b5c48491aa631040
 DIST qemu-9.1.3.tar.xz 132492084 BLAKE2B 268c8fb91dd5fc4e393a46a578537338861e5d2a92c381517447c6c2fe67604ed9aacc96371c864dc7f4a800cc9b9f94118d17c5dcc24f3fac5be0a18ca553e5 SHA512 e7b938e72eb4a8a4a6680ce3b282a4e5cbd1ad30003bed959e51ea2621acea7434b4366ef6559e3622fac8865ad212702f393ba7698be38cf2fc8f264b951318
 DIST qemu-9.2.0-docs.tar.xz 2431076 BLAKE2B 420148b9d7cafbdc9aea21b0d0a84a53ca0d17fb99fc34ae4c0786fa7d4ce40838f4b3173508b90742d6dfbfd4b58dda25b2e5cd1394241b0b56a64fe5705d9b SHA512 88816e326e9eac9acf0a1c73e677552845d6885e220b55e795241c40d2c1bd1b1994a22e56f95046e420225e0b7dc839d459f1c1e5318c8c36392727a86b3008
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/metadata.xml b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/metadata.xml
index c42f7d920b3..dc8404a3f8f 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/metadata.xml
@@ -45,7 +45,6 @@
 		<flag name="spice">Enable Spice protocol support via <pkg>app-emulation/spice</pkg></flag>
 		<flag name="ssh">Enable SSH based block device support via <pkg>net-libs/libssh2</pkg></flag>
 		<flag name="static-user">Build the User targets as static binaries</flag>
-		<flag name="static">Build the User and Software MMU (system) targets as well as tools as static binaries</flag>
 		<flag name="systemtap">Enable SystemTap/DTrace tracing</flag>
 		<flag name="jpeg">Enable jpeg image support for the VNC console server</flag>
 		<flag name="png">Enable png image support for the VNC console server</flag>
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.0.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.0.ebuild
index c539d8c9d5b..e7bd8508188 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.0.ebuild
@@ -27,7 +27,6 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
 	declare -A SUBPROJECTS=(
 		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
 		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
@@ -172,7 +171,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
@@ -278,6 +277,7 @@ PPC_FIRMWARE_DEPEND="
 # See bug #913084 for pip dep
 BDEPEND="
 	$(python_gen_impl_dep)
+	dev-python/distlib[${PYTHON_USEDEP}]
 	dev-lang/perl
 	>=dev-build/meson-0.63.0
 	app-alternatives/ninja
@@ -943,7 +943,7 @@ pkg_postinst() {
 	xdg_icon_cache_update
 
 	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
-		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+		fcaps -m u+s cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
 
 	DISABLE_AUTOFORMATTING=true
 	readme.gentoo_print_elog
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.10-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2-r50.ebuild
similarity index 92%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.10-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2-r50.ebuild
index 0ae89ea3b38..31fc585a0b5 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.10-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2-r50.ebuild
@@ -13,13 +13,11 @@ QEMU_DOCS_VERSION=$(ver_cut 1-2).0
 # bug #830088
 QEMU_DOC_USEFLAG="+doc"
 
-PYTHON_COMPAT=( python3_{11..12} )
+PYTHON_COMPAT=( python3_{11..13} )
 PYTHON_REQ_USE="ensurepip(-),ncurses,readline"
 
-FIRMWARE_ABI_VERSION="7.2.0"
-
-inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
-		pax-utils xdg-utils
+inherit eapi9-ver flag-o-matic linux-info toolchain-funcs python-r1 udev fcaps \
+		readme.gentoo-r1 pax-utils xdg-utils
 
 if [[ ${PV} == *9999* ]]; then
 	QEMU_DOCS_PREBUILT=0
@@ -27,11 +25,10 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
 	declare -A SUBPROJECTS=(
 		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
 		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
-		[berkeley-testfloat-3]="40619cbb3bf32872df8c53cc457039229428a263"
+		[berkeley-testfloat-3]="e7af9751d9f9fd3b47911f51a5cfd08af256a9ab"
 	)
 
 	for proj in "${!SUBPROJECTS[@]}"; do
@@ -47,7 +44,7 @@ else
 	fi
 
 	S="${WORKDIR}/${MY_P}"
-	[[ "${PV}" != *_rc* ]] && KEYWORDS="amd64 ~arm arm64 ~loong ~ppc ppc64 ~riscv x86"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
 fi
 
 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
@@ -66,14 +63,13 @@ IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
 	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
 	+slirp
 	smartcard snappy spice ssh static-user systemtap test udev usb
-	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xen
+	usbredir vde +vhost-net virgl virtfs +vnc vte wayland X xattr xdp xen
 	zstd"
 
 COMMON_TARGETS="
 	aarch64
 	alpha
 	arm
-	cris
 	hppa
 	i386
 	loongarch64
@@ -84,7 +80,6 @@ COMMON_TARGETS="
 	mips64
 	mips64el
 	mipsel
-	nios2
 	or1k
 	ppc
 	ppc64
@@ -142,6 +137,7 @@ REQUIRED_USE="
 	vte? ( gtk )
 	multipath? ( udev )
 	plugins? ( !static-user )
+	xdp? ( bpf )
 "
 for smname in ${IUSE_SOFTMMU_TARGETS} ; do
 	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( kernel_linux? ( seccomp ) )"
@@ -173,19 +169,19 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
 		dev-libs/nettle:=[static-libs(+)]
 	)
 	gtk? (
-		x11-libs/gtk+:3
+		x11-libs/gtk+:3[wayland?,X?]
 		vte? ( x11-libs/vte:2.91 )
 	)
 	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
@@ -236,17 +232,34 @@ SOFTMMU_TOOLS_DEPEND="
 	vde? ( net-misc/vde[static-libs(+)] )
 	virgl? ( media-libs/virglrenderer[static-libs(+)] )
 	virtfs? ( sys-libs/libcap )
+	xdp? ( net-libs/xdp-tools )
 	xen? ( app-emulation/xen-tools:= )
 	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
 "
 
-EDK2_OVMF_VERSION="202202"
+#
+# With USE=+pin-upstream-blobs we pin firmware versions to known good
+# version in order to  minimize the frequency of disruptive changes. This
+# avoids unnecessary frustration on user side because changing the firmware
+# version can break resume of hibernated guest, inhibit live migrations,
+# and might have other unwanted consequences. For now, let us try to
+# synchronize firmware blobs with the ones bundled in upstream qemu. Simply
+# check the upstream git repository for any changes, for example:
+#   https://github.com/qemu/qemu/tree/v10.0.2/roms for the 10.0.2 release.
+#
+# When changing pinned firmware versions
+#  - create a separate ebuild with revision -r50
+#  - update the FIRMWARE_ABI_VERSION to the current package version
+#
+
+FIRMWARE_ABI_VERSION="10.0.2"
+EDK2_OVMF_VERSION="202408"
 SEABIOS_VERSION="1.16.3"
 
 X86_FIRMWARE_DEPEND="
 	pin-upstream-blobs? (
 		~sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
-		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/ipxe-1.21.1_p20230601[binary,qemu]
 		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
 		~sys-firmware/sgabios-0.1_pre10[binary]
 	)
@@ -278,6 +291,7 @@ PPC_FIRMWARE_DEPEND="
 # See bug #913084 for pip dep
 BDEPEND="
 	$(python_gen_impl_dep)
+	dev-python/distlib[${PYTHON_USEDEP}]
 	dev-lang/perl
 	>=dev-build/meson-0.63.0
 	app-alternatives/ninja
@@ -288,8 +302,9 @@ BDEPEND="
 	)
 	gtk? ( nls? ( sys-devel/gettext ) )
 	test? (
-		dev-libs/glib[utils]
 		app-alternatives/bc
+		dev-libs/glib[utils]
+		dev-python/pycotap[${PYTHON_USEDEP}]
 	)
 "
 CDEPEND="
@@ -315,9 +330,8 @@ RDEPEND="
 "
 
 PATCHES=(
-	"${FILESDIR}"/${PN}-8.0.0-disable-keymap.patch
-	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
-	"${FILESDIR}"/${PN}-8.1.0-also-build-virtfs-proxy-helper.patch
+	"${FILESDIR}"/${PN}-9.0.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-9.2.0-capstone-include-path.patch
 	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
 	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
 	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
@@ -325,6 +339,7 @@ PATCHES=(
 
 QA_PREBUILT="
 	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/hppa-firmware64.img
 	usr/share/qemu/openbios-ppc
 	usr/share/qemu/openbios-sparc64
 	usr/share/qemu/openbios-sparc32
@@ -368,12 +383,12 @@ kernel module is loaded is to load it on boot.
 Please review /etc/conf.d/modules for how to load these.
 
 Make sure your user is in the 'kvm' group. Just run
-	$ gpasswd -a <USER> kvm
+	# gpasswd -a <USER> kvm
 then have <USER> re-login.
 
 For brand new installs, the default permissions on /dev/kvm might not let
 you access it.  You can tell udev to reset ownership/perms:
-	$ udevadm trigger -c add /dev/kvm
+	# udevadm trigger -c add /dev/kvm
 
 If you want to register binfmt handlers for qemu user targets:
 For openrc:
@@ -402,6 +417,8 @@ pkg_pretend() {
 			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
 			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
 			ERROR_VHOST_NET+=" support"
+			use test && CONFIG_CHECK+=" IP_MULTICAST"
+			ERROR_IP_MULTICAST="Test suite requires IP_MULTICAST"
 
 			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
 				if grep -q AuthenticAMD /proc/cpuinfo; then
@@ -475,6 +492,10 @@ src_prepare() {
 	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
 	export WINDRES=${CHOST}-windres
 
+	# defang automagic dependencies
+	use X || append-flags -DGENTOO_GTK_HIDE_X11
+	use wayland || append-flags -DGENTOO_GTK_HIDE_WAYLAND
+
 	# Workaround for bug #938302
 	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
 		cat >> "${S}"/configs/meson/linux.txt <<-EOF || die
@@ -631,6 +652,7 @@ qemu_src_configure() {
 		$(conf_softmmu virtfs)
 		$(conf_notuser vnc)
 		$(conf_notuser vte)
+		$(conf_softmmu xdp af-xdp)
 		$(conf_notuser xen)
 		$(conf_notuser xen xen-pci-passthrough)
 		# use prebuilt keymaps, bug #759604
@@ -673,6 +695,7 @@ qemu_src_configure() {
 			--disable-tools
 			--enable-cap-ng
 			--enable-seccomp
+			--disable-libcbor
 		)
 		local static_flag="none"
 		;;
@@ -926,16 +949,6 @@ src_install() {
 	readme.gentoo_create_doc
 }
 
-firmware_abi_change() {
-	local pv
-	for pv in ${REPLACING_VERSIONS}; do
-		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
-			return 0
-		fi
-	done
-	return 1
-}
-
 pkg_postinst() {
 	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
 		udev_reload
@@ -944,12 +957,12 @@ pkg_postinst() {
 	xdg_icon_cache_update
 
 	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
-		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+		fcaps -m u+s cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
 
 	DISABLE_AUTOFORMATTING=true
 	readme.gentoo_print_elog
 
-	if use pin-upstream-blobs && firmware_abi_change; then
+	if use pin-upstream-blobs && ver_replacing -lt ${FIRMWARE_ABI_VERSION}; then
 		ewarn "This version of qemu pins new versions of firmware blobs:"
 
 		if has_version 'sys-firmware/edk2-bin'; then
@@ -969,8 +982,7 @@ pkg_postinst() {
 		ewarn "This might break resume of hibernated guests (started with a different"
 		ewarn "firmware version) and live migration to/from qemu versions with different"
 		ewarn "firmware. Please (cold) restart all running guests. For functional"
-		ewarn "guest migration ensure that all"
-		ewarn "hosts run at least"
+		ewarn "guest migration ensure that all hosts run at least"
 		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
 	fi
 }
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2.ebuild
index 50468066b82..bdcf47772e2 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2.ebuild
@@ -27,7 +27,6 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
 	declare -A SUBPROJECTS=(
 		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
 		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
@@ -172,7 +171,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
@@ -278,6 +277,7 @@ PPC_FIRMWARE_DEPEND="
 # See bug #913084 for pip dep
 BDEPEND="
 	$(python_gen_impl_dep)
+	dev-python/distlib[${PYTHON_USEDEP}]
 	dev-lang/perl
 	>=dev-build/meson-0.63.0
 	app-alternatives/ninja
@@ -943,7 +943,7 @@ pkg_postinst() {
 	xdg_icon_cache_update
 
 	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
-		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+		fcaps -m u+s cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
 
 	DISABLE_AUTOFORMATTING=true
 	readme.gentoo_print_elog
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.3.ebuild
similarity index 85%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.3.ebuild
index 04e77d0306a..31fc585a0b5 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.3.ebuild
@@ -7,31 +7,34 @@ EAPI=8
 # Set to 1 if prebuilt, 0 if not
 # (the construct below is to allow overriding from env for script)
 QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
-QEMU_DOCS_PREBUILT_DEV=ajak
-QEMU_DOCS_VERSION="7.2.0"
+QEMU_DOCS_PREBUILT_DEV=sam
+QEMU_DOCS_VERSION=$(ver_cut 1-2).0
 # Default to generating docs (inc. man pages) if no prebuilt; overridden later
 # bug #830088
 QEMU_DOC_USEFLAG="+doc"
 
-PYTHON_COMPAT=( python3_{11..12} )
-PYTHON_REQ_USE="ncurses,readline"
+PYTHON_COMPAT=( python3_{11..13} )
+PYTHON_REQ_USE="ensurepip(-),ncurses,readline"
 
-FIRMWARE_ABI_VERSION="7.2.0"
-
-inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
-		pax-utils xdg-utils
+inherit eapi9-ver flag-o-matic linux-info toolchain-funcs python-r1 udev fcaps \
+		readme.gentoo-r1 pax-utils xdg-utils
 
 if [[ ${PV} == *9999* ]]; then
 	QEMU_DOCS_PREBUILT=0
 
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
-	EGIT_SUBMODULES=(
-		tests/fp/berkeley-softfloat-3
-		tests/fp/berkeley-testfloat-3
-		ui/keycodemapdb
-	)
+	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
+	declare -A SUBPROJECTS=(
+		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
+		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
+		[berkeley-testfloat-3]="e7af9751d9f9fd3b47911f51a5cfd08af256a9ab"
+	)
+
+	for proj in "${!SUBPROJECTS[@]}"; do
+		c=${SUBPROJECTS[${proj}]}
+		SRC_URI+=" https://gitlab.com/qemu-project/${proj}/-/archive/${c}/${proj}-${c}.tar.bz2"
+	done
 else
 	MY_P="${PN}-${PV/_rc/-rc}"
 	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
@@ -41,7 +44,7 @@ else
 	fi
 
 	S="${WORKDIR}/${MY_P}"
-	[[ "${PV}" != *_rc* ]] && KEYWORDS="amd64 ~arm arm64 ~loong ~ppc ppc64 ~riscv x86"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
 fi
 
 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
@@ -54,20 +57,19 @@ SLOT="0"
 
 IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
 	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
-	jack jemalloc +jpeg
+	jack jemalloc +jpeg keyutils
 	lzo multipath
-	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs pipewire
 	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
 	+slirp
-	smartcard snappy spice ssh static static-user systemtap test udev usb
-	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xen
+	smartcard snappy spice ssh static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte wayland X xattr xdp xen
 	zstd"
 
 COMMON_TARGETS="
 	aarch64
 	alpha
 	arm
-	cris
 	hppa
 	i386
 	loongarch64
@@ -78,7 +80,6 @@ COMMON_TARGETS="
 	mips64
 	mips64el
 	mipsel
-	nios2
 	or1k
 	ppc
 	ppc64
@@ -129,17 +130,17 @@ REQUIRED_USE="
 	qemu_softmmu_targets_riscv64? ( fdt )
 	qemu_softmmu_targets_x86_64? ( fdt )
 	sdl-image? ( sdl )
-	static? ( static-user !alsa !gtk !jack !opengl !pam !pulseaudio !plugins !rbd !snappy !udev )
 	static-user? ( !plugins )
 	virgl? ( opengl )
 	virtfs? ( xattr )
 	vnc? ( gnutls )
 	vte? ( gtk )
 	multipath? ( udev )
-	plugins? ( !static !static-user )
+	plugins? ( !static-user )
+	xdp? ( bpf )
 "
 for smname in ${IUSE_SOFTMMU_TARGETS} ; do
-	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( seccomp ) "
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( kernel_linux? ( seccomp ) )"
 done
 
 # Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
@@ -155,12 +156,12 @@ ALL_DEPEND="
 	sys-libs/zlib[static-libs(+)]
 	python? ( ${PYTHON_DEPS} )
 	systemtap? ( dev-debug/systemtap )
-	xattr? ( sys-apps/attr[static-libs(+)] )"
+	xattr? ( sys-apps/attr[static-libs(+)] )
+"
 
 # Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
 # softmmu targets (qemu-system-*).
 SOFTMMU_TOOLS_DEPEND="
-	sys-libs/libcap-ng[static-libs(+)]
 	>=x11-libs/pixman-0.28.0[static-libs(+)]
 	accessibility? (
 		app-accessibility/brltty[api]
@@ -168,7 +169,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
@@ -180,10 +181,7 @@ SOFTMMU_TOOLS_DEPEND="
 		dev-libs/nettle:=[static-libs(+)]
 	)
 	gtk? (
-		x11-libs/cairo
-		x11-libs/gdk-pixbuf:2
-		x11-libs/gtk+:3
-		x11-libs/libX11
+		x11-libs/gtk+:3[wayland?,X?]
 		vte? ( x11-libs/vte:2.91 )
 	)
 	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
@@ -192,6 +190,8 @@ SOFTMMU_TOOLS_DEPEND="
 	jack? ( virtual/jack )
 	jemalloc? ( dev-libs/jemalloc )
 	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	kernel_linux? ( sys-libs/libcap-ng[static-libs(+)] )
+	keyutils? ( sys-apps/keyutils[static-libs(+)] )
 	lzo? ( dev-libs/lzo:2[static-libs(+)] )
 	multipath? ( sys-fs/multipath-tools )
 	ncurses? (
@@ -207,7 +207,8 @@ SOFTMMU_TOOLS_DEPEND="
 		media-libs/mesa[egl(+),gbm(+)]
 	)
 	pam? ( sys-libs/pam )
-	png? ( media-libs/libpng:0=[static-libs(+)] )
+	pipewire? ( >=media-video/pipewire-0.3.60 )
+	png? ( >=media-libs/libpng-1.6.34:=[static-libs(+)] )
 	pulseaudio? ( media-libs/libpulse )
 	rbd? ( sys-cluster/ceph )
 	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
@@ -221,8 +222,8 @@ SOFTMMU_TOOLS_DEPEND="
 	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
 	snappy? ( app-arch/snappy:= )
 	spice? (
-		>=app-emulation/spice-protocol-0.12.3
-		>=app-emulation/spice-0.12.0[static-libs(+)]
+		>=app-emulation/spice-protocol-0.14.0
+		>=app-emulation/spice-0.14.0[static-libs(+)]
 	)
 	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
 	udev? ( virtual/libudev:= )
@@ -231,17 +232,34 @@ SOFTMMU_TOOLS_DEPEND="
 	vde? ( net-misc/vde[static-libs(+)] )
 	virgl? ( media-libs/virglrenderer[static-libs(+)] )
 	virtfs? ( sys-libs/libcap )
+	xdp? ( net-libs/xdp-tools )
 	xen? ( app-emulation/xen-tools:= )
 	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
 "
 
-EDK2_OVMF_VERSION="202202"
-SEABIOS_VERSION="1.16.0"
+#
+# With USE=+pin-upstream-blobs we pin firmware versions to known good
+# version in order to  minimize the frequency of disruptive changes. This
+# avoids unnecessary frustration on user side because changing the firmware
+# version can break resume of hibernated guest, inhibit live migrations,
+# and might have other unwanted consequences. For now, let us try to
+# synchronize firmware blobs with the ones bundled in upstream qemu. Simply
+# check the upstream git repository for any changes, for example:
+#   https://github.com/qemu/qemu/tree/v10.0.2/roms for the 10.0.2 release.
+#
+# When changing pinned firmware versions
+#  - create a separate ebuild with revision -r50
+#  - update the FIRMWARE_ABI_VERSION to the current package version
+#
+
+FIRMWARE_ABI_VERSION="10.0.2"
+EDK2_OVMF_VERSION="202408"
+SEABIOS_VERSION="1.16.3"
 
 X86_FIRMWARE_DEPEND="
 	pin-upstream-blobs? (
 		~sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
-		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/ipxe-1.21.1_p20230601[binary,qemu]
 		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
 		~sys-firmware/sgabios-0.1_pre10[binary]
 	)
@@ -256,7 +274,8 @@ X86_FIRMWARE_DEPEND="
 			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
 		)
 		sys-firmware/sgabios
-	)"
+	)
+"
 PPC_FIRMWARE_DEPEND="
 	pin-upstream-blobs? (
 		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
@@ -269,57 +288,58 @@ PPC_FIRMWARE_DEPEND="
 	)
 "
 
+# See bug #913084 for pip dep
 BDEPEND="
 	$(python_gen_impl_dep)
+	dev-python/distlib[${PYTHON_USEDEP}]
 	dev-lang/perl
-	dev-build/meson
-	sys-apps/texinfo
+	>=dev-build/meson-0.63.0
+	app-alternatives/ninja
 	virtual/pkgconfig
 	doc? (
-		dev-python/sphinx[${PYTHON_USEDEP}]
+		>=dev-python/sphinx-1.6.0[${PYTHON_USEDEP}]
 		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
 	)
 	gtk? ( nls? ( sys-devel/gettext ) )
 	test? (
-		dev-libs/glib[utils]
 		app-alternatives/bc
+		dev-libs/glib[utils]
+		dev-python/pycotap[${PYTHON_USEDEP}]
 	)
 "
 CDEPEND="
-	!static? (
-		${ALL_DEPEND//\[static-libs(+)]}
-		${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
-	)
+	${ALL_DEPEND//\[static-libs(+)]}
+	${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
 	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
 	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
 	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
 	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
 "
-DEPEND="${CDEPEND}
+DEPEND="
+	${CDEPEND}
 	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
-	static? (
-		${ALL_DEPEND}
-		${SOFTMMU_TOOLS_DEPEND}
-	)
-	static-user? ( ${ALL_DEPEND} )"
-RDEPEND="${CDEPEND}
+	static-user? ( ${ALL_DEPEND} )
+"
+RDEPEND="
+	${CDEPEND}
 	acct-group/kvm
 	selinux? (
 		sec-policy/selinux-qemu
 		sys-libs/libselinux
-	)"
+	)
+"
 
 PATCHES=(
-	"${FILESDIR}"/${PN}-5.2.0-disable-keymap.patch
-	"${FILESDIR}"/${PN}-6.0.0-make.patch
-	"${FILESDIR}"/${PN}-7.1.0-also-build-virtfs-proxy-helper.patch
-	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
-	"${FILESDIR}"/${PN}-7.2.0-disable-gmp.patch
+	"${FILESDIR}"/${PN}-9.0.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-9.2.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
+	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
 	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
 )
 
 QA_PREBUILT="
 	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/hppa-firmware64.img
 	usr/share/qemu/openbios-ppc
 	usr/share/qemu/openbios-sparc64
 	usr/share/qemu/openbios-sparc32
@@ -331,7 +351,8 @@ QA_PREBUILT="
 	usr/share/qemu/u-boot.e500
 "
 
-QA_WX_LOAD="usr/bin/qemu-i386
+QA_WX_LOAD="
+	usr/bin/qemu-i386
 	usr/bin/qemu-x86_64
 	usr/bin/qemu-alpha
 	usr/bin/qemu-arm
@@ -362,12 +383,12 @@ kernel module is loaded is to load it on boot.
 Please review /etc/conf.d/modules for how to load these.
 
 Make sure your user is in the 'kvm' group. Just run
-	$ gpasswd -a <USER> kvm
+	# gpasswd -a <USER> kvm
 then have <USER> re-login.
 
 For brand new installs, the default permissions on /dev/kvm might not let
 you access it.  You can tell udev to reset ownership/perms:
-	$ udevadm trigger -c add /dev/kvm
+	# udevadm trigger -c add /dev/kvm
 
 If you want to register binfmt handlers for qemu user targets:
 For openrc:
@@ -396,6 +417,8 @@ pkg_pretend() {
 			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
 			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
 			ERROR_VHOST_NET+=" support"
+			use test && CONFIG_CHECK+=" IP_MULTICAST"
+			ERROR_IP_MULTICAST="Test suite requires IP_MULTICAST"
 
 			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
 				if grep -q AuthenticAMD /proc/cpuinfo; then
@@ -442,6 +465,23 @@ check_targets() {
 	popd >/dev/null
 }
 
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		for file in ${A}; do
+			unpack "${file}"
+		done
+		cd "${WORKDIR}" || die
+		for proj in "${!SUBPROJECTS[@]}"; do
+			mv "${proj}-${SUBPROJECTS[${proj}]}" "${S}/subprojects/${proj}" || die
+		done
+		cd "${S}" || die
+		meson subprojects packagefiles --apply || die
+	else
+		default
+	fi
+}
+
 src_prepare() {
 	check_targets IUSE_SOFTMMU_TARGETS softmmu
 	check_targets IUSE_USER_TARGETS linux-user
@@ -452,6 +492,10 @@ src_prepare() {
 	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
 	export WINDRES=${CHOST}-windres
 
+	# defang automagic dependencies
+	use X || append-flags -DGENTOO_GTK_HIDE_X11
+	use wayland || append-flags -DGENTOO_GTK_HIDE_WAYLAND
+
 	# Workaround for bug #938302
 	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
 		cat >> "${S}"/configs/meson/linux.txt <<-EOF || die
@@ -463,13 +507,8 @@ src_prepare() {
 	# Verbose builds
 	MAKEOPTS+=" V=1"
 
-	# We already force -D_FORTIFY_SOURCE=2 (or 3) in our toolchain, but
-	# this setting (-U then -D..=2) will prevent us from trying out 3, so
-	# drop it. No change to level of protection b/c we patch our toolchain.
-	sed -i -e 's/-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2//' configure || die
-
 	# Remove bundled modules
-	rm -r dtc meson roms/*/ || die
+	rm -r roms/*/ || die
 }
 
 ##
@@ -497,7 +536,8 @@ qemu_src_configure() {
 		--disable-containers # bug #732972
 		--disable-guest-agent
 		--disable-strip
-		--with-git-submodules=ignore
+		--disable-download
+		--python="${PYTHON}"
 
 		# bug #746752: TCG interpreter has a few limitations:
 		# - it does not support FPU
@@ -516,6 +556,7 @@ qemu_src_configure() {
 		--disable-gcrypt
 		--cc="$(tc-getCC)"
 		--cxx="$(tc-getCXX)"
+		--objcc="$(tc-getCC)"
 		--host-cc="$(tc-getBUILD_CC)"
 
 		$(use_enable alsa)
@@ -524,6 +565,7 @@ qemu_src_configure() {
 		$(use_enable jack)
 		$(use_enable nls gettext)
 		$(use_enable oss)
+		$(use_enable pipewire)
 		$(use_enable plugins)
 		$(use_enable pulseaudio pa)
 		$(use_enable selinux)
@@ -582,6 +624,7 @@ qemu_src_configure() {
 		$(conf_malloc jemalloc)
 		$(conf_notuser jpeg vnc-jpeg)
 		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser keyutils libkeyutils)
 		$(conf_notuser lzo)
 		$(conf_notuser multipath mpath)
 		$(conf_notuser ncurses curses)
@@ -609,6 +652,7 @@ qemu_src_configure() {
 		$(conf_softmmu virtfs)
 		$(conf_notuser vnc)
 		$(conf_notuser vte)
+		$(conf_softmmu xdp af-xdp)
 		$(conf_notuser xen)
 		$(conf_notuser xen xen-pci-passthrough)
 		# use prebuilt keymaps, bug #759604
@@ -622,6 +666,7 @@ qemu_src_configure() {
 			# Note: backend order matters here: #716202
 			# We iterate from higher-level to lower level.
 			$(usex pulseaudio pa "")
+			$(usev pipewire)
 			$(usev jack)
 			$(usev sdl)
 			$(usev alsa)
@@ -637,7 +682,6 @@ qemu_src_configure() {
 		conf_opts+=(
 			--enable-linux-user
 			--disable-system
-			--disable-blobs
 			--disable-tools
 			--disable-cap-ng
 			--disable-seccomp
@@ -651,18 +695,18 @@ qemu_src_configure() {
 			--disable-tools
 			--enable-cap-ng
 			--enable-seccomp
+			--disable-libcbor
 		)
-		local static_flag="static"
+		local static_flag="none"
 		;;
 	tools)
 		conf_opts+=(
 			--disable-linux-user
 			--disable-system
-			--disable-blobs
 			--enable-tools
 			--enable-cap-ng
 		)
-		local static_flag="static"
+		local static_flag="none"
 		;;
 	esac
 
@@ -670,12 +714,12 @@ qemu_src_configure() {
 	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
 
 	# Add support for SystemTap
-	use systemtap && conf_opts+=( --enable-trace-backend=dtrace )
+	use systemtap && conf_opts+=( --enable-trace-backends="dtrace" )
 
 	# We always want to attempt to build with PIE support as it results
 	# in a more secure binary. But it doesn't work with static or if
 	# the current GCC doesn't have PIE support.
-	if use ${static_flag}; then
+	if [[ ${static_flag} != "none" ]] && use ${static_flag}; then
 		conf_opts+=( --static --disable-pie )
 	else
 		tc-enables-pie && conf_opts+=( --enable-pie )
@@ -855,7 +899,7 @@ src_install() {
 	doins "${FILESDIR}/bridge.conf"
 
 	cd "${S}" || die
-	dodoc MAINTAINERS docs/specs/pci-ids.txt
+	dodoc MAINTAINERS
 	newdoc pc-bios/README README.pc-bios
 
 	# Disallow stripping of prebuilt firmware files.
@@ -905,16 +949,6 @@ src_install() {
 	readme.gentoo_create_doc
 }
 
-firmware_abi_change() {
-	local pv
-	for pv in ${REPLACING_VERSIONS}; do
-		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
-			return 0
-		fi
-	done
-	return 1
-}
-
 pkg_postinst() {
 	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
 		udev_reload
@@ -923,12 +957,12 @@ pkg_postinst() {
 	xdg_icon_cache_update
 
 	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
-		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+		fcaps -m u+s cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
 
 	DISABLE_AUTOFORMATTING=true
 	readme.gentoo_print_elog
 
-	if use pin-upstream-blobs && firmware_abi_change; then
+	if use pin-upstream-blobs && ver_replacing -lt ${FIRMWARE_ABI_VERSION}; then
 		ewarn "This version of qemu pins new versions of firmware blobs:"
 
 		if has_version 'sys-firmware/edk2-bin'; then
@@ -948,8 +982,7 @@ pkg_postinst() {
 		ewarn "This might break resume of hibernated guests (started with a different"
 		ewarn "firmware version) and live migration to/from qemu versions with different"
 		ewarn "firmware. Please (cold) restart all running guests. For functional"
-		ewarn "guest migration ensure that all"
-		ewarn "hosts run at least"
+		ewarn "guest migration ensure that all hosts run at least"
 		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
 	fi
 }
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r2.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r2.ebuild
index 19613bf631f..a8d792bdfc4 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r2.ebuild
@@ -27,7 +27,6 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
 	declare -A SUBPROJECTS=(
 		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
 		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
@@ -173,7 +172,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
@@ -279,6 +278,7 @@ PPC_FIRMWARE_DEPEND="
 # See bug #913084 for pip dep
 BDEPEND="
 	$(python_gen_impl_dep)
+	dev-python/distlib[${PYTHON_USEDEP}]
 	dev-lang/perl
 	>=dev-build/meson-0.63.0
 	app-alternatives/ninja
@@ -954,7 +954,7 @@ pkg_postinst() {
 	xdg_icon_cache_update
 
 	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
-		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+		fcaps -m u+s cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
 
 	DISABLE_AUTOFORMATTING=true
 	readme.gentoo_print_elog
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r3.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r3.ebuild
index d2aa81b37ec..3bb7630d8bb 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r3.ebuild
@@ -27,7 +27,6 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
 	declare -A SUBPROJECTS=(
 		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
 		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
@@ -172,7 +171,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
@@ -278,6 +277,7 @@ PPC_FIRMWARE_DEPEND="
 # See bug #913084 for pip dep
 BDEPEND="
 	$(python_gen_impl_dep)
+	dev-python/distlib[${PYTHON_USEDEP}]
 	dev-lang/perl
 	>=dev-build/meson-0.63.0
 	app-alternatives/ninja
@@ -944,7 +944,7 @@ pkg_postinst() {
 	xdg_icon_cache_update
 
 	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
-		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+		fcaps -m u+s cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
 
 	DISABLE_AUTOFORMATTING=true
 	readme.gentoo_print_elog
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.4.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.4.ebuild
index 2ffaefa9ee0..d64cf18f6a8 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.4.ebuild
@@ -27,7 +27,6 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
 	declare -A SUBPROJECTS=(
 		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
 		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
@@ -172,7 +171,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
@@ -278,6 +277,7 @@ PPC_FIRMWARE_DEPEND="
 # See bug #913084 for pip dep
 BDEPEND="
 	$(python_gen_impl_dep)
+	dev-python/distlib[${PYTHON_USEDEP}]
 	dev-lang/perl
 	>=dev-build/meson-0.63.0
 	app-alternatives/ninja
@@ -943,7 +943,7 @@ pkg_postinst() {
 	xdg_icon_cache_update
 
 	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
-		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+		fcaps -m u+s cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
 
 	DISABLE_AUTOFORMATTING=true
 	readme.gentoo_print_elog
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
index d5861e676ca..bc77b1a50bc 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
@@ -27,7 +27,6 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
 	declare -A SUBPROJECTS=(
 		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
 		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
@@ -172,7 +171,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
@@ -278,6 +277,7 @@ PPC_FIRMWARE_DEPEND="
 # See bug #913084 for pip dep
 BDEPEND="
 	$(python_gen_impl_dep)
+	dev-python/distlib[${PYTHON_USEDEP}]
 	dev-lang/perl
 	>=dev-build/meson-0.63.0
 	app-alternatives/ninja
@@ -943,7 +943,7 @@ pkg_postinst() {
 	xdg_icon_cache_update
 
 	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
-		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+		fcaps -m u+s cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
 
 	DISABLE_AUTOFORMATTING=true
 	readme.gentoo_print_elog

From 99be827078e035755ed5d7f7f93d833d3d401570 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:08 +0000
Subject: [PATCH 013/122] app-emulation/qemu-guest-agent: Sync with Gentoo

It's from Gentoo commit eaad88dabfde0d53d9740871962527b3cfb5837d.
---
 .../qemu-guest-agent/qemu-guest-agent-8.2.0.ebuild       | 9 ++++++++-
 .../qemu-guest-agent/qemu-guest-agent-9.2.0.ebuild       | 7 +++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/qemu-guest-agent-8.2.0.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/qemu-guest-agent-8.2.0.ebuild
index d9988b5cbf5..cee1d47b41d 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/qemu-guest-agent-8.2.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/qemu-guest-agent-8.2.0.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -24,6 +24,9 @@ RDEPEND="dev-libs/glib"
 DEPEND="${RDEPEND}"
 BDEPEND="
 	${PYTHON_DEPS}
+	$(python_gen_any_dep '
+		dev-python/distlib[${PYTHON_USEDEP}]
+	')
 	dev-lang/perl
 	app-alternatives/ninja
 "
@@ -32,6 +35,10 @@ PATCHES=(
 	"${FILESDIR}"/qemu-8.1.0-find-sphinx.patch
 )
 
+python_check_deps() {
+	python_has_version "dev-python/distlib[${PYTHON_USEDEP}]"
+}
+
 src_configure() {
 	tc-export AR LD OBJCOPY RANLIB
 
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/qemu-guest-agent-9.2.0.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/qemu-guest-agent-9.2.0.ebuild
index 75d0e3f000d..cee1d47b41d 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/qemu-guest-agent-9.2.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/qemu-guest-agent-9.2.0.ebuild
@@ -24,6 +24,9 @@ RDEPEND="dev-libs/glib"
 DEPEND="${RDEPEND}"
 BDEPEND="
 	${PYTHON_DEPS}
+	$(python_gen_any_dep '
+		dev-python/distlib[${PYTHON_USEDEP}]
+	')
 	dev-lang/perl
 	app-alternatives/ninja
 "
@@ -32,6 +35,10 @@ PATCHES=(
 	"${FILESDIR}"/qemu-8.1.0-find-sphinx.patch
 )
 
+python_check_deps() {
+	python_has_version "dev-python/distlib[${PYTHON_USEDEP}]"
+}
+
 src_configure() {
 	tc-export AR LD OBJCOPY RANLIB
 

From 4ca312354bad46568408f1cfd1796d09ca18f264 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:25 +0000
Subject: [PATCH 014/122] app-shells/bash: Sync with Gentoo

It's from Gentoo commit 06048dd2d2ba27ef398c2355931b63481da7f78f.
---
 .../portage-stable/app-shells/bash/Manifest   |  10 +
 .../app-shells/bash/bash-5.3_p3.ebuild        | 404 ++++++++++++++++++
 .../bash/bash-5.4_alpha_pre20250801.ebuild    | 403 +++++++++++++++++
 .../bash/bash-5.4_alpha_pre20250804.ebuild    | 403 +++++++++++++++++
 .../bash/bash-5.4_alpha_pre20250808.ebuild    | 403 +++++++++++++++++
 .../bash/bash-5.4_alpha_pre20250814.ebuild    | 403 +++++++++++++++++
 6 files changed, 2026 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_p3.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250801.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250804.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250808.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250814.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest b/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
index 1471f39fa3f..ae1b340934b 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
@@ -26,6 +26,10 @@ DIST bash-5.3.tar.gz 11354270 BLAKE2B 88a4f0146eb11698120890f2afaf28210295135f8f
 DIST bash-5.3.tar.gz.sig 95 BLAKE2B 90a6a47b5b318d03ff7e196e6504a987c281f564db878e8452f0543953832b5ac4f767f69a9bdf6b6a98938b0b439040c10674dd54e38ef03730ae6a2ec4484e SHA512 e9da98e993528d69bec9c6da272eb7a96858b4ba33487435f584c7df2d73c3ce82f373b5277cc3a7d8dc9ee04410dc06ce476d3f9ade097121bea0570abe07bc
 DIST bash-5.4_alpha_pre20250711-80a8f650a1defc3f72539c3b57bf6d228c33c116.tar.gz 16111994 BLAKE2B 7ab445c5580c3c8d0af10a6764d65a33705f42ed79c50297a4cbf3b345b2f0ba9f28001a80ec5cc85291f57f88e81aef41492a79779239a33292b460e4361d8f SHA512 64f5985ad9a94fd37bc5efa06a57b72c5b3ec8d43a0ed36d9cdc9f292b37137e035bcba0d9855965e0f7bc2416ae60ec44d8f19ee2201acef01d3eda43d8989b
 DIST bash-5.4_alpha_pre20250718-01070d43248fb97f3b2a08d780ae5a392573ce34.tar.gz 16112469 BLAKE2B 6ebcf65b4f1ae93f52d549d2c6836cd4ff7e87739efa9746ef10f00bf6010f00d957c0624e3b806c4d581539f9160338a00824302b245f4c82c72c416976a0f0 SHA512 b200d62eb6634bf9f623841b7a024dc8b3a89c43b8e127dbc89dbf06f3df793d82ad37d35e1be43558ef97c473e37e44384d8c73736c7b62794e65dcfb8f30ce
+DIST bash-5.4_alpha_pre20250801-c1d9c088531eef0797e78c66b899d895862de80c.tar.gz 16116027 BLAKE2B 1be7657f61e91acc9e5e3bb9d5051f4d9e6f29e5457db544ebd26ac4ff7931925732d8b81de243bf6374ba3ce3aaa133ec6a33f03133e22317d712e696847bed SHA512 44c890bd46ec87ba11b78a0a817ed42544d32df12270c9766f78418e966d3247457facad0e4dcdbf07fd9a6a8865029f3eb3a93c485e01506d67d4ed1c156670
+DIST bash-5.4_alpha_pre20250804-e9053f2a3ae4ed638d269481626e0e5408ae8965.tar.gz 16116218 BLAKE2B 3722dce5927d2864365e3b1b328719b659a9ef5c0ae66cdfb9df3483a6808edeaa26928deada7b927ebf21733eb34f901a65bdfb7700470161bab9eb32df1445 SHA512 6fcca3592928b36a399dfad04d222e147c885b96d622f227eabd57a6252fb31570919b605d5b5297b47bcc727316664e6a0eafb679087a9e1860665654eb8642
+DIST bash-5.4_alpha_pre20250808-ff6cfb1464a39b964204a4f83caab2b8484829a6.tar.gz 16117028 BLAKE2B edcb02792d3cc2eae3e18770853b540bd741da68de17ba47af37d6ab8329c9cd82bfef66c3ae3a33d156e3ba618572ae3fc74d2971cce5cec97e1718f0d74e56 SHA512 65ec39031e34d74591a44056f134e38fd5bd0fd0cad99d471fa3f40bdb33b7ccbbeaad4d55a2b4e521365f8035a9cb36cd9cfb46f27dea193c4562f6f783be68
+DIST bash-5.4_alpha_pre20250814-3160c0b89ce4f3934e791de94f9370b6cfc26ae5.tar.gz 16118231 BLAKE2B a956361f3c111f1e03bdca68678c08cd595c26cfbb926243fe059689d354fde452feb28b984469fd6b201d5aebc5f6007abdf05a824f0e3f7518f945eef78823 SHA512 7ba29f861fd2e7a0162664f0dba14c4bf8cafb9db9ed8ce36564436c8e797cbae1817c6f8fe6450a5f2863b616bd56feba09a045534b998e5c194fe1104b2b04
 DIST bash205b-001 1132 BLAKE2B 0c5eef29777d54ef05957ea3d63b1556fb380bd20c238dc28993d822b37bc4e78ff4048ad069f6b8cd25da77ccdeb7aecd86c4349cb9d81e5e94c7001eeae5e6 SHA512 5ce4357468821b05e747201f3aa57225ad8f540c9e2c87051720490e039c30b478b9b662a68f14a0800fefe40184e4495e2645665200f9d75e9a115b2ac08071
 DIST bash205b-002 755 BLAKE2B 6a6ed5679d451f02f8104b345c1722d11718ce3b4043b581c17786d40d8da69a34786fb56d0c363dba277b8e9dd33f12f70c9cc73a9fc39ba4a8319406f0458d SHA512 46947b0229478d5c2cfeff68b8ebc00e4ef0c8b94e336ca12f72b4490ba3622c0240c01c17c1641c3b07adc2c64ec94d6d780365e8990768ec8888f3a9526883
 DIST bash205b-003 2356 BLAKE2B b7887d00d92fd298cd07a15e1c73b516dabd22ecd74c97091636dd97a0cd55024ed698e5cc924c4311d994dd326b1ad074bea35e7650cf9cf4e25c60d2713fa7 SHA512 74528ca5d165b812d299f1c69b47757bd677c0b22ce4217e155cd641708b02364a93c6709fb57b546b376b36da74429a61493921c7c199563da40ddcf1c1f399
@@ -450,3 +454,9 @@ DIST bash52-036 5941 BLAKE2B e86b0df8ea7ace1ce4bc6f269de389f2f85fbe20e59e6a1e88a
 DIST bash52-036.sig 95 BLAKE2B 5ed270f26471e08456f73498ea8110c514b8e1bae424182f4cf530ab6e4f89a7946cabd3f7dd703f4f4bab7de9c73922e7be688df18df485cd64a33ce98df223 SHA512 7a26b606ab0d7a5716ac49bd1492e3b3480c3764aaec64e1763a2beda7a962c81a4066887c950b3bdd1ada317b790bd985f8b858e78c7cb8eb4a2bd02f1b07cd
 DIST bash52-037 2835 BLAKE2B 4af190d53b498d6d4403f64f39060f1add17edfe3e48b4b58a4377d1e96caa93017aed3df7011a64c99fd908af967603ed287e6bbb0380a8569d170779d8f26a SHA512 3e104dff63dabceea2f56f9dc58869d48a71ce61c3c8aff4f289d2f4a47d4325e70178d520c265a25ddb2227e0b78f08177fcd594470e5e81f4116aad282b4de
 DIST bash52-037.sig 95 BLAKE2B e3cfa89933fe59159a44dc20832406d3c42e28ac0c33674bf369a2f20a1d9de3e985bd178640f17be7b45a4fe3f96c72f80124384cec42fa263eb95586150a3b SHA512 437a69a167a4b889fca40b03eb2dcaa1ddc53db8fde924a6f8bcd21c3ac0c7629cb87b7bc08fa3b16f46b05c6a198a01dce6af3d2b761429345acd361df105dd
+DIST bash53-001 1531 BLAKE2B ca275ade6a7132d316a4d1ffd401c9bfc6de691c58531385d85087c4d50723aeacb5b4bc7abef0165b4fb3cbed146a0fefd9dae4c99c1547f61618798a772d29 SHA512 66d0987f1a8951974c3a707a1980ef391a1f2a2938f0fa46adb77fcdcef6a3ca49e67182b9640ece3e59bb289e5b4a17eb870aa2a525a03e829a7be158d020a6
+DIST bash53-001.sig 95 BLAKE2B 3f795e8881a9ff075b62ba1b3b87610632509b94472d28f04b20cc60f3023c6237dfcaaf030aa1e9533eb87f70ab2555472d22ef9cb6e3f1a9cb1c56467fbc13 SHA512 e27cac36d8f513a255e928b01661aac3c1a594fd254ceab119dcba662e9344ac8807be679953def9a2aab59035836c3e6a2aa7f1b21b6eec1f381dfe286099f5
+DIST bash53-002 2635 BLAKE2B fec52c475b8126774290eab7a514f8145ae51edab150d413c09f5540719c9578fe1cb99987b6190a9cd82bd947e059c32e740a03d26e9d472af51356cafd8a32 SHA512 05caea1c1f5a3d27f2aa351c24f324f9d544ded89db4183ae2872e0283dde62dd6166ca4e780304398935b4aa3fb4db77ecf57acd0f0e295d279ffe40b772158
+DIST bash53-002.sig 95 BLAKE2B 576dd4535af85d122f62e310ddae5cf7eec4ada59b5c73c5a891f3bc50cb6bbad8b47cd74d8c7a868381d340d1c7391f52f7a6f34ae99caf6b4ee290d2808849 SHA512 bd64fc61e5516a636a039c51a33f72e9adb7761d4e4101584b7dc3b43198be026c4165d6a34ca77e1ea5d4122b942dc853803a0c836bffc618aae9f7f8c008aa
+DIST bash53-003 2683 BLAKE2B 6bb6f6679726d65f95c11b4ac1fb0729eaebfeef02de06e9fda4e3ac2bb3d328cc6f7fd6e29976a0907390ed6709cd5a0a6046682acbed73eb0470143bf144e1 SHA512 3d4004653cb3f2cba984e67b8e7ae54c19351e176b62bb415f88fdd482ae04be063dacf6303c8343ab6c8bf4f2388026c1742ac603a5cd5c330db22a4b76f4cb
+DIST bash53-003.sig 95 BLAKE2B 9827f23ea927f39dd20316eec8b311bc7692c5645a77e15eba31d17252a0035d401f620ed9b51b62f643ae0c6c1ed9340e413564151da884b9361d8026557a06 SHA512 f128a82d19d83da70a8c72f3fca52a376a96a31be2b8e94ffd073329a254c5e9f3a231a4b29d33efe12c0b9a20a4c293331c5fc55767fb3538a6208996b7e2bb
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_p3.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_p3.ebuild
new file mode 100644
index 00000000000..b8564f5043c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_p3.ebuild
@@ -0,0 +1,404 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
+inherit flag-o-matic toolchain-funcs prefix verify-sig
+
+# Uncomment if we have a patchset.
+#GENTOO_PATCH_DEV="sam"
+#GENTOO_PATCH_VER="${PV}"
+
+MY_PV=${PV/_p*}
+MY_PV=${MY_PV/_/-}
+MY_P=${PN}-${MY_PV}
+MY_PATCHES=()
+
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
+case ${PV} in
+	9999|*_alpha*|*_beta*|*_rc*)
+		# Set a negative patchlevel to indicate that it's a pre-release.
+		PLEVEL=-1
+		;;
+	*_p*)
+		PLEVEL=${PV##*_p}
+		;;
+	*)
+		PLEVEL=0
+		;;
+esac
+
+# The version of readline this bash normally ships with. Note that we only use
+# the bundled copy of readline for pre-releases.
+READLINE_VER="8.3"
+
+DESCRIPTION="The standard GNU Bourne again shell"
+HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
+	EGIT_BRANCH=devel
+	inherit git-r3
+elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+	# It can be useful to have snapshots in the pre-release period once
+	# the first alpha is out, as various bugs get reported and fixed from
+	# the alpha, and the next pre-release is usually quite far away.
+	#
+	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
+	BASH_COMMIT="b35866a2891a9b069e37ca5684d4309c0391e261"
+	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
+	S=${WORKDIR}/${PN}-${BASH_COMMIT}
+else
+	my_urls=( "mirror://gnu/bash/${MY_P}.tar.gz" )
+
+	# bash-5.1 -> bash51
+	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
+
+	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
+		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
+		my_urls+=( "mirror://gnu/bash/${MY_P}-patches/${my_patch_ver}" )
+		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
+	done
+
+	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
+	S=${WORKDIR}/${MY_P}
+
+	unset -v my_urls my_p my_patch_idx my_patch_ver
+fi
+
+if [[ ${GENTOO_PATCH_VER} ]]; then
+	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+if (( PLEVEL >= 0 )); then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
+
+DEPEND="
+	>=sys-libs/ncurses-5.2-r2:=
+	nls? ( virtual/libintl )
+"
+if (( PLEVEL >= 0 )); then
+	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
+fi
+RDEPEND="
+	${DEPEND}
+"
+# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
+BDEPEND="
+	pgo? ( dev-util/gperf )
+	verify-sig? ( sec-keys/openpgp-keys-chetramey )
+"
+
+# EAPI 8 tries to append it but it doesn't exist here.
+QA_CONFIGURE_OPTIONS="--disable-static"
+
+PATCHES=(
+	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
+
+	# Patches to or from Chet, posted to the bug-bash mailing list.
+	"${FILESDIR}"/${PN}-5.0-syslog-history-extern.patch
+	"${FILESDIR}"/${PN}-5.3-read-sys.patch
+)
+
+pkg_setup() {
+	# bug #7332
+	if is-flag -malign-double; then
+		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
+		eerror "as it breaks LFS (struct stat64) on x86."
+		die "remove -malign-double from your CFLAGS mr ricer"
+	fi
+
+	if use bashlogger; then
+		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
+		ewarn "This will log ALL output you enter into the shell, you have been warned."
+	fi
+}
+
+src_unpack() {
+	local patch
+
+	if [[ ${PV} == 9999 ]]; then
+		git-r3_src_unpack
+	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+		default
+	else
+		if use verify-sig; then
+			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
+
+			for patch in "${MY_PATCHES[@]}"; do
+				verify-sig_verify_detached "${patch}"{,.sig}
+			done
+		fi
+
+		unpack "${MY_P}.tar.gz"
+
+		if [[ ${GENTOO_PATCH_VER} ]]; then
+			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Include official patches.
+	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
+
+	# Prefixify hardcoded path names. No-op for non-prefix.
+	hprefixify pathnames.h.in
+
+	# Avoid regenerating docs after patches, bug #407985.
+	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
+	&& touch -r . doc/* \
+	|| die
+
+	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
+	rm tests/run-jobs || die
+
+	eapply -p0 "${PATCHES[@]}"
+	eapply_user
+}
+
+src_configure() {
+	local -a myconf
+
+	# Upstream only test with Bison and require GNUisms like YYEOF and
+	# YYERRCODE. The former at least may be in POSIX soon:
+	# https://www.austingroupbugs.net/view.php?id=1269.
+	# configure warns on use of non-Bison but doesn't abort. The result
+	# may misbehave at runtime.
+	unset -v YACC
+
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
+	myconf=(
+		--disable-profiling
+
+		# Force linking with system curses ... the bundled termcap lib
+		# sucks bad compared to ncurses.  For the most part, ncurses
+		# is here because readline needs it.  But bash itself calls
+		# ncurses in one or two small places :(.
+		--with-curses
+
+		$(use_enable mem-scramble)
+		$(use_enable net net-redirections)
+		$(use_enable readline)
+		$(use_enable readline bang-history)
+		$(use_enable readline history)
+		$(use_with afs)
+		$(use_with mem-scramble bash-malloc)
+	)
+
+	# For descriptions of these, see config-top.h.
+	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
+	append-cppflags \
+		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
+		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
+		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
+		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
+		-DNON_INTERACTIVE_LOGIN_SHELLS \
+		-DSSH_SOURCE_BASHRC \
+		$(use bashlogger && echo -DSYSLOG_HISTORY)
+
+	use nls || myconf+=( --disable-nls )
+
+	if (( PLEVEL >= 0 )); then
+		# Historically, we always used the builtin readline, but since
+		# our handling of SONAME upgrades has gotten much more stable
+		# in the PM (and the readline ebuild itself preserves the old
+		# libs during upgrades), linking against the system copy should
+		# be safe.
+		# Exact cached version here doesn't really matter as long as it
+		# is at least what's in the DEPEND up above.
+		export ac_cv_rl_version=${READLINE_VER%%_*}
+
+		# Use system readline only with released versions.
+		myconf+=( --with-installed-readline=. )
+	fi
+
+	if use plugins; then
+		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
+	else
+		# Disable the plugins logic by hand since bash doesn't provide
+		# a way of doing it.
+		export ac_cv_func_dl{close,open,sym}=no \
+			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
+
+		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
+	fi
+
+	# bug #444070
+	tc-export AR
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	local -a pgo_generate_flags pgo_use_flags
+	local flag
+
+	# -fprofile-partial-training because upstream notes the test suite isn't
+	# super comprehensive.
+	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	if use pgo; then
+		pgo_generate_flags=(
+			-fprofile-update=atomic
+			-fprofile-dir="${T}"/pgo
+			-fprofile-generate="${T}"/pgo
+		)
+		pgo_use_flags=(
+			-fprofile-use="${T}"/pgo
+			-fprofile-dir="${T}"/pgo
+		)
+		if flag=$(test-flags-CC -fprofile-partial-training); then
+			pgo_generate_flags+=( "${flag}" )
+			pgo_use_flags+=( "${flag}" )
+		fi
+	fi
+
+	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
+	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
+
+	# Build Bash and run its tests to generate profiles.
+	if (( ${#pgo_generate_flags[@]} )); then
+		# Used in test suite.
+		unset -v A
+
+		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
+
+		if tc-is-clang; then
+			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
+		fi
+
+		# Rebuild Bash using the profiling data we just generated.
+		emake clean
+		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
+		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
+	fi
+}
+
+src_test() {
+	# Used in test suite.
+	unset -v A
+
+	default
+}
+
+src_install() {
+	local d f
+
+	default
+
+	my_prefixify() {
+		while read -r; do
+			if [[ $REPLY == *$1* ]]; then
+				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
+			fi
+			printf '%s\n' "${REPLY}" || ! break
+		done < "$2" || die
+	}
+
+	dodir /bin
+	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
+	dosym bash /bin/rbash
+
+	insinto /etc/bash
+	doins "${FILESDIR}"/bash_logout
+	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
+
+	insinto /etc/bash/bashrc.d
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
+	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
+	if [[ ! ${EPREFIX} ]]; then
+		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
+	fi
+
+	insinto /etc/skel
+	for f in bash{_logout,_profile,rc}; do
+		newins "${FILESDIR}/dot-${f}" ".${f}"
+	done
+
+	if use plugins; then
+		exeinto "/usr/$(get_libdir)/bash"
+		set -- examples/loadables/*.o
+		doexe "${@%.o}"
+
+		insinto /usr/include/bash-plugins
+		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
+	fi
+
+	if use examples; then
+		for d in examples/{functions,misc,scripts,startup-files}; do
+			exeinto "/usr/share/doc/${PF}/${d}"
+			docinto "${d}"
+			for f in "${d}"/*; do
+				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
+					doexe "${f}"
+				else
+					dodoc "${f}"
+				fi
+			done
+		done
+	fi
+
+	# Install bash_builtins.1 and rbash.1.
+	emake -C doc DESTDIR="${D}" install_builtins
+	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
+	doman "${T}"/rbash.1
+
+	newdoc CWRU/changelog ChangeLog
+	dosym bash.info /usr/share/info/bashref.info
+}
+
+pkg_preinst() {
+	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
+		mkdir -p -- "${EROOT}"/etc/bash \
+		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
+		|| die
+	fi
+}
+
+pkg_postinst() {
+	local old_ver
+
+	# If /bin/sh does not exist, provide it.
+	if [[ ! -e ${EROOT}/bin/sh ]]; then
+		ln -sf -- bash "${EROOT}"/bin/sh || die
+	fi
+
+	read -r old_ver <<<"${REPLACING_VERSIONS}"
+	if [[ ! $old_ver ]]; then
+		:
+	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
+		return
+	fi
+
+	while read -r; do ewarn "${REPLY}"; done <<'EOF'
+Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
+
+Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
+characteristics of the operating environment, it may contain a command to set
+the terminal's window title. Those who were already choosing to customise the
+PROMPT_COMMAND variable are now advised to append their commands like so:
+
+PROMPT_COMMAND+=('custom command goes here')
+
+Gentoo no longer defaults to having bash set the window title in the case
+that the terminal is controlled by sshd(8), unless screen is launched on the
+remote side or the terminal reliably supports saving and restoring the title
+(as alacritty, foot and tmux do). Those wanting for the title to be set
+regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
+drop-in - to set PROMPT_COMMMAND like so:
+
+PROMPT_COMMAND=(genfun_set_win_title)
+
+Those who would prefer for bash never to interfere with the window title may
+now opt out of the default title setting behaviour, either with the "unset -v
+PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
+EOF
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250801.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250801.ebuild
new file mode 100644
index 00000000000..1300218c38d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250801.ebuild
@@ -0,0 +1,403 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
+inherit flag-o-matic toolchain-funcs prefix verify-sig
+
+# Uncomment if we have a patchset.
+#GENTOO_PATCH_DEV="sam"
+#GENTOO_PATCH_VER="${PV}"
+
+MY_PV=${PV/_p*}
+MY_PV=${MY_PV/_/-}
+MY_P=${PN}-${MY_PV}
+MY_PATCHES=()
+
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
+case ${PV} in
+	9999|*_alpha*|*_beta*|*_rc*)
+		# Set a negative patchlevel to indicate that it's a pre-release.
+		PLEVEL=-1
+		;;
+	*_p*)
+		PLEVEL=${PV##*_p}
+		;;
+	*)
+		PLEVEL=0
+		;;
+esac
+
+# The version of readline this bash normally ships with. Note that we only use
+# the bundled copy of readline for pre-releases.
+READLINE_VER="8.3"
+
+DESCRIPTION="The standard GNU Bourne again shell"
+HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
+	EGIT_BRANCH=devel
+	inherit git-r3
+elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+	# It can be useful to have snapshots in the pre-release period once
+	# the first alpha is out, as various bugs get reported and fixed from
+	# the alpha, and the next pre-release is usually quite far away.
+	#
+	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
+	BASH_COMMIT="c1d9c088531eef0797e78c66b899d895862de80c"
+	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
+	S=${WORKDIR}/${PN}-${BASH_COMMIT}
+else
+	my_urls=( "mirror://gnu/bash/${MY_P}.tar.gz" )
+
+	# bash-5.1 -> bash51
+	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
+
+	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
+		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
+		my_urls+=( "mirror://gnu/bash/${MY_P}-patches/${my_patch_ver}" )
+		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
+	done
+
+	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
+	S=${WORKDIR}/${MY_P}
+
+	unset -v my_urls my_p my_patch_idx my_patch_ver
+fi
+
+if [[ ${GENTOO_PATCH_VER} ]]; then
+	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+if (( PLEVEL >= 0 )); then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
+
+DEPEND="
+	>=sys-libs/ncurses-5.2-r2:=
+	nls? ( virtual/libintl )
+"
+if (( PLEVEL >= 0 )); then
+	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
+fi
+RDEPEND="
+	${DEPEND}
+"
+# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
+BDEPEND="
+	pgo? ( dev-util/gperf )
+	verify-sig? ( sec-keys/openpgp-keys-chetramey )
+"
+
+# EAPI 8 tries to append it but it doesn't exist here.
+QA_CONFIGURE_OPTIONS="--disable-static"
+
+PATCHES=(
+	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
+
+	# Patches to or from Chet, posted to the bug-bash mailing list.
+	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
+)
+
+pkg_setup() {
+	# bug #7332
+	if is-flag -malign-double; then
+		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
+		eerror "as it breaks LFS (struct stat64) on x86."
+		die "remove -malign-double from your CFLAGS mr ricer"
+	fi
+
+	if use bashlogger; then
+		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
+		ewarn "This will log ALL output you enter into the shell, you have been warned."
+	fi
+}
+
+src_unpack() {
+	local patch
+
+	if [[ ${PV} == 9999 ]]; then
+		git-r3_src_unpack
+	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+		default
+	else
+		if use verify-sig; then
+			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
+
+			for patch in "${MY_PATCHES[@]}"; do
+				verify-sig_verify_detached "${patch}"{,.sig}
+			done
+		fi
+
+		unpack "${MY_P}.tar.gz"
+
+		if [[ ${GENTOO_PATCH_VER} ]]; then
+			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Include official patches.
+	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
+
+	# Prefixify hardcoded path names. No-op for non-prefix.
+	hprefixify pathnames.h.in
+
+	# Avoid regenerating docs after patches, bug #407985.
+	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
+	&& touch -r . doc/* \
+	|| die
+
+	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
+	rm tests/run-jobs || die
+
+	eapply -p0 "${PATCHES[@]}"
+	eapply_user
+}
+
+src_configure() {
+	local -a myconf
+
+	# Upstream only test with Bison and require GNUisms like YYEOF and
+	# YYERRCODE. The former at least may be in POSIX soon:
+	# https://www.austingroupbugs.net/view.php?id=1269.
+	# configure warns on use of non-Bison but doesn't abort. The result
+	# may misbehave at runtime.
+	unset -v YACC
+
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
+	myconf=(
+		--disable-profiling
+
+		# Force linking with system curses ... the bundled termcap lib
+		# sucks bad compared to ncurses.  For the most part, ncurses
+		# is here because readline needs it.  But bash itself calls
+		# ncurses in one or two small places :(.
+		--with-curses
+
+		$(use_enable mem-scramble)
+		$(use_enable net net-redirections)
+		$(use_enable readline)
+		$(use_enable readline bang-history)
+		$(use_enable readline history)
+		$(use_with afs)
+		$(use_with mem-scramble bash-malloc)
+	)
+
+	# For descriptions of these, see config-top.h.
+	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
+	append-cppflags \
+		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
+		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
+		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
+		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
+		-DNON_INTERACTIVE_LOGIN_SHELLS \
+		-DSSH_SOURCE_BASHRC \
+		$(use bashlogger && echo -DSYSLOG_HISTORY)
+
+	use nls || myconf+=( --disable-nls )
+
+	if (( PLEVEL >= 0 )); then
+		# Historically, we always used the builtin readline, but since
+		# our handling of SONAME upgrades has gotten much more stable
+		# in the PM (and the readline ebuild itself preserves the old
+		# libs during upgrades), linking against the system copy should
+		# be safe.
+		# Exact cached version here doesn't really matter as long as it
+		# is at least what's in the DEPEND up above.
+		export ac_cv_rl_version=${READLINE_VER%%_*}
+
+		# Use system readline only with released versions.
+		myconf+=( --with-installed-readline=. )
+	fi
+
+	if use plugins; then
+		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
+	else
+		# Disable the plugins logic by hand since bash doesn't provide
+		# a way of doing it.
+		export ac_cv_func_dl{close,open,sym}=no \
+			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
+
+		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
+	fi
+
+	# bug #444070
+	tc-export AR
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	local -a pgo_generate_flags pgo_use_flags
+	local flag
+
+	# -fprofile-partial-training because upstream notes the test suite isn't
+	# super comprehensive.
+	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	if use pgo; then
+		pgo_generate_flags=(
+			-fprofile-update=atomic
+			-fprofile-dir="${T}"/pgo
+			-fprofile-generate="${T}"/pgo
+		)
+		pgo_use_flags=(
+			-fprofile-use="${T}"/pgo
+			-fprofile-dir="${T}"/pgo
+		)
+		if flag=$(test-flags-CC -fprofile-partial-training); then
+			pgo_generate_flags+=( "${flag}" )
+			pgo_use_flags+=( "${flag}" )
+		fi
+	fi
+
+	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
+	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
+
+	# Build Bash and run its tests to generate profiles.
+	if (( ${#pgo_generate_flags[@]} )); then
+		# Used in test suite.
+		unset -v A
+
+		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
+
+		if tc-is-clang; then
+			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
+		fi
+
+		# Rebuild Bash using the profiling data we just generated.
+		emake clean
+		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
+		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
+	fi
+}
+
+src_test() {
+	# Used in test suite.
+	unset -v A
+
+	default
+}
+
+src_install() {
+	local d f
+
+	default
+
+	my_prefixify() {
+		while read -r; do
+			if [[ $REPLY == *$1* ]]; then
+				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
+			fi
+			printf '%s\n' "${REPLY}" || ! break
+		done < "$2" || die
+	}
+
+	dodir /bin
+	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
+	dosym bash /bin/rbash
+
+	insinto /etc/bash
+	doins "${FILESDIR}"/bash_logout
+	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
+
+	insinto /etc/bash/bashrc.d
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
+	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
+	if [[ ! ${EPREFIX} ]]; then
+		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
+	fi
+
+	insinto /etc/skel
+	for f in bash{_logout,_profile,rc}; do
+		newins "${FILESDIR}/dot-${f}" ".${f}"
+	done
+
+	if use plugins; then
+		exeinto "/usr/$(get_libdir)/bash"
+		set -- examples/loadables/*.o
+		doexe "${@%.o}"
+
+		insinto /usr/include/bash-plugins
+		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
+	fi
+
+	if use examples; then
+		for d in examples/{functions,misc,scripts,startup-files}; do
+			exeinto "/usr/share/doc/${PF}/${d}"
+			docinto "${d}"
+			for f in "${d}"/*; do
+				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
+					doexe "${f}"
+				else
+					dodoc "${f}"
+				fi
+			done
+		done
+	fi
+
+	# Install bash_builtins.1 and rbash.1.
+	emake -C doc DESTDIR="${D}" install_builtins
+	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
+	doman "${T}"/rbash.1
+
+	newdoc CWRU/changelog ChangeLog
+	dosym bash.info /usr/share/info/bashref.info
+}
+
+pkg_preinst() {
+	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
+		mkdir -p -- "${EROOT}"/etc/bash \
+		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
+		|| die
+	fi
+}
+
+pkg_postinst() {
+	local old_ver
+
+	# If /bin/sh does not exist, provide it.
+	if [[ ! -e ${EROOT}/bin/sh ]]; then
+		ln -sf -- bash "${EROOT}"/bin/sh || die
+	fi
+
+	read -r old_ver <<<"${REPLACING_VERSIONS}"
+	if [[ ! $old_ver ]]; then
+		:
+	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
+		return
+	fi
+
+	while read -r; do ewarn "${REPLY}"; done <<'EOF'
+Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
+
+Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
+characteristics of the operating environment, it may contain a command to set
+the terminal's window title. Those who were already choosing to customise the
+PROMPT_COMMAND variable are now advised to append their commands like so:
+
+PROMPT_COMMAND+=('custom command goes here')
+
+Gentoo no longer defaults to having bash set the window title in the case
+that the terminal is controlled by sshd(8), unless screen is launched on the
+remote side or the terminal reliably supports saving and restoring the title
+(as alacritty, foot and tmux do). Those wanting for the title to be set
+regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
+drop-in - to set PROMPT_COMMMAND like so:
+
+PROMPT_COMMAND=(genfun_set_win_title)
+
+Those who would prefer for bash never to interfere with the window title may
+now opt out of the default title setting behaviour, either with the "unset -v
+PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
+EOF
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250804.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250804.ebuild
new file mode 100644
index 00000000000..f27b9b18e93
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250804.ebuild
@@ -0,0 +1,403 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
+inherit flag-o-matic toolchain-funcs prefix verify-sig
+
+# Uncomment if we have a patchset.
+#GENTOO_PATCH_DEV="sam"
+#GENTOO_PATCH_VER="${PV}"
+
+MY_PV=${PV/_p*}
+MY_PV=${MY_PV/_/-}
+MY_P=${PN}-${MY_PV}
+MY_PATCHES=()
+
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
+case ${PV} in
+	9999|*_alpha*|*_beta*|*_rc*)
+		# Set a negative patchlevel to indicate that it's a pre-release.
+		PLEVEL=-1
+		;;
+	*_p*)
+		PLEVEL=${PV##*_p}
+		;;
+	*)
+		PLEVEL=0
+		;;
+esac
+
+# The version of readline this bash normally ships with. Note that we only use
+# the bundled copy of readline for pre-releases.
+READLINE_VER="8.3"
+
+DESCRIPTION="The standard GNU Bourne again shell"
+HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
+	EGIT_BRANCH=devel
+	inherit git-r3
+elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+	# It can be useful to have snapshots in the pre-release period once
+	# the first alpha is out, as various bugs get reported and fixed from
+	# the alpha, and the next pre-release is usually quite far away.
+	#
+	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
+	BASH_COMMIT="e9053f2a3ae4ed638d269481626e0e5408ae8965"
+	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
+	S=${WORKDIR}/${PN}-${BASH_COMMIT}
+else
+	my_urls=( "mirror://gnu/bash/${MY_P}.tar.gz" )
+
+	# bash-5.1 -> bash51
+	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
+
+	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
+		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
+		my_urls+=( "mirror://gnu/bash/${MY_P}-patches/${my_patch_ver}" )
+		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
+	done
+
+	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
+	S=${WORKDIR}/${MY_P}
+
+	unset -v my_urls my_p my_patch_idx my_patch_ver
+fi
+
+if [[ ${GENTOO_PATCH_VER} ]]; then
+	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+if (( PLEVEL >= 0 )); then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
+
+DEPEND="
+	>=sys-libs/ncurses-5.2-r2:=
+	nls? ( virtual/libintl )
+"
+if (( PLEVEL >= 0 )); then
+	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
+fi
+RDEPEND="
+	${DEPEND}
+"
+# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
+BDEPEND="
+	pgo? ( dev-util/gperf )
+	verify-sig? ( sec-keys/openpgp-keys-chetramey )
+"
+
+# EAPI 8 tries to append it but it doesn't exist here.
+QA_CONFIGURE_OPTIONS="--disable-static"
+
+PATCHES=(
+	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
+
+	# Patches to or from Chet, posted to the bug-bash mailing list.
+	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
+)
+
+pkg_setup() {
+	# bug #7332
+	if is-flag -malign-double; then
+		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
+		eerror "as it breaks LFS (struct stat64) on x86."
+		die "remove -malign-double from your CFLAGS mr ricer"
+	fi
+
+	if use bashlogger; then
+		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
+		ewarn "This will log ALL output you enter into the shell, you have been warned."
+	fi
+}
+
+src_unpack() {
+	local patch
+
+	if [[ ${PV} == 9999 ]]; then
+		git-r3_src_unpack
+	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+		default
+	else
+		if use verify-sig; then
+			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
+
+			for patch in "${MY_PATCHES[@]}"; do
+				verify-sig_verify_detached "${patch}"{,.sig}
+			done
+		fi
+
+		unpack "${MY_P}.tar.gz"
+
+		if [[ ${GENTOO_PATCH_VER} ]]; then
+			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Include official patches.
+	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
+
+	# Prefixify hardcoded path names. No-op for non-prefix.
+	hprefixify pathnames.h.in
+
+	# Avoid regenerating docs after patches, bug #407985.
+	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
+	&& touch -r . doc/* \
+	|| die
+
+	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
+	rm tests/run-jobs || die
+
+	eapply -p0 "${PATCHES[@]}"
+	eapply_user
+}
+
+src_configure() {
+	local -a myconf
+
+	# Upstream only test with Bison and require GNUisms like YYEOF and
+	# YYERRCODE. The former at least may be in POSIX soon:
+	# https://www.austingroupbugs.net/view.php?id=1269.
+	# configure warns on use of non-Bison but doesn't abort. The result
+	# may misbehave at runtime.
+	unset -v YACC
+
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
+	myconf=(
+		--disable-profiling
+
+		# Force linking with system curses ... the bundled termcap lib
+		# sucks bad compared to ncurses.  For the most part, ncurses
+		# is here because readline needs it.  But bash itself calls
+		# ncurses in one or two small places :(.
+		--with-curses
+
+		$(use_enable mem-scramble)
+		$(use_enable net net-redirections)
+		$(use_enable readline)
+		$(use_enable readline bang-history)
+		$(use_enable readline history)
+		$(use_with afs)
+		$(use_with mem-scramble bash-malloc)
+	)
+
+	# For descriptions of these, see config-top.h.
+	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
+	append-cppflags \
+		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
+		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
+		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
+		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
+		-DNON_INTERACTIVE_LOGIN_SHELLS \
+		-DSSH_SOURCE_BASHRC \
+		$(use bashlogger && echo -DSYSLOG_HISTORY)
+
+	use nls || myconf+=( --disable-nls )
+
+	if (( PLEVEL >= 0 )); then
+		# Historically, we always used the builtin readline, but since
+		# our handling of SONAME upgrades has gotten much more stable
+		# in the PM (and the readline ebuild itself preserves the old
+		# libs during upgrades), linking against the system copy should
+		# be safe.
+		# Exact cached version here doesn't really matter as long as it
+		# is at least what's in the DEPEND up above.
+		export ac_cv_rl_version=${READLINE_VER%%_*}
+
+		# Use system readline only with released versions.
+		myconf+=( --with-installed-readline=. )
+	fi
+
+	if use plugins; then
+		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
+	else
+		# Disable the plugins logic by hand since bash doesn't provide
+		# a way of doing it.
+		export ac_cv_func_dl{close,open,sym}=no \
+			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
+
+		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
+	fi
+
+	# bug #444070
+	tc-export AR
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	local -a pgo_generate_flags pgo_use_flags
+	local flag
+
+	# -fprofile-partial-training because upstream notes the test suite isn't
+	# super comprehensive.
+	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	if use pgo; then
+		pgo_generate_flags=(
+			-fprofile-update=atomic
+			-fprofile-dir="${T}"/pgo
+			-fprofile-generate="${T}"/pgo
+		)
+		pgo_use_flags=(
+			-fprofile-use="${T}"/pgo
+			-fprofile-dir="${T}"/pgo
+		)
+		if flag=$(test-flags-CC -fprofile-partial-training); then
+			pgo_generate_flags+=( "${flag}" )
+			pgo_use_flags+=( "${flag}" )
+		fi
+	fi
+
+	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
+	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
+
+	# Build Bash and run its tests to generate profiles.
+	if (( ${#pgo_generate_flags[@]} )); then
+		# Used in test suite.
+		unset -v A
+
+		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
+
+		if tc-is-clang; then
+			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
+		fi
+
+		# Rebuild Bash using the profiling data we just generated.
+		emake clean
+		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
+		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
+	fi
+}
+
+src_test() {
+	# Used in test suite.
+	unset -v A
+
+	default
+}
+
+src_install() {
+	local d f
+
+	default
+
+	my_prefixify() {
+		while read -r; do
+			if [[ $REPLY == *$1* ]]; then
+				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
+			fi
+			printf '%s\n' "${REPLY}" || ! break
+		done < "$2" || die
+	}
+
+	dodir /bin
+	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
+	dosym bash /bin/rbash
+
+	insinto /etc/bash
+	doins "${FILESDIR}"/bash_logout
+	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
+
+	insinto /etc/bash/bashrc.d
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
+	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
+	if [[ ! ${EPREFIX} ]]; then
+		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
+	fi
+
+	insinto /etc/skel
+	for f in bash{_logout,_profile,rc}; do
+		newins "${FILESDIR}/dot-${f}" ".${f}"
+	done
+
+	if use plugins; then
+		exeinto "/usr/$(get_libdir)/bash"
+		set -- examples/loadables/*.o
+		doexe "${@%.o}"
+
+		insinto /usr/include/bash-plugins
+		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
+	fi
+
+	if use examples; then
+		for d in examples/{functions,misc,scripts,startup-files}; do
+			exeinto "/usr/share/doc/${PF}/${d}"
+			docinto "${d}"
+			for f in "${d}"/*; do
+				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
+					doexe "${f}"
+				else
+					dodoc "${f}"
+				fi
+			done
+		done
+	fi
+
+	# Install bash_builtins.1 and rbash.1.
+	emake -C doc DESTDIR="${D}" install_builtins
+	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
+	doman "${T}"/rbash.1
+
+	newdoc CWRU/changelog ChangeLog
+	dosym bash.info /usr/share/info/bashref.info
+}
+
+pkg_preinst() {
+	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
+		mkdir -p -- "${EROOT}"/etc/bash \
+		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
+		|| die
+	fi
+}
+
+pkg_postinst() {
+	local old_ver
+
+	# If /bin/sh does not exist, provide it.
+	if [[ ! -e ${EROOT}/bin/sh ]]; then
+		ln -sf -- bash "${EROOT}"/bin/sh || die
+	fi
+
+	read -r old_ver <<<"${REPLACING_VERSIONS}"
+	if [[ ! $old_ver ]]; then
+		:
+	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
+		return
+	fi
+
+	while read -r; do ewarn "${REPLY}"; done <<'EOF'
+Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
+
+Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
+characteristics of the operating environment, it may contain a command to set
+the terminal's window title. Those who were already choosing to customise the
+PROMPT_COMMAND variable are now advised to append their commands like so:
+
+PROMPT_COMMAND+=('custom command goes here')
+
+Gentoo no longer defaults to having bash set the window title in the case
+that the terminal is controlled by sshd(8), unless screen is launched on the
+remote side or the terminal reliably supports saving and restoring the title
+(as alacritty, foot and tmux do). Those wanting for the title to be set
+regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
+drop-in - to set PROMPT_COMMMAND like so:
+
+PROMPT_COMMAND=(genfun_set_win_title)
+
+Those who would prefer for bash never to interfere with the window title may
+now opt out of the default title setting behaviour, either with the "unset -v
+PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
+EOF
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250808.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250808.ebuild
new file mode 100644
index 00000000000..111048455db
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250808.ebuild
@@ -0,0 +1,403 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
+inherit flag-o-matic toolchain-funcs prefix verify-sig
+
+# Uncomment if we have a patchset.
+#GENTOO_PATCH_DEV="sam"
+#GENTOO_PATCH_VER="${PV}"
+
+MY_PV=${PV/_p*}
+MY_PV=${MY_PV/_/-}
+MY_P=${PN}-${MY_PV}
+MY_PATCHES=()
+
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
+case ${PV} in
+	9999|*_alpha*|*_beta*|*_rc*)
+		# Set a negative patchlevel to indicate that it's a pre-release.
+		PLEVEL=-1
+		;;
+	*_p*)
+		PLEVEL=${PV##*_p}
+		;;
+	*)
+		PLEVEL=0
+		;;
+esac
+
+# The version of readline this bash normally ships with. Note that we only use
+# the bundled copy of readline for pre-releases.
+READLINE_VER="8.3"
+
+DESCRIPTION="The standard GNU Bourne again shell"
+HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
+	EGIT_BRANCH=devel
+	inherit git-r3
+elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+	# It can be useful to have snapshots in the pre-release period once
+	# the first alpha is out, as various bugs get reported and fixed from
+	# the alpha, and the next pre-release is usually quite far away.
+	#
+	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
+	BASH_COMMIT="ff6cfb1464a39b964204a4f83caab2b8484829a6"
+	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
+	S=${WORKDIR}/${PN}-${BASH_COMMIT}
+else
+	my_urls=( "mirror://gnu/bash/${MY_P}.tar.gz" )
+
+	# bash-5.1 -> bash51
+	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
+
+	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
+		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
+		my_urls+=( "mirror://gnu/bash/${MY_P}-patches/${my_patch_ver}" )
+		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
+	done
+
+	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
+	S=${WORKDIR}/${MY_P}
+
+	unset -v my_urls my_p my_patch_idx my_patch_ver
+fi
+
+if [[ ${GENTOO_PATCH_VER} ]]; then
+	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+if (( PLEVEL >= 0 )); then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
+
+DEPEND="
+	>=sys-libs/ncurses-5.2-r2:=
+	nls? ( virtual/libintl )
+"
+if (( PLEVEL >= 0 )); then
+	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
+fi
+RDEPEND="
+	${DEPEND}
+"
+# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
+BDEPEND="
+	pgo? ( dev-util/gperf )
+	verify-sig? ( sec-keys/openpgp-keys-chetramey )
+"
+
+# EAPI 8 tries to append it but it doesn't exist here.
+QA_CONFIGURE_OPTIONS="--disable-static"
+
+PATCHES=(
+	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
+
+	# Patches to or from Chet, posted to the bug-bash mailing list.
+	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
+)
+
+pkg_setup() {
+	# bug #7332
+	if is-flag -malign-double; then
+		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
+		eerror "as it breaks LFS (struct stat64) on x86."
+		die "remove -malign-double from your CFLAGS mr ricer"
+	fi
+
+	if use bashlogger; then
+		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
+		ewarn "This will log ALL output you enter into the shell, you have been warned."
+	fi
+}
+
+src_unpack() {
+	local patch
+
+	if [[ ${PV} == 9999 ]]; then
+		git-r3_src_unpack
+	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+		default
+	else
+		if use verify-sig; then
+			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
+
+			for patch in "${MY_PATCHES[@]}"; do
+				verify-sig_verify_detached "${patch}"{,.sig}
+			done
+		fi
+
+		unpack "${MY_P}.tar.gz"
+
+		if [[ ${GENTOO_PATCH_VER} ]]; then
+			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Include official patches.
+	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
+
+	# Prefixify hardcoded path names. No-op for non-prefix.
+	hprefixify pathnames.h.in
+
+	# Avoid regenerating docs after patches, bug #407985.
+	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
+	&& touch -r . doc/* \
+	|| die
+
+	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
+	rm tests/run-jobs || die
+
+	eapply -p0 "${PATCHES[@]}"
+	eapply_user
+}
+
+src_configure() {
+	local -a myconf
+
+	# Upstream only test with Bison and require GNUisms like YYEOF and
+	# YYERRCODE. The former at least may be in POSIX soon:
+	# https://www.austingroupbugs.net/view.php?id=1269.
+	# configure warns on use of non-Bison but doesn't abort. The result
+	# may misbehave at runtime.
+	unset -v YACC
+
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
+	myconf=(
+		--disable-profiling
+
+		# Force linking with system curses ... the bundled termcap lib
+		# sucks bad compared to ncurses.  For the most part, ncurses
+		# is here because readline needs it.  But bash itself calls
+		# ncurses in one or two small places :(.
+		--with-curses
+
+		$(use_enable mem-scramble)
+		$(use_enable net net-redirections)
+		$(use_enable readline)
+		$(use_enable readline bang-history)
+		$(use_enable readline history)
+		$(use_with afs)
+		$(use_with mem-scramble bash-malloc)
+	)
+
+	# For descriptions of these, see config-top.h.
+	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
+	append-cppflags \
+		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
+		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
+		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
+		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
+		-DNON_INTERACTIVE_LOGIN_SHELLS \
+		-DSSH_SOURCE_BASHRC \
+		$(use bashlogger && echo -DSYSLOG_HISTORY)
+
+	use nls || myconf+=( --disable-nls )
+
+	if (( PLEVEL >= 0 )); then
+		# Historically, we always used the builtin readline, but since
+		# our handling of SONAME upgrades has gotten much more stable
+		# in the PM (and the readline ebuild itself preserves the old
+		# libs during upgrades), linking against the system copy should
+		# be safe.
+		# Exact cached version here doesn't really matter as long as it
+		# is at least what's in the DEPEND up above.
+		export ac_cv_rl_version=${READLINE_VER%%_*}
+
+		# Use system readline only with released versions.
+		myconf+=( --with-installed-readline=. )
+	fi
+
+	if use plugins; then
+		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
+	else
+		# Disable the plugins logic by hand since bash doesn't provide
+		# a way of doing it.
+		export ac_cv_func_dl{close,open,sym}=no \
+			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
+
+		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
+	fi
+
+	# bug #444070
+	tc-export AR
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	local -a pgo_generate_flags pgo_use_flags
+	local flag
+
+	# -fprofile-partial-training because upstream notes the test suite isn't
+	# super comprehensive.
+	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	if use pgo; then
+		pgo_generate_flags=(
+			-fprofile-update=atomic
+			-fprofile-dir="${T}"/pgo
+			-fprofile-generate="${T}"/pgo
+		)
+		pgo_use_flags=(
+			-fprofile-use="${T}"/pgo
+			-fprofile-dir="${T}"/pgo
+		)
+		if flag=$(test-flags-CC -fprofile-partial-training); then
+			pgo_generate_flags+=( "${flag}" )
+			pgo_use_flags+=( "${flag}" )
+		fi
+	fi
+
+	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
+	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
+
+	# Build Bash and run its tests to generate profiles.
+	if (( ${#pgo_generate_flags[@]} )); then
+		# Used in test suite.
+		unset -v A
+
+		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
+
+		if tc-is-clang; then
+			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
+		fi
+
+		# Rebuild Bash using the profiling data we just generated.
+		emake clean
+		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
+		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
+	fi
+}
+
+src_test() {
+	# Used in test suite.
+	unset -v A
+
+	default
+}
+
+src_install() {
+	local d f
+
+	default
+
+	my_prefixify() {
+		while read -r; do
+			if [[ $REPLY == *$1* ]]; then
+				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
+			fi
+			printf '%s\n' "${REPLY}" || ! break
+		done < "$2" || die
+	}
+
+	dodir /bin
+	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
+	dosym bash /bin/rbash
+
+	insinto /etc/bash
+	doins "${FILESDIR}"/bash_logout
+	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
+
+	insinto /etc/bash/bashrc.d
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
+	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
+	if [[ ! ${EPREFIX} ]]; then
+		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
+	fi
+
+	insinto /etc/skel
+	for f in bash{_logout,_profile,rc}; do
+		newins "${FILESDIR}/dot-${f}" ".${f}"
+	done
+
+	if use plugins; then
+		exeinto "/usr/$(get_libdir)/bash"
+		set -- examples/loadables/*.o
+		doexe "${@%.o}"
+
+		insinto /usr/include/bash-plugins
+		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
+	fi
+
+	if use examples; then
+		for d in examples/{functions,misc,scripts,startup-files}; do
+			exeinto "/usr/share/doc/${PF}/${d}"
+			docinto "${d}"
+			for f in "${d}"/*; do
+				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
+					doexe "${f}"
+				else
+					dodoc "${f}"
+				fi
+			done
+		done
+	fi
+
+	# Install bash_builtins.1 and rbash.1.
+	emake -C doc DESTDIR="${D}" install_builtins
+	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
+	doman "${T}"/rbash.1
+
+	newdoc CWRU/changelog ChangeLog
+	dosym bash.info /usr/share/info/bashref.info
+}
+
+pkg_preinst() {
+	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
+		mkdir -p -- "${EROOT}"/etc/bash \
+		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
+		|| die
+	fi
+}
+
+pkg_postinst() {
+	local old_ver
+
+	# If /bin/sh does not exist, provide it.
+	if [[ ! -e ${EROOT}/bin/sh ]]; then
+		ln -sf -- bash "${EROOT}"/bin/sh || die
+	fi
+
+	read -r old_ver <<<"${REPLACING_VERSIONS}"
+	if [[ ! $old_ver ]]; then
+		:
+	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
+		return
+	fi
+
+	while read -r; do ewarn "${REPLY}"; done <<'EOF'
+Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
+
+Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
+characteristics of the operating environment, it may contain a command to set
+the terminal's window title. Those who were already choosing to customise the
+PROMPT_COMMAND variable are now advised to append their commands like so:
+
+PROMPT_COMMAND+=('custom command goes here')
+
+Gentoo no longer defaults to having bash set the window title in the case
+that the terminal is controlled by sshd(8), unless screen is launched on the
+remote side or the terminal reliably supports saving and restoring the title
+(as alacritty, foot and tmux do). Those wanting for the title to be set
+regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
+drop-in - to set PROMPT_COMMMAND like so:
+
+PROMPT_COMMAND=(genfun_set_win_title)
+
+Those who would prefer for bash never to interfere with the window title may
+now opt out of the default title setting behaviour, either with the "unset -v
+PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
+EOF
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250814.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250814.ebuild
new file mode 100644
index 00000000000..c2cd9c07682
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250814.ebuild
@@ -0,0 +1,403 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
+inherit flag-o-matic toolchain-funcs prefix verify-sig
+
+# Uncomment if we have a patchset.
+#GENTOO_PATCH_DEV="sam"
+#GENTOO_PATCH_VER="${PV}"
+
+MY_PV=${PV/_p*}
+MY_PV=${MY_PV/_/-}
+MY_P=${PN}-${MY_PV}
+MY_PATCHES=()
+
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
+case ${PV} in
+	9999|*_alpha*|*_beta*|*_rc*)
+		# Set a negative patchlevel to indicate that it's a pre-release.
+		PLEVEL=-1
+		;;
+	*_p*)
+		PLEVEL=${PV##*_p}
+		;;
+	*)
+		PLEVEL=0
+		;;
+esac
+
+# The version of readline this bash normally ships with. Note that we only use
+# the bundled copy of readline for pre-releases.
+READLINE_VER="8.3"
+
+DESCRIPTION="The standard GNU Bourne again shell"
+HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
+	EGIT_BRANCH=devel
+	inherit git-r3
+elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+	# It can be useful to have snapshots in the pre-release period once
+	# the first alpha is out, as various bugs get reported and fixed from
+	# the alpha, and the next pre-release is usually quite far away.
+	#
+	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
+	BASH_COMMIT="3160c0b89ce4f3934e791de94f9370b6cfc26ae5"
+	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
+	S=${WORKDIR}/${PN}-${BASH_COMMIT}
+else
+	my_urls=( "mirror://gnu/bash/${MY_P}.tar.gz" )
+
+	# bash-5.1 -> bash51
+	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
+
+	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
+		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
+		my_urls+=( "mirror://gnu/bash/${MY_P}-patches/${my_patch_ver}" )
+		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
+	done
+
+	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
+	S=${WORKDIR}/${MY_P}
+
+	unset -v my_urls my_p my_patch_idx my_patch_ver
+fi
+
+if [[ ${GENTOO_PATCH_VER} ]]; then
+	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+if (( PLEVEL >= 0 )); then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
+
+DEPEND="
+	>=sys-libs/ncurses-5.2-r2:=
+	nls? ( virtual/libintl )
+"
+if (( PLEVEL >= 0 )); then
+	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
+fi
+RDEPEND="
+	${DEPEND}
+"
+# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
+BDEPEND="
+	pgo? ( dev-util/gperf )
+	verify-sig? ( sec-keys/openpgp-keys-chetramey )
+"
+
+# EAPI 8 tries to append it but it doesn't exist here.
+QA_CONFIGURE_OPTIONS="--disable-static"
+
+PATCHES=(
+	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
+
+	# Patches to or from Chet, posted to the bug-bash mailing list.
+	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
+)
+
+pkg_setup() {
+	# bug #7332
+	if is-flag -malign-double; then
+		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
+		eerror "as it breaks LFS (struct stat64) on x86."
+		die "remove -malign-double from your CFLAGS mr ricer"
+	fi
+
+	if use bashlogger; then
+		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
+		ewarn "This will log ALL output you enter into the shell, you have been warned."
+	fi
+}
+
+src_unpack() {
+	local patch
+
+	if [[ ${PV} == 9999 ]]; then
+		git-r3_src_unpack
+	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+		default
+	else
+		if use verify-sig; then
+			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
+
+			for patch in "${MY_PATCHES[@]}"; do
+				verify-sig_verify_detached "${patch}"{,.sig}
+			done
+		fi
+
+		unpack "${MY_P}.tar.gz"
+
+		if [[ ${GENTOO_PATCH_VER} ]]; then
+			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Include official patches.
+	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
+
+	# Prefixify hardcoded path names. No-op for non-prefix.
+	hprefixify pathnames.h.in
+
+	# Avoid regenerating docs after patches, bug #407985.
+	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
+	&& touch -r . doc/* \
+	|| die
+
+	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
+	rm tests/run-jobs || die
+
+	eapply -p0 "${PATCHES[@]}"
+	eapply_user
+}
+
+src_configure() {
+	local -a myconf
+
+	# Upstream only test with Bison and require GNUisms like YYEOF and
+	# YYERRCODE. The former at least may be in POSIX soon:
+	# https://www.austingroupbugs.net/view.php?id=1269.
+	# configure warns on use of non-Bison but doesn't abort. The result
+	# may misbehave at runtime.
+	unset -v YACC
+
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
+	myconf=(
+		--disable-profiling
+
+		# Force linking with system curses ... the bundled termcap lib
+		# sucks bad compared to ncurses.  For the most part, ncurses
+		# is here because readline needs it.  But bash itself calls
+		# ncurses in one or two small places :(.
+		--with-curses
+
+		$(use_enable mem-scramble)
+		$(use_enable net net-redirections)
+		$(use_enable readline)
+		$(use_enable readline bang-history)
+		$(use_enable readline history)
+		$(use_with afs)
+		$(use_with mem-scramble bash-malloc)
+	)
+
+	# For descriptions of these, see config-top.h.
+	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
+	append-cppflags \
+		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
+		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
+		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
+		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
+		-DNON_INTERACTIVE_LOGIN_SHELLS \
+		-DSSH_SOURCE_BASHRC \
+		$(use bashlogger && echo -DSYSLOG_HISTORY)
+
+	use nls || myconf+=( --disable-nls )
+
+	if (( PLEVEL >= 0 )); then
+		# Historically, we always used the builtin readline, but since
+		# our handling of SONAME upgrades has gotten much more stable
+		# in the PM (and the readline ebuild itself preserves the old
+		# libs during upgrades), linking against the system copy should
+		# be safe.
+		# Exact cached version here doesn't really matter as long as it
+		# is at least what's in the DEPEND up above.
+		export ac_cv_rl_version=${READLINE_VER%%_*}
+
+		# Use system readline only with released versions.
+		myconf+=( --with-installed-readline=. )
+	fi
+
+	if use plugins; then
+		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
+	else
+		# Disable the plugins logic by hand since bash doesn't provide
+		# a way of doing it.
+		export ac_cv_func_dl{close,open,sym}=no \
+			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
+
+		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
+	fi
+
+	# bug #444070
+	tc-export AR
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	local -a pgo_generate_flags pgo_use_flags
+	local flag
+
+	# -fprofile-partial-training because upstream notes the test suite isn't
+	# super comprehensive.
+	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	if use pgo; then
+		pgo_generate_flags=(
+			-fprofile-update=atomic
+			-fprofile-dir="${T}"/pgo
+			-fprofile-generate="${T}"/pgo
+		)
+		pgo_use_flags=(
+			-fprofile-use="${T}"/pgo
+			-fprofile-dir="${T}"/pgo
+		)
+		if flag=$(test-flags-CC -fprofile-partial-training); then
+			pgo_generate_flags+=( "${flag}" )
+			pgo_use_flags+=( "${flag}" )
+		fi
+	fi
+
+	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
+	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
+
+	# Build Bash and run its tests to generate profiles.
+	if (( ${#pgo_generate_flags[@]} )); then
+		# Used in test suite.
+		unset -v A
+
+		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
+
+		if tc-is-clang; then
+			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
+		fi
+
+		# Rebuild Bash using the profiling data we just generated.
+		emake clean
+		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
+		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
+	fi
+}
+
+src_test() {
+	# Used in test suite.
+	unset -v A
+
+	default
+}
+
+src_install() {
+	local d f
+
+	default
+
+	my_prefixify() {
+		while read -r; do
+			if [[ $REPLY == *$1* ]]; then
+				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
+			fi
+			printf '%s\n' "${REPLY}" || ! break
+		done < "$2" || die
+	}
+
+	dodir /bin
+	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
+	dosym bash /bin/rbash
+
+	insinto /etc/bash
+	doins "${FILESDIR}"/bash_logout
+	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
+
+	insinto /etc/bash/bashrc.d
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
+	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
+	if [[ ! ${EPREFIX} ]]; then
+		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
+	fi
+
+	insinto /etc/skel
+	for f in bash{_logout,_profile,rc}; do
+		newins "${FILESDIR}/dot-${f}" ".${f}"
+	done
+
+	if use plugins; then
+		exeinto "/usr/$(get_libdir)/bash"
+		set -- examples/loadables/*.o
+		doexe "${@%.o}"
+
+		insinto /usr/include/bash-plugins
+		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
+	fi
+
+	if use examples; then
+		for d in examples/{functions,misc,scripts,startup-files}; do
+			exeinto "/usr/share/doc/${PF}/${d}"
+			docinto "${d}"
+			for f in "${d}"/*; do
+				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
+					doexe "${f}"
+				else
+					dodoc "${f}"
+				fi
+			done
+		done
+	fi
+
+	# Install bash_builtins.1 and rbash.1.
+	emake -C doc DESTDIR="${D}" install_builtins
+	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
+	doman "${T}"/rbash.1
+
+	newdoc CWRU/changelog ChangeLog
+	dosym bash.info /usr/share/info/bashref.info
+}
+
+pkg_preinst() {
+	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
+		mkdir -p -- "${EROOT}"/etc/bash \
+		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
+		|| die
+	fi
+}
+
+pkg_postinst() {
+	local old_ver
+
+	# If /bin/sh does not exist, provide it.
+	if [[ ! -e ${EROOT}/bin/sh ]]; then
+		ln -sf -- bash "${EROOT}"/bin/sh || die
+	fi
+
+	read -r old_ver <<<"${REPLACING_VERSIONS}"
+	if [[ ! $old_ver ]]; then
+		:
+	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
+		return
+	fi
+
+	while read -r; do ewarn "${REPLY}"; done <<'EOF'
+Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
+
+Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
+characteristics of the operating environment, it may contain a command to set
+the terminal's window title. Those who were already choosing to customise the
+PROMPT_COMMAND variable are now advised to append their commands like so:
+
+PROMPT_COMMAND+=('custom command goes here')
+
+Gentoo no longer defaults to having bash set the window title in the case
+that the terminal is controlled by sshd(8), unless screen is launched on the
+remote side or the terminal reliably supports saving and restoring the title
+(as alacritty, foot and tmux do). Those wanting for the title to be set
+regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
+drop-in - to set PROMPT_COMMMAND like so:
+
+PROMPT_COMMAND=(genfun_set_win_title)
+
+Those who would prefer for bash never to interfere with the window title may
+now opt out of the default title setting behaviour, either with the "unset -v
+PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
+EOF
+}

From c8a613ec7b374ec1ba4bf6c9d9489bda836719c1 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:25 +0000
Subject: [PATCH 015/122] app-shells/bash-completion: Sync with Gentoo

It's from Gentoo commit 06b7ac9f63663d7b80ed950d6f1fbddeb94be9a1.
---
 .../bash-completion-2.16.0-r2.ebuild          | 169 ++++++++++++++++++
 .../bash-completion-9999.ebuild               |   2 -
 2 files changed, 169 insertions(+), 2 deletions(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-2.16.0-r2.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-2.16.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-2.16.0-r2.ebuild
new file mode 100644
index 00000000000..292bac941f5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-2.16.0-r2.ebuild
@@ -0,0 +1,169 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+BASHCOMP_P=bashcomp-2.0.3
+PYTHON_COMPAT=( python3_{10..13} )
+
+inherit autotools python-any-r1
+
+DESCRIPTION="Programmable Completion for bash"
+HOMEPAGE="https://github.com/scop/bash-completion"
+SRC_URI="
+	https://github.com/scop/bash-completion/releases/download/${PV}/${P}.tar.xz
+	eselect? (
+		https://github.com/projg2/bashcomp2/releases/download/v${BASHCOMP_P#*-}/${BASHCOMP_P}.tar.gz
+	)
+"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+IUSE="+eselect test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=app-shells/bash-4.3_p30-r1:0
+	sys-apps/miscfiles
+	!<app-text/tree-2.1.1-r1
+	!!<=net-fs/mc-2025.04.16.18.13.26
+"
+BDEPEND="
+	test? (
+		${RDEPEND}
+		$(python_gen_any_dep '
+			dev-python/pexpect[${PYTHON_USEDEP}]
+			dev-python/pytest[${PYTHON_USEDEP}]
+			dev-python/pytest-xdist[${PYTHON_USEDEP}]
+		')
+	)
+"
+PDEPEND="
+	>=app-shells/gentoo-bashcomp-20140911
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.14.0-optimize-kernel-modules.patch
+	"${FILESDIR}"/${PN}-2.16.0-libsecret-completion.patch
+)
+
+strip_completions() {
+	# Remove unwanted completions.
+	local strip_completions=(
+		# Slackware package stuff, quite generic names cause collisions
+		# (e.g. with sys-apps/pacman)
+		explodepkg installpkg makepkg pkgtool removepkg upgradepkg
+
+		# Debian/Red Hat network stuff
+		ifdown ifup ifquery ifstatus
+
+		# Installed in app-editors/vim-core
+		xxd
+
+		# Now-dead symlinks to deprecated completions
+		hd ncal
+
+		# For GNU mailman, which isn't packaged. If mailman isn't installed,
+		# it triggers a QA warning.
+		arch
+	)
+
+	local file
+	for file in "${strip_completions[@]}"; do
+		rm "${ED}"/usr/share/bash-completion/completions/${file} ||
+			die "stripping ${file} failed"
+	done
+
+	# remove deprecated completions (moved to other packages)
+	rm "${ED}"/usr/share/bash-completion/completions/_* || die
+}
+
+python_check_deps() {
+	python_has_version "dev-python/pexpect[${PYTHON_USEDEP}]" &&
+	python_has_version "dev-python/pytest[${PYTHON_USEDEP}]" &&
+	python_has_version "dev-python/pytest-xdist[${PYTHON_USEDEP}]"
+}
+
+pkg_setup() {
+	use test && python-any-r1_pkg_setup
+}
+
+src_prepare() {
+	if use eselect; then
+		eapply "${WORKDIR}/${BASHCOMP_P}/bash-completion-blacklist-support.patch"
+	fi
+
+	default
+	# Only needed for ${PN}-2.16.0-libsecret-completion.patch
+	eautoreconf
+}
+
+src_test() {
+	local EPYTEST_DESELECT=(
+		# redhat-specific, we strip these completions
+		test/t/test_if{down,up}.py
+		# not available for icedtea
+		test/t/test_javaws.py
+		# TODO
+		test/t/test_vi.py::TestVi::test_2
+		test/t/test_xmlwf.py::TestXmlwf::test_2 #bug 886159
+		test/t/test_xrandr.py::TestXrandr::test_output_filter
+		test/t/unit/test_unit_dequote.py
+		test/t/test_sudo.py::TestSudo::test_1 #bug 935400
+		test/t/test_xfreerdp.py::TestXfreerdp::test_6 #bug 935400
+		test/t/unit/test_unit_command_offset.py::TestUnitCommandOffset::test_cmd_quoted #bug 931744
+		test/t/test_make.py::TestMake::test_6 #bug 931744
+	)
+	local EPYTEST_IGNORE=(
+		# stupid test that async tests work
+		test/fixtures/pytest/test_async.py
+	)
+	local EPYTEST_XDIST=1
+
+	# portage's HOME override breaks tests
+	local -x HOME=$(unset HOME; echo ~)
+	addpredict "${HOME}"
+	# used in pytest tests
+	local -x NETWORK=none
+	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+	local -x PYTEST_PLUGINS=xdist.plugin
+	emake -C completions check
+	epytest
+}
+
+src_install() {
+	# work-around race conditions, bug #526996
+	mkdir -p "${ED}"/usr/share/bash-completion/{completions,helpers} || die
+
+	emake DESTDIR="${D}" profiledir="${EPREFIX}"/etc/bash/bashrc.d install
+
+	strip_completions
+
+	dodoc AUTHORS CHANGELOG.md CONTRIBUTING.md README.md
+
+	# install the python completions for all targets, bug #622892
+	local TARGET
+	for TARGET in "${PYTHON_COMPAT[@]}"; do
+		if [[ ! -e "${ED}"/usr/share/bash-completion/completions/${TARGET/_/.} ]]; then
+			dosym python "${ED}"/usr/share/bash-completion/completions/${TARGET/_/.}
+		fi
+	done
+
+	# install the eselect module
+	if use eselect; then
+		insinto /usr/share/eselect/modules
+		doins "${WORKDIR}/${BASHCOMP_P}/bashcomp.eselect"
+		doman "${WORKDIR}/${BASHCOMP_P}/bashcomp.eselect.5"
+	fi
+}
+
+pkg_postinst() {
+	if has_version 'app-shells/zsh'; then
+		elog
+		elog "If you are interested in using the provided bash completion functions with"
+		elog "zsh, valuable tips on the effective use of bashcompinit are available:"
+		elog "  http://www.zsh.org/mla/workers/2003/msg00046.html"
+		elog
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-9999.ebuild
index 437c7a111cf..3489ced000b 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-9999.ebuild
@@ -16,12 +16,10 @@ SLOT="0"
 IUSE="+eselect test"
 RESTRICT="!test? ( test )"
 
-# completion collision with net-fs/mc
 RDEPEND="
 	>=app-shells/bash-4.3_p30-r1:0
 	sys-apps/miscfiles
 	!<app-text/tree-2.1.1-r1
-	!!net-fs/mc
 "
 BDEPEND="
 	test? (

From 30e463e057c0d3f919ee1386d625bdb96a42d369 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:25 +0000
Subject: [PATCH 016/122] app-shells/gentoo-bashcomp: Sync with Gentoo

It's from Gentoo commit 61f1385fd761b18516f5c7908936d0965117639d.
---
 .../app-shells/gentoo-bashcomp/gentoo-bashcomp-20250620.ebuild  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/app-shells/gentoo-bashcomp/gentoo-bashcomp-20250620.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/gentoo-bashcomp/gentoo-bashcomp-20250620.ebuild
index f39e47a2534..2bc307d6f96 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/gentoo-bashcomp/gentoo-bashcomp-20250620.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/gentoo-bashcomp/gentoo-bashcomp-20250620.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://gitweb.gentoo.org/proj/${PN}.git/snapshot/${P}.tar.bz2"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
 
 src_install() {
 	emake DESTDIR="${D}" install \

From 07ec691dcc6a50ab32865e12489dbc7b38fce055 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:39 +0000
Subject: [PATCH 017/122] dev-build/cmake: Sync with Gentoo

It's from Gentoo commit 342875635fd0bad4a078eedea969f3863cf74e17.
---
 .../portage-stable/dev-build/cmake/Manifest   |   3 +
 .../dev-build/cmake/cmake-4.1.0.ebuild        | 321 ++++++++++++++++++
 2 files changed, 324 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.1.0.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest b/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
index bf67a044391..1e9e4711396 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
@@ -16,3 +16,6 @@ DIST cmake-4.0.0_rc1-docs.tar.xz 577536 BLAKE2B 74a742ffef8e1af1652746e1c177d419
 DIST cmake-4.0.3-SHA-256.txt 2015 BLAKE2B a346da6aa064c5b390459ab265680e0835f4a66fae6c957cedce302da13daa31e8387b1113b049d5518a2b0431d6ee9ad8fd10abec9e6b35502f954cc02a15ee SHA512 f1ce0d1d9ca3286d311611de2da19de543105dfedda5f0449648a79d0c4ecb2a221aad540915bdc3f1904966c79c60b828cb8a7e6198a718f6f6906bd07697eb
 DIST cmake-4.0.3-SHA-256.txt.asc 833 BLAKE2B 0e82305e93eedfe888e2c54590e509aad58f5d634d3112c66ff5eff622619aef53e4d97f67921b5998082117430d541220df6e2e58656749ae8620aad4928a8a SHA512 d502d87bbf5bb24bdd2d6a0a1d97b854dcc09e17b00e6fa9af4610eb5984b46fd2d7a2a01c15e89bbeed25882738fa764d4b7746c4e25c197d9017277c6f95b8
 DIST cmake-4.0.3.tar.gz 11830216 BLAKE2B 4dc2705baf2404b64da88a5b8838850b782849a4dcdfb0eaefa819ba00a018885a8bd0b42f17f92c8e24b9e76c66e60880377017d8e2d584cb75b2978018e214 SHA512 d3fb9ef408a1b13cd6ef1c294b2515733d1c7220c2c639426bd8037d023ebb439f02e412dd8dd42e385b8e3553547d785eeedc47f2b0843e413b88bd5a7eab18
+DIST cmake-4.1.0-SHA-256.txt 2015 BLAKE2B cbbe940911a0bfb18a0fb0dcc714ad750f348c1a7f7e176816cc6d9e32e0ae4b3f0c1ace3779e17cb443f2cce2b41bf53d756a20b665a3bdcb95d4acd0b6638f SHA512 e81e07abae94588a5ed9cb62396dba04885ed8ddda98751c991af970509e07e6899896d998b52c04c67e58e81e1af243fc64bf7a127e37027385539c5cf6a050
+DIST cmake-4.1.0-SHA-256.txt.asc 833 BLAKE2B 28b6415e1e60f81cf3295573ad43e732fbd53b8d8c76b589a56ea9a8abb02bc7de1d0875fe55ffde8588368a1555f8010769b6ffa92ef860a085b15d0b7f5917 SHA512 beb141dbb66c302a6aff1667afa56898f266e9f8d630e75b806bc2e59178ba56f5a84022b5c9d2e24fb8e762168644ba49fe059812750132c2b11b5821ee456a
+DIST cmake-4.1.0.tar.gz 12042798 BLAKE2B 57e086b18f24d97e386a391151b09fe228feb22fbf0af31f26859069cf269de32b763d1545cdd18f5f73ede1980a83cb21a2b9a8a04a5aa0b08f2525def4c134 SHA512 644b6b13539ba0e7f35a7496e4240b1d3361606163f35b69006e47d03ffd9759d35c62a73826253ed168af4196df29983ec10c0f561ea74d7ed6ffee0c2cd8e4
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.1.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.1.0.ebuild
new file mode 100644
index 00000000000..d5c57e85205
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.1.0.ebuild
@@ -0,0 +1,321 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-cmake-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+: ${CMAKE_DOCS_PREBUILT:=1}
+
+CMAKE_DOCS_PREBUILT_DEV=sam
+CMAKE_DOCS_VERSION=4.0.0_rc1
+#CMAKE_DOCS_VERSION=${PV}
+#CMAKE_DOCS_VERSION=$(ver_cut 1-2).0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# See bug #784815
+CMAKE_DOCS_USEFLAG="+doc"
+
+# TODO RunCMake.LinkWhatYouUse fails consistently w/ ninja
+# ... but seems fine as of 3.22.3?
+# TODO ... but bootstrap sometimes(?) fails with ninja now. bug #834759.
+CMAKE_MAKEFILE_GENERATOR="emake"
+CMAKE_REMOVE_MODULES_LIST=( none )
+inherit bash-completion-r1 cmake flag-o-matic multiprocessing \
+	toolchain-funcs xdg-utils
+
+MY_P="${P/_/-}"
+
+DESCRIPTION="Cross platform Make"
+HOMEPAGE="https://cmake.org/"
+if [[ ${PV} == *9999* ]] ; then
+	CMAKE_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.kitware.com/cmake/cmake.git"
+	inherit git-r3
+else
+	SRC_URI="https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}.tar.gz"
+
+	if [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${CMAKE_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${CMAKE_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/bradking.asc
+	inherit verify-sig
+
+	SRC_URI+=" verify-sig? (
+		https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}-SHA-256.txt
+		https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}-SHA-256.txt.asc
+		https://github.com/Kitware/CMake/releases/download/v${PV/_/-}/${MY_P}-SHA-256.txt
+		https://github.com/Kitware/CMake/releases/download/v${PV/_/-}/${MY_P}-SHA-256.txt.asc
+	)"
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+
+	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-bradking-20240902 )"
+fi
+
+[[ ${CMAKE_DOCS_PREBUILT} == 1 ]] && CMAKE_DOCS_USEFLAG="doc"
+
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="BSD"
+SLOT="0"
+IUSE="${CMAKE_DOCS_USEFLAG} dap gui ncurses test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=app-arch/libarchive-3.3.3:=
+	app-crypt/rhash:0=
+	>=dev-libs/expat-2.0.1
+	>=dev-libs/jsoncpp-1.9.2-r2:0=
+	>=dev-libs/libuv-1.10.0:=
+	>=net-misc/curl-7.21.5[ssl]
+	sys-libs/zlib
+	virtual/pkgconfig
+	dap? ( dev-cpp/cppdap )
+	gui? ( dev-qt/qtbase:6[gui,widgets] )
+	ncurses? ( sys-libs/ncurses:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND+="
+	doc? (
+		dev-python/requests
+		dev-python/sphinx
+	)
+	test? ( app-arch/libarchive[zstd] )
+"
+
+SITEFILE="50${PN}-gentoo.el"
+
+PATCHES=(
+	# Prefix
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0001-Don-t-use-.so-for-modules-on-darwin-macos.-Use-.bund.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0002-Set-some-proper-paths-to-make-cmake-find-our-tools.patch
+	# Misc
+	"${FILESDIR}"/${PN}-3.31.6-Prefer-pkgconfig-in-FindBLAS.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0004-Ensure-that-the-correct-version-of-Qt-is-always-used.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0005-Respect-Gentoo-s-Python-eclasses.patch
+	# Cuda
+	"${FILESDIR}/${PN}-3.30.3-cudahostld.patch"
+
+	# Upstream fixes (can usually be removed with a version bump)
+)
+
+cmake_src_bootstrap() {
+	# disable running of cmake in bootstrap command
+	sed -i \
+		-e '/"${cmake_bootstrap_dir}\/cmake"/s/^/#DONOTRUN /' \
+		bootstrap || die "sed failed"
+
+	# execinfo.h on Solaris isn't quite what it is on Darwin
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		sed -i -e 's/execinfo\.h/blablabla.h/' \
+			Source/kwsys/CMakeLists.txt || die
+	fi
+
+	# bootstrap script isn't exactly /bin/sh compatible
+	tc-env_build ${CONFIG_SHELL:-sh} ./bootstrap \
+		--prefix="${T}/cmakestrap/" \
+		--parallel=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)") \
+		|| die "Bootstrap failed"
+}
+
+pkg_pretend() {
+	if [[ -z ${EPREFIX} ]] ; then
+		local file
+		local errant_files=()
+
+		# See bug #599684 and bug #753581 (at least)
+		for file in /etc/arch-release /etc/redhat-release /etc/debian_version ; do
+			if [[ -e ${file} ]]; then
+				errant_files+=( "${file}" )
+			fi
+		done
+
+		# If errant files exist
+		if [[ ${#errant_files[@]} -gt 0 ]]; then
+			eerror "Errant files found!"
+			eerror "The presence of these files is known to confuse CMake's"
+			eerror "library path logic. Please (re)move these files:"
+
+			for file in "${errant_files[@]}"; do
+				eerror " mv ${file} ${file}.bak"
+			done
+
+			die "Stray files found in /etc/, see above message"
+		fi
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	elif [[ ${PV} == *_rc* ]] || ! use verify-sig ; then
+		default
+	else
+		cd "${DISTDIR}" || die
+
+		# See https://mgorny.pl/articles/verify-sig-by-example.html#verifying-using-a-checksum-file-with-a-detached-signature
+		verify-sig_verify_detached ${MY_P}-SHA-256.txt{,.asc}
+		verify-sig_verify_unsigned_checksums ${MY_P}-SHA-256.txt sha256 ${MY_P}.tar.gz
+
+		cd "${WORKDIR}" || die
+
+		default
+	fi
+}
+
+src_prepare() {
+	cmake_src_prepare
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# Disable Xcode hooks, bug #652134
+		sed -i -e 's/cm\(\|Global\|Local\)XCode[^.]\+\.\(cxx\|h\)//' \
+			Source/CMakeLists.txt || die
+		sed -i -e '/define CMAKE_USE_XCODE/s/XCODE/NO_XCODE/' \
+			-e '/cmGlobalXCodeGenerator.h/d' \
+			Source/cmake.cxx || die
+		# Disable system integration, bug #933744
+		sed -i -e 's/__APPLE__/__DISABLED__/' \
+			Source/cmFindProgramCommand.cxx \
+			Source/CPack/cmCPackGeneratorFactory.cxx || die
+		sed -i -e 's/__MAC_OS_X_VERSION_MIN_REQUIRED/__DISABLED__/' \
+			Source/cmMachO.cxx || die
+		sed -i -e 's:CPack/cmCPack\(Bundle\|DragNDrop\|PKG\|ProductBuild\)Generator.cxx::' \
+			Source/CMakeLists.txt || die
+
+		# Disable isysroot usage with GCC, we've properly instructed
+		# where things are via GCC configuration and ldwrapper
+		sed -i -e '/cmake_gnu_set_sysroot_flag/d' \
+			Modules/Platform/Apple-GNU-*.cmake || die
+		# Disable isysroot usage with clang as well
+		sed -i -e '/_SYSROOT_FLAG/d' \
+			Modules/Platform/Apple-Clang.cmake || die
+		# Don't set a POSIX standard, system headers don't like that, #757426
+		sed -i -e 's/^#if !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
+			Source/cmLoadCommandCommand.cxx \
+			Source/cmStandardLexer.h \
+			Source/cmSystemTools.cxx \
+			Source/cmTimestamp.cxx
+		sed -i -e 's/^#if !defined(_POSIX_C_SOURCE) && !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
+			Source/cmStandardLexer.h
+	fi
+
+	# Add gcc libs to the default link paths
+	sed -i \
+		-e "s|@GENTOO_PORTAGE_GCCLIBDIR@|${EPREFIX}/usr/${CHOST}/lib/|g" \
+		-e "$(usex prefix-guest "s|@GENTOO_HOST@||" "/@GENTOO_HOST@/d")" \
+		-e "s|@GENTOO_PORTAGE_EPREFIX@|${EPREFIX}/|g" \
+		Modules/Platform/{UnixPaths,Darwin}.cmake || die "sed failed"
+
+	## in theory we could handle these flags in src_configure, as we do in many other packages. But we *must*
+	## handle them as part of bootstrapping, sadly.
+
+	# Fix linking on Solaris
+	[[ ${CHOST} == *-solaris* ]] && append-ldflags -lsocket -lnsl
+
+	# ODR warnings, bug #858335
+	# https://gitlab.kitware.com/cmake/cmake/-/issues/20740
+	filter-lto
+
+	# 4.0.0_rc1 is missing this, fails to configure
+	# https://gitlab.kitware.com/cmake/cmake/-/issues/26712
+	touch .clang-tidy Utilities/.clang-tidy || die
+
+	if ! has_version -b \>=${CATEGORY}/${PN}-3.13 || ! cmake --version &>/dev/null ; then
+		CMAKE_BINARY="${S}/Bootstrap.cmk/cmake"
+		cmake_src_bootstrap
+	fi
+}
+
+src_configure() {
+	local mycmakeargs=(
+		-DCMAKE_USE_SYSTEM_LIBRARIES=ON
+		-DCMake_ENABLE_DEBUGGER=$(usex dap)
+		-DCMAKE_DOC_DIR=/share/doc/${PF}
+		-DCMAKE_MAN_DIR=/share/man
+		-DCMAKE_DATA_DIR=/share/${PN}
+		-DSPHINX_MAN=$(usex doc)
+		-DSPHINX_HTML=$(usex doc)
+		-DBUILD_CursesDialog="$(usex ncurses)"
+		-DBUILD_TESTING=$(usex test)
+		-DBUILD_QtDialog=$(usex gui)
+	)
+
+	use gui && mycmakeargs+=( -DCMake_QT_MAJOR_VERSION=6 )
+
+	cmake_src_configure
+}
+
+src_test() {
+	# Fix OutDir and SelectLibraryConfigurations tests
+	# these are altered thanks to our eclass
+	sed -i -e 's:^#_cmake_modify_IGNORE ::g' \
+		"${S}"/Tests/{OutDir,CMakeOnly/SelectLibraryConfigurations}/CMakeLists.txt \
+		|| die
+
+	unset CLICOLOR CLICOLOR_FORCE CMAKE_COMPILER_COLOR_DIAGNOSTICS CMAKE_COLOR_DIAGNOSTICS
+
+	pushd "${BUILD_DIR}" > /dev/null || die
+
+	# Excluded tests:
+	#    BootstrapTest: we actually bootstrap it every time so why test it?
+	#    BundleUtilities: bundle creation broken
+	#    CMakeOnly.AllFindModules: pthread issues
+	#    CTest.updatecvs: which fails to commit as root
+	#    Fortran: requires fortran
+	#    RunCMake.CompilerLauncher: also requires fortran
+	#    RunCMake.CPack_RPM: breaks if app-arch/rpm is installed because
+	#        debugedit binary is not in the expected location
+	#    RunCMake.CPack_DEB: breaks if app-arch/dpkg is installed because
+	#        it can't find a deb package that owns libc
+	#    TestUpload, which requires network access
+	#    RunCMake.CMP0125, known failure reported upstream (bug #829414)
+	local myctestargs=(
+		--output-on-failure
+		-E "(BootstrapTest|BundleUtilities|CMakeOnly.AllFindModules|CompileOptions|CTest.UpdateCVS|Fortran|RunCMake.CompilerLauncher|RunCMake.CPack_(DEB|RPM)|TestUpload|RunCMake.CMP0125)" \
+	)
+
+	local -x QT_QPA_PLATFORM=offscreen
+
+	cmake_src_test
+}
+
+src_install() {
+	cmake_src_install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${CMAKE_DOCS_VERSION}-docs/man*/*.[0-8]
+	fi
+
+	insinto /usr/share/vim/vimfiles/syntax
+	doins Auxiliary/vim/syntax/cmake.vim
+
+	insinto /usr/share/vim/vimfiles/indent
+	doins Auxiliary/vim/indent/cmake.vim
+
+	insinto /usr/share/vim/vimfiles/ftdetect
+	doins "${FILESDIR}/${PN}.vim"
+
+	dobashcomp Auxiliary/bash-completion/{${PN},ctest,cpack}
+}
+
+pkg_postinst() {
+	if use gui; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+		xdg_mimeinfo_database_update
+	fi
+}
+
+pkg_postrm() {
+	if use gui; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+		xdg_mimeinfo_database_update
+	fi
+}

From 04fa56ca9a8778eb6b0012f5b0c8233c5b168841 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:41 +0000
Subject: [PATCH 018/122] dev-build/make: Sync with Gentoo

It's from Gentoo commit 12ce12eed8b679d9f1bddba5e29fff7664667b74.
---
 .../portage-stable/dev-build/make/make-9999.ebuild     | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-build/make/make-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/make/make-9999.ebuild
index f23c2c0c378..8fe498fd755 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/make/make-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/make/make-9999.ebuild
@@ -10,7 +10,6 @@ inherit flag-o-matic unpacker verify-sig guile-single
 DESCRIPTION="Standard tool to compile source trees"
 HOMEPAGE="https://www.gnu.org/software/make/make.html"
 if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/git/make.git"
 	inherit autotools git-r3
 elif [[ $(ver_cut 3) -ge 90 || $(ver_cut 4) -ge 90 ]] ; then
 	SRC_URI="https://alpha.gnu.org/gnu/make/${P}.tar.lz"
@@ -50,6 +49,15 @@ PATCHES=(
 
 src_unpack() {
 	if [[ ${PV} == 9999 ]] ; then
+		EGIT_REPO_URI=("https://git.savannah.gnu.org/git/make.git")
+		git-r3_src_unpack
+
+		EGIT_REPO_URI=(
+			"https://github.com/coreutils/gnulib/"
+			"https://git.savannah.gnu.org/git/gnulib.git"
+		)
+		EGIT_BRANCH=$(. "${S}/bootstrap.conf" && echo "${GNULIB_REVISION}" || die)
+		EGIT_CHECKOUT_DIR=${S}/gnulib
 		git-r3_src_unpack
 
 		cd "${S}" || die

From 4ae10796b01a7b0ec23f3987de825847f1ddc8ba Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:41 +0000
Subject: [PATCH 019/122] dev-build/meson: Sync with Gentoo

It's from Gentoo commit 4da7ed0f81b99509aa9bbc112173d38e62edca7e.
---
 .../portage-stable/dev-build/meson/Manifest   |   6 +
 .../dev-build/meson/meson-1.7.0.ebuild        |   1 +
 .../dev-build/meson/meson-1.7.2.ebuild        |   7 +-
 .../dev-build/meson/meson-1.8.3.ebuild        | 231 ++++++++++++++++++
 .../dev-build/meson/meson-1.9.0_rc2.ebuild    | 231 ++++++++++++++++++
 .../dev-build/meson/meson-9999.ebuild         |   4 +-
 6 files changed, 476 insertions(+), 4 deletions(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.8.3.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.9.0_rc2.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest b/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest
index 4be4857a8d4..358e5717417 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest
@@ -18,6 +18,10 @@ DIST meson-1.8.1.tar.gz 2332007 BLAKE2B 8fa77bd0e1494d94de585f8f740cb01dfc302fef
 DIST meson-1.8.1.tar.gz.asc 833 BLAKE2B a31c10eb386597049eed127987dfa32f044fbd2ec0261fa0547c066a47a57e27893821f80eb6a7ad82fd72278ff77abdaf4a88fd057b9b960edd8626530a17be SHA512 5d6a0681ccd1132f86904b88fdef4838a9de403d29b6dddb8d8626ce3f1e9d1d911b79f821aa81cd1421fd4c095ca488494a1b77e59f94ba616504eef251dbc7
 DIST meson-1.8.2.tar.gz 2335538 BLAKE2B c3a4e2c505af02b85407f66bb076d4c1a96ca0fde85576d26d8ad6522dce8107f1bdb97c771b0f28e527da0383853b36cd56e8533d5be175cf62b7fbadca40b6 SHA512 d3d87c806a0ac8405af9205cc2c9a5f2dbeda8639506bf96bfb3821aa8184c185a1afc29738a54b47902ef830c1b5253e3ee3542a3f9bbc8fd91b9ea02f0a0b7
 DIST meson-1.8.2.tar.gz.asc 833 BLAKE2B c59ef68cf74daf9658c6589cc037a21bbc9fa03134093b1a30425ba19a69036868c1c7bd1c7f26b486a6eb9e6e13796f02b52e7caa78701d546d9da3f7591b41 SHA512 9f6dbe0329a8f1685110fadd803239eb675b67f59f2f1988494ec6e95110aca754ff7dbb6edad708c53b9420bd09c2d115af5f9f879175a9e37cb28f978add8b
+DIST meson-1.8.3.tar.gz 2335924 BLAKE2B 3c440854bd91c757d4370b498f0e6e903df4589f4958e05fa16ae70e6efc01d2e96f101612146556b81cc3db370255f4319bd5d49d8e46210df282cc447ec12e SHA512 effd6f556152e508185a5bc59131b3a31696577298aec5f3d3ab68153ade9e98242171d6b72c00f8c32fc3492aba3487252d77a94a96b5a92e89724de045d49b
+DIST meson-1.8.3.tar.gz.asc 833 BLAKE2B 25f00f76819c74e64b3750ddd4507fdd8a0be764db54ea48ba49f0985bfbf04d294e5eff1ee799ec082cba24ed59b21a8fd75f81dee9d824e5f8cd9c775b0dcd SHA512 9c28747ff4756422dae4eb4a86de24fe230e6676660aa9cfb72d29311012106a9edbcfff3559682917a7e0ed8c80af8b8ec37807d3f7e0f4005eed5793367307
+DIST meson-1.9.0rc2.tar.gz 2367323 BLAKE2B fbc00274c7c7b434517d8dffa80bf7bde13847b45ed9942b75495a2446e8e9721fde083d0ed446577771548e61c5e2bb12dbd7512ee2ccf8c8929519600d7652 SHA512 d50553e211ba68f27865c01dd3e00f48feda430f047b5be9725fe45b14dd3fb68a256668fbc70e7773e1076cc8f993a1c1006d106e2bf0d0eb8fef6773608fd6
+DIST meson-1.9.0rc2.tar.gz.asc 833 BLAKE2B a9d8c571520b2015bcb0f18eacc20df3f0e2d0da1cf560f405163ac077935eea1b57e342cb69610fff88b077c4bf8d7a4706c1c8825ab8e138bd5eb07226fc2b SHA512 fd34b5abca57fb31ef113006d0ae20997f800a57f60eff192d3a2e1a7d8c27237090b104b4863f24552997952732b3031e78700b2f16bc5cf780a36c5b04e3ac
 DIST meson-reference-1.4.2.3 339324 BLAKE2B 1a4fbd8c27a8cfba773777eabd2ebaa0f76ec0c61dcfe1c7b4483737b348ff9528d68f26e68d7d40b2e1875611eed5b9a31c1cf55fed8eabb42fc1e31d9ef14b SHA512 8b8ec43e812599203ec44c08805eb6818485805c45b9c69802261eaa35efc97846a96f6472c6b1ef5f6c703e7153fd957df7b805f173ca3400a2030dfbe002ca
 DIST meson-reference-1.5.2.3 341110 BLAKE2B 0d588b796f7f2da2dcb0e7822acde6a9a461930da4bfead3cf9148fa0fac18cd0ccbc6e891f555c973836f1c16b4eae299908a838a0b6843293de8815d30fc23 SHA512 64715ce2113e362e7d67179fe13566bc8f84ce7f4e6d795b836f42455a871173fee06e3e969e2996022d7e6c9b4b5379587a4c0c3d97b4bca527fb8902d3547f
 DIST meson-reference-1.6.1.3 343730 BLAKE2B 55df822192781a70e4bc44cfe14fb363e3f820406260ca9705d7fdb5fad1bf0117e3f1325d37e58e23477bc075ab6bd84056409355ec694f72eeaa5bf982ecc7 SHA512 553cdcd86a7a600cda05ac970cc285c4c50017d1e7d2925645d7f19a62b34c2f079673cafecf4111aa102afbe9d8e4d56f166d1d9940b740eeec0bb99d6cbc0d
@@ -25,3 +29,5 @@ DIST meson-reference-1.7.0.3 344764 BLAKE2B 615c70325b6ca3b964bf2827f20f07845150
 DIST meson-reference-1.7.2.3 344764 BLAKE2B 82de9a7a01c2f1b45a2b3432deb4713af3cfd3b2dc9af8802488b7d1b86dde9b6ac81f90b144006a79e90b313e1d4d23f9cc90e17255ce9573e5487d3e20c286 SHA512 d482a3b3bed671705d6316e106984ad2c2169fe890349437e512455705ee8dddb31a29d31f44402a4c7c5bd2f78595b75bfc5ad34d8c0337b66f40837b08ee56
 DIST meson-reference-1.8.1.3 345633 BLAKE2B 026423161eeddff3e663016c4b3fff885e96dc1a652562fe312cb80cfcc845015cab0d0f51c39f187cc484752f8f2bf7954dc8daf6762a74f895338cac4c35c4 SHA512 d3041eee86e63c178a04d5ec1ec383e7bbd209f358103806d488b28383471c1ecb5a13aa3716f699c1973a1d32dace34b0fdb0375e19abc0050deeb66fc5d376
 DIST meson-reference-1.8.2.3 345633 BLAKE2B a53888284967c1beb8875a380eb7fd58402db0ae8d3357f47cd265a1695f73f85dd5ef6c36ee95252012120f3b904d74dabcbd4b1aa4174975b1d1899d30283c SHA512 b40904bebedc678f4e8567cd0b6a377a678d4f3fa13feb5d978d65b39a308b607c78adfc6b742f9d7c2f2c57e7b011f52d875e97b85f1c4ffbfd4ebe52814443
+DIST meson-reference-1.8.3.3 345855 BLAKE2B c8825ba7b72b36866ebfa8cdf63362f2d38673315378ea213c438057f5dafa36b9e729e8c415a29715c1da4fe72733a4a6a2cdbee4b7df57e5eb97f50152491b SHA512 3085c10cfc08ce4f0edad7129ce4d9a0bf75c6522309e344ba14e27c34d46c3da25ebb46260de28caef4a6c8134857d63297ded26f1296639a8a097e62a1801c
+DIST meson-reference-1.9.0rc2.3 347290 BLAKE2B 992705aa79f7706dcd9bda49e047cdb5ac64e1561049bc6af60b6dcf29a403bf6ade00494135c1419c912063066fef9c7b4fa844a865f967f432860a9fe88596 SHA512 5c0ac755be8830b55505612e2009820d2296b10fac8e49acd2c5af63749dfe224fc91d4df88510a7694ab4f46db1e1c9c7c079944a8d17fdd2932b7ce4aa7c5b
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.0.ebuild
index 74fc5cee9d8..fa4fbb404a1 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.0.ebuild
@@ -84,6 +84,7 @@ DEPEND="
 		dev-qt/linguist-tools:5
 		dev-qt/qtwidgets:5
 		dev-qt/qtbase:6[gui,widgets]
+		dev-qt/qtdeclarative:6
 		dev-qt/qttools:6
 		dev-util/gdbus-codegen
 		x11-libs/gtk+:3
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.2.ebuild
index f944f07ba00..5714816dda6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.2.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 DISTUTILS_USE_PEP517=setuptools
 
 inherit shell-completion edo distutils-r1 flag-o-matic toolchain-funcs
@@ -32,8 +32,8 @@ else
 	# Releases may be signed by those listed in Releasing.md. Jussi
 	# remains the default release manager.
 	# https://github.com/mesonbuild/meson/commit/c2d795735fa1c46c54d6aed4d4a30f36a1f853cb
-	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-eschwartz )"
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/eschwartz.gpg
+	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-eschwartz-20250723-r1 )"
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/eschwartz.asc
 
 	if [[ ${PV} != *_rc* ]] ; then
 		KEYWORDS="~alpha amd64 arm ~arm64 hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
@@ -87,6 +87,7 @@ DEPEND="
 		dev-qt/linguist-tools:5
 		dev-qt/qtwidgets:5
 		dev-qt/qtbase:6[gui,widgets]
+		dev-qt/qtdeclarative:6
 		dev-qt/qttools:6
 		dev-util/gdbus-codegen
 		x11-libs/gtk+:3
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.8.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.8.3.ebuild
new file mode 100644
index 00000000000..699967ac5f1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.8.3.ebuild
@@ -0,0 +1,231 @@
+# Copyright 2016-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
+DISTUTILS_USE_PEP517=setuptools
+
+inherit shell-completion edo distutils-r1 flag-o-matic toolchain-funcs
+
+if [[ ${PV} = *9999* ]]; then
+	EGIT_REPO_URI="https://github.com/mesonbuild/meson"
+	inherit ninja-utils git-r3
+
+	BDEPEND="
+		${NINJA_DEPEND}
+		$(python_gen_any_dep 'dev-python/pyyaml[${PYTHON_USEDEP}]')
+	"
+
+else
+	inherit verify-sig
+
+	MY_PV=${PV/_/}
+	MY_P=${P/_/}
+	S=${WORKDIR}/${MY_P}
+
+	SRC_URI="
+		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz
+		verify-sig? ( https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz.asc )
+		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/meson-reference.3 -> meson-reference-${MY_PV}.3
+	"
+	# Releases may be signed by those listed in Releasing.md. Jussi
+	# remains the default release manager.
+	# https://github.com/mesonbuild/meson/commit/c2d795735fa1c46c54d6aed4d4a30f36a1f853cb
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-jpakkane )"
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/jpakkane.gpg
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+fi
+
+DESCRIPTION="Open source build system"
+HOMEPAGE="https://mesonbuild.com/"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="test test-full"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="test-full? ( test )"
+
+DEPEND="
+	test? (
+		dev-libs/glib:2
+		dev-libs/gobject-introspection
+		app-alternatives/ninja
+		dev-vcs/git
+		sys-libs/zlib[static-libs(+)]
+		virtual/pkgconfig
+		dev-build/cmake
+	)
+	test-full? (
+		|| ( dev-lang/rust dev-lang/rust-bin )
+		dev-lang/nasm
+		>=dev-lang/pypy-3
+		dev-lang/vala
+		dev-python/cython
+		virtual/fortran
+		virtual/jdk
+
+		app-text/doxygen
+		dev-cpp/gtest
+		dev-libs/protobuf
+		dev-util/bindgen
+		dev-util/gtk-doc
+		dev-util/itstool
+		llvm-core/llvm
+		media-libs/libsdl2
+		media-libs/libwmf
+		net-libs/libpcap
+		sci-libs/hdf5[fortran]
+		sci-libs/netcdf
+		sys-cluster/openmpi[fortran]
+		sys-devel/bison
+		sys-devel/flex
+
+		dev-qt/linguist-tools:5
+		dev-qt/qtwidgets:5
+		dev-qt/qtbase:6[gui,widgets]
+		dev-qt/qtdeclarative:6
+		dev-qt/qttools:6
+		dev-util/gdbus-codegen
+		x11-libs/gtk+:3
+
+		dev-libs/wayland
+		dev-util/wayland-scanner
+	)
+"
+RDEPEND="
+	!<dev-build/muon-0.2.0-r2[man(-)]
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.2.1-python-path.patch
+)
+
+src_unpack() {
+	if [[ ${PV} = *9999* ]]; then
+		git-r3_src_unpack
+	else
+		default
+		use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.asc}
+	fi
+}
+
+python_prepare_all() {
+	local disable_unittests=(
+		# ASAN and sandbox both want control over LD_PRELOAD
+		# https://bugs.gentoo.org/673016
+		-e 's/test_generate_gir_with_address_sanitizer/_&/'
+		-e 's/test_env_cflags_ldflags/_&/'
+		-e 's/test_c_link_args_and_env/_&/'
+
+		# ASAN is unsupported on some targets
+		# https://bugs.gentoo.org/692822
+		-e 's/test_pch_with_address_sanitizer/_&/'
+
+		# clippy-driver fails, but only when run via portage.
+		#
+		#   error[E0463]: can't find crate for `std`
+		#   error: requires `sized` lang_item
+		-e 's/test_rust_clippy/_&/'
+	)
+
+	sed -i "${disable_unittests[@]}" unittests/*.py || die
+
+	# Broken due to python2 script created by python_wrapper_setup
+	rm -r "test cases/frameworks/1 boost" || die
+	# nvcc breaks on essentially any LDFLAGS
+	# https://bugs.gentoo.org/936757
+	# https://github.com/mesonbuild/meson/issues/11234
+	rm -r "test cases/cuda"/* || die
+
+	distutils-r1_python_prepare_all
+}
+
+python_check_deps() {
+	if [[ ${PV} = *9999* ]]; then
+		python_has_version "dev-python/pyyaml[${PYTHON_USEDEP}]"
+	fi
+}
+
+python_configure_all() {
+	if [[ ${PV} = *9999* ]]; then
+		# We use the unsafe_yaml loader because strictyaml is not packaged. In
+		# theory they produce the same results, but pyyaml is faster and
+		# without safety checks.
+		edo ./meson.py setup \
+			--prefix "${EPREFIX}/usr" \
+			-Dhtml=false \
+			-Dunsafe_yaml=true \
+			docs/ docs/builddir
+	fi
+}
+
+python_compile_all() {
+	if [[ ${PV} = *9999* ]]; then
+		eninja -C docs/builddir
+	fi
+}
+
+src_test() {
+	tc-export PKG_CONFIG
+	if ${PKG_CONFIG} --exists Qt5Core && ! ${PKG_CONFIG} --exists Qt5Gui; then
+		ewarn "Found Qt5Core but not Qt5Gui; skipping tests"
+	else
+		distutils-r1_src_test
+	fi
+}
+
+python_test() {
+	(
+		# meson has its own tests for LTO support. We don't need to verify that
+		# all tests work when they happen to use it. And in particular, this
+		# breaks rust.
+		filter-lto
+
+		# remove unwanted python_wrapper_setup contents
+		# We actually do want to non-error if python2 is installed and tested.
+		remove="${T}/${EPYTHON}/bin:"
+		PATH=${PATH/${remove}/}
+
+		# test_meson_installed
+		unset PYTHONDONTWRITEBYTECODE
+
+		# https://bugs.gentoo.org/687792
+		unset PKG_CONFIG
+
+		# test_cross_file_system_paths
+		unset XDG_DATA_HOME
+
+		# 'test cases/unit/73 summary' expects 80 columns
+		export COLUMNS=80
+
+		# If JAVA_HOME is not set, meson looks for javac in PATH.
+		# If javac is in /usr/bin, meson assumes /usr/include is a valid
+		# JDK include path. Setting JAVA_HOME works around this broken
+		# autodetection. If no JDK is installed, we should end up with an empty
+		# value in JAVA_HOME, and the tests should get skipped.
+		export JAVA_HOME=$(java-config -O 2>/dev/null)
+
+		${EPYTHON} -u run_tests.py
+	) || die "Testing failed with ${EPYTHON}"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	insinto /usr/share/vim/vimfiles
+	doins -r data/syntax-highlighting/vim/{ftdetect,indent,syntax}
+
+	dozshcomp data/shell-completions/zsh/_meson
+	dobashcomp data/shell-completions/bash/meson
+
+	if [[ ${PV} = *9999* ]]; then
+		DESTDIR="${ED}" eninja -C docs/builddir install
+	else
+		newman "${DISTDIR}"/meson-reference-${MY_PV}.3 meson-reference.3
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.9.0_rc2.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.9.0_rc2.ebuild
new file mode 100644
index 00000000000..699967ac5f1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.9.0_rc2.ebuild
@@ -0,0 +1,231 @@
+# Copyright 2016-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
+DISTUTILS_USE_PEP517=setuptools
+
+inherit shell-completion edo distutils-r1 flag-o-matic toolchain-funcs
+
+if [[ ${PV} = *9999* ]]; then
+	EGIT_REPO_URI="https://github.com/mesonbuild/meson"
+	inherit ninja-utils git-r3
+
+	BDEPEND="
+		${NINJA_DEPEND}
+		$(python_gen_any_dep 'dev-python/pyyaml[${PYTHON_USEDEP}]')
+	"
+
+else
+	inherit verify-sig
+
+	MY_PV=${PV/_/}
+	MY_P=${P/_/}
+	S=${WORKDIR}/${MY_P}
+
+	SRC_URI="
+		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz
+		verify-sig? ( https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz.asc )
+		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/meson-reference.3 -> meson-reference-${MY_PV}.3
+	"
+	# Releases may be signed by those listed in Releasing.md. Jussi
+	# remains the default release manager.
+	# https://github.com/mesonbuild/meson/commit/c2d795735fa1c46c54d6aed4d4a30f36a1f853cb
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-jpakkane )"
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/jpakkane.gpg
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+fi
+
+DESCRIPTION="Open source build system"
+HOMEPAGE="https://mesonbuild.com/"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="test test-full"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="test-full? ( test )"
+
+DEPEND="
+	test? (
+		dev-libs/glib:2
+		dev-libs/gobject-introspection
+		app-alternatives/ninja
+		dev-vcs/git
+		sys-libs/zlib[static-libs(+)]
+		virtual/pkgconfig
+		dev-build/cmake
+	)
+	test-full? (
+		|| ( dev-lang/rust dev-lang/rust-bin )
+		dev-lang/nasm
+		>=dev-lang/pypy-3
+		dev-lang/vala
+		dev-python/cython
+		virtual/fortran
+		virtual/jdk
+
+		app-text/doxygen
+		dev-cpp/gtest
+		dev-libs/protobuf
+		dev-util/bindgen
+		dev-util/gtk-doc
+		dev-util/itstool
+		llvm-core/llvm
+		media-libs/libsdl2
+		media-libs/libwmf
+		net-libs/libpcap
+		sci-libs/hdf5[fortran]
+		sci-libs/netcdf
+		sys-cluster/openmpi[fortran]
+		sys-devel/bison
+		sys-devel/flex
+
+		dev-qt/linguist-tools:5
+		dev-qt/qtwidgets:5
+		dev-qt/qtbase:6[gui,widgets]
+		dev-qt/qtdeclarative:6
+		dev-qt/qttools:6
+		dev-util/gdbus-codegen
+		x11-libs/gtk+:3
+
+		dev-libs/wayland
+		dev-util/wayland-scanner
+	)
+"
+RDEPEND="
+	!<dev-build/muon-0.2.0-r2[man(-)]
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.2.1-python-path.patch
+)
+
+src_unpack() {
+	if [[ ${PV} = *9999* ]]; then
+		git-r3_src_unpack
+	else
+		default
+		use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.asc}
+	fi
+}
+
+python_prepare_all() {
+	local disable_unittests=(
+		# ASAN and sandbox both want control over LD_PRELOAD
+		# https://bugs.gentoo.org/673016
+		-e 's/test_generate_gir_with_address_sanitizer/_&/'
+		-e 's/test_env_cflags_ldflags/_&/'
+		-e 's/test_c_link_args_and_env/_&/'
+
+		# ASAN is unsupported on some targets
+		# https://bugs.gentoo.org/692822
+		-e 's/test_pch_with_address_sanitizer/_&/'
+
+		# clippy-driver fails, but only when run via portage.
+		#
+		#   error[E0463]: can't find crate for `std`
+		#   error: requires `sized` lang_item
+		-e 's/test_rust_clippy/_&/'
+	)
+
+	sed -i "${disable_unittests[@]}" unittests/*.py || die
+
+	# Broken due to python2 script created by python_wrapper_setup
+	rm -r "test cases/frameworks/1 boost" || die
+	# nvcc breaks on essentially any LDFLAGS
+	# https://bugs.gentoo.org/936757
+	# https://github.com/mesonbuild/meson/issues/11234
+	rm -r "test cases/cuda"/* || die
+
+	distutils-r1_python_prepare_all
+}
+
+python_check_deps() {
+	if [[ ${PV} = *9999* ]]; then
+		python_has_version "dev-python/pyyaml[${PYTHON_USEDEP}]"
+	fi
+}
+
+python_configure_all() {
+	if [[ ${PV} = *9999* ]]; then
+		# We use the unsafe_yaml loader because strictyaml is not packaged. In
+		# theory they produce the same results, but pyyaml is faster and
+		# without safety checks.
+		edo ./meson.py setup \
+			--prefix "${EPREFIX}/usr" \
+			-Dhtml=false \
+			-Dunsafe_yaml=true \
+			docs/ docs/builddir
+	fi
+}
+
+python_compile_all() {
+	if [[ ${PV} = *9999* ]]; then
+		eninja -C docs/builddir
+	fi
+}
+
+src_test() {
+	tc-export PKG_CONFIG
+	if ${PKG_CONFIG} --exists Qt5Core && ! ${PKG_CONFIG} --exists Qt5Gui; then
+		ewarn "Found Qt5Core but not Qt5Gui; skipping tests"
+	else
+		distutils-r1_src_test
+	fi
+}
+
+python_test() {
+	(
+		# meson has its own tests for LTO support. We don't need to verify that
+		# all tests work when they happen to use it. And in particular, this
+		# breaks rust.
+		filter-lto
+
+		# remove unwanted python_wrapper_setup contents
+		# We actually do want to non-error if python2 is installed and tested.
+		remove="${T}/${EPYTHON}/bin:"
+		PATH=${PATH/${remove}/}
+
+		# test_meson_installed
+		unset PYTHONDONTWRITEBYTECODE
+
+		# https://bugs.gentoo.org/687792
+		unset PKG_CONFIG
+
+		# test_cross_file_system_paths
+		unset XDG_DATA_HOME
+
+		# 'test cases/unit/73 summary' expects 80 columns
+		export COLUMNS=80
+
+		# If JAVA_HOME is not set, meson looks for javac in PATH.
+		# If javac is in /usr/bin, meson assumes /usr/include is a valid
+		# JDK include path. Setting JAVA_HOME works around this broken
+		# autodetection. If no JDK is installed, we should end up with an empty
+		# value in JAVA_HOME, and the tests should get skipped.
+		export JAVA_HOME=$(java-config -O 2>/dev/null)
+
+		${EPYTHON} -u run_tests.py
+	) || die "Testing failed with ${EPYTHON}"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	insinto /usr/share/vim/vimfiles
+	doins -r data/syntax-highlighting/vim/{ftdetect,indent,syntax}
+
+	dozshcomp data/shell-completions/zsh/_meson
+	dobashcomp data/shell-completions/bash/meson
+
+	if [[ ${PV} = *9999* ]]; then
+		DESTDIR="${ED}" eninja -C docs/builddir install
+	else
+		newman "${DISTDIR}"/meson-reference-${MY_PV}.3 meson-reference.3
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-9999.ebuild
index dcb9ffd2067..699967ac5f1 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-9999.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 DISTUTILS_USE_PEP517=setuptools
 
 inherit shell-completion edo distutils-r1 flag-o-matic toolchain-funcs
@@ -87,6 +87,7 @@ DEPEND="
 		dev-qt/linguist-tools:5
 		dev-qt/qtwidgets:5
 		dev-qt/qtbase:6[gui,widgets]
+		dev-qt/qtdeclarative:6
 		dev-qt/qttools:6
 		dev-util/gdbus-codegen
 		x11-libs/gtk+:3
@@ -119,6 +120,7 @@ python_prepare_all() {
 		# https://bugs.gentoo.org/673016
 		-e 's/test_generate_gir_with_address_sanitizer/_&/'
 		-e 's/test_env_cflags_ldflags/_&/'
+		-e 's/test_c_link_args_and_env/_&/'
 
 		# ASAN is unsupported on some targets
 		# https://bugs.gentoo.org/692822

From bef2fafb4b98a8ed4febbe0878cdb54d274c7e03 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:48 +0000
Subject: [PATCH 020/122] dev-db/sqlite: Sync with Gentoo

It's from Gentoo commit 089da180174c28bde44c68a0e2a8dde0c98fac06.
---
 .../portage-stable/dev-db/sqlite/Manifest     |   4 +
 .../dev-db/sqlite/sqlite-3.50.3.ebuild        | 444 ++++++++++++++++++
 .../dev-db/sqlite/sqlite-3.50.4.ebuild        | 444 ++++++++++++++++++
 3 files changed, 892 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.50.3.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.50.4.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
index ac104ac4329..410ea07a572 100644
--- a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
@@ -5,6 +5,8 @@ DIST sqlite-doc-3490200.zip 11340124 BLAKE2B 56c1456f5720ee98553350790232d043caf
 DIST sqlite-doc-3500000.zip 11367399 BLAKE2B 3356bfc188a8827dbee655df559e0c12391e74d7d1a8afff47f19fd4e6136f30b8eaf43ad1a51da39b9e8e4259e24dc5c4f976d96ea5be008219b4caa48cd105 SHA512 bc385c3d47f738547eac353d78121076bc188cb972b78b5ef8176da91e7c325e99111ebdd80f93538254562281113a527bbfbcd687923874291f19481980cb22
 DIST sqlite-doc-3500100.zip 11377048 BLAKE2B 1634de3e4e31661d0039a62c362f3668b47bc01b3220c82e97d93f8d93a3502960d7fbd1d26dd1a3a6924d795fa50a61273956ccec14c0c4b596b117517ee598 SHA512 a4be8415e07750e6e414fbb3282087438dabf0a36cf81c60052e78618264688784da98ee30ad476fbc47fa405f5cc0d2db92010a1173d0b65a58608177e12589
 DIST sqlite-doc-3500200.zip 11382890 BLAKE2B f7cea3721d77b32ac4b4c514023750aae8fd95e417fa594452b6f29aa56a061f4177187effaad82d25b868076c6dd8b15db08cf5b9353aa6be06e9938be73e9d SHA512 d1dbec8bc41cc83d2fd048cdc353e44f1ae4a60949aabec1e5aee50485f8535efba85bdae88f93785c8e53d48feb76b8143f272d70f73ce13368815f978bd4bc
+DIST sqlite-doc-3500300.zip 11390337 BLAKE2B ba6d03c78d7c3c865f6ef7fab4077b5eac17c77bba6f64c8fec440da21611e03bf1c558cad1b45b20c30ac01c112624d7e14db273cba0f8023029e041f035de2 SHA512 abd9f19574268d11e8980166c257b7e7361c9fbdb5508fbcb67bb855809a4d7823f658acfeb8c48a142508a5a355882b4f4c976ffd53071f13357c4c5892c861
+DIST sqlite-doc-3500400.zip 11398708 BLAKE2B a179191767c86b10604ad03ebd6408ebc3e6b14ce5a85d7dd14cfc933da8e92b76a7ad8b40616699c54022259ba852e30e6f7eeb34640326d51623a7c52c0065 SHA512 24db55ec5d29a6389cf930e3fa3c7205ca47973f5857f7cc5444166bd10d00109cbe4141e87cbb94f75711cb981e60bde286b15c0384cdcfb41337f0f0eaa446
 DIST sqlite-src-3460100.zip 14276926 BLAKE2B df16ea944e317df8ed64fdfab289e3699ec71725ce55e2b30450adaeb41c061b4fba1eb8c41ba638b0edcd12b23264a1f9e413b69fd593c2b65fb1037d3fc8b2 SHA512 6d32a0db9f95d3cec34f02f3fd45b453bf7c422d4d4d9570790f641e7d190b8b31be8e8715afacc1b6e4417f15a4d15a0b28e608ae0b4b5f3054b075783b916e
 DIST sqlite-src-3470200.zip 14421983 BLAKE2B dcaea5be0099b2dad1b53403933f0037ace48b1f248040c1b5cc116ac2ad6c9b44c71b8efe3afd16bef01119b440d1a2ec9d553a22f855e0ba55793684f53d8d SHA512 a6280a02304bfae173d9e9ebf376b2d3624658f04af4d8e95d5a042e24cf0405a47c0a4023f4dbc2790716cd85e16b97fcc0a83c1534e6d554f4eb0bfb0a3ed3
 DIST sqlite-src-3490100.zip 14372402 BLAKE2B c7f6a574698512e2fde44e54ed2a101e7307821b0015287bbf5ab151f5f59432fe051fda1d1caec865928717f51c42f1161187fb768180088574ca225cd29250 SHA512 24c81cee52e5655f4e9d6496a366e4787352b5108ea27eb5ce3dc07ef3e1975205bb250584b0758fb2832add84ca922b09a4d925e0dc2f55dd3613a58b414ec3
@@ -12,3 +14,5 @@ DIST sqlite-src-3490200.zip 14377708 BLAKE2B b455388c3c9d0424b7f36b5ab41b7506f52
 DIST sqlite-src-3500000.zip 14387288 BLAKE2B 9df808ca2e754d8196c19bba3eca370b7675edb89c1fe3bce4d50f848132a5a67079ef6bfceef44fafc7f96f2ded495416093dcda821ea64e06b04b81f3678f1 SHA512 d1b14906011c22bdb1a77e2668aceb42ea912047d8c6358e68fd4097cdaf1dc932ad47f3e621b5242c0c30366a1ecea26c170cd21ff4153d4f0c91d4b9c9eb14
 DIST sqlite-src-3500100.zip 14391009 BLAKE2B 4e8568e3994b6fc63f0d27e035001fcf4798b6dda50e9a52943b618a5585c87b2658b57f7153361253bf574f2948c0f44436514c890f1e98f7d816e77d3b985c SHA512 20d5bda28ab6a9edff28c7a7b5c36b3aeabf34758560e87205626dad4202cd2e1e0e01226791e866e995423f7c76e89f26da49515f47c774a3241f59228a27f7
 DIST sqlite-src-3500200.zip 14392422 BLAKE2B d1d21b53e4eb5b4a89d1460e2a1f57f198fa194efa804f1eb71a747d8a8ff75240f7d2757bee537b901830c359b42d7639943f59d28623bc2fb3c870b725debf SHA512 827c78b2bfd823626cdae6a88fff882cbd90430babfab6c6fd224cf05c8764b43499184a4f07293fb00bfcbbaedfec958d1afbfe4431ea9b24b189c561213e7d
+DIST sqlite-src-3500300.zip 14393097 BLAKE2B 98c751f9d2aeaaef11d447b2921c7d9df160cdf74231d92f83b49a94df96bf3e09ba99a2aad54e85029f483c864430950f5869146f453accf4319b11cb30a825 SHA512 b09293191341df781353d1f76e7280b806e79ec79857e6ab881e4a0a2311ae8d524c2a918f1beeb007b487cc5615ad5c5ca96e2657c1e9853b2e727f637bcb5f
+DIST sqlite-src-3500400.zip 14393367 BLAKE2B e94589cb80ce64b5b8c0a2d28582b223a7cb9355424366fc3135c261ca33b4a93dcdeafb86252deeb9beca0ea94490ec6461ba5ab9e8f16b33e9628a85a19813 SHA512 003b03ddc4dd9618b48370e2aaf339c12c3384963f142f1f97110d6ed74f45aa7477477f53bc8b24b6d9f473b899ecb5d13889f52b8cd4fbdce2e6e5fa24502f
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.50.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.50.3.ebuild
new file mode 100644
index 00000000000..b1a38b74238
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.50.3.ebuild
@@ -0,0 +1,444 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic multilib multilib-minimal toolchain-funcs
+
+DESCRIPTION="SQL database engine"
+HOMEPAGE="https://sqlite.org/"
+
+# On version updates, make sure to read the forum (https://sqlite.org/forum/forum)
+# for hints regarding test failures, backports, etc.
+if [[ ${PV} == 9999 ]]; then
+	S="${WORKDIR}"/${PN}
+	PROPERTIES="live"
+else
+	printf -v SRC_PV "%u%02u%02u%02u" $(ver_rs 1- " ")
+	DOC_PV="${SRC_PV}"
+	#printf -v DOC_PV "%u%02u%02u00" $(ver_rs 1-3 " ")
+
+	SRC_URI="
+		https://sqlite.org/2025/${PN}-src-${SRC_PV}.zip
+		doc? ( https://sqlite.org/2025/${PN}-doc-${DOC_PV}.zip )
+	"
+	S="${WORKDIR}/${PN}-src-${SRC_PV}"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="public-domain"
+SLOT="3"
+IUSE="debug doc icu +readline secure-delete static-libs tcl test tools"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/zlib:=[${MULTILIB_USEDEP}]
+	icu? ( dev-libs/icu:=[${MULTILIB_USEDEP}] )
+	readline? ( sys-libs/readline:=[${MULTILIB_USEDEP}] )
+	tcl? ( dev-lang/tcl:=[${MULTILIB_USEDEP}] )
+	tools? ( dev-lang/tcl:= )
+"
+DEPEND="
+	${RDEPEND}
+	test? ( >=dev-lang/tcl-8.6:0[${MULTILIB_USEDEP}] )
+"
+if [[ ${PV} == 9999 ]]; then
+	BDEPEND+=" dev-vcs/fossil"
+else
+	BDEPEND+=" app-arch/unzip"
+fi
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.47.2-hwtime.h-Don-t-use-rdtsc-on-i486.patch
+)
+
+_fossil_fetch() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local repo_uri="${2}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	mkdir -p "${T}/fossil/${repo_id}" || die
+	pushd "${T}/fossil/${repo_id}" > /dev/null || die
+
+	if [[ -n "${EVCS_OFFLINE}" ]]; then
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			die "Network activity disabled using EVCS_OFFLINE and clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+		fi
+	else
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			einfo fossil clone --verbose "${repo_uri}" "${repo_id}.fossil"
+			fossil clone --verbose "${repo_uri}" "${repo_id}.fossil" || die
+			echo
+		else
+			cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" . || die
+			einfo fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}"
+			fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}" || die
+			echo
+		fi
+
+		(
+			addwrite "${distdir}"
+			mkdir -p "${distdir}/fossil-src/${repo_id}" || die
+			cp -p "${repo_id}.fossil" "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" || die
+		)
+	fi
+
+	popd > /dev/null || die
+}
+
+_fossil_checkout() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local branch_or_commit="${2}"
+	local target_directory="${3}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+		die "Clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+	fi
+
+	if [[ ! -f "${T}/fossil/${repo_id}/${repo_id}.fossil" ]]; then
+		mkdir -p "${T}/fossil/${repo_id}" || die
+		cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" "${T}/fossil/${repo_id}" || die
+	fi
+
+	mkdir "${target_directory}" || die
+	pushd "${target_directory}" > /dev/null || die
+
+	einfo fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}"
+	fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}" || die
+	echo
+
+	popd > /dev/null || die
+}
+
+fossil_fetch() {
+	local repo_id="${1}"
+	local repo_uri="${2}"
+	local target_directory="${3}"
+
+	local branch_or_commit="${EFOSSIL_COMMIT:-${EFOSSIL_BRANCH:-trunk}}"
+
+	_fossil_fetch "${repo_id}" "${repo_uri}"
+	_fossil_checkout "${repo_id}" "${branch_or_commit}" "${target_directory}"
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]]; then
+		fossil_fetch sqlite https://sqlite.org/src "${WORKDIR}/${PN}"
+		if use doc; then
+			fossil_fetch sqlite-doc https://sqlite.org/docsrc "${WORKDIR}/${PN}-doc"
+		fi
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	default
+
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	local -x CPPFLAGS="${CPPFLAGS}" CFLAGS="${CFLAGS}"
+	local options=()
+
+	options+=(
+		--enable-load-extension
+		--enable-threadsafe
+	)
+
+	# Support detection of misuse of SQLite API.
+	# https://sqlite.org/compile.html#enable_api_armor
+	append-cppflags -DSQLITE_ENABLE_API_ARMOR
+
+	# Support bytecode and tables_used virtual tables.
+	# https://sqlite.org/compile.html#enable_bytecode_vtab
+	# https://sqlite.org/bytecodevtab.html
+	append-cppflags -DSQLITE_ENABLE_BYTECODE_VTAB
+
+	# Support column metadata functions.
+	# https://sqlite.org/compile.html#enable_column_metadata
+	# https://sqlite.org/c3ref/column_database_name.html
+	append-cppflags -DSQLITE_ENABLE_COLUMN_METADATA
+
+	# Support sqlite_dbpage virtual table.
+	# https://sqlite.org/compile.html#enable_dbpage_vtab
+	# https://sqlite.org/dbpage.html
+	append-cppflags -DSQLITE_ENABLE_DBPAGE_VTAB
+
+	# Support dbstat virtual table.
+	# https://sqlite.org/compile.html#enable_dbstat_vtab
+	# https://sqlite.org/dbstat.html
+	append-cppflags -DSQLITE_ENABLE_DBSTAT_VTAB
+
+	# Support sqlite3_serialize() and sqlite3_deserialize() functions.
+	# https://sqlite.org/compile.html#enable_deserialize
+	# https://sqlite.org/c3ref/serialize.html
+	# https://sqlite.org/c3ref/deserialize.html
+	append-cppflags -DSQLITE_ENABLE_DESERIALIZE
+
+	# Support comments in output of EXPLAIN.
+	# https://sqlite.org/compile.html#enable_explain_comments
+	append-cppflags -DSQLITE_ENABLE_EXPLAIN_COMMENTS
+
+	# Support Full-Text Search versions 3, 4 and 5.
+	# https://sqlite.org/compile.html#enable_fts3
+	# https://sqlite.org/compile.html#enable_fts3_parenthesis
+	# https://sqlite.org/compile.html#enable_fts4
+	# https://sqlite.org/compile.html#enable_fts5
+	# https://sqlite.org/fts3.html
+	# https://sqlite.org/fts5.html
+	append-cppflags -DSQLITE_ENABLE_FTS3 -DSQLITE_ENABLE_FTS3_PARENTHESIS
+	options+=( --enable-fts4 )
+	options+=( --enable-fts5 )
+
+	# Support hidden columns.
+	append-cppflags -DSQLITE_ENABLE_HIDDEN_COLUMNS
+
+	# Support memsys5 memory allocator.
+	# https://sqlite.org/compile.html#enable_memsys5
+	# https://sqlite.org/malloc.html#memsys5
+	options+=( --enable-memsys5 )
+
+	# Support sqlite3_normalized_sql() function.
+	# https://sqlite.org/c3ref/expanded_sql.html
+	append-cppflags -DSQLITE_ENABLE_NORMALIZE
+
+	# Support sqlite_offset() function.
+	# https://sqlite.org/compile.html#enable_offset_sql_func
+	# https://sqlite.org/lang_corefunc.html#sqlite_offset
+	append-cppflags -DSQLITE_ENABLE_OFFSET_SQL_FUNC
+
+	# Support pre-update hook functions.
+	# https://sqlite.org/compile.html#enable_preupdate_hook
+	# https://sqlite.org/c3ref/preupdate_count.html
+	append-cppflags -DSQLITE_ENABLE_PREUPDATE_HOOK
+
+	# Support Resumable Bulk Update extension.
+	# https://sqlite.org/compile.html#enable_rbu
+	# https://sqlite.org/rbu.html
+	append-cppflags -DSQLITE_ENABLE_RBU
+
+	# Support R*Trees.
+	# https://sqlite.org/compile.html#enable_rtree
+	# https://sqlite.org/compile.html#enable_geopoly
+	# https://sqlite.org/rtree.html
+	# https://sqlite.org/geopoly.html
+	options+=( --enable-rtree --enable-geopoly )
+
+	# Support Session extension.
+	# https://sqlite.org/compile.html#enable_session
+	# https://sqlite.org/sessionintro.html
+	options+=( --enable-session )
+
+	# Support scan status functions.
+	# https://sqlite.org/compile.html#enable_stmt_scanstatus
+	# https://sqlite.org/c3ref/stmt_scanstatus.html
+	# https://sqlite.org/c3ref/stmt_scanstatus_reset.html
+	append-cppflags -DSQLITE_ENABLE_STMT_SCANSTATUS
+
+	# Support sqlite_stmt virtual table.
+	# https://sqlite.org/compile.html#enable_stmtvtab
+	# https://sqlite.org/stmt.html
+	append-cppflags -DSQLITE_ENABLE_STMTVTAB
+
+	# Support unknown() function.
+	# https://sqlite.org/compile.html#enable_unknown_sql_function
+	append-cppflags -DSQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
+
+	# Support unlock notification.
+	# https://sqlite.org/compile.html#enable_unlock_notify
+	# https://sqlite.org/c3ref/unlock_notify.html
+	# https://sqlite.org/unlock_notify.html
+	append-cppflags -DSQLITE_ENABLE_UNLOCK_NOTIFY
+
+	# Support LIMIT and ORDER BY clauses on DELETE and UPDATE statements.
+	# https://sqlite.org/compile.html#enable_update_delete_limit
+	# https://sqlite.org/lang_delete.html#optional_limit_and_order_by_clauses
+	# https://sqlite.org/lang_update.html#optional_limit_and_order_by_clauses
+	append-cppflags -DSQLITE_ENABLE_UPDATE_DELETE_LIMIT
+
+	# Support soundex() function.
+	# https://sqlite.org/compile.html#soundex
+	# https://sqlite.org/lang_corefunc.html#soundex
+	append-cppflags -DSQLITE_SOUNDEX
+
+	# Support URI filenames.
+	# https://sqlite.org/compile.html#use_uri
+	# https://sqlite.org/uri.html
+	append-cppflags -DSQLITE_USE_URI
+
+	options+=( $(use_enable debug) )
+
+	if use icu; then
+		# Support ICU extension.
+		# https://sqlite.org/compile.html#enable_icu
+		options+=( --with-icu-config )
+	fi
+
+	options+=(
+		--disable-editline
+		$(use_enable readline)
+	)
+
+	if use readline; then
+		options+=( --with-readline-inc="-I${ESYSROOT}/usr/include/readline" )
+	fi
+
+	if use secure-delete; then
+		# Enable secure_delete pragma by default.
+		# https://sqlite.org/compile.html#secure_delete
+		# https://sqlite.org/pragma.html#pragma_secure_delete
+		append-cppflags -DSQLITE_SECURE_DELETE
+	fi
+
+	options+=( $(use_enable static-libs static) )
+
+	# tcl, test, tools USE flags.
+	if use tcl || use test || { use tools && multilib_is_native_abi; }; then
+		options+=(
+			--enable-tcl
+			--with-tcl="${ESYSROOT}/usr/$(get_libdir)"
+		)
+	else
+		options+=( --disable-tcl )
+	fi
+
+	if [[ "${ABI}" == "x86" ]]; then
+		if $(tc-getCC) ${CPPFLAGS} ${CFLAGS} -E -P -dM - < /dev/null 2> /dev/null | grep -q "^#define __SSE__ 1$"; then
+			append-cflags -mfpmath=sse
+		else
+			append-cflags -ffloat-store
+		fi
+	fi
+
+	if [[ ${CHOST} != *-darwin* ]] ; then
+		# set SONAME for the library
+		options+=( --soname=legacy )
+	else
+		# to allow install_name_tool id change
+		append-ldflags -headerpad_max_install_names
+	fi
+
+	# https://sqlite.org/forum/forumpost/4f4d06a9f6683bb9
+	tc-export_build_env BUILD_CC
+
+	CC_FOR_BUILD=${BUILD_CC} econf "${options[@]}"
+}
+
+multilib_src_compile() {
+	emake HAVE_TCL="$(usex tcl 1 0)" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}"
+
+	if use tools && multilib_is_native_abi; then
+		emake changeset dbdump dbhash dbtotxt index_usage rbu scrub showdb showjournal showshm showstat4 showwal sqldiff sqlite3_analyzer sqlite3_checker sqlite3_expert sqltclsh
+	fi
+
+	if [[ ${PV} == 9999 ]] && use doc && multilib_is_native_abi; then
+		emake tclsqlite3.c
+
+		local build_directory="$(pwd)"
+		build_directory="${build_directory##*/}"
+
+		mkdir "${WORKDIR}/${PN}-doc-build" || die
+		pushd "${WORKDIR}/${PN}-doc-build" > /dev/null || die
+
+		emake -f "../${PN}-doc/Makefile" -j1 SRC="../${PN}" BLD="../${build_directory}" DOC="../${PN}-doc" CC="$(tc-getBUILD_CC)" TCLINC="" TCLFLAGS="$($(tc-getBUILD_PKG_CONFIG) --libs tcl) -ldl -lm" base doc
+		rmdir doc/matrix{/*,} || die
+
+		popd > /dev/null || die
+	fi
+}
+
+multilib_src_test() {
+	if [[ "${EUID}" -eq 0 ]]; then
+		ewarn "Skipping tests due to root permissions"
+		return
+	fi
+
+	local -x SQLITE_HISTORY="${T}/sqlite_history_${ABI}"
+
+	# e_uri.test tries to open files in /.
+	# bug #839798
+	local SANDBOX_PREDICT=${SANDBOX_PREDICT}
+	addpredict "/test.db"
+	addpredict "/ÿ.db"
+
+	emake -Onone $(usex debug 'fulltest' 'test')
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" HAVE_TCL="$(usex tcl 1 "")" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}" install
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# fix install_name, soname=legacy doesn't work for this (but
+		# breaks the build instead)
+		install_name_tool \
+			-id "${EPREFIX}/usr/$(get_libdir)/libsqlite3$(get_libname 0)" \
+			"${ED}/usr/$(get_libdir)/libsqlite3$(get_libname ${PV})" \
+			|| die "failed to fix install_name"
+	fi
+
+	if use tools && multilib_is_native_abi; then
+		install_tool() {
+			if [[ -f ".libs/${1}" ]]; then
+				newbin ".libs/${1}" "${2}"
+			else
+				newbin "${1}" "${2}"
+			fi
+		}
+
+		install_tool changeset sqlite3-changeset
+		install_tool dbdump sqlite3-db-dump
+		install_tool dbhash sqlite3-db-hash
+		install_tool dbtotxt sqlite3-db-to-txt
+		install_tool index_usage sqlite3-index-usage
+		install_tool rbu sqlite3-rbu
+		install_tool scrub sqlite3-scrub
+		install_tool showdb sqlite3-show-db
+		install_tool showjournal sqlite3-show-journal
+		install_tool showshm sqlite3-show-shm
+		install_tool showstat4 sqlite3-show-stat4
+		install_tool showwal sqlite3-show-wal
+		install_tool sqldiff sqlite3-diff
+		install_tool sqlite3_analyzer sqlite3-analyzer
+		install_tool sqlite3_checker sqlite3-checker
+		install_tool sqlite3_expert sqlite3-expert
+		install_tool sqltclsh sqlite3-tclsh
+
+		unset -f install_tool
+	fi
+}
+
+multilib_src_install_all() {
+	find "${ED}" -name "*.la" -delete || die
+
+	doman sqlite3.1
+
+	if use doc; then
+		if [[ ${PV} == 9999 ]]; then
+			pushd "${WORKDIR}/${PN}-doc-build/doc" > /dev/null || die
+		else
+			pushd "${WORKDIR}/${PN}-doc-${DOC_PV}" > /dev/null || die
+		fi
+
+		find "(" -name "*.db" -o -name "*.txt" ")" -delete || die
+		if [[ ${PV} != 9999 ]]; then
+			rm search search.d/admin || die
+			rmdir search.d || die
+			find -name "*~" -delete || die
+		fi
+
+		(
+			docinto html
+			dodoc -r *
+		)
+
+		popd > /dev/null || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.50.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.50.4.ebuild
new file mode 100644
index 00000000000..b1a38b74238
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.50.4.ebuild
@@ -0,0 +1,444 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic multilib multilib-minimal toolchain-funcs
+
+DESCRIPTION="SQL database engine"
+HOMEPAGE="https://sqlite.org/"
+
+# On version updates, make sure to read the forum (https://sqlite.org/forum/forum)
+# for hints regarding test failures, backports, etc.
+if [[ ${PV} == 9999 ]]; then
+	S="${WORKDIR}"/${PN}
+	PROPERTIES="live"
+else
+	printf -v SRC_PV "%u%02u%02u%02u" $(ver_rs 1- " ")
+	DOC_PV="${SRC_PV}"
+	#printf -v DOC_PV "%u%02u%02u00" $(ver_rs 1-3 " ")
+
+	SRC_URI="
+		https://sqlite.org/2025/${PN}-src-${SRC_PV}.zip
+		doc? ( https://sqlite.org/2025/${PN}-doc-${DOC_PV}.zip )
+	"
+	S="${WORKDIR}/${PN}-src-${SRC_PV}"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="public-domain"
+SLOT="3"
+IUSE="debug doc icu +readline secure-delete static-libs tcl test tools"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/zlib:=[${MULTILIB_USEDEP}]
+	icu? ( dev-libs/icu:=[${MULTILIB_USEDEP}] )
+	readline? ( sys-libs/readline:=[${MULTILIB_USEDEP}] )
+	tcl? ( dev-lang/tcl:=[${MULTILIB_USEDEP}] )
+	tools? ( dev-lang/tcl:= )
+"
+DEPEND="
+	${RDEPEND}
+	test? ( >=dev-lang/tcl-8.6:0[${MULTILIB_USEDEP}] )
+"
+if [[ ${PV} == 9999 ]]; then
+	BDEPEND+=" dev-vcs/fossil"
+else
+	BDEPEND+=" app-arch/unzip"
+fi
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.47.2-hwtime.h-Don-t-use-rdtsc-on-i486.patch
+)
+
+_fossil_fetch() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local repo_uri="${2}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	mkdir -p "${T}/fossil/${repo_id}" || die
+	pushd "${T}/fossil/${repo_id}" > /dev/null || die
+
+	if [[ -n "${EVCS_OFFLINE}" ]]; then
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			die "Network activity disabled using EVCS_OFFLINE and clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+		fi
+	else
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			einfo fossil clone --verbose "${repo_uri}" "${repo_id}.fossil"
+			fossil clone --verbose "${repo_uri}" "${repo_id}.fossil" || die
+			echo
+		else
+			cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" . || die
+			einfo fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}"
+			fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}" || die
+			echo
+		fi
+
+		(
+			addwrite "${distdir}"
+			mkdir -p "${distdir}/fossil-src/${repo_id}" || die
+			cp -p "${repo_id}.fossil" "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" || die
+		)
+	fi
+
+	popd > /dev/null || die
+}
+
+_fossil_checkout() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local branch_or_commit="${2}"
+	local target_directory="${3}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+		die "Clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+	fi
+
+	if [[ ! -f "${T}/fossil/${repo_id}/${repo_id}.fossil" ]]; then
+		mkdir -p "${T}/fossil/${repo_id}" || die
+		cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" "${T}/fossil/${repo_id}" || die
+	fi
+
+	mkdir "${target_directory}" || die
+	pushd "${target_directory}" > /dev/null || die
+
+	einfo fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}"
+	fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}" || die
+	echo
+
+	popd > /dev/null || die
+}
+
+fossil_fetch() {
+	local repo_id="${1}"
+	local repo_uri="${2}"
+	local target_directory="${3}"
+
+	local branch_or_commit="${EFOSSIL_COMMIT:-${EFOSSIL_BRANCH:-trunk}}"
+
+	_fossil_fetch "${repo_id}" "${repo_uri}"
+	_fossil_checkout "${repo_id}" "${branch_or_commit}" "${target_directory}"
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]]; then
+		fossil_fetch sqlite https://sqlite.org/src "${WORKDIR}/${PN}"
+		if use doc; then
+			fossil_fetch sqlite-doc https://sqlite.org/docsrc "${WORKDIR}/${PN}-doc"
+		fi
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	default
+
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	local -x CPPFLAGS="${CPPFLAGS}" CFLAGS="${CFLAGS}"
+	local options=()
+
+	options+=(
+		--enable-load-extension
+		--enable-threadsafe
+	)
+
+	# Support detection of misuse of SQLite API.
+	# https://sqlite.org/compile.html#enable_api_armor
+	append-cppflags -DSQLITE_ENABLE_API_ARMOR
+
+	# Support bytecode and tables_used virtual tables.
+	# https://sqlite.org/compile.html#enable_bytecode_vtab
+	# https://sqlite.org/bytecodevtab.html
+	append-cppflags -DSQLITE_ENABLE_BYTECODE_VTAB
+
+	# Support column metadata functions.
+	# https://sqlite.org/compile.html#enable_column_metadata
+	# https://sqlite.org/c3ref/column_database_name.html
+	append-cppflags -DSQLITE_ENABLE_COLUMN_METADATA
+
+	# Support sqlite_dbpage virtual table.
+	# https://sqlite.org/compile.html#enable_dbpage_vtab
+	# https://sqlite.org/dbpage.html
+	append-cppflags -DSQLITE_ENABLE_DBPAGE_VTAB
+
+	# Support dbstat virtual table.
+	# https://sqlite.org/compile.html#enable_dbstat_vtab
+	# https://sqlite.org/dbstat.html
+	append-cppflags -DSQLITE_ENABLE_DBSTAT_VTAB
+
+	# Support sqlite3_serialize() and sqlite3_deserialize() functions.
+	# https://sqlite.org/compile.html#enable_deserialize
+	# https://sqlite.org/c3ref/serialize.html
+	# https://sqlite.org/c3ref/deserialize.html
+	append-cppflags -DSQLITE_ENABLE_DESERIALIZE
+
+	# Support comments in output of EXPLAIN.
+	# https://sqlite.org/compile.html#enable_explain_comments
+	append-cppflags -DSQLITE_ENABLE_EXPLAIN_COMMENTS
+
+	# Support Full-Text Search versions 3, 4 and 5.
+	# https://sqlite.org/compile.html#enable_fts3
+	# https://sqlite.org/compile.html#enable_fts3_parenthesis
+	# https://sqlite.org/compile.html#enable_fts4
+	# https://sqlite.org/compile.html#enable_fts5
+	# https://sqlite.org/fts3.html
+	# https://sqlite.org/fts5.html
+	append-cppflags -DSQLITE_ENABLE_FTS3 -DSQLITE_ENABLE_FTS3_PARENTHESIS
+	options+=( --enable-fts4 )
+	options+=( --enable-fts5 )
+
+	# Support hidden columns.
+	append-cppflags -DSQLITE_ENABLE_HIDDEN_COLUMNS
+
+	# Support memsys5 memory allocator.
+	# https://sqlite.org/compile.html#enable_memsys5
+	# https://sqlite.org/malloc.html#memsys5
+	options+=( --enable-memsys5 )
+
+	# Support sqlite3_normalized_sql() function.
+	# https://sqlite.org/c3ref/expanded_sql.html
+	append-cppflags -DSQLITE_ENABLE_NORMALIZE
+
+	# Support sqlite_offset() function.
+	# https://sqlite.org/compile.html#enable_offset_sql_func
+	# https://sqlite.org/lang_corefunc.html#sqlite_offset
+	append-cppflags -DSQLITE_ENABLE_OFFSET_SQL_FUNC
+
+	# Support pre-update hook functions.
+	# https://sqlite.org/compile.html#enable_preupdate_hook
+	# https://sqlite.org/c3ref/preupdate_count.html
+	append-cppflags -DSQLITE_ENABLE_PREUPDATE_HOOK
+
+	# Support Resumable Bulk Update extension.
+	# https://sqlite.org/compile.html#enable_rbu
+	# https://sqlite.org/rbu.html
+	append-cppflags -DSQLITE_ENABLE_RBU
+
+	# Support R*Trees.
+	# https://sqlite.org/compile.html#enable_rtree
+	# https://sqlite.org/compile.html#enable_geopoly
+	# https://sqlite.org/rtree.html
+	# https://sqlite.org/geopoly.html
+	options+=( --enable-rtree --enable-geopoly )
+
+	# Support Session extension.
+	# https://sqlite.org/compile.html#enable_session
+	# https://sqlite.org/sessionintro.html
+	options+=( --enable-session )
+
+	# Support scan status functions.
+	# https://sqlite.org/compile.html#enable_stmt_scanstatus
+	# https://sqlite.org/c3ref/stmt_scanstatus.html
+	# https://sqlite.org/c3ref/stmt_scanstatus_reset.html
+	append-cppflags -DSQLITE_ENABLE_STMT_SCANSTATUS
+
+	# Support sqlite_stmt virtual table.
+	# https://sqlite.org/compile.html#enable_stmtvtab
+	# https://sqlite.org/stmt.html
+	append-cppflags -DSQLITE_ENABLE_STMTVTAB
+
+	# Support unknown() function.
+	# https://sqlite.org/compile.html#enable_unknown_sql_function
+	append-cppflags -DSQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
+
+	# Support unlock notification.
+	# https://sqlite.org/compile.html#enable_unlock_notify
+	# https://sqlite.org/c3ref/unlock_notify.html
+	# https://sqlite.org/unlock_notify.html
+	append-cppflags -DSQLITE_ENABLE_UNLOCK_NOTIFY
+
+	# Support LIMIT and ORDER BY clauses on DELETE and UPDATE statements.
+	# https://sqlite.org/compile.html#enable_update_delete_limit
+	# https://sqlite.org/lang_delete.html#optional_limit_and_order_by_clauses
+	# https://sqlite.org/lang_update.html#optional_limit_and_order_by_clauses
+	append-cppflags -DSQLITE_ENABLE_UPDATE_DELETE_LIMIT
+
+	# Support soundex() function.
+	# https://sqlite.org/compile.html#soundex
+	# https://sqlite.org/lang_corefunc.html#soundex
+	append-cppflags -DSQLITE_SOUNDEX
+
+	# Support URI filenames.
+	# https://sqlite.org/compile.html#use_uri
+	# https://sqlite.org/uri.html
+	append-cppflags -DSQLITE_USE_URI
+
+	options+=( $(use_enable debug) )
+
+	if use icu; then
+		# Support ICU extension.
+		# https://sqlite.org/compile.html#enable_icu
+		options+=( --with-icu-config )
+	fi
+
+	options+=(
+		--disable-editline
+		$(use_enable readline)
+	)
+
+	if use readline; then
+		options+=( --with-readline-inc="-I${ESYSROOT}/usr/include/readline" )
+	fi
+
+	if use secure-delete; then
+		# Enable secure_delete pragma by default.
+		# https://sqlite.org/compile.html#secure_delete
+		# https://sqlite.org/pragma.html#pragma_secure_delete
+		append-cppflags -DSQLITE_SECURE_DELETE
+	fi
+
+	options+=( $(use_enable static-libs static) )
+
+	# tcl, test, tools USE flags.
+	if use tcl || use test || { use tools && multilib_is_native_abi; }; then
+		options+=(
+			--enable-tcl
+			--with-tcl="${ESYSROOT}/usr/$(get_libdir)"
+		)
+	else
+		options+=( --disable-tcl )
+	fi
+
+	if [[ "${ABI}" == "x86" ]]; then
+		if $(tc-getCC) ${CPPFLAGS} ${CFLAGS} -E -P -dM - < /dev/null 2> /dev/null | grep -q "^#define __SSE__ 1$"; then
+			append-cflags -mfpmath=sse
+		else
+			append-cflags -ffloat-store
+		fi
+	fi
+
+	if [[ ${CHOST} != *-darwin* ]] ; then
+		# set SONAME for the library
+		options+=( --soname=legacy )
+	else
+		# to allow install_name_tool id change
+		append-ldflags -headerpad_max_install_names
+	fi
+
+	# https://sqlite.org/forum/forumpost/4f4d06a9f6683bb9
+	tc-export_build_env BUILD_CC
+
+	CC_FOR_BUILD=${BUILD_CC} econf "${options[@]}"
+}
+
+multilib_src_compile() {
+	emake HAVE_TCL="$(usex tcl 1 0)" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}"
+
+	if use tools && multilib_is_native_abi; then
+		emake changeset dbdump dbhash dbtotxt index_usage rbu scrub showdb showjournal showshm showstat4 showwal sqldiff sqlite3_analyzer sqlite3_checker sqlite3_expert sqltclsh
+	fi
+
+	if [[ ${PV} == 9999 ]] && use doc && multilib_is_native_abi; then
+		emake tclsqlite3.c
+
+		local build_directory="$(pwd)"
+		build_directory="${build_directory##*/}"
+
+		mkdir "${WORKDIR}/${PN}-doc-build" || die
+		pushd "${WORKDIR}/${PN}-doc-build" > /dev/null || die
+
+		emake -f "../${PN}-doc/Makefile" -j1 SRC="../${PN}" BLD="../${build_directory}" DOC="../${PN}-doc" CC="$(tc-getBUILD_CC)" TCLINC="" TCLFLAGS="$($(tc-getBUILD_PKG_CONFIG) --libs tcl) -ldl -lm" base doc
+		rmdir doc/matrix{/*,} || die
+
+		popd > /dev/null || die
+	fi
+}
+
+multilib_src_test() {
+	if [[ "${EUID}" -eq 0 ]]; then
+		ewarn "Skipping tests due to root permissions"
+		return
+	fi
+
+	local -x SQLITE_HISTORY="${T}/sqlite_history_${ABI}"
+
+	# e_uri.test tries to open files in /.
+	# bug #839798
+	local SANDBOX_PREDICT=${SANDBOX_PREDICT}
+	addpredict "/test.db"
+	addpredict "/ÿ.db"
+
+	emake -Onone $(usex debug 'fulltest' 'test')
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" HAVE_TCL="$(usex tcl 1 "")" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}" install
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# fix install_name, soname=legacy doesn't work for this (but
+		# breaks the build instead)
+		install_name_tool \
+			-id "${EPREFIX}/usr/$(get_libdir)/libsqlite3$(get_libname 0)" \
+			"${ED}/usr/$(get_libdir)/libsqlite3$(get_libname ${PV})" \
+			|| die "failed to fix install_name"
+	fi
+
+	if use tools && multilib_is_native_abi; then
+		install_tool() {
+			if [[ -f ".libs/${1}" ]]; then
+				newbin ".libs/${1}" "${2}"
+			else
+				newbin "${1}" "${2}"
+			fi
+		}
+
+		install_tool changeset sqlite3-changeset
+		install_tool dbdump sqlite3-db-dump
+		install_tool dbhash sqlite3-db-hash
+		install_tool dbtotxt sqlite3-db-to-txt
+		install_tool index_usage sqlite3-index-usage
+		install_tool rbu sqlite3-rbu
+		install_tool scrub sqlite3-scrub
+		install_tool showdb sqlite3-show-db
+		install_tool showjournal sqlite3-show-journal
+		install_tool showshm sqlite3-show-shm
+		install_tool showstat4 sqlite3-show-stat4
+		install_tool showwal sqlite3-show-wal
+		install_tool sqldiff sqlite3-diff
+		install_tool sqlite3_analyzer sqlite3-analyzer
+		install_tool sqlite3_checker sqlite3-checker
+		install_tool sqlite3_expert sqlite3-expert
+		install_tool sqltclsh sqlite3-tclsh
+
+		unset -f install_tool
+	fi
+}
+
+multilib_src_install_all() {
+	find "${ED}" -name "*.la" -delete || die
+
+	doman sqlite3.1
+
+	if use doc; then
+		if [[ ${PV} == 9999 ]]; then
+			pushd "${WORKDIR}/${PN}-doc-build/doc" > /dev/null || die
+		else
+			pushd "${WORKDIR}/${PN}-doc-${DOC_PV}" > /dev/null || die
+		fi
+
+		find "(" -name "*.db" -o -name "*.txt" ")" -delete || die
+		if [[ ${PV} != 9999 ]]; then
+			rm search search.d/admin || die
+			rmdir search.d || die
+			find -name "*~" -delete || die
+		fi
+
+		(
+			docinto html
+			dodoc -r *
+		)
+
+		popd > /dev/null || die
+	fi
+}

From 3608c60e0ad683746490c33478584d774195a4cf Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:48 +0000
Subject: [PATCH 021/122] dev-debug/strace: Sync with Gentoo

It's from Gentoo commit a3bed04f5280ea59cd126a6f7776433712a8abdc.
---
 .../portage-stable/dev-debug/strace/Manifest  |   2 +
 .../dev-debug/strace/strace-6.16.ebuild       | 120 ++++++++++++++++++
 2 files changed, 122 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.16.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/strace/Manifest b/sdk_container/src/third_party/portage-stable/dev-debug/strace/Manifest
index a1cd9e7d10d..e7aac512a60 100644
--- a/sdk_container/src/third_party/portage-stable/dev-debug/strace/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/strace/Manifest
@@ -4,3 +4,5 @@ DIST strace-6.14.tar.xz 2650972 BLAKE2B 940bb7d54c29e8f22dcf67e617e8a664a7147bb9
 DIST strace-6.14.tar.xz.asc 801 BLAKE2B d25bc4e4164861c258da9037579603f5cfbfc45ee75c172fa90783d3ef9bfb743690b50bb6a6350f24937aa4cb4d87ea63e05f48d081c07ac45f0796486bb733 SHA512 8c107df8bedd2a9574e390e4bb576062681a5137bb48efbdb9ed2f9229871ffc847936b5e2341e335702601feba3a0935b9cc22a316607b5e32858b5cbcb0fd8
 DIST strace-6.15.tar.xz 2662388 BLAKE2B 73bac2016b3a92e88c1bfcdf4b0ce7a273c07554e61c1ba59d5b7c27f219ea0fc0f976413a26cf34e512739d0275e702dab280dd73d6124a4eabe67c6d8d0109 SHA512 5bb21b55d52aab6883821d4aea9449138d5efafac99f72b3831de710ed1ece11bb4a21b16fab97d772397213f43d06072e1d467ae03c38198ead0e65ddcd6ab5
 DIST strace-6.15.tar.xz.asc 801 BLAKE2B 08eb7aac938ab8f0fbb1f37b3072a3243b4a97e9206d2f6e23202d1494a0917e061a814a1a55cec5264dd828dbc2480a9ed63cc8b55fe68945d00a52c85e5bbf SHA512 c2c0098d9b415950c6f0591e2b8c59b96bb929df9270f5e256078d27e93b791f3bca2bf52f36d8ddf3b7354e711a94b4588b78a94da3327a35777c859808d993
+DIST strace-6.16.tar.xz 2674064 BLAKE2B 42155b733d18de50e38b95847a018b315ab36622823ba1113d1a58666de9eda373cc4110b2acdc0c4173520eb55859ff4493fa4a01df1b7c4c1902b11afaa88e SHA512 47d806e7a91537977a41b0289f896c4e36a2c2715554ea31df6c416de581b974d8826be1abf02999fd3ca2f90af122cfefe7c4f20c935026b84421aa8a516f96
+DIST strace-6.16.tar.xz.asc 801 BLAKE2B bcf1729906866c7d92a6672ffe4f89946b27fbdf9963775f1a6703c7fa297f62f1fef80a029f5e0caa117f2c7094fb959dba967ff628117785b934b28ececb79 SHA512 cb4c71780a817ec6e0dcd0f994e91870b8a1ee26b2062fe51000414624343d05dce799c8677683264d9c051a20d4a40e028159282e979e4f3307447cecc16446
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.16.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.16.ebuild
new file mode 100644
index 00000000000..196f558d280
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.16.ebuild
@@ -0,0 +1,120 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools edo flag-o-matic toolchain-funcs verify-sig
+
+DESCRIPTION="Useful diagnostic, instructional, and debugging tool"
+HOMEPAGE="https://strace.io/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/strace/strace.git"
+	inherit git-r3
+else
+	SRC_URI="
+		https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz
+		verify-sig? ( https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz.asc )
+	"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/strace.asc
+
+LICENSE="LGPL-2.1+ test? ( GPL-2+ )"
+SLOT="0"
+IUSE="aio perl selinux static test unwind elfutils"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="?? ( unwind elfutils )"
+
+BDEPEND="
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-strace-20151021 )
+"
+LIB_DEPEND="
+	unwind? ( sys-libs/libunwind[static-libs(+)] )
+	elfutils? ( dev-libs/elfutils[static-libs(+)] )
+	selinux? ( sys-libs/libselinux[static-libs(+)] )
+"
+# strace only uses the header from libaio to decode structs
+DEPEND="
+	static? ( ${LIB_DEPEND} )
+	aio? ( >=dev-libs/libaio-0.3.106 )
+"
+RDEPEND="
+	!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+	perl? ( dev-lang/perl )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-6.5-static.patch"
+)
+
+src_prepare() {
+	default
+
+	if [[ ! -e configure ]] ; then
+		# git generation
+		sed /autoreconf/d -i bootstrap || die
+		edo ./bootstrap
+		[[ ! -e CREDITS ]] && cp CREDITS{.in,}
+	fi
+
+	eautoreconf
+
+	# Stub out the -k test since it's known to be flaky. bug #545812
+	sed -i '1iexit 77' tests*/strace-k.test || die
+}
+
+src_configure() {
+	# Set up the default build settings, and then use the names strace expects.
+	tc-export_build_env BUILD_{CC,CPP}
+	local v bv
+	for v in CC CPP {C,CPP,LD}FLAGS ; do
+		bv="BUILD_${v}"
+		export "${v}_FOR_BUILD=${!bv}"
+	done
+
+	filter-lfs-flags # configure handles this sanely
+
+	export ac_cv_header_libaio_h=$(usex aio)
+	use elibc_musl && export ac_cv_header_stdc=no
+
+	local myeconfargs=(
+		--disable-gcc-Werror
+
+		# Don't require mpers support on non-multilib systems. #649560
+		--enable-mpers=check
+
+		# We don't want to pin to exact linux-headers versions (bug #950309)
+		--enable-bundled=yes
+
+		$(use_enable static)
+		$(use_with unwind libunwind)
+		$(use_with elfutils libdw)
+		$(use_with selinux libselinux)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	if has usersandbox ${FEATURES} ; then
+		# bug #643044
+		ewarn "Test suite is known to fail with FEATURES=usersandbox -- skipping ..."
+		return 0
+	fi
+
+	default
+}
+
+src_install() {
+	default
+
+	if use perl ; then
+		exeinto /usr/bin
+		doexe src/strace-graph
+	fi
+
+	dodoc CREDITS
+}

From 31c9430d965b2fef928fdb701158feb86a55708a Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:49 +0000
Subject: [PATCH 022/122] dev-go/go-md2man: Sync with Gentoo

It's from Gentoo commit 6810914dea2629aedcb96a9bc61aa3a6eaa3940f.
---
 .../portage-stable/dev-go/go-md2man/Manifest  |  3 +-
 .../dev-go/go-md2man/go-md2man-2.0.3.ebuild   | 32 -------------------
 .../dev-go/go-md2man/go-md2man-2.0.7.ebuild   | 30 +++++++++++++++++
 3 files changed, 32 insertions(+), 33 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.3.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.7.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/Manifest b/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/Manifest
index 5f9909e3d0e..17af0e6d638 100644
--- a/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/Manifest
@@ -1,3 +1,4 @@
-DIST go-md2man-2.0.3.tar.gz 64961 BLAKE2B 790fe7c247e0f934a397d7389be589c6e4d75be3cd533da13ae4e46c927604c3249e3a2f0c975320bac0f21f3040059202434f6fd4b2ea6dd50d6b772fa01842 SHA512 237e8039beea11b4efb7d0c75fb5826c17dea50057b0149b9533e72e2a5198811f9a3a5b264ea3788922d2f03b07cb57914448b2d4325d54d0f946fb42c42f40
 DIST go-md2man-2.0.6-deps.tar.xz 76368 BLAKE2B 010d274d5e5c20e14848e92b210b03447d11c6fe8fd728b0f148a6f2cbc9f0a7cca22217f1920e00b0f7c363bbe2c5f572fb95ce02e67e3e55175c56cbd372d9 SHA512 7abc4eb75b4a168f2269936049eaca68ecb9ed39b29e6885cddf3683daf9b439b1573848192dff98ce67b99da0d1f09ddc27261e97c8cdfeb71e09e0030876b6
 DIST go-md2man-2.0.6.tar.gz 11064 BLAKE2B fec5c061c5d1b85e3ad86563a301afd01d47f2d83ef5b97bf964f77ebbbbb19c58108ecd8caa9df1663396a13c8b178578a9b02c3c30341cea0bb9abe1d196ea SHA512 c6273040edf7e4c97851c0bfb5366ed0298e92ff1f7f4740104979f1cac17d6303b998ff75396a4264b164872886854e7dadfee3f139d76f684c1b6ca5512828
+DIST go-md2man-2.0.7-deps.tar.xz 76368 BLAKE2B 010d274d5e5c20e14848e92b210b03447d11c6fe8fd728b0f148a6f2cbc9f0a7cca22217f1920e00b0f7c363bbe2c5f572fb95ce02e67e3e55175c56cbd372d9 SHA512 7abc4eb75b4a168f2269936049eaca68ecb9ed39b29e6885cddf3683daf9b439b1573848192dff98ce67b99da0d1f09ddc27261e97c8cdfeb71e09e0030876b6
+DIST go-md2man-2.0.7.tar.gz 11337 BLAKE2B 4b82e6cff896317e555b0eb50da69e9c29b9532d115e3c9b2c5a9c98681ba2726db81bab6dc8fac95a2dc4ca32f9e99161c0a8943001863ef68191acf8fd6c09 SHA512 cc6878af3cfdb0c06ee46b39aa407ec5e48814dc8f68eeae885607407833ac263995fe61c0870217e7c2b2102904f1cf732fa210d89ba38e2443ab1436212905
diff --git a/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.3.ebuild
deleted file mode 100644
index de6a9433af8..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.3.ebuild
+++ /dev/null
@@ -1,32 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-inherit go-module
-
-DESCRIPTION="A utility to convert markdown to man pages"
-	SRC_URI="https://github.com/cpuguy83/go-md2man/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-HOMEPAGE="https://github.com/cpuguy83/go-md2man"
-
-LICENSE="BSD-2 MIT"
-SLOT="0"
-KEYWORDS="amd64 ~arm arm64 ~loong ppc64 ~riscv ~x86"
-
-# restrict tests because they need network-sandbox disabled
-# bug https://bugs.gentoo.org/715028
-RESTRICT+=" test"
-
-src_compile() {
-	emake BUILD_FLAGS="-mod=vendor" build
-}
-
-src_install() {
-	"${S}"/bin/go-md2man -in go-md2man.1.md -out go-md2man.1 ||
-		die "Unable to create man page"
-	dobin bin/go-md2man
-	doman go-md2man.1
-}
-
-src_test() {
-	emake test
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.7.ebuild
new file mode 100644
index 00000000000..bcac703061a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.7.ebuild
@@ -0,0 +1,30 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit edo go-module
+
+DESCRIPTION="A utility to convert markdown to man pages"
+HOMEPAGE="https://github.com/cpuguy83/go-md2man"
+SRC_URI="https://github.com/cpuguy83/go-md2man/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~arthurzam/distfiles/dev-go/${PN}/${P}-deps.tar.xz"
+
+LICENSE="BSD-2 MIT"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+
+src_compile() {
+	emake build
+}
+
+src_test() {
+	emake test
+}
+
+src_install() {
+	dobin bin/go-md2man
+
+	edo "${S}"/bin/go-md2man -in go-md2man.1.md -out go-md2man.1
+	doman go-md2man.1
+}

From d19bd498f6a2dafd43845356fa92a41555e5949e Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:51 +0000
Subject: [PATCH 023/122] dev-lang/go: Sync with Gentoo

It's from Gentoo commit 27b2dca6f10cfa7732058f83d7792cc503b65e51.
---
 .../portage-stable/dev-lang/go/Manifest       |   8 +-
 .../dev-lang/go/go-1.23.10.ebuild             | 161 ------------------
 .../dev-lang/go/go-1.23.11.ebuild             | 161 ------------------
 ...{go-1.23.9-r1.ebuild => go-1.23.12.ebuild} |   3 +-
 .../dev-lang/go/go-1.24.4.ebuild              | 132 --------------
 .../dev-lang/go/go-1.24.5-r1.ebuild           | 128 --------------
 .../dev-lang/go/go-1.24.5.ebuild              | 132 --------------
 .../go/{go-1.24.3.ebuild => go-1.24.6.ebuild} |   7 +-
 .../portage-stable/dev-lang/go/go-9999.ebuild |   3 +-
 9 files changed, 8 insertions(+), 727 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.10.ebuild
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.11.ebuild
 rename sdk_container/src/third_party/portage-stable/dev-lang/go/{go-1.23.9-r1.ebuild => go-1.23.12.ebuild} (99%)
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.4.ebuild
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.5-r1.ebuild
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.5.ebuild
 rename sdk_container/src/third_party/portage-stable/dev-lang/go/{go-1.24.3.ebuild => go-1.24.6.ebuild} (96%)

diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest
index 62317fc69cd..e78f90a7838 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest
@@ -1,6 +1,2 @@
-DIST go1.23.10.src.tar.gz 28183775 BLAKE2B 877d61cc6dce0846feb0e2b3f901be9f233d458f549afe9c547d8a279b10c483120c3224cdb2add11af1ff4fb229a1a6d362b0701cf02d8d1c12721275fc954a SHA512 20639185b05720aa8bb295c54e3eaa7cf56739763544d28ce14a6f0323bf890900d5fad13086032291fbefad4482f1442772875bbdf16a94e2286eb405c8f327
-DIST go1.23.11.src.tar.gz 28185977 BLAKE2B 7624458c815210fe9b91a7cef8ca6fa0222518d84ebae500b3b36df2af1ecece6e2eee1fcb2a5d724492ba7dfdfe07509f18cd1976ca7e40c2f5d26802f4ad02 SHA512 108b86d384de01617b7c58fba8a2c6446f6d1e8d07b720de2c49854e664c8c2660f6a3700827bf77cb7f018f78c7f3dc4f9c9f3a8fba8ca5e91cadde2df98a95
-DIST go1.23.9.src.tar.gz 28182928 BLAKE2B fe1038bb32982c4b2032e4a2a9aa533e7ff648337107581b905e484ae9cbbb8bb4e6d8b5b6041f06dd9b25b47c271e9240d6b329813d7777736fc9a33538a381 SHA512 0f80680caabbf50a4f55555d0515530c55e297f38bf193a9da531e640f069719e3c7a5670b72f7629fada8162f978305ae1e4e6398369b8021cfe6dc9157254a
-DIST go1.24.3.src.tar.gz 30789282 BLAKE2B b9ddb484900129f2b916c224ce30b59fdd14ed396f92b8935baa775e9574c5970494d8e612b60c675f699a73683781dfa9802a4c3906f5cc112b9de8ea83154f SHA512 05d19372fb923eeea19395b4de569d2ecfec7fadf2d8236d47cd667982de51c569e9816372cb79e32166553f9bcbe68f7bc2a6ded5655809b1caf5bd941011e7
-DIST go1.24.4.src.tar.gz 30788576 BLAKE2B a553d7f3ec647fb962a4bf89c131b2eb6ad5da4f9335b9e3ef417a9eeca20d81d61c4e92a48fa050d3f422affbcf371a2bcc81e23a7c1b2c408677f7bcaa1025 SHA512 b785583fc53d62094b2de793a0e3281a26d2de17897a35b378fc2d13cb912ca473c37a7bae54a50660141809d5d0a70a97663d406cf30d7f0221ecbb5ffddec6
-DIST go1.24.5.src.tar.gz 30792943 BLAKE2B 47d281c221ca87f7b668e5e44017b77c408c08543ded64c54de9515cd3759f92228983f878e39ae0d52e7bbdae4c09161381196bb7efb48e77f38694195c883e SHA512 917cd6ac83e3370227da40f8490697e8638847e9279ed1806044a173d3b52829c67c429990db92d8aadcfba6a37bfc00114c1ecec3ac387a781bb7edc8dcab22
+DIST go1.23.12.src.tar.gz 28185486 BLAKE2B a4d66382a56b89987084e06cc7d18fa48eb870cb1cb4202c86f7a8136f2dd1e2f592a8f3129384c426635aae74d4dae073520a124163497f143a047c61aa753d SHA512 c7f2125328da13aa956b58e5238ff4bba6bd94f2e93dac88c1b96c0556c1de3de28c512197a780366806bba92fb4ec03f1ccd14b606b8544b16bb08df106cb50
+DIST go1.24.6.src.tar.gz 30794139 BLAKE2B b51693de6047402baa555e3d6c0c37511de60270c538797ea09317c604345b7577c0a24aa0f9f3963340538965f130360d4d98ed91470df83e790c95972af265 SHA512 65f535c722f4a0f6111c9ed829677621e456a5bc969ccb99009da1ade096b2b1a648a44ccfa913543677c220baeaf1afe634ba8ba165d9474ac9433ac249c914
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.10.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.10.ebuild
deleted file mode 100644
index 804fca4ff06..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.10.ebuild
+++ /dev/null
@@ -1,161 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-export CBUILD=${CBUILD:-${CHOST}}
-export CTARGET=${CTARGET:-${CHOST}}
-
-# See "Bootstrap" in release notes
-GO_BOOTSTRAP_MIN=1.20.14
-MY_PV=${PV/_/}
-
-inherit go-env toolchain-funcs
-
-case ${PV}  in
-*9999*)
-	EGIT_REPO_URI="https://github.com/golang/go.git"
-	inherit git-r3
-	;;
-*)
-	SRC_URI="https://storage.googleapis.com/golang/go${MY_PV}.src.tar.gz "
-	S="${WORKDIR}"/go
-	case ${PV} in
-	*_beta*|*_rc*) ;;
-	*)
-		KEYWORDS="-* amd64 arm ~arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
-		;;
-	esac
-esac
-
-DESCRIPTION="A concurrent garbage collected and typesafe programming language"
-HOMEPAGE="https://go.dev"
-
-LICENSE="BSD"
-SLOT="0/${PV}"
-IUSE="cpu_flags_x86_sse2"
-
-BDEPEND="|| (
-		>=dev-lang/go-${GO_BOOTSTRAP_MIN}
-		>=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN} )"
-
-# the *.syso files have writable/executable stacks
-QA_EXECSTACK='*.syso'
-
-# Do not complain about CFLAGS, etc, since Go doesn't use them.
-QA_FLAGS_IGNORED='.*'
-
-# The tools in /usr/lib/go should not cause the multilib-strict check to fail.
-QA_MULTILIB_PATHS="usr/lib/go/pkg/tool/.*/.*"
-
-# This package triggers "unrecognized elf file(s)" notices on riscv.
-# https://bugs.gentoo.org/794046
-QA_PREBUILT='.*'
-
-# Do not strip this package. Stripping is unsupported upstream and may
-# fail.
-RESTRICT=" strip"
-
-DOCS=(
-	CONTRIBUTING.md
-	PATENTS
-	README.md
-	SECURITY.md
-)
-
-go_tuple() {
-	echo "$(go-env_goos $@)_$(go-env_goarch $@)"
-}
-
-go_cross_compile() {
-	[[ $(go_tuple ${CBUILD}) != $(go_tuple) ]]
-}
-
-PATCHES=(
-	"${FILESDIR}"/go-1.24-skip-gdb-tests.patch
-	"${FILESDIR}"/go-1.24-dont-force-gold-arm.patch
-	"${FILESDIR}"/go-never-download-newer-toolchains.patch
-)
-
-src_compile() {
-	if has_version -b ">=dev-lang/go-${GO_BOOTSTRAP_MIN}"; then
-		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go"
-	elif has_version -b ">=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN}"; then
-		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go-bootstrap"
-	else
-		eerror "Go cannot be built without go or go-bootstrap installed"
-		die "Should not be here, please report a bug"
-	fi
-
-	# Go's build script does not use BUILD/HOST/TARGET consistently. :(
-	export GOHOSTARCH=$(go-env_goarch ${CBUILD})
-	export GOHOSTOS=$(go-env_goos ${CBUILD})
-	export CC=$(tc-getBUILD_CC)
-
-	export GOARCH=$(go-env_goarch)
-	export GOOS=$(go-env_goos)
-	export CC_FOR_TARGET=$(tc-getCC)
-	export CXX_FOR_TARGET=$(tc-getCXX)
-	use arm && export GOARM=$(go-env_goarm)
-	use x86 && export GO386=$(go-env_go386)
-
-	cd src
-	bash -x ./make.bash || die "build failed"
-}
-
-src_test() {
-	go_cross_compile && return 0
-
-	cd src
-
-	# https://github.com/golang/go/issues/42005
-	rm cmd/link/internal/ld/fallocate_test.go || die
-
-	PATH="${GOBIN}:${PATH}" \
-	./run.bash -no-rebuild -k || die "tests failed"
-	cd ..
-	rm -fr pkg/*_race || die
-	rm -fr pkg/obj/go-build || die
-}
-
-src_install() {
-	dodir /usr/lib/go
-	# The use of cp is deliberate in order to retain permissions
-	cp -R api bin doc lib pkg misc src test "${ED}"/usr/lib/go
-	einstalldocs
-
-	insinto /usr/lib/go
-	doins go.env VERSION*
-
-	# testdata directories are not needed on the installed system
-	rm -fr $(find "${ED}"/usr/lib/go -iname testdata -type d -print)
-
-	local bin_path
-	if go_cross_compile; then
-		bin_path="bin/$(go_tuple)"
-	else
-		bin_path=bin
-	fi
-	local f x
-	for x in ${bin_path}/*; do
-		f=${x##*/}
-		dosym ../lib/go/${bin_path}/${f} /usr/bin/${f}
-	done
-
-	# install the @golang-rebuild set for Portage
-	insinto /usr/share/portage/config/sets
-	newins "${FILESDIR}"/go-sets.conf go.conf
-}
-
-pkg_postinst() {
-	[[ -z ${REPLACING_VERSIONS} ]] && return
-	elog "After ${CATEGORY}/${PN} is updated it is recommended to rebuild"
-	elog "all packages compiled with previous versions of ${CATEGORY}/${PN}"
-	elog "due to the static linking nature of go."
-	elog "If this is not done, the packages compiled with the older"
-	elog "version of the compiler will not be updated until they are"
-	elog "updated individually, which could mean they will have"
-	elog "vulnerabilities."
-	elog "Run 'emerge @golang-rebuild' to rebuild all 'go' packages"
-	elog "See https://bugs.gentoo.org/752153 for more info"
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.11.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.11.ebuild
deleted file mode 100644
index 8055c81cefa..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.11.ebuild
+++ /dev/null
@@ -1,161 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-export CBUILD=${CBUILD:-${CHOST}}
-export CTARGET=${CTARGET:-${CHOST}}
-
-# See "Bootstrap" in release notes
-GO_BOOTSTRAP_MIN=1.20.14
-MY_PV=${PV/_/}
-
-inherit go-env toolchain-funcs
-
-case ${PV}  in
-*9999*)
-	EGIT_REPO_URI="https://github.com/golang/go.git"
-	inherit git-r3
-	;;
-*)
-	SRC_URI="https://storage.googleapis.com/golang/go${MY_PV}.src.tar.gz "
-	S="${WORKDIR}"/go
-	case ${PV} in
-	*_beta*|*_rc*) ;;
-	*)
-		KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
-		;;
-	esac
-esac
-
-DESCRIPTION="A concurrent garbage collected and typesafe programming language"
-HOMEPAGE="https://go.dev"
-
-LICENSE="BSD"
-SLOT="0/${PV}"
-IUSE="cpu_flags_x86_sse2"
-
-BDEPEND="|| (
-		>=dev-lang/go-${GO_BOOTSTRAP_MIN}
-		>=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN} )"
-
-# the *.syso files have writable/executable stacks
-QA_EXECSTACK='*.syso'
-
-# Do not complain about CFLAGS, etc, since Go doesn't use them.
-QA_FLAGS_IGNORED='.*'
-
-# The tools in /usr/lib/go should not cause the multilib-strict check to fail.
-QA_MULTILIB_PATHS="usr/lib/go/pkg/tool/.*/.*"
-
-# This package triggers "unrecognized elf file(s)" notices on riscv.
-# https://bugs.gentoo.org/794046
-QA_PREBUILT='.*'
-
-# Do not strip this package. Stripping is unsupported upstream and may
-# fail.
-RESTRICT=" strip"
-
-DOCS=(
-	CONTRIBUTING.md
-	PATENTS
-	README.md
-	SECURITY.md
-)
-
-go_tuple() {
-	echo "$(go-env_goos $@)_$(go-env_goarch $@)"
-}
-
-go_cross_compile() {
-	[[ $(go_tuple ${CBUILD}) != $(go_tuple) ]]
-}
-
-PATCHES=(
-	"${FILESDIR}"/go-1.24-skip-gdb-tests.patch
-	"${FILESDIR}"/go-1.24-dont-force-gold-arm.patch
-	"${FILESDIR}"/go-never-download-newer-toolchains.patch
-)
-
-src_compile() {
-	if has_version -b ">=dev-lang/go-${GO_BOOTSTRAP_MIN}"; then
-		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go"
-	elif has_version -b ">=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN}"; then
-		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go-bootstrap"
-	else
-		eerror "Go cannot be built without go or go-bootstrap installed"
-		die "Should not be here, please report a bug"
-	fi
-
-	# Go's build script does not use BUILD/HOST/TARGET consistently. :(
-	export GOHOSTARCH=$(go-env_goarch ${CBUILD})
-	export GOHOSTOS=$(go-env_goos ${CBUILD})
-	export CC=$(tc-getBUILD_CC)
-
-	export GOARCH=$(go-env_goarch)
-	export GOOS=$(go-env_goos)
-	export CC_FOR_TARGET=$(tc-getCC)
-	export CXX_FOR_TARGET=$(tc-getCXX)
-	use arm && export GOARM=$(go-env_goarm)
-	use x86 && export GO386=$(go-env_go386)
-
-	cd src
-	bash -x ./make.bash || die "build failed"
-}
-
-src_test() {
-	go_cross_compile && return 0
-
-	cd src
-
-	# https://github.com/golang/go/issues/42005
-	rm cmd/link/internal/ld/fallocate_test.go || die
-
-	PATH="${GOBIN}:${PATH}" \
-	./run.bash -no-rebuild -k || die "tests failed"
-	cd ..
-	rm -fr pkg/*_race || die
-	rm -fr pkg/obj/go-build || die
-}
-
-src_install() {
-	dodir /usr/lib/go
-	# The use of cp is deliberate in order to retain permissions
-	cp -R api bin doc lib pkg misc src test "${ED}"/usr/lib/go
-	einstalldocs
-
-	insinto /usr/lib/go
-	doins go.env VERSION*
-
-	# testdata directories are not needed on the installed system
-	rm -fr $(find "${ED}"/usr/lib/go -iname testdata -type d -print)
-
-	local bin_path
-	if go_cross_compile; then
-		bin_path="bin/$(go_tuple)"
-	else
-		bin_path=bin
-	fi
-	local f x
-	for x in ${bin_path}/*; do
-		f=${x##*/}
-		dosym ../lib/go/${bin_path}/${f} /usr/bin/${f}
-	done
-
-	# install the @golang-rebuild set for Portage
-	insinto /usr/share/portage/config/sets
-	newins "${FILESDIR}"/go-sets.conf go.conf
-}
-
-pkg_postinst() {
-	[[ -z ${REPLACING_VERSIONS} ]] && return
-	elog "After ${CATEGORY}/${PN} is updated it is recommended to rebuild"
-	elog "all packages compiled with previous versions of ${CATEGORY}/${PN}"
-	elog "due to the static linking nature of go."
-	elog "If this is not done, the packages compiled with the older"
-	elog "version of the compiler will not be updated until they are"
-	elog "updated individually, which could mean they will have"
-	elog "vulnerabilities."
-	elog "Run 'emerge @golang-rebuild' to rebuild all 'go' packages"
-	elog "See https://bugs.gentoo.org/752153 for more info"
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.9-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.12.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.9-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.12.ebuild
index 3c89d598512..460ae2af014 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.9-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.12.ebuild
@@ -50,7 +50,8 @@ QA_MULTILIB_PATHS="usr/lib/go/pkg/tool/.*/.*"
 
 # This package triggers "unrecognized elf file(s)" notices on riscv.
 # https://bugs.gentoo.org/794046
-QA_PREBUILT='.*'
+QA_PREBUILT="*"
+QA_PRESTRIPPED="*.syso"
 
 # Do not strip this package. Stripping is unsupported upstream and may
 # fail.
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.4.ebuild
deleted file mode 100644
index 2a3d3932da5..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.4.ebuild
+++ /dev/null
@@ -1,132 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-export CBUILD=${CBUILD:-${CHOST}}
-export CTARGET=${CTARGET:-${CHOST}}
-
-# See "Bootstrap" in release notes
-GO_BOOTSTRAP_MIN=1.22.12
-MY_PV=${PV/_/}
-
-inherit go-env toolchain-funcs
-
-case ${PV}  in
-*9999*)
-	EGIT_REPO_URI="https://github.com/golang/go.git"
-	inherit git-r3
-	;;
-*)
-	SRC_URI="https://storage.googleapis.com/golang/go${MY_PV}.src.tar.gz "
-	S="${WORKDIR}"/go
-	KEYWORDS="-* amd64 arm ~arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
-	;;
-esac
-
-DESCRIPTION="A concurrent garbage collected and typesafe programming language"
-HOMEPAGE="https://go.dev"
-
-LICENSE="BSD"
-SLOT="0/${PV}"
-IUSE="cpu_flags_x86_sse2"
-
-BDEPEND="|| (
-		>=dev-lang/go-${GO_BOOTSTRAP_MIN}
-		>=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN} )"
-
-# the *.syso files have writable/executable stacks
-QA_EXECSTACK='*.syso'
-
-# Do not complain about CFLAGS, etc, since Go doesn't use them.
-QA_FLAGS_IGNORED='.*'
-
-# The tools in /usr/lib/go should not cause the multilib-strict check to fail.
-QA_MULTILIB_PATHS="usr/lib/go/pkg/tool/.*/.*"
-
-# This package triggers "unrecognized elf file(s)" notices on riscv.
-# https://bugs.gentoo.org/794046
-QA_PREBUILT='.*'
-
-# Do not strip this package. Stripping is unsupported upstream and may
-# fail.
-RESTRICT=" strip"
-
-DOCS=(
-	CONTRIBUTING.md
-	PATENTS
-	README.md
-	SECURITY.md
-)
-
-go_tuple() {
-	echo "$(go-env_goos $@)_$(go-env_goarch $@)"
-}
-
-go_cross_compile() {
-	[[ $(go_tuple ${CBUILD}) != $(go_tuple) ]]
-}
-
-PATCHES=(
-	"${FILESDIR}"/go-1.24-skip-gdb-tests.patch
-	"${FILESDIR}"/go-1.24-dont-force-gold-arm.patch
-	"${FILESDIR}"/go-never-download-newer-toolchains.patch
-)
-
-src_compile() {
-	if has_version -b ">=dev-lang/go-${GO_BOOTSTRAP_MIN}"; then
-		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go"
-	elif has_version -b ">=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN}"; then
-		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go-bootstrap"
-	else
-		eerror "Go cannot be built without go or go-bootstrap installed"
-		die "Should not be here, please report a bug"
-	fi
-
-	# Go's build script does not use BUILD/HOST/TARGET consistently. :(
-	export GOHOSTARCH=$(go-env_goarch ${CBUILD})
-	export GOHOSTOS=$(go-env_goos ${CBUILD})
-	export CC=$(tc-getBUILD_CC)
-
-	export GOARCH=$(go-env_goarch)
-	export GOOS=$(go-env_goos)
-	export CC_FOR_TARGET=$(tc-getCC)
-	export CXX_FOR_TARGET=$(tc-getCXX)
-	use arm && export GOARM=$(go-env_goarm)
-	use x86 && export GO386=$(go-env_go386)
-
-	cd src
-	bash -x ./make.bash || die "build failed"
-}
-
-src_test() {
-	go_cross_compile && return 0
-	cd src
-	PATH="${GOBIN}:${PATH}" \
-	./run.bash -no-rebuild -k || die "tests failed"
-}
-
-src_install() {
-	dodir /usr/lib/go
-	# The use of cp is deliberate in order to retain permissions
-	cp -R . "${ED}"/usr/lib/go
-	einstalldocs
-
-	# testdata directories are not needed on the installed system
-	# The other files we remove are installed by einstalldocs
-	rm -r $(find "${ED}"/usr/lib/go -iname testdata -type d -print) || die
-	rm "${ED}"/usr/lib/go/{CONTRIBUTING.md,PATENTS,README.md} || die
-	rm "${ED}"/usr/lib/go/{SECURITY.md,codereview.cfg,LICENSE} || die
-
-	local bin_path
-	if go_cross_compile; then
-		bin_path="bin/$(go_tuple)"
-	else
-		bin_path=bin
-	fi
-	local f x
-	for x in ${bin_path}/*; do
-		f=${x##*/}
-		dosym ../lib/go/${bin_path}/${f} /usr/bin/${f}
-	done
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.5-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.5-r1.ebuild
deleted file mode 100644
index 73979ffd662..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.5-r1.ebuild
+++ /dev/null
@@ -1,128 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-export CBUILD=${CBUILD:-${CHOST}}
-export CTARGET=${CTARGET:-${CHOST}}
-
-# See "Bootstrap" in release notes
-GO_BOOTSTRAP_MIN=1.22.12
-MY_PV=${PV/_/}
-
-inherit go-env toolchain-funcs
-
-case ${PV}  in
-*9999*)
-	EGIT_REPO_URI="https://github.com/golang/go.git"
-	inherit git-r3
-	;;
-*)
-	SRC_URI="https://storage.googleapis.com/golang/go${MY_PV}.src.tar.gz "
-	S="${WORKDIR}"/go
-	KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
-	;;
-esac
-
-DESCRIPTION="A concurrent garbage collected and typesafe programming language"
-HOMEPAGE="https://go.dev"
-
-LICENSE="BSD"
-SLOT="0/${PV}"
-IUSE="cpu_flags_x86_sse2"
-
-BDEPEND="|| (
-		>=dev-lang/go-${GO_BOOTSTRAP_MIN}
-		>=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN} )"
-
-# the *.syso files have writable/executable stacks
-QA_EXECSTACK='*.syso'
-
-# Do not complain about CFLAGS, etc, since Go doesn't use them.
-QA_FLAGS_IGNORED='.*'
-
-# The tools in /usr/lib/go should not cause the multilib-strict check to fail.
-QA_MULTILIB_PATHS="usr/lib/go/pkg/tool/.*/.*"
-
-# This package triggers "unrecognized elf file(s)" notices on riscv.
-# https://bugs.gentoo.org/794046
-QA_PREBUILT='.*'
-
-DOCS=(
-	CONTRIBUTING.md
-	PATENTS
-	README.md
-	SECURITY.md
-)
-
-go_tuple() {
-	echo "$(go-env_goos $@)_$(go-env_goarch $@)"
-}
-
-go_cross_compile() {
-	[[ $(go_tuple ${CBUILD}) != $(go_tuple) ]]
-}
-
-PATCHES=(
-	"${FILESDIR}"/go-1.24-skip-gdb-tests.patch
-	"${FILESDIR}"/go-1.24-dont-force-gold-arm.patch
-	"${FILESDIR}"/go-never-download-newer-toolchains.patch
-)
-
-src_compile() {
-	if has_version -b ">=dev-lang/go-${GO_BOOTSTRAP_MIN}"; then
-		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go"
-	elif has_version -b ">=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN}"; then
-		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go-bootstrap"
-	else
-		eerror "Go cannot be built without go or go-bootstrap installed"
-		die "Should not be here, please report a bug"
-	fi
-
-	# Go's build script does not use BUILD/HOST/TARGET consistently. :(
-	export GOHOSTARCH=$(go-env_goarch ${CBUILD})
-	export GOHOSTOS=$(go-env_goos ${CBUILD})
-	export CC=$(tc-getBUILD_CC)
-
-	export GOARCH=$(go-env_goarch)
-	export GOOS=$(go-env_goos)
-	export CC_FOR_TARGET=$(tc-getCC)
-	export CXX_FOR_TARGET=$(tc-getCXX)
-	use arm && export GOARM=$(go-env_goarm)
-	use x86 && export GO386=$(go-env_go386)
-
-	cd src
-	bash -x ./make.bash || die "build failed"
-}
-
-src_test() {
-	go_cross_compile && return 0
-	cd src
-	PATH="${GOBIN}:${PATH}" \
-	./run.bash -no-rebuild -k || die "tests failed"
-}
-
-src_install() {
-	dodir /usr/lib/go
-	# The use of cp is deliberate in order to retain permissions
-	cp -R . "${ED}"/usr/lib/go
-	einstalldocs
-
-	# testdata directories are not needed on the installed system
-	# The other files we remove are installed by einstalldocs
-	rm -r $(find "${ED}"/usr/lib/go -iname testdata -type d -print) || die
-	rm "${ED}"/usr/lib/go/{CONTRIBUTING.md,PATENTS,README.md} || die
-	rm "${ED}"/usr/lib/go/{SECURITY.md,codereview.cfg,LICENSE} || die
-
-	local bin_path
-	if go_cross_compile; then
-		bin_path="bin/$(go_tuple)"
-	else
-		bin_path=bin
-	fi
-	local f x
-	for x in ${bin_path}/*; do
-		f=${x##*/}
-		dosym ../lib/go/${bin_path}/${f} /usr/bin/${f}
-	done
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.5.ebuild
deleted file mode 100644
index 2be24178ea7..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.5.ebuild
+++ /dev/null
@@ -1,132 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-export CBUILD=${CBUILD:-${CHOST}}
-export CTARGET=${CTARGET:-${CHOST}}
-
-# See "Bootstrap" in release notes
-GO_BOOTSTRAP_MIN=1.22.12
-MY_PV=${PV/_/}
-
-inherit go-env toolchain-funcs
-
-case ${PV}  in
-*9999*)
-	EGIT_REPO_URI="https://github.com/golang/go.git"
-	inherit git-r3
-	;;
-*)
-	SRC_URI="https://storage.googleapis.com/golang/go${MY_PV}.src.tar.gz "
-	S="${WORKDIR}"/go
-	KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
-	;;
-esac
-
-DESCRIPTION="A concurrent garbage collected and typesafe programming language"
-HOMEPAGE="https://go.dev"
-
-LICENSE="BSD"
-SLOT="0/${PV}"
-IUSE="cpu_flags_x86_sse2"
-
-BDEPEND="|| (
-		>=dev-lang/go-${GO_BOOTSTRAP_MIN}
-		>=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN} )"
-
-# the *.syso files have writable/executable stacks
-QA_EXECSTACK='*.syso'
-
-# Do not complain about CFLAGS, etc, since Go doesn't use them.
-QA_FLAGS_IGNORED='.*'
-
-# The tools in /usr/lib/go should not cause the multilib-strict check to fail.
-QA_MULTILIB_PATHS="usr/lib/go/pkg/tool/.*/.*"
-
-# This package triggers "unrecognized elf file(s)" notices on riscv.
-# https://bugs.gentoo.org/794046
-QA_PREBUILT='.*'
-
-# Do not strip this package. Stripping is unsupported upstream and may
-# fail.
-RESTRICT=" strip"
-
-DOCS=(
-	CONTRIBUTING.md
-	PATENTS
-	README.md
-	SECURITY.md
-)
-
-go_tuple() {
-	echo "$(go-env_goos $@)_$(go-env_goarch $@)"
-}
-
-go_cross_compile() {
-	[[ $(go_tuple ${CBUILD}) != $(go_tuple) ]]
-}
-
-PATCHES=(
-	"${FILESDIR}"/go-1.24-skip-gdb-tests.patch
-	"${FILESDIR}"/go-1.24-dont-force-gold-arm.patch
-	"${FILESDIR}"/go-never-download-newer-toolchains.patch
-)
-
-src_compile() {
-	if has_version -b ">=dev-lang/go-${GO_BOOTSTRAP_MIN}"; then
-		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go"
-	elif has_version -b ">=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN}"; then
-		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go-bootstrap"
-	else
-		eerror "Go cannot be built without go or go-bootstrap installed"
-		die "Should not be here, please report a bug"
-	fi
-
-	# Go's build script does not use BUILD/HOST/TARGET consistently. :(
-	export GOHOSTARCH=$(go-env_goarch ${CBUILD})
-	export GOHOSTOS=$(go-env_goos ${CBUILD})
-	export CC=$(tc-getBUILD_CC)
-
-	export GOARCH=$(go-env_goarch)
-	export GOOS=$(go-env_goos)
-	export CC_FOR_TARGET=$(tc-getCC)
-	export CXX_FOR_TARGET=$(tc-getCXX)
-	use arm && export GOARM=$(go-env_goarm)
-	use x86 && export GO386=$(go-env_go386)
-
-	cd src
-	bash -x ./make.bash || die "build failed"
-}
-
-src_test() {
-	go_cross_compile && return 0
-	cd src
-	PATH="${GOBIN}:${PATH}" \
-	./run.bash -no-rebuild -k || die "tests failed"
-}
-
-src_install() {
-	dodir /usr/lib/go
-	# The use of cp is deliberate in order to retain permissions
-	cp -R . "${ED}"/usr/lib/go
-	einstalldocs
-
-	# testdata directories are not needed on the installed system
-	# The other files we remove are installed by einstalldocs
-	rm -r $(find "${ED}"/usr/lib/go -iname testdata -type d -print) || die
-	rm "${ED}"/usr/lib/go/{CONTRIBUTING.md,PATENTS,README.md} || die
-	rm "${ED}"/usr/lib/go/{SECURITY.md,codereview.cfg,LICENSE} || die
-
-	local bin_path
-	if go_cross_compile; then
-		bin_path="bin/$(go_tuple)"
-	else
-		bin_path=bin
-	fi
-	local f x
-	for x in ${bin_path}/*; do
-		f=${x##*/}
-		dosym ../lib/go/${bin_path}/${f} /usr/bin/${f}
-	done
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.6.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.3.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.6.ebuild
index f3fe286ef7a..0b04ca19870 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.6.ebuild
@@ -46,11 +46,8 @@ QA_MULTILIB_PATHS="usr/lib/go/pkg/tool/.*/.*"
 
 # This package triggers "unrecognized elf file(s)" notices on riscv.
 # https://bugs.gentoo.org/794046
-QA_PREBUILT='.*'
-
-# Do not strip this package. Stripping is unsupported upstream and may
-# fail.
-RESTRICT=" strip"
+QA_PREBUILT="*"
+QA_PRESTRIPPED="*.syso"
 
 DOCS=(
 	CONTRIBUTING.md
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-9999.ebuild
index 5f202931d0d..4f9caabf8a0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-9999.ebuild
@@ -46,7 +46,8 @@ QA_MULTILIB_PATHS="usr/lib/go/pkg/tool/.*/.*"
 
 # This package triggers "unrecognized elf file(s)" notices on riscv.
 # https://bugs.gentoo.org/794046
-QA_PREBUILT='.*'
+QA_PREBUILT="*"
+QA_PRESTRIPPED="*.syso"
 
 DOCS=(
 	CONTRIBUTING.md

From 49873e785ae073b1f732478f04050046d2c7ab09 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:54 +0000
Subject: [PATCH 024/122] dev-lang/python: Sync with Gentoo

It's from Gentoo commit e3bae65843c3404ac074d70e30d1fb3e67786a24.
---
 .../portage-stable/dev-lang/python/Manifest   |  19 +
 .../dev-lang/python/python-0.3.13.4.ebuild    |  19 +-
 .../dev-lang/python/python-0.3.13.5.ebuild    |  19 +-
 .../dev-lang/python/python-0.3.13.5_p1.ebuild | 611 +++++++++++++++++
 .../dev-lang/python/python-0.3.13.6.ebuild    | 611 +++++++++++++++++
 .../dev-lang/python/python-0.3.13.6_p1.ebuild | 611 +++++++++++++++++
 .../dev-lang/python/python-0.3.13.7.ebuild    | 611 +++++++++++++++++
 .../dev-lang/python/python-0.3.13.9999.ebuild |  19 +-
 .../python/python-0.3.14.0_beta4.ebuild       |  19 +-
 .../python/python-0.3.14.0_rc1.ebuild         | 621 +++++++++++++++++
 .../python/python-0.3.14.0_rc1_p1.ebuild      | 621 +++++++++++++++++
 .../python/python-0.3.14.0_rc2.ebuild         | 621 +++++++++++++++++
 .../dev-lang/python/python-0.3.14.9999.ebuild |  19 +-
 .../dev-lang/python/python-0.3.15.9999.ebuild |  19 +-
 .../dev-lang/python/python-3.10.18-r1.ebuild  |   2 +
 .../dev-lang/python/python-3.10.18_p2.ebuild  | 572 ++++++++++++++++
 .../dev-lang/python/python-3.10.9999.ebuild   |   2 +
 .../dev-lang/python/python-3.11.13-r1.ebuild  |  10 +-
 .../dev-lang/python/python-3.11.13_p1.ebuild  | 619 +++++++++++++++++
 .../dev-lang/python/python-3.11.9999.ebuild   |   8 +-
 .../dev-lang/python/python-3.12.11.ebuild     |  14 +-
 .../dev-lang/python/python-3.12.11_p1.ebuild  | 602 +++++++++++++++++
 .../dev-lang/python/python-3.12.9999.ebuild   |  14 +-
 .../dev-lang/python/python-3.13.5.ebuild      |  19 +-
 .../dev-lang/python/python-3.13.5_p1.ebuild   | 616 +++++++++++++++++
 .../dev-lang/python/python-3.13.6.ebuild      | 616 +++++++++++++++++
 .../dev-lang/python/python-3.13.6_p1.ebuild   | 616 +++++++++++++++++
 .../dev-lang/python/python-3.13.7.ebuild      | 616 +++++++++++++++++
 .../dev-lang/python/python-3.13.9999.ebuild   |  19 +-
 .../python/python-3.14.0_beta4.ebuild         |  19 +-
 .../dev-lang/python/python-3.14.0_rc1.ebuild  | 632 ++++++++++++++++++
 .../python/python-3.14.0_rc1_p1.ebuild        | 632 ++++++++++++++++++
 .../dev-lang/python/python-3.14.0_rc2.ebuild  | 632 ++++++++++++++++++
 .../dev-lang/python/python-3.14.9999.ebuild   |  19 +-
 .../dev-lang/python/python-3.15.9999.ebuild   |  19 +-
 .../python/python-3.8.20_p7-r1.ebuild         |   2 +
 .../dev-lang/python/python-3.9.23-r1.ebuild   |   2 +
 .../dev-lang/python/python-3.9.23_p2.ebuild   | 566 ++++++++++++++++
 .../dev-lang/python/python-3.9.9999.ebuild    |   7 +-
 39 files changed, 11100 insertions(+), 215 deletions(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.5_p1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.6.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.6_p1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.7.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_rc1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_rc1_p1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_rc2.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.18_p2.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.13_p1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.11_p1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.5_p1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.6.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.6_p1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.7.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_rc1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_rc1_p1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_rc2.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.23_p2.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
index 18e3c9871a1..d4c8e4032b5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
@@ -10,19 +10,38 @@ DIST Python-3.13.4.tar.xz 22672472 BLAKE2B d453538db82084f490456416829c7d30672e5
 DIST Python-3.13.4.tar.xz.asc 963 BLAKE2B 5c594f95a7b74c2191b553f50020cd6db9b400f32af62d12094fa4c449651079a662645de8118a7a661c4ceafceb9ce5bcecbbbf8d6bc80d6657a0247e88e510 SHA512 ba9c1dee0f3bf564e6ac19cbe08cf4fdc3779a04ed8289654f6dda3fba9f07a0937764a12f1e7e2f6d7ff17bb5b86c05b8ea19296a2b98d1c81a48362ccf6104
 DIST Python-3.13.5.tar.xz 22856016 BLAKE2B 9caacad8745dcd238b208022cb140a6655ae57ae0b7f5ac88efc84a96635c310102a5de20cbaa43ef3c329f454b142a0a019141279d49a4d657be5682a1d6521 SHA512 2a058072e87b614b204bd1321b2bfa9c4b6614dbd5ded98dc0ee51c0d6b81504f902b7c003ad14295b371a37918f6975dc37d5a9c836dd9c30f8b086e4759193
 DIST Python-3.13.5.tar.xz.asc 963 BLAKE2B 2db0162d18129ec42b48393108a72c28e7f8f8c3fa40b2e231c87fe0bdc3c166fb6ca4a1c1dfb3fffe1aa0c2618c7ccb245513beb7a0919b4aaca5ec7eb23b36 SHA512 07c1a2ec2d6ba2805680b7f1dc262fdc5dc3eec4503780ecdc08cd570ccbb5f1efa736ee03c83d36bdb33ce87db06be5892cf5a6eaf4018d5fe78fff99e615ae
+DIST Python-3.13.6.tar.xz 22761268 BLAKE2B 9f025130ffbedfb105a33abf47a85c598f31df25f39c1c2b18d9a778d62cce8005b7716618d094e38b30670855a388d18e90cbc2ba25d22c8a6e7728fdbbd0d8 SHA512 fca724dbb4f3fed889d0b51c86ee0559c70ee2c7aba1d8b089b08538d82411ec9e6bc9c7a39c1dc4bb4f13b5cf0d9a332f7759412fa540a1940477cb47052316
+DIST Python-3.13.6.tar.xz.asc 963 BLAKE2B 7c360c7fb269e36bb886e9adcbbf667a781ee6abe2c0b133d3470f9ec0568aa376cb42d6760f3e836caf5f91c96243a0c42619d6dcd7afd3f7d4e0df617cc924 SHA512 133b2c017f9f8cf93209f11bb398908528dabf9b66ece034cb8a26fc9550b84a3589f85deb1acfe322b01db20da083c039ce91db1452bdda9fb885a948d53c50
+DIST Python-3.13.7.tar.xz 22769492 BLAKE2B 8654588ed12e8cd1d691a1869ed1db0d4b9dbb8e265bb0189cfb3cd1f21a298c1d8e9678e27c23b31e6c7f86478f33f3fc6bb66488a550bed60d64b7a801e65a SHA512 73fa04db860e8b98c204f84d403598fcb802b19bfc8f2675df2fddb6b153b1643daf081746a043f57c8fa71b950a439581aa5204c2bfadb8cfd8864ca4f42f0d
+DIST Python-3.13.7.tar.xz.asc 963 BLAKE2B ae8721488c7ce01c9c6fe1b184526044900b39d033b0ba1ac573c742cf99a902b32cfefc9b73af8573667b47c71b8356fced5abf0a4b581ef8d0aff1bbcacf47 SHA512 71cd002c18ebb47861abd3309c8cf38972d3d916cca5595d895ba3940719243c66fa28595c2370a8846d9d1c4b3cb4ac5baeda9e9cf94be30302892d01df5e87
 DIST Python-3.14.0b4.tar.xz 23641472 BLAKE2B e894c115d50371e2ecfd5c0cf79f37d3bff230338524bbb2352af8e42d256cd8fe17a38c68769d3125ddcae33500fd151ed64b5641d7f35f4b8968fcae9e31b4 SHA512 faaea000a474430a4ee41bdc95f9a77aa6573354698bc987a7617a6d36eae4b8e7f02ac945eb5b97df8dc62a256725ccd59fec08d4af2bd7b6e8a31ef4f92e2a
 DIST Python-3.14.0b4.tar.xz.sigstore 5038 BLAKE2B 95bd040d9be4d746b8d1a5a7486d309783248093b032b85ac5e7e7eaf35caa99b43bf3bf7c3ad69635a7b4f14bf6e42a9ba0b54d19986069b5dc075d17a8ddd5 SHA512 3e2a7a73d5cd98e4e8139ef89bf75c1213459db7634bb57ea2de126ff403e7f9244ec6fca525bcb55b9cd5342cbc80d659772709ebf405d330dcd4f14f93a7cc
+DIST Python-3.14.0rc1.tar.xz 23661916 BLAKE2B 77657bb87fe5a8ef538d97ca5ab39be8243d222400f0439ae6a719f528f19d79a22b3c0832c8e0ed9650e8d18a546cec4f40dd881d142b0739e97add688662be SHA512 6f34f593713282e105f9cf0396c523f738f3e4e8c2d4bcc4051c9febff96ab521e67abfe5fd072d7f584c3afcc7acb96a42939f51259ea411308a48468f7fd4e
+DIST Python-3.14.0rc1.tar.xz.sigstore 5134 BLAKE2B 10f93540d5acfcd1509826b606d5a2ded0b40c5c60951c893d18c1baa39d8189ac15fa586fcd34318ac6cfeb4c9ad51a86936849a8cdcbb179a11cc86f5f3189 SHA512 0ecd23bf303e42be6f639d55e2b00c13a87caf512923fd529b2661de6e73f76491def062037befbefd6c2fcf2608ae8cb27faae7431137b53e60c8cc20fec740
+DIST Python-3.14.0rc2.tar.xz 23566140 BLAKE2B 6871d31eba6167f2d0b2d098b1582e465b1bb8df90ede41bba57b8dbdcb087ceba7cc047e93e43cf93c3c36d3166f4f99ab4c321566ec64cdc4c0e65c0abd1da SHA512 8021dc8e23239fd9e53fafd1fcaa1108da41ef376ee5b5e9c8dfd74995537131990239cd83de45b8bd5fb52b44c4dc08df1c837f69ce82c5b2d99ddf3ea5ef77
+DIST Python-3.14.0rc2.tar.xz.sigstore 4942 BLAKE2B 650404fe155c874f05d114dda6ff47ef90b9ed09f6d40f7a3757a3f0fe4420380cb2e52696dda76badccd86b31117e6f8b906a61881b8f65949d00d692abd959 SHA512 2cce5b68b32f9f0f400e5c2d571ad9ce479cff904690ddd454ea69b612cd8c5c003f632f8866a220be46e5e56b92a1dfb12c4e12b381fc7c58710635be5ea715
 DIST Python-3.8.20.tar.xz 18962788 BLAKE2B 715c75e0c0a3d3b77af7f07478311bb0554b80aac72915be703aa2d0dd6459a972e5669808e64da14a0b91bb183e00655055c1726f302dc3ccd8721e3b4ae3e6 SHA512 3c9341ee1fd33cb687958dcf2b7c0c7700489726c4d530c3e9d9537d46a6ab534541a4b312232d8505bea395a07e4518c42d75fb7571103e6b266f8f44115c61
 DIST Python-3.8.20.tar.xz.asc 833 BLAKE2B 5c86c15a1090b42e42bb7512565b1a7ad9d2137d59e9fd1ab0f83fdfc37dfcf184389418d6703db809e9c8c04a169af292665a2b58bf5dc61b7724ecbb4132d9 SHA512 a751ae0407a593d97acac4d5f8a0456580c753efa12a7d960125c219b4897fdb26fc1ffd43d8ea33ad1449162dd3b2904c16b6c51c57561ba73de3ffa62e0eed
 DIST Python-3.9.23.tar.xz 19659284 BLAKE2B 17c7c9acec1e2f2e9d146b2c35738ea05cf16609f267dd784668ab43bcce7be93e164c14106f9640a060326ebb2b8bd4ee4e58086bdced4ca611d7f96dbb3699 SHA512 ad2eb2eebff286a16ad631339bc0890b0686cf5e669d28905a98f96e9b1af6673d255f36bf19e146aa4de8d012587dc6b3193e903718f9cdba4b97041318f418
 DIST Python-3.9.23.tar.xz.asc 833 BLAKE2B a17a88b1997ece75e6447398d20c67e4b1be6d64204e6ac20aa4650e465b0657e7ae8bd497602d2e3c7193b50ecf7d15a1eb996942a05aab117eb25446dab159 SHA512 10187b0df66743308548780f82872d032530f8233f539cf66a2cfbdef1095b760f81f2fcc1759f003cc6f20752be91bdef71e4d821e76a75c0c85df112335698
 DIST python-gentoo-patches-2.7.18_p16.tar.xz 35448 BLAKE2B 0139c0944f62f9cdd236f6a8557e0ed19704c7d72869af1cb7d8bd3e646a746cd4a0201e1b44232a5e78ef49f254db20b0d0271bf744fbfd4fe0f1e99b8f3e6c SHA512 810be590d0e06fab4b2165e6852ca49662f09dcd7e20b47a29f613ad7653252c8dfac3f0eb228d77c8a914efa7c08788b2fbd552a4b47504f5fd0ec17450c48f
 DIST python-gentoo-patches-3.10.18.tar.xz 29664 BLAKE2B dd69f7866cebad2536b41056571d74cbd90800062b06612b7509c9ce8f258aef66586f3c6e08f52caaceb7b0a01a52502b9c763b6f7d94caac0e929d9d77219b SHA512 b4cf4ff2d7e5b73e1102acc2183c4da3e734bdbec1c284d1fef8aceba0d49246dcdc954d3e4119521fde1e895bab0754b34b346b736b46ce45aff1afc6d38cef
+DIST python-gentoo-patches-3.10.18_p2.tar.xz 40708 BLAKE2B 9fb59889ffec1215511b0a1540d4765366ae850c43ea4fa41cdb65ffbae073b03288cf4071a0451cfc240a0e3a172224121c583ede5baa0784e47509aba83a1f SHA512 58404ae035becbac51031ac1dab84191f2ea342f763f9ac9ca0ded10bc2c3ece4c68d1b49f202c1ccf8faf5c5417f779d56a977da93af27c15aa08754e8bded8
 DIST python-gentoo-patches-3.11.13.tar.xz 16492 BLAKE2B 8b188742dd3f25974cead290e5793c31f02741a901dce65137c596045fa2fbd5baaef332204af90f95ddcd864ee542b252c00b190e15c25af60a7bda771b116f SHA512 b5abad341d2eede81df445b56a98720466ec23df40a8a2e99a04dba5a106205655c8e2b64df0ca2630f036c8fe457ba64524280d137bbc99f52e4fd8e6bbd5ae
+DIST python-gentoo-patches-3.11.13_p1.tar.xz 27748 BLAKE2B 26e0b5397d7927711bcc40330f72f54fb16c660c56a2f87166c5336eb2f53ccd4e920b906854ee122d64360b414e11a38a31a410936b4a49f6610626203f4322 SHA512 7c7eca7bf827255925e073c0ed5c69e9036b79e35e8f6ccb2684709bdc41fec80823a1df192c3decf56ba6d53e2c9feaf7fb81f3a214da69773da6a2997ca19b
 DIST python-gentoo-patches-3.12.11.tar.xz 12020 BLAKE2B b419d32b1d7bef9408027edda7eac9a920a877e1b8f521483df595199bad1bbadd9dd9500079c09beab63286a801bfb25da5f93a5d31462ed3e457a6e40ad6af SHA512 1b0eaff4c0df06554525a50576da7eadb4067c4f2970851e5c9e3e527a9ccc4216cbd65c45fd562af4a1cedc2c66278a74bee5cf5c1a65df8feb22f34f5a19e4
+DIST python-gentoo-patches-3.12.11_p1.tar.xz 23276 BLAKE2B 794485d0fa596f0f2797e2aa505f888a05e2ef63840068b3214efbe51b592586bcfdf193b71e239beb3c3037f01ca086b6b97aeff092b2a344e74d962fb9dffc SHA512 1402b0bbeb189ed4a16364398495fcccc31da0aad4fc88e30978e7754575fbd8f51974dcd97d2a57a581072f083233dfb00b30af687455ad170fc3c64875a9d5
 DIST python-gentoo-patches-3.13.4.tar.xz 8912 BLAKE2B e3d9f2a12f801dc75e09c5301757f35216d712b5e5394f2ec3ce1d79d0cb57571dbca525e3d5c35b90fa059c2b78ee24341b6a51cbe9691deac84c9ee0578824 SHA512 1a7141accb7aa70c7bd8dd12528f7de031dfeab9ff089f3d044da0b7b52461e2d6d7d1467161e0fe1e259d9fa06d70bcf107d86ad3590e8cf73aa1132ef3aaf9
 DIST python-gentoo-patches-3.13.5.tar.xz 8916 BLAKE2B 9d985b12af62b8a917cac1dab9576aac099bc81ad954a5de254a14a3c7d2254edcdcfaadc46314b69a1bb76bd30ca8bed7c866c0de3fc3f89aac0f76af344f32 SHA512 5ac92aa3eef82eae5d707ffcb5085ac98bd9bf64f72fc7ac4aa1b12a0c3aa86c57d0f671ca07f46e2250779f4cf4885916e4d175357ad626eca6e41257a027e7
+DIST python-gentoo-patches-3.13.5_p1.tar.xz 19756 BLAKE2B ecc594573bbe3a28364d541d5e1014778c342b6e8ecb09e5e9def238ce73d51f178d02ae91bedce3f7aee4a753f2653aee4f4035f238fa60d603baa59ce4e89b SHA512 a60f3cf65b57aa6c85f59dc5f36fbabe1fa19a5225c3e224c99696bb3d1186b54bdad94627638a3a73b66ceb5958b3a5dcb2b83d13357c71ded04c98ad7da0b9
+DIST python-gentoo-patches-3.13.6.tar.xz 7100 BLAKE2B 71f3a4dd65ccfbd25ec9655fdff0a6d8cd4f0ac73e2589658ec321e67672e3ab2b95bd8b99dd2998deb5af9fa41470e1ced46eceefd565b741015beb52e613aa SHA512 0c9b3dd60d1038154f1a5e5a1e5e45ef548f2cc065fcc5012eabb3d3776b0703c39cea17a7360f182392efc4b3490f77fb919687d13c5be7a50c680497424643
+DIST python-gentoo-patches-3.13.6_p1.tar.xz 9152 BLAKE2B 3ded5d6e48d4f000376c782e099b333345f7e2c873c4a10413e8d49d12a4a5d0a5b18e1406f2a42a2f9aa9022c5952c30bc650d1952f9d18310ac9f022737e61 SHA512 c1ae5f4ab6083fab60ae73cbdd8eda640b7af8cc88c4c691eb0a17083eee3323e6b15d0032f7058c2a45c3d62106da3ec2bbdbec77875091558684ad699b856e
+DIST python-gentoo-patches-3.13.7.tar.xz 7088 BLAKE2B 07acf2a1cc25f95131875e0282f33ce4710094bcb75b8ac1c383aa88456194d19ede17b41dda1b29bbb194a467f56e8fe976e387128aa82507529cba6ba315b7 SHA512 d79a450db4678bb494e85167e5f035ec146f9b8c400e34cbfa1211cda19aef517ffc624b11687425b1e0ff7a63c22129c649aba663fb9cfec12512b09b64d6a6
 DIST python-gentoo-patches-3.14.0b1.tar.xz 5680 BLAKE2B 514b3edc3025e5bf675d371b5ada17dea426856edf1fb6095c2ee400eae95bd4265ef81fe593ae9338e801e7d0a25b1d5ba2d05ca563fd9dd020114b13575746 SHA512 74289e42cf532b54bb1b66a283ec19156f8a36ba38764209c133842314c9efb2ce2ebcba5aa9213bcf7fc0c8a5ca9b6e7adbd5dbfa4397233136d7cd55f53ee7
 DIST python-gentoo-patches-3.14.0b4.tar.xz 3780 BLAKE2B ad67e213b21bc039bf33c0a2e6d3a4ce5e06179ce167f89d56561834dfb5c5b5b5d7f43f6fe2597e94e4ea5d544bb0b60d38b847bb0c32277a0151f2084f3618 SHA512 e5e6fa02d2d24e46848fa5a79ba7fd8a6703473e3bee257fee7b5c55d5c82fedb29f0ba6de1117c6ca738df3841bae5bb00962ae0290d553020e3617dc557c6d
+DIST python-gentoo-patches-3.14.0rc1.tar.xz 3776 BLAKE2B 4f2cf7598dac08c3118bbca6c111684fe68fa7c8749ef394eae35c50bc7d78e30f6c54a77199fc87270ccdafa7725dad974226964841d666ceab7cb34d7bd778 SHA512 323586bfd662ff4ed41b7f5f34d1dc394e7e7e1ad87e8a9283b99a14e226cc73d7ff7fb510e772319e361f2ad2becfe4ac246cc0be34d0a981df286cb20c9734
+DIST python-gentoo-patches-3.14.0rc1_p1.tar.xz 5436 BLAKE2B 04a7e01c758e7e162ab05607e1a5f035c4bd77ad09cdbdfee183f02af396140f3b4f7cc0c627fbfeb05e076d4bb763afd77502a35178ec2eb0f4050d7d829734 SHA512 3795d4aa89d433196da74361b0b7ea9fa52966409667f88e8b069ec85674286068cfa3666a5503c62597c5cff4aa5ebf360b907c7571ced269a38019e593cf45
+DIST python-gentoo-patches-3.14.0rc2.tar.xz 3776 BLAKE2B 122a49783f12cf0274ab74ff06edfc483971fca125085914dbc69c2a147a91178b8e573aac6567f5f540aec968e04af6e76a5dec0028b7a8abaac599ce1ae9b4 SHA512 3a16fbbf9e1d71ac87c79f0940634ab299b9f68f98928ac7fde44eae47b5a3f89232e63366bd8fda4484eb6721dcf05e17f92459f95b5786f3649d5ae499df4d
 DIST python-gentoo-patches-3.8.20_p7.tar.xz 54544 BLAKE2B e31fc9fb5e98b62b0f70165670ec58ed4fa932cfc95d5287c249015a3a372fdbf0d1ba08cb98f63c2dc500700edfd6ffea6db670385d2c86a4fdb92ffb991192 SHA512 a9e7e4976be226931a503af2c986da207d060d4ce436af61f5e8427da513639adbed32bb0061963b83fef275a5de91707ab13b7a9abf3a7472ee0e2c5310eda1
 DIST python-gentoo-patches-3.9.23.tar.xz 37148 BLAKE2B a7c0514037169b9938b2180ec2dd22063621d532367f6febfa47da43f47534559baab992d9c5257271121af755b8445346d4d92582e7e11b6468a1c359f28bf2 SHA512 73ef00a7aa671016de396c9e1c4bb5f5c1a97dc735739f806d809f987e802ec440370bf4c85468097547284a5d2b476cbffcec3cf219b7cb6fc890d5029eb5bd
+DIST python-gentoo-patches-3.9.23_p2.tar.xz 48060 BLAKE2B 2d4ddd3aa48fc52b9f63fbc6020e534234b4183366d121e836544cab93632cd05439205893a11bb505f679946b0690f0962eb0fc029e624cb1c61bc0936127be SHA512 61b3e2c7e8629e1c522c9de8ce9384ee8d1f90ca5ef0f7b902e6315c80196e5f13e0258f8002405a2a752e1c9b5e60f5c3c767c07554d83635fa074bce8a86bd
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.4.ebuild
index 1c29c715ac4..2e133b563a9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.4.ebuild
@@ -247,6 +247,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 		# https://bugs.gentoo.org/933840
@@ -272,16 +275,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -289,11 +282,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -307,7 +295,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.5.ebuild
index 1c29c715ac4..2e133b563a9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.5.ebuild
@@ -247,6 +247,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 		# https://bugs.gentoo.org/933840
@@ -272,16 +275,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -289,11 +282,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -307,7 +295,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.5_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.5_p1.ebuild
new file mode 100644
index 00000000000..2e133b563a9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.5_p1.ebuild
@@ -0,0 +1,611 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic linux-info
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+REAL_PV=${PV#0.}
+MY_PV=${REAL_PV}
+MY_P="Python-${MY_PV%_p*}"
+PYVER="$(ver_cut 2-3)t"
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	ewarn "Freethreading build is considered experimental upstream.  Using it"
+	ewarn "could lead to unexpected breakage, including race conditions"
+	ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+	ewarn "you can reproduce the problem with dev-lang/python.  Instead,"
+	ewarn "please consider reporting freethreading problems upstream."
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--disable-gil
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+	# Fix collision with GIL-enabled build.
+	rm "${ED}/usr/bin/python${PYVER%t}" || die
+	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
+	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if use tk; then
+		# rename to avoid collision with dev-lang/python
+		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
+	else
+		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.6.ebuild
new file mode 100644
index 00000000000..2e133b563a9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.6.ebuild
@@ -0,0 +1,611 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic linux-info
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+REAL_PV=${PV#0.}
+MY_PV=${REAL_PV}
+MY_P="Python-${MY_PV%_p*}"
+PYVER="$(ver_cut 2-3)t"
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	ewarn "Freethreading build is considered experimental upstream.  Using it"
+	ewarn "could lead to unexpected breakage, including race conditions"
+	ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+	ewarn "you can reproduce the problem with dev-lang/python.  Instead,"
+	ewarn "please consider reporting freethreading problems upstream."
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--disable-gil
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+	# Fix collision with GIL-enabled build.
+	rm "${ED}/usr/bin/python${PYVER%t}" || die
+	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
+	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if use tk; then
+		# rename to avoid collision with dev-lang/python
+		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
+	else
+		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.6_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.6_p1.ebuild
new file mode 100644
index 00000000000..2e133b563a9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.6_p1.ebuild
@@ -0,0 +1,611 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic linux-info
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+REAL_PV=${PV#0.}
+MY_PV=${REAL_PV}
+MY_P="Python-${MY_PV%_p*}"
+PYVER="$(ver_cut 2-3)t"
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	ewarn "Freethreading build is considered experimental upstream.  Using it"
+	ewarn "could lead to unexpected breakage, including race conditions"
+	ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+	ewarn "you can reproduce the problem with dev-lang/python.  Instead,"
+	ewarn "please consider reporting freethreading problems upstream."
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--disable-gil
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+	# Fix collision with GIL-enabled build.
+	rm "${ED}/usr/bin/python${PYVER%t}" || die
+	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
+	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if use tk; then
+		# rename to avoid collision with dev-lang/python
+		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
+	else
+		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.7.ebuild
new file mode 100644
index 00000000000..2e133b563a9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.7.ebuild
@@ -0,0 +1,611 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic linux-info
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+REAL_PV=${PV#0.}
+MY_PV=${REAL_PV}
+MY_P="Python-${MY_PV%_p*}"
+PYVER="$(ver_cut 2-3)t"
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	ewarn "Freethreading build is considered experimental upstream.  Using it"
+	ewarn "could lead to unexpected breakage, including race conditions"
+	ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+	ewarn "you can reproduce the problem with dev-lang/python.  Instead,"
+	ewarn "please consider reporting freethreading problems upstream."
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--disable-gil
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+	# Fix collision with GIL-enabled build.
+	rm "${ED}/usr/bin/python${PYVER%t}" || die
+	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
+	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if use tk; then
+		# rename to avoid collision with dev-lang/python
+		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
+	else
+		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.9999.ebuild
index 013df0cf467..ff19b29faff 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.9999.ebuild
@@ -234,6 +234,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 		# https://bugs.gentoo.org/933840
@@ -259,16 +262,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -276,11 +269,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -294,7 +282,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_beta4.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_beta4.ebuild
index aded6ca75f7..a9a1bc733e3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_beta4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_beta4.ebuild
@@ -243,6 +243,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 		# https://bugs.gentoo.org/933840
@@ -268,16 +271,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -285,11 +278,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -303,7 +291,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_rc1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_rc1.ebuild
new file mode 100644
index 00000000000..742a14ccd3b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_rc1.ebuild
@@ -0,0 +1,621 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+VERIFY_SIG_METHOD=sigstore
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs eapi9-ver flag-o-matic linux-info
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+REAL_PV=${PV#0.}
+MY_PV=${REAL_PV/_/}
+MY_P="Python-${MY_PV%_p*}"
+PYVER="$(ver_cut 2-3)t"
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz.sigstore
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl tail-call-interp test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-arch/zstd:=
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+# https://www.python.org/downloads/metadata/sigstore/
+VERIFY_SIG_CERT_IDENTITY=hugo@python.org
+VERIFY_SIG_CERT_OIDC_ISSUER=https://github.com/login/oauth
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sigstore}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--disable-gil
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with tail-call-interp)
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+	# Fix collision with GIL-enabled build.
+	rm "${ED}/usr/bin/python${PYVER%t}" || die
+	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
+	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if use tk; then
+		# rename to avoid collision with dev-lang/python
+		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
+	else
+		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	if ver_replacing -lt 3.14.0_beta3; then
+		ewarn "Python 3.14.0b3 has changed its module ABI.  The .pyc files"
+		ewarn "installed previously are no longer valid and will be regenerated"
+		ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+		ewarn "when installing some packages and checksum mismatches when removing"
+		ewarn "old versions.  To actively prevent this, rebuild all packages"
+		ewarn "installing Python 3.14 modules, e.g. using:"
+		ewarn
+		ewarn "  emerge -1v /usr/lib/python3.14t/site-packages"
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_rc1_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_rc1_p1.ebuild
new file mode 100644
index 00000000000..742a14ccd3b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_rc1_p1.ebuild
@@ -0,0 +1,621 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+VERIFY_SIG_METHOD=sigstore
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs eapi9-ver flag-o-matic linux-info
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+REAL_PV=${PV#0.}
+MY_PV=${REAL_PV/_/}
+MY_P="Python-${MY_PV%_p*}"
+PYVER="$(ver_cut 2-3)t"
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz.sigstore
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl tail-call-interp test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-arch/zstd:=
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+# https://www.python.org/downloads/metadata/sigstore/
+VERIFY_SIG_CERT_IDENTITY=hugo@python.org
+VERIFY_SIG_CERT_OIDC_ISSUER=https://github.com/login/oauth
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sigstore}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--disable-gil
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with tail-call-interp)
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+	# Fix collision with GIL-enabled build.
+	rm "${ED}/usr/bin/python${PYVER%t}" || die
+	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
+	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if use tk; then
+		# rename to avoid collision with dev-lang/python
+		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
+	else
+		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	if ver_replacing -lt 3.14.0_beta3; then
+		ewarn "Python 3.14.0b3 has changed its module ABI.  The .pyc files"
+		ewarn "installed previously are no longer valid and will be regenerated"
+		ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+		ewarn "when installing some packages and checksum mismatches when removing"
+		ewarn "old versions.  To actively prevent this, rebuild all packages"
+		ewarn "installing Python 3.14 modules, e.g. using:"
+		ewarn
+		ewarn "  emerge -1v /usr/lib/python3.14t/site-packages"
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_rc2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_rc2.ebuild
new file mode 100644
index 00000000000..742a14ccd3b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_rc2.ebuild
@@ -0,0 +1,621 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+VERIFY_SIG_METHOD=sigstore
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs eapi9-ver flag-o-matic linux-info
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+REAL_PV=${PV#0.}
+MY_PV=${REAL_PV/_/}
+MY_P="Python-${MY_PV%_p*}"
+PYVER="$(ver_cut 2-3)t"
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz.sigstore
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl tail-call-interp test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-arch/zstd:=
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+# https://www.python.org/downloads/metadata/sigstore/
+VERIFY_SIG_CERT_IDENTITY=hugo@python.org
+VERIFY_SIG_CERT_OIDC_ISSUER=https://github.com/login/oauth
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sigstore}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--disable-gil
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with tail-call-interp)
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+	# Fix collision with GIL-enabled build.
+	rm "${ED}/usr/bin/python${PYVER%t}" || die
+	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
+	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if use tk; then
+		# rename to avoid collision with dev-lang/python
+		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
+	else
+		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	if ver_replacing -lt 3.14.0_beta3; then
+		ewarn "Python 3.14.0b3 has changed its module ABI.  The .pyc files"
+		ewarn "installed previously are no longer valid and will be regenerated"
+		ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+		ewarn "when installing some packages and checksum mismatches when removing"
+		ewarn "old versions.  To actively prevent this, rebuild all packages"
+		ewarn "installing Python 3.14 modules, e.g. using:"
+		ewarn
+		ewarn "  emerge -1v /usr/lib/python3.14t/site-packages"
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.9999.ebuild
index 2b71ace381b..9d9d70958f7 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.9999.ebuild
@@ -234,6 +234,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 		# https://bugs.gentoo.org/933840
@@ -259,16 +262,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -276,11 +269,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -294,7 +282,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.15.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.15.9999.ebuild
index 034cc43a588..246ae13dfe7 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.15.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.15.9999.ebuild
@@ -229,6 +229,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 		# https://bugs.gentoo.org/933840
@@ -254,16 +257,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -271,11 +264,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -289,7 +277,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.18-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.18-r1.ebuild
index a8d31067ba6..43f8ee3db8e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.18-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.18-r1.ebuild
@@ -233,6 +233,8 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
 		-x test_gdb
 	)
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.18_p2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.18_p2.ebuild
new file mode 100644
index 00000000000..2ffd36444ec
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.18_p2.ebuild
@@ -0,0 +1,572 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit prefix toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-python )
+"
+PDEPEND="
+	ensurepip? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910 and bug #864911.
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross.
+		--without-lto
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+	# libdir correctly for cross.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
+		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Avoid as many dependencies as possible for the cross build.
+	cat >> Makefile <<-EOF || die
+		MODULE_NIS=disabled
+		MODULE__DBM=disabled
+		MODULE__GDBM=disabled
+		MODULE__DBM=disabled
+		MODULE__SQLITE3=disabled
+		MODULE__HASHLIB=disabled
+		MODULE__SSL=disabled
+		MODULE__CURSES=disabled
+		MODULE__CURSES_PANEL=disabled
+		MODULE_READLINE=disabled
+		MODULE__TKINTER=disabled
+		MODULE_PYEXPAT=disabled
+		MODULE_ZLIB=disabled
+	EOF
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the Python it was pointed to
+	# immediately.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+	local disable
+	use gdbm      || disable+=" gdbm"
+	use ncurses   || disable+=" _curses _curses_panel"
+	use readline  || disable+=" readline"
+	use sqlite    || disable+=" _sqlite3"
+	use ssl       || export PYTHON_DISABLE_SSL="1"
+	use tk        || disable+=" _tkinter"
+	export PYTHON_DISABLE_MODULES="${disable}"
+
+	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
+		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-system-libmpdec
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		# Point the imminent CHOST build to the Python we just
+		# built for CBUILD.
+		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	emake DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.9999.ebuild
index f31bba4946b..13edc56d65e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.9999.ebuild
@@ -222,6 +222,8 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
 		-x test_gdb
 	)
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.13-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.13-r1.ebuild
index 12f13e84a1a..830041bc385 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.13-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.13-r1.ebuild
@@ -228,6 +228,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 	)
@@ -251,11 +254,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -266,7 +264,6 @@ src_configure() {
 		powerpc64-*) # big endian
 			COMMON_TEST_SKIPS+=(
 				-x test_descr
-				-x test_gdb
 			)
 			;;
 		riscv*)
@@ -283,7 +280,6 @@ src_configure() {
 
 				-x test_ctypes
 				-x test_descr
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.13_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.13_p1.ebuild
new file mode 100644
index 00000000000..33eb872c4ef
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.13_p1.ebuild
@@ -0,0 +1,619 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit prefix python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-python )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+	# libdir correctly for cross.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
+		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Avoid as many dependencies as possible for the cross build.
+	cat >> Makefile <<-EOF || die
+		MODULE_NIS_STATE=disabled
+		MODULE__DBM_STATE=disabled
+		MODULE__GDBM_STATE=disabled
+		MODULE__DBM_STATE=disabled
+		MODULE__SQLITE3_STATE=disabled
+		MODULE__HASHLIB_STATE=disabled
+		MODULE__SSL_STATE=disabled
+		MODULE__CURSES_STATE=disabled
+		MODULE__CURSES_PANEL_STATE=disabled
+		MODULE_READLINE_STATE=disabled
+		MODULE__TKINTER_STATE=disabled
+		MODULE_PYEXPAT_STATE=disabled
+		MODULE_ZLIB_STATE=disabled
+	EOF
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# force-disable modules we don't want built
+	local disable_modules=( NIS )
+	use gdbm || disable_modules+=( _GDBM _DBM )
+	use sqlite || disable_modules+=( _SQLITE3 )
+	use ssl || disable_modules+=( _HASHLIB _SSL )
+	use ncurses || disable_modules+=( _CURSES _CURSES_PANEL )
+	use readline || disable_modules+=( READLINE )
+	use tk || disable_modules+=( _TKINTER )
+
+	local mod
+	for mod in "${disable_modules[@]}"; do
+		echo "MODULE_${mod}_STATE=disabled"
+	done >> Makefile || die
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9999.ebuild
index 28f563fc339..c174b1c2a94 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9999.ebuild
@@ -217,6 +217,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 	)
@@ -240,11 +243,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.11.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.11.ebuild
index 6de4b2d0090..9986c578aa5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.11.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.11.ebuild
@@ -224,6 +224,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 	)
@@ -247,11 +250,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -259,11 +257,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -277,7 +270,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.11_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.11_p1.ebuild
new file mode 100644
index 00000000000..0627a62b043
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.11_p1.ebuild
@@ -0,0 +1,602 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes _crypt
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# the Makefile rules are broken
+	# https://github.com/python/cpython/issues/100221
+	mkdir -p "${libdir}"/lib-dynload || die
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.9999.ebuild
index 9de13a1b925..5ac7078919b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.9999.ebuild
@@ -213,6 +213,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 	)
@@ -236,11 +239,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -248,11 +246,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -266,7 +259,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.5.ebuild
index 726461c034b..3daede2bcaa 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.5.ebuild
@@ -258,6 +258,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 		# https://bugs.gentoo.org/933840
@@ -283,16 +286,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -300,11 +293,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -318,7 +306,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.5_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.5_p1.ebuild
new file mode 100644
index 00000000000..b6cd0106fea
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.5_p1.ebuild
@@ -0,0 +1,616 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 18 )
+LLVM_OPTIONAL=1
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+MY_PV=${PV}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm jit libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	if use jit; then
+		ewarn "USE=jit is considered experimental upstream.  Using it"
+		ewarn "could lead to unexpected breakage, including race conditions"
+		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
+		ewarn "please consider reporting JIT problems upstream."
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--enable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.6.ebuild
new file mode 100644
index 00000000000..13bdac28ade
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.6.ebuild
@@ -0,0 +1,616 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 18 )
+LLVM_OPTIONAL=1
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+MY_PV=${PV}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm jit libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	if use jit; then
+		ewarn "USE=jit is considered experimental upstream.  Using it"
+		ewarn "could lead to unexpected breakage, including race conditions"
+		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
+		ewarn "please consider reporting JIT problems upstream."
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--enable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.6_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.6_p1.ebuild
new file mode 100644
index 00000000000..13bdac28ade
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.6_p1.ebuild
@@ -0,0 +1,616 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 18 )
+LLVM_OPTIONAL=1
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+MY_PV=${PV}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm jit libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	if use jit; then
+		ewarn "USE=jit is considered experimental upstream.  Using it"
+		ewarn "could lead to unexpected breakage, including race conditions"
+		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
+		ewarn "please consider reporting JIT problems upstream."
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--enable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.7.ebuild
new file mode 100644
index 00000000000..13bdac28ade
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.7.ebuild
@@ -0,0 +1,616 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 18 )
+LLVM_OPTIONAL=1
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+MY_PV=${PV}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm jit libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	if use jit; then
+		ewarn "USE=jit is considered experimental upstream.  Using it"
+		ewarn "could lead to unexpected breakage, including race conditions"
+		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
+		ewarn "please consider reporting JIT problems upstream."
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--enable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.9999.ebuild
index 3a94cf50aa4..90faf189a2a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.9999.ebuild
@@ -246,6 +246,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 		# https://bugs.gentoo.org/933840
@@ -271,16 +274,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -288,11 +281,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -306,7 +294,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_beta4.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_beta4.ebuild
index 3a555c73330..0e12041ad47 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_beta4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_beta4.ebuild
@@ -260,6 +260,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 		# https://bugs.gentoo.org/933840
@@ -285,16 +288,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -302,11 +295,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -320,7 +308,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_rc1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_rc1.ebuild
new file mode 100644
index 00000000000..fefea218044
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_rc1.ebuild
@@ -0,0 +1,632 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 19 )
+LLVM_OPTIONAL=1
+VERIFY_SIG_METHOD=sigstore
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs eapi9-ver flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+MY_PV=${PV/_/}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.sigstore
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm jit libedit +ncurses pgo
+	+readline +sqlite +ssl tail-call-interp test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-arch/zstd:=
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+# https://www.python.org/downloads/metadata/sigstore/
+VERIFY_SIG_CERT_IDENTITY=hugo@python.org
+VERIFY_SIG_CERT_OIDC_ISSUER=https://github.com/login/oauth
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	if use jit; then
+		ewarn "USE=jit is considered experimental upstream.  Using it"
+		ewarn "could lead to unexpected breakage, including race conditions"
+		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
+		ewarn "please consider reporting JIT problems upstream."
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sigstore}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--enable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with tail-call-interp)
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	if ver_replacing -lt 3.14.0_beta3; then
+		ewarn "Python 3.14.0b3 has changed its module ABI.  The .pyc files"
+		ewarn "installed previously are no longer valid and will be regenerated"
+		ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+		ewarn "when installing some packages and checksum mismatches when removing"
+		ewarn "old versions.  To actively prevent this, rebuild all packages"
+		ewarn "installing Python 3.14 modules, e.g. using:"
+		ewarn
+		ewarn "  emerge -1v /usr/lib/python3.14/site-packages"
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_rc1_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_rc1_p1.ebuild
new file mode 100644
index 00000000000..fefea218044
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_rc1_p1.ebuild
@@ -0,0 +1,632 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 19 )
+LLVM_OPTIONAL=1
+VERIFY_SIG_METHOD=sigstore
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs eapi9-ver flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+MY_PV=${PV/_/}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.sigstore
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm jit libedit +ncurses pgo
+	+readline +sqlite +ssl tail-call-interp test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-arch/zstd:=
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+# https://www.python.org/downloads/metadata/sigstore/
+VERIFY_SIG_CERT_IDENTITY=hugo@python.org
+VERIFY_SIG_CERT_OIDC_ISSUER=https://github.com/login/oauth
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	if use jit; then
+		ewarn "USE=jit is considered experimental upstream.  Using it"
+		ewarn "could lead to unexpected breakage, including race conditions"
+		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
+		ewarn "please consider reporting JIT problems upstream."
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sigstore}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--enable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with tail-call-interp)
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	if ver_replacing -lt 3.14.0_beta3; then
+		ewarn "Python 3.14.0b3 has changed its module ABI.  The .pyc files"
+		ewarn "installed previously are no longer valid and will be regenerated"
+		ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+		ewarn "when installing some packages and checksum mismatches when removing"
+		ewarn "old versions.  To actively prevent this, rebuild all packages"
+		ewarn "installing Python 3.14 modules, e.g. using:"
+		ewarn
+		ewarn "  emerge -1v /usr/lib/python3.14/site-packages"
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_rc2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_rc2.ebuild
new file mode 100644
index 00000000000..fefea218044
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_rc2.ebuild
@@ -0,0 +1,632 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 19 )
+LLVM_OPTIONAL=1
+VERIFY_SIG_METHOD=sigstore
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs eapi9-ver flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+MY_PV=${PV/_/}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.sigstore
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm jit libedit +ncurses pgo
+	+readline +sqlite +ssl tail-call-interp test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-arch/zstd:=
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+# https://www.python.org/downloads/metadata/sigstore/
+VERIFY_SIG_CERT_IDENTITY=hugo@python.org
+VERIFY_SIG_CERT_OIDC_ISSUER=https://github.com/login/oauth
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	if use jit; then
+		ewarn "USE=jit is considered experimental upstream.  Using it"
+		ewarn "could lead to unexpected breakage, including race conditions"
+		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
+		ewarn "please consider reporting JIT problems upstream."
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sigstore}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--enable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with tail-call-interp)
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	if ver_replacing -lt 3.14.0_beta3; then
+		ewarn "Python 3.14.0b3 has changed its module ABI.  The .pyc files"
+		ewarn "installed previously are no longer valid and will be regenerated"
+		ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+		ewarn "when installing some packages and checksum mismatches when removing"
+		ewarn "old versions.  To actively prevent this, rebuild all packages"
+		ewarn "installing Python 3.14 modules, e.g. using:"
+		ewarn
+		ewarn "  emerge -1v /usr/lib/python3.14/site-packages"
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.9999.ebuild
index bce16a6df9f..6b946baf908 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.9999.ebuild
@@ -246,6 +246,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 		# https://bugs.gentoo.org/933840
@@ -271,16 +274,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -288,11 +281,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -306,7 +294,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.15.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.15.9999.ebuild
index 054fcbcab78..f85907c04d2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.15.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.15.9999.ebuild
@@ -241,6 +241,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 		# https://bugs.gentoo.org/933840
@@ -266,16 +269,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -283,11 +276,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -301,7 +289,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20_p7-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20_p7-r1.ebuild
index 4555932e5c9..b74ae04ae88 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20_p7-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20_p7-r1.ebuild
@@ -158,6 +158,8 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
 		-x test_gdb
 	)
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.23-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.23-r1.ebuild
index 4c74c776485..2d7101334fd 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.23-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.23-r1.ebuild
@@ -167,6 +167,8 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
 		-x test_gdb
 	)
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.23_p2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.23_p2.ebuild
new file mode 100644
index 00000000000..d1493c0eaf7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.23_p2.ebuild
@@ -0,0 +1,566 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit prefix toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm +ncurses pgo +readline
+	+sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? ( >=sys-libs/readline-4.1:= )
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-python )
+"
+PDEPEND="
+	ensurepip? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+	local disable
+	use gdbm      || disable+=" gdbm"
+	use ncurses   || disable+=" _curses _curses_panel"
+	use readline  || disable+=" readline"
+	use sqlite    || disable+=" _sqlite3"
+	use ssl       || export PYTHON_DISABLE_SSL="1"
+	use tk        || disable+=" _tkinter"
+	export PYTHON_DISABLE_MODULES="${disable}"
+
+	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
+		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-system-libmpdec
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+		# propagated to sysconfig for built extensions
+		#
+		# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+		local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+		local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+		local -x CFLAGS= LDFLAGS=
+		local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+		local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+		# We need to build our own Python on CBUILD first, and feed it in.
+		# bug #847910 and bug #864911.
+		local myeconfargs_cbuild=(
+			"${myeconfargs[@]}"
+
+			--libdir="${cbuild_libdir:2}"
+
+			# Avoid needing to load the right libpython.so.
+			--disable-shared
+
+			# As minimal as possible for the mini CBUILD Python
+			# we build just for cross.
+			--without-lto
+			--disable-optimizations
+		)
+
+		# Point the imminent CHOST build to the Python we just
+		# built for CBUILD.
+		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
+
+		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
+			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+		# Avoid as many dependencies as possible for the cross build.
+		cat >> Makefile <<-EOF || die
+			MODULE_NIS=disabled
+			MODULE__DBM=disabled
+			MODULE__GDBM=disabled
+			MODULE__DBM=disabled
+			MODULE__SQLITE3=disabled
+			MODULE__HASHLIB=disabled
+			MODULE__SSL=disabled
+			MODULE__CURSES=disabled
+			MODULE__CURSES_PANEL=disabled
+			MODULE_READLINE=disabled
+			MODULE__TKINTER=disabled
+			MODULE_PYEXPAT=disabled
+			MODULE_ZLIB=disabled
+		EOF
+
+		# Unfortunately, we do have to build this immediately, and
+		# not in src_compile, because CHOST configure for Python
+		# will check the existence of the Python it was pointed to
+		# immediately.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
+		popd &> /dev/null || die
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	emake DESTDIR="${D}" altinstall
+
+	# Remove static library
+	rm "${ED}"/usr/$(get_libdir)/libpython*.a || die
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.9999.ebuild
index 1f0cd19c1e6..39973c9fe4d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.9999.ebuild
@@ -156,6 +156,8 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
 		-x test_gdb
 	)
 
@@ -185,11 +187,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_descr
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2

From 508e1540a5e3ad559a2a842dbed0ddb3ee958493 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:54 +0000
Subject: [PATCH 025/122] dev-lang/python-exec: Sync with Gentoo

It's from Gentoo commit 3c986dbc652294f7a3d76ef5e21e80b3ea31c8d0.
---
 .../dev-lang/python-exec/python-exec-2.4.10.ebuild           | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python-exec/python-exec-2.4.10.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python-exec/python-exec-2.4.10.ebuild
index af542129b69..1ec3c923c8e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python-exec/python-exec-2.4.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python-exec/python-exec-2.4.10.ebuild
@@ -3,7 +3,10 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+# This is just a stub for tooling, see the IUSE hack below. Don't panic
+# if the array here doesn't contain the latest impl. If you can't use a
+# new impl., it's likely because it's a stable-masked flag.
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit python-any-r1
 

From d6f6698aed43bf2d61bc3903e427a9507312181b Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:56 +0000
Subject: [PATCH 026/122] dev-lang/rust: Sync with Gentoo

It's from Gentoo commit 25234b1a79fcd57c98122d448914b7b54c77a96c.
---
 .../portage-stable/dev-lang/rust/Manifest     |   7 +-
 ...53956-fix-hardcoded-gnu-linker-flags.patch |  18 -
 ...53956-fix-hardcoded-gnu-linker-flags.patch |  29 -
 .../dev-lang/rust/rust-1.74.1-r101.ebuild     |   2 +
 .../dev-lang/rust/rust-1.75.0-r101.ebuild     |   2 +
 .../dev-lang/rust/rust-1.76.0-r101.ebuild     |   2 +
 .../dev-lang/rust/rust-1.77.1-r101.ebuild     |   2 +
 .../dev-lang/rust/rust-1.78.0-r101.ebuild     |   2 +
 .../dev-lang/rust/rust-1.79.0-r101.ebuild     |   2 +
 .../dev-lang/rust/rust-1.80.1-r101.ebuild     |   2 +
 .../dev-lang/rust/rust-1.81.0-r101.ebuild     |   2 +
 .../dev-lang/rust/rust-1.82.0-r103.ebuild     |   2 +
 .../dev-lang/rust/rust-1.83.0-r3.ebuild       |   2 +
 .../dev-lang/rust/rust-1.84.0-r2.ebuild       |   2 +
 .../dev-lang/rust/rust-1.84.1-r2.ebuild       |   2 +
 .../dev-lang/rust/rust-1.85.0-r2.ebuild       |   2 +
 .../dev-lang/rust/rust-1.85.1-r1.ebuild       |   2 +
 .../dev-lang/rust/rust-1.86.0-r2.ebuild       |   6 +-
 .../dev-lang/rust/rust-1.87.0-r1.ebuild       |   8 +-
 .../dev-lang/rust/rust-1.88.0.ebuild          |   6 +-
 .../dev-lang/rust/rust-1.89.0.ebuild          | 837 ++++++++++++++++++
 .../dev-lang/rust/rust-9999.ebuild            |   6 +-
 22 files changed, 885 insertions(+), 60 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/rust/files/rust-1.86.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/rust/files/rust-1.87.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.89.0.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest
index 0e8f57d6865..f4f700c5ca5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest
@@ -12,9 +12,10 @@ DIST rust-patches-1.84.0-r2.tar.bz2 2507 BLAKE2B ffe4e5fc49deebdb8b8b3022f951dfe
 DIST rust-patches-1.84.1-r2.tar.bz2 2982 BLAKE2B 2f7addfa4530f3eab79f55ea44eee6390970874ae5ed40ef8706224024db47c861326dc5a79ed9bffcffbad5b27d44b6a3aebab7987fdb61124be3083fbabd71 SHA512 cc852e1e679827390134b47bfaa68567a75a5e8559a3caa24ab3931955050bac59f4fe6a4c249d83bde0aa25667ea04749f3763ff3566daa2999df8cbf2d0981
 DIST rust-patches-1.85.0-r2.tar.bz2 4462 BLAKE2B 61cfde8688fecab1a5c3c80f29b37b691581f3f8be1648f9db34fff15026dab426458cba3b9f06fc5606a0a878b0527698ea6f94c7dff014e4339154ac907d13 SHA512 317ab0bcbb792faa1a761893264a29bd650b0d6c5ab17aa762075daccfda684bc6cdd20c0ef89b51bde1a7384fb1df576b18b5303115a8cf04877b435b2d6491
 DIST rust-patches-1.85.1-r1.tar.bz2 4473 BLAKE2B fad2fe3222e2625b5cbc60ea1fb805080ce70f751c930c0e3bde9cf043059e1fc3ba4d8e618166fe99a7fcf12d5cccb684c05d4c2542a89c9794869204cbcb09 SHA512 edf680a1d3a29ae5d8140031dc8b232b747d08494db2f3393ccc286d9197139583bcaf536d5125b8c896a610c075115b9a16a6e6f3f6b5da60e58433f000dba6
-DIST rust-patches-1.86.0-r2.tar.bz2 5980 BLAKE2B 179d6acc8c7006eac4d00e073ec1f5496756ef51d465bc098daf1cfe650f469f4341893c72a65e21d84ecb3ccaeb46f5204ef517ae942482d835f89c0a934391 SHA512 31e902661d5ee2da82858910551393890583d9702303fed5652122c852e9384fb88a42eddd0b968558865e16b5bd4ac2a13a35bd01ec3f8c3adbb673bc465596
-DIST rust-patches-1.87.0-r1.tar.bz2 4635 BLAKE2B d813ec4a602d3bb879927a44a0b9f752aac255e31dfd13c56ab71b3fae7ce46a742c1d2e7494a7e17728f1edb2327ddd6ad6ebabc0c47d66326b766bbd323fbd SHA512 596ffe744a5849b443f077bbd4edbcbb240b9ac51c9d53e0e436e46d7c93a6734477d22eba4a066a0cf474503a6357a72dfa124e594f645be6f50d9bd25bdb10
+DIST rust-patches-1.86.0-r2-1.tar.bz2 6308 BLAKE2B eca644026942bd729a748df57dd67465bbec96b2d18a71c58fe04bb8e2514aabb1ca02cbd3761be5283328a3b728e063b1b85ea78f4f242c182071c44b8cb148 SHA512 1f1edcf76c64b0555366253e21d759e904a752746c2e5d88aba6e31f5ee2a2b0b06275674d2fc3acc42f589905eddc006d788f95b48a5d79a6ab767251d934da
+DIST rust-patches-1.87.0-r1-1.tar.bz2 5116 BLAKE2B 783ad21464a7e393d0aee506119be12b0137a7d360402b74f36b6fde154c2804cc0779da63875977d09f7e9f2d273ff41dd189bbe4eb239a314fea27bbaa704c SHA512 8c67e4e43bf2afb226f70bb2a03aad0abfd525cd484c8c9ff663da06d63b471f4f1b48169d952a6a6c14258c0029dedea14aadaaca2ee75389df65b806188363
 DIST rust-patches-1.88.0.tar.bz2 4062 BLAKE2B 64168ffa608f2edf2e0b3d079152c3b5dd59d0cea29078894f286bf91488e2e7769c55ede2d43769368d2147b46699d1bf981190d6800dc3d41c736289122eaf SHA512 b565acfb4d1146e52b1fb66b4a242927407cc34f1b38c2a100135cbbde24c8374af1997bc22069cca25f33cc8d747e56391f3d98a2d4e13dc0abcec0d6f88b0b
+DIST rust-patches-1.89.0.tar.bz2 4091 BLAKE2B 0fea3488a39d2b00627084f6b192dfbd7ed49bdceabbb1141d1a849ba053f786e31115e00365679b1b6fb5b0ccdf5dc0dc0803057cbffbcf0ae3d75ae9830d94 SHA512 de6c9b693bdd719d06605b5da730ee5d9cf9a1d88d58194a0ba48bd378a951c66723f561e39181222d28abb38e974a2921e14ea1f40156caf7b903778cf65790
 DIST rustc-1.74.1-src.tar.xz 155968724 BLAKE2B e05f2379ac94b286f85791a138e1928e5b5b5a7749f0981d82c40c2a12860f55bf96bb2f0e924e35a0f8b2447b13052d38adea909aaa3199105787bb5a4861b3 SHA512 14c7e7ed2f38ab60299d8c7d41d78f042b6b57ef822d577b5138e60bdde31cf141eccd4332a25bc5da3d58eb5313d63c1448b5dfe9e11b8055bb8ea133a9038d
 DIST rustc-1.74.1-src.tar.xz.asc 801 BLAKE2B ddf73175b164233babf31ca3a381b03e20c0f36d017c1d5f85d6ab11f0986d861ab23b11c061e6b2444ced70c3d6a494cc3de4ec86f0deb221a805491bd75420 SHA512 9a96ff9ba9a4e2af4e267b2ec126fc0675c78d0eb767703daa2f28491c3d85c2ab00fbd8584390bf658812ec6c4ab6c57e43b386db59fd505bd3134a8873a09e
 DIST rustc-1.75.0-src.tar.xz 159624388 BLAKE2B 8937b80585eddaa3e1f1ef948899d14a170308518c6fef9fe569560cdd870053776956743f796055f2119399b9ca6c0df12fedd789ae46324d071e5126c4e495 SHA512 7b0f25d91b1b5c317980fc88e059200bd43b56a70b445fbc72fb9b96e09775bfd3a98e9bd9d662af80f0ce3aef527c777ee82777e96ca876f47a972d63da8606
@@ -49,3 +50,5 @@ DIST rustc-1.87.0-src.tar.xz 283604208 BLAKE2B 7ede723121ff8df3908674631ceaec757
 DIST rustc-1.87.0-src.tar.xz.asc 801 BLAKE2B c9740c03baedcd70defba3fd37831692adaf0e984ef6b11d259244330d044fcacf935e6dd76caf126848da0c40f38e5368c60e8aabed5d3c2655a61fdbdc7564 SHA512 ebc13374381839a997c63455b733fd2a7960b4fd497f19c29be948cce8bb59a31ddda5da54ca154c16f7de43dd1bacd6c6bd76f3b6b36c5b43f4cfaf1746b952
 DIST rustc-1.88.0-src.tar.xz 283294344 BLAKE2B fc17efbc8b2e54f2da61384097dcb3b8f595f27f7853f56cef034913f6b46a718113af0fe66f0e3b0afd184ec506b35f3b74172926cf727ddc061f567d54fa4c SHA512 e6c62af2953f49462b2369e9551b12f2bec114577f90e3e76049636da4279b1e7f4d53bc6896f5d0d4715d90ef6d29dacff529a45690ffac6af62ad64600db40
 DIST rustc-1.88.0-src.tar.xz.asc 801 BLAKE2B 858e987ad1fc49c1e1cbc5ea709f835c60fce907e89205e431c843bfad97dc0ccbcf399fc7d87319b8455561cbc24020bd88cb572cbe932cb8b80a8adec39687 SHA512 64ab398dc602fed3ad7bf232249e80cc0a9831aa90c7eb37658f7dc5b2af04ee391f9633aae7a1d90f743d019cec531318384f71384ecbe4f6169e6e88b7ba0e
+DIST rustc-1.89.0-src.tar.xz 267487572 BLAKE2B 9f6e3c595f843c239b57f14e26685e9856cffa10189b75627fee4dc82970a9b5f2c6f42e145d1c1042d934bd4db0334014c046450f7594d621b378d951546d5d SHA512 3ac0f02baaff12c67fe35cef4d56b315134d0a043bb6103a248a2842456c74733c6e3039f079bacfb8b8ab9b7487f92d678987e588bd41276abf9bf7c2f7870b
+DIST rustc-1.89.0-src.tar.xz.asc 801 BLAKE2B cd94da916d3646048d8f90c6de658de2981d0c815a1f8da01fe58ab6ec133e47180c8b506a41e22c68b3cb77aff5bd3bfc966a71ae2b73849918096d68764386 SHA512 006b91bf41fbedf91c39b8a6e483b089f69af7e78026f2903928fed64e44ee6aa53e46fd19bae31b1576b53a80dab66bf3e53a3bf79f820066d36285d706b90c
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/rust-1.86.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch b/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/rust-1.86.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch
deleted file mode 100644
index 11d7738f2ee..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/rust-1.86.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-diff '--color=auto' -Nuar rustc-1.86.0-src.orig/src/bootstrap/src/utils/helpers.rs rustc-1.86.0-src/src/bootstrap/src/utils/helpers.rs
---- rustc-1.86.0-src.orig/src/bootstrap/src/utils/helpers.rs	2025-03-31 22:37:24.000000000 +0100
-+++ rustc-1.86.0-src/src/bootstrap/src/utils/helpers.rs	2025-04-17 12:31:37.651607535 +0100
-@@ -451,12 +451,12 @@
-     if !builder.is_lld_direct_linker(target) && builder.config.lld_mode.is_used() {
-         match builder.config.lld_mode {
-             LldMode::External => {
--                args.push("-Clinker-flavor=gnu-lld-cc".to_string());
-+                args.push("-Zlinker-features=+lld".to_string());
-                 // FIXME(kobzol): remove this flag once MCP510 gets stabilized
-                 args.push("-Zunstable-options".to_string());
-             }
-             LldMode::SelfContained => {
--                args.push("-Clinker-flavor=gnu-lld-cc".to_string());
-+                args.push("-Zlinker-features=+lld".to_string());
-                 args.push("-Clink-self-contained=+linker".to_string());
-                 // FIXME(kobzol): remove this flag once MCP510 gets stabilized
-                 args.push("-Zunstable-options".to_string());
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/rust-1.87.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch b/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/rust-1.87.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch
deleted file mode 100644
index 37d054222cd..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/rust-1.87.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 76e13020767e7ff783284b5bcf7a7509259ceb51 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jakub=20Ber=C3=A1nek?= <berykubik@gmail.com>
-Date: Fri, 4 Apr 2025 18:29:20 +0200
-Subject: [PATCH] Use target-agnostic LLD flags in bootstrap for use-lld
-
----
- src/bootstrap/src/utils/helpers.rs | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/bootstrap/src/utils/helpers.rs b/src/bootstrap/src/utils/helpers.rs
-index f8e4d4e04717d..78dcdcbd1874a 100644
---- a/src/bootstrap/src/utils/helpers.rs
-+++ b/src/bootstrap/src/utils/helpers.rs
-@@ -474,13 +474,13 @@ pub fn linker_flags(
-                 if stage == 0 && target.is_windows() {
-                     args.push("-Clink-arg=-fuse-ld=lld".to_string());
-                 } else {
--                    args.push("-Clinker-flavor=gnu-lld-cc".to_string());
-+                    args.push("-Zlinker-features=+lld".to_string());
-                 }
-                 // FIXME(kobzol): remove this flag once MCP510 gets stabilized
-                 args.push("-Zunstable-options".to_string());
-             }
-             LldMode::SelfContained => {
--                args.push("-Clinker-flavor=gnu-lld-cc".to_string());
-+                args.push("-Zlinker-features=+lld".to_string());
-                 args.push("-Clink-self-contained=+linker".to_string());
-                 // FIXME(kobzol): remove this flag once MCP510 gets stabilized
-                 args.push("-Zunstable-options".to_string());
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.74.1-r101.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.74.1-r101.ebuild
index 877fac40cfb..102ec7ee6b4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.74.1-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.74.1-r101.ebuild
@@ -264,6 +264,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.75.0-r101.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.75.0-r101.ebuild
index 988471ca47f..ed00b285343 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.75.0-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.75.0-r101.ebuild
@@ -243,6 +243,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.76.0-r101.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.76.0-r101.ebuild
index b30ccfabb5c..02b705c0331 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.76.0-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.76.0-r101.ebuild
@@ -243,6 +243,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.77.1-r101.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.77.1-r101.ebuild
index 8eb384190d4..f8096883ddd 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.77.1-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.77.1-r101.ebuild
@@ -243,6 +243,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.78.0-r101.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.78.0-r101.ebuild
index 51d7cbe0bf5..bf0f4a9f2cc 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.78.0-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.78.0-r101.ebuild
@@ -243,6 +243,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.79.0-r101.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.79.0-r101.ebuild
index 916a48f6b3d..1a4e15eb06d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.79.0-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.79.0-r101.ebuild
@@ -243,6 +243,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.80.1-r101.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.80.1-r101.ebuild
index 101321ff60d..0309e05390c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.80.1-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.80.1-r101.ebuild
@@ -243,6 +243,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.81.0-r101.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.81.0-r101.ebuild
index c5dc04af29b..e7b39689f06 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.81.0-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.81.0-r101.ebuild
@@ -244,6 +244,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.82.0-r103.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.82.0-r103.ebuild
index 690ca13d010..62fcfc8aa3f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.82.0-r103.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.82.0-r103.ebuild
@@ -243,6 +243,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.83.0-r3.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.83.0-r3.ebuild
index 01c787cdb74..6b44e212445 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.83.0-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.83.0-r3.ebuild
@@ -243,6 +243,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.0-r2.ebuild
index 481be29a720..e78e687cc9b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.0-r2.ebuild
@@ -249,6 +249,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.1-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.1-r2.ebuild
index bcee8100e1b..74c60132f62 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.1-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.1-r2.ebuild
@@ -249,6 +249,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.0-r2.ebuild
index 55a53cbf5e7..ef0915f9a4b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.0-r2.ebuild
@@ -306,6 +306,8 @@ src_prepare() {
 		${CARGO} generate-lockfile --offline || die "Failed to generate lockfiles"
 	fi
 
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.1-r1.ebuild
index 4b334f7c33d..e64ed601296 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.1-r1.ebuild
@@ -306,6 +306,8 @@ src_prepare() {
 		${CARGO} generate-lockfile --offline || die "Failed to generate lockfiles"
 	fi
 
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0-r2.ebuild
index c7bbd326073..9586a6dcae6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0-r2.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 19 )
 PYTHON_COMPAT=( python3_{11..13} )
 
-RUST_PATCH_VER=${PVR}
+RUST_PATCH_VER="${PVR}-1"
 
 RUST_MAX_VER=${PV%%_*}
 if [[ ${PV} == *9999* ]]; then
@@ -307,6 +307,8 @@ src_prepare() {
 		${CARGO} generate-lockfile --offline || die "Failed to generate lockfiles"
 	fi
 
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
@@ -316,8 +318,6 @@ src_prepare() {
 	fi
 
 	default
-
-	eapply "${FILESDIR}"/rust-1.86.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch
 }
 
 src_configure() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.87.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.87.0-r1.ebuild
index 44ae18b9046..9ef6faaf802 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.87.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.87.0-r1.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 20 )
 PYTHON_COMPAT=( python3_{11..14} )
 
-RUST_PATCH_VER=${PVR}
+RUST_PATCH_VER="${PVR}-1"
 
 RUST_MAX_VER=${PV%%_*}
 if [[ ${PV} == *9999* ]]; then
@@ -308,6 +308,8 @@ src_prepare() {
 		${CARGO} generate-lockfile --offline || die "Failed to generate lockfiles"
 	fi
 
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
@@ -317,8 +319,6 @@ src_prepare() {
 	fi
 
 	default
-
-	eapply "${FILESDIR}"/rust-1.87.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch
 }
 
 src_configure() {
@@ -446,6 +446,7 @@ src_configure() {
 		cargo = "${rust_stage0_root}/bin/cargo"
 		rustc = "${rust_stage0_root}/bin/rustc"
 		rustfmt = "${rust_stage0_root}/bin/rustfmt"
+		description = "gentoo"
 		docs = $(toml_usex doc)
 		compiler-docs = false
 		submodules = false
@@ -483,7 +484,6 @@ src_configure() {
 			echo "default-linker = \"${CHOST}-cc\""
 		fi)
 		channel = "${build_channel}"
-		description = "gentoo"
 		rpath = true
 		verbose-tests = true
 		optimize-tests = $(toml_usex !debug)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.88.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.88.0.ebuild
index 1bb3c5f4711..cf6636c8b24 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.88.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.88.0.ebuild
@@ -42,7 +42,7 @@ else
 		verify-sig? ( https://static.rust-lang.org/dist/${MY_P}-src.tar.xz.asc )
 	"
 	S="${WORKDIR}/${MY_P}-src"
-	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	KEYWORDS="amd64 arm arm64 ~loong ~mips ~ppc ppc64 ~riscv ~sparc ~x86"
 fi
 
 DESCRIPTION="Systems programming language originally developed by Mozilla"
@@ -320,6 +320,8 @@ src_prepare() {
 		${CARGO} generate-lockfile --offline || die "Failed to generate lockfiles"
 	fi
 
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
@@ -458,6 +460,7 @@ src_configure() {
 		cargo = "${rust_stage0_root}/bin/cargo"
 		rustc = "${rust_stage0_root}/bin/rustc"
 		rustfmt = "${rust_stage0_root}/bin/rustfmt"
+		description = "gentoo"
 		docs = $(toml_usex doc)
 		compiler-docs = false
 		submodules = false
@@ -495,7 +498,6 @@ src_configure() {
 			echo "default-linker = \"${CHOST}-cc\""
 		fi)
 		channel = "${build_channel}"
-		description = "gentoo"
 		rpath = true
 		verbose-tests = true
 		optimize-tests = $(toml_usex !debug)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.89.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.89.0.ebuild
new file mode 100644
index 00000000000..5ace910567f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.89.0.ebuild
@@ -0,0 +1,837 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( 20 )
+PYTHON_COMPAT=( python3_{11..14} )
+
+RUST_PATCH_VER=${PVR}
+
+RUST_MAX_VER=${PV%%_*}
+if [[ ${PV} == *9999* ]]; then
+	RUST_MIN_VER="1.88.0" # Update this as new `beta` releases come out.
+elif [[ ${PV} == *beta* ]]; then
+	RUST_MAX_VER="$(ver_cut 1).$(ver_cut 2).0"
+	RUST_MIN_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
+else
+	RUST_MIN_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
+fi
+
+inherit check-reqs estack flag-o-matic llvm-r1 multiprocessing optfeature \
+	multilib multilib-build python-any-r1 rust rust-toolchain toolchain-funcs verify-sig
+
+if [[ ${PV} = *9999* ]]; then
+	inherit git-r3
+elif [[ ${PV} == *beta* ]]; then
+	# Identify the snapshot date of the beta release:
+	# curl -Ls static.rust-lang.org/dist/channel-rust-beta.toml | grep beta-src.tar.xz
+	betaver=${PV//*beta}
+	BETA_SNAPSHOT="${betaver:0:4}-${betaver:4:2}-${betaver:6:2}"
+	MY_P="rustc-beta"
+	SRC_URI="https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz -> rustc-${PV}-src.tar.xz
+		https://gitweb.gentoo.org/proj/rust-patches.git/snapshot/rust-patches-${RUST_PATCH_VER}.tar.bz2
+		verify-sig? ( https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz.asc
+			-> rustc-${PV}-src.tar.xz.asc )
+	"
+	S="${WORKDIR}/${MY_P}-src"
+else
+	MY_P="rustc-${PV}"
+	SRC_URI="https://static.rust-lang.org/dist/${MY_P}-src.tar.xz
+		https://gitweb.gentoo.org/proj/rust-patches.git/snapshot/rust-patches-${RUST_PATCH_VER}.tar.bz2
+		verify-sig? ( https://static.rust-lang.org/dist/${MY_P}-src.tar.xz.asc )
+	"
+	S="${WORKDIR}/${MY_P}-src"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+fi
+
+DESCRIPTION="Systems programming language originally developed by Mozilla"
+HOMEPAGE="https://www.rust-lang.org/"
+
+# keep in sync with llvm ebuild of the same version as bundled one.
+ALL_LLVM_TARGETS=( AArch64 AMDGPU ARC ARM AVR BPF CSKY DirectX Hexagon Lanai
+	LoongArch M68k Mips MSP430 NVPTX PowerPC RISCV Sparc SPIRV SystemZ VE
+	WebAssembly X86 XCore Xtensa )
+ALL_LLVM_TARGETS=( "${ALL_LLVM_TARGETS[@]/#/llvm_targets_}" )
+LLVM_TARGET_USEDEPS=${ALL_LLVM_TARGETS[@]/%/(-)?}
+
+# https://github.com/rust-lang/llvm-project/blob/rustc-1.84.0/llvm/CMakeLists.txt
+_ALL_RUST_EXPERIMENTAL_TARGETS=( ARC CSKY DirectX M68k SPIRV Xtensa )
+declare -A ALL_RUST_EXPERIMENTAL_TARGETS
+for _x in "${_ALL_RUST_EXPERIMENTAL_TARGETS[@]}"; do
+	ALL_RUST_EXPERIMENTAL_TARGETS["llvm_targets_${_x}"]=0
+done
+
+LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
+SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
+
+IUSE="big-endian clippy cpu_flags_x86_sse2 debug dist doc llvm-libunwind lto rustfmt rust-analyzer rust-src +system-llvm test wasm ${ALL_LLVM_TARGETS[*]}"
+
+if [[ ${PV} = *9999* ]]; then
+	# These USE flags require nightly rust
+	IUSE+=" miri"
+fi
+
+LLVM_DEPEND=()
+# splitting usedeps needed to avoid CI/pkgcheck's UncheckableDep limitation
+for _x in "${ALL_LLVM_TARGETS[@]}"; do
+	LLVM_DEPEND+=( "	${_x}? ( $(llvm_gen_dep "llvm-core/llvm:\${LLVM_SLOT}[${_x}=]") )" )
+	if [[ -v ALL_RUST_EXPERIMENTAL_TARGETS["${_x}"] ]] ; then
+		ALL_RUST_EXPERIMENTAL_TARGETS["${_x}"]=1
+	fi
+done
+LLVM_DEPEND+=( "	wasm? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') )" )
+LLVM_DEPEND+=( "	$(llvm_gen_dep 'llvm-core/llvm:${LLVM_SLOT}')" )
+
+# dev-libs/oniguruma is used for documentation
+BDEPEND="${PYTHON_DEPS}
+	app-eselect/eselect-rust
+	dev-libs/oniguruma
+	|| (
+		>=sys-devel/gcc-4.7[cxx]
+		>=llvm-core/clang-3.5
+	)
+	lto? ( system-llvm? (
+		|| (
+			$(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}')
+			sys-devel/mold
+		)
+	) )
+	!system-llvm? (
+		>=dev-build/cmake-3.13.4
+		app-alternatives/ninja
+	)
+	test? ( dev-debug/gdb )
+	verify-sig? ( sec-keys/openpgp-keys-rust )
+"
+
+DEPEND="
+	>=app-arch/xz-utils-5.2
+	net-misc/curl:=[http2,ssl]
+	sys-libs/zlib:=
+	dev-libs/openssl:0=
+	system-llvm? (
+		${LLVM_DEPEND[*]}
+		llvm-libunwind? ( llvm-runtimes/libunwind:= )
+	)
+	!system-llvm? (
+		!llvm-libunwind? (
+			elibc_musl? ( sys-libs/libunwind:= )
+		)
+	)
+"
+
+RDEPEND="${DEPEND}
+	app-eselect/eselect-rust
+	dev-lang/rust-common
+	sys-apps/lsb-release
+	!dev-lang/rust:stable
+	!dev-lang/rust-bin:stable
+"
+
+REQUIRED_USE="|| ( ${ALL_LLVM_TARGETS[*]} )
+	rust-analyzer? ( rust-src )
+	test? ( ${ALL_LLVM_TARGETS[*]} )
+	wasm? ( llvm_targets_WebAssembly )
+	x86? ( cpu_flags_x86_sse2 )
+"
+
+# we don't use cmake.eclass, but can get a warning
+CMAKE_WARN_UNUSED_CLI=no
+
+QA_FLAGS_IGNORED="
+	usr/lib/${PN}/${SLOT}/bin/.*
+	usr/lib/${PN}/${SLOT}/libexec/.*
+	usr/lib/${PN}/${SLOT}/lib/lib.*.so
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/bin/.*
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/lib/lib.*.so
+"
+
+QA_SONAME="
+	usr/lib/${PN}/${SLOT}/lib/lib.*.so.*
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/lib/lib.*.so
+"
+
+QA_PRESTRIPPED="
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/bin/rust-llvm-dwp
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/lib/self-contained/crtn.o
+"
+
+# An rmeta file is custom binary format that contains the metadata for the crate.
+# rmeta files do not support linking, since they do not contain compiled object files.
+# so we can safely silence the warning for this QA check.
+QA_EXECSTACK="usr/lib/${PN}/${SLOT}/lib/rustlib/*/lib*.rlib:lib.rmeta"
+
+# causes double bootstrap
+RESTRICT="test"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/rust.asc
+
+clear_vendor_checksums() {
+	sed -i 's/\("files":{\)[^}]*/\1/' "vendor/${1}/.cargo-checksum.json" || die
+}
+
+toml_usex() {
+	usex "${1}" true false
+}
+
+pre_build_checks() {
+	local M=9216
+	# multiply requirements by 1.3 if we are doing x86-multilib
+	if use amd64; then
+		M=$(( $(usex abi_x86_32 13 10) * ${M} / 10 ))
+	fi
+	M=$(( $(usex clippy 128 0) + ${M} ))
+	if [[ ${PV} == *9999* ]]; then
+		M=$(( $(usex miri 128 0) + ${M} ))
+	fi
+	M=$(( $(usex rustfmt 256 0) + ${M} ))
+	# add 2G if we compile llvm and 256M per llvm_target
+	if ! use system-llvm; then
+		M=$(( 2048 + ${M} ))
+		local ltarget
+		for ltarget in ${ALL_LLVM_TARGETS[@]}; do
+			M=$(( $(usex ${ltarget} 256 0) + ${M} ))
+		done
+	fi
+	M=$(( $(usex wasm 256 0) + ${M} ))
+	M=$(( $(usex debug 2 1) * ${M} ))
+	eshopts_push -s extglob
+	if is-flagq '-g?(gdb)?([1-9])'; then
+		M=$(( 15 * ${M} / 10 ))
+	fi
+	eshopts_pop
+	M=$(( $(usex doc 256 0) + ${M} ))
+	CHECKREQS_DISK_BUILD=${M}M check-reqs_pkg_${EBUILD_PHASE}
+}
+
+llvm_check_deps() {
+	has_version -r "llvm-core/llvm:${LLVM_SLOT}[${LLVM_TARGET_USEDEPS// /,}]"
+}
+
+# Is LLVM being linked against libc++?
+is_libcxx_linked() {
+	local code='#include <ciso646>
+#if defined(_LIBCPP_VERSION)
+	HAVE_LIBCXX
+#endif
+'
+	local out=$($(tc-getCXX) ${CXXFLAGS} ${CPPFLAGS} -x c++ -E -P - <<<"${code}") || return 1
+	[[ ${out} == *HAVE_LIBCXX* ]]
+}
+
+pkg_pretend() {
+	pre_build_checks
+}
+
+pkg_setup() {
+	pre_build_checks
+	python-any-r1_pkg_setup
+
+	export LIBGIT2_NO_PKG_CONFIG=1 #749381
+	if tc-is-cross-compiler; then
+		use system-llvm && die "USE=system-llvm not allowed when cross-compiling"
+		local cross_llvm_target="$(llvm_tuple_to_target "${CBUILD}")"
+		use "llvm_targets_${cross_llvm_target}" || \
+			die "Must enable LLVM_TARGETS=${cross_llvm_target} matching CBUILD=${CBUILD} when cross-compiling"
+	fi
+
+	rust_pkg_setup
+
+	if use system-llvm; then
+		llvm-r1_pkg_setup
+
+		local llvm_config="$(get_llvm_prefix)/bin/llvm-config"
+		export LLVM_LINK_SHARED=1
+		export RUSTFLAGS="${RUSTFLAGS} -Lnative=$("${llvm_config}" --libdir)"
+	fi
+}
+
+rust_live_get_sources() {
+	EGIT_REPO_URI="
+		https://anongit.gentoo.org/git/proj/rust-patches.git
+	"
+	EGIT_CHECKOUT_DIR="${WORKDIR}/rust-patches-${RUST_PATCH_VER}"
+	git-r3_src_unpack
+
+	EGIT_REPO_URI="
+		https://github.com/rust-lang/rust.git
+	"
+	EGIT_SUBMODULES=(
+		"*"
+		"-src/gcc"
+	)
+	S="${WORKDIR}/rust"
+	EGIT_CHECKOUT_DIR="${S}"
+	git-r3_src_unpack
+}
+
+src_unpack() {
+	if [[ ${PV} == *9999* ]] ; then
+		rust_live_get_sources
+
+		# Vendor dependencies
+		mkdir "${S}/.cargo" || die # The vendor script has a check for .cargo/config{,.toml}
+		touch "${S}/.cargo/bootstrap.toml" || die
+		local rust_stage0_root="$(${RUSTC} --print sysroot || die "Can't determine rust's sysroot")"
+		# Configure vendor to use the portage-provided toolchain. This prevents it from
+		# attempting to fetch a `beta` toolchain from the internet.
+		cat <<- _EOF_ > "${T}/vendor-bootstrap.toml"
+			# Suppresses a warning about tracking changes which we don't care about.
+			change-id = "ignore"
+			[build]
+			build = "$(rust_abi "${CBUILD}")"
+			host = ["$(rust_abi "${CHOST}")"]
+			target = ["$(rust_abi "${CHOST}")"]
+			cargo = "${rust_stage0_root}/bin/cargo"
+			rustc = "${rust_stage0_root}/bin/rustc"
+			rustfmt = "${rust_stage0_root}/bin/rustfmt"
+		_EOF_
+		# We're using git sources so we need to run the Vendor script
+		# to ensure that all dependencies are present and up-to-date
+		mkdir "${S}/vendor" || die
+		# This also compiles the 'build helper', there's no way to avoid this.
+		${EPYTHON} "${S}"/x.py vendor -v --config="${T}"/vendor-bootstrap.toml -j$(makeopts_jobs) ||
+			die "Failed to vendor dependencies"
+		# TODO: This has to be generated somehow, this is from a 1.84.x tarball I had lying around.
+		cat <<- _EOF_ > "${S}/.cargo/config.toml"
+			[source.crates-io]
+			replace-with = "vendored-sources"
+
+			[source."git+https://github.com/rust-lang/team"]
+			git = "https://github.com/rust-lang/team"
+			replace-with = "vendored-sources"
+
+			[source.vendored-sources]
+			directory = "vendor"
+		_EOF_
+	elif use verify-sig ; then
+		# Patch tarballs are not signed (but we trust Gentoo infra)
+		verify-sig_verify_detached "${DISTDIR}"/rustc-${PV}-src.tar.xz{,.asc}
+		default
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	if [[ ${PV} = *9999* ]]; then
+		# We need to update / generate lockfiles for the workspace
+		${CARGO} generate-lockfile --offline || die "Failed to generate lockfiles"
+	fi
+
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
+	PATCHES=(
+		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
+	)
+
+	if use lto && tc-is-clang && ! tc-ld-is-lld && ! tc-ld-is-mold; then
+		export RUSTFLAGS+=" -C link-arg=-fuse-ld=lld"
+	fi
+
+	default
+}
+
+src_configure() {
+	if tc-is-cross-compiler; then
+		export PKG_CONFIG_ALLOW_CROSS=1
+		export PKG_CONFIG_PATH="${ESYSROOT}/usr/$(get_libdir)/pkgconfig"
+		export OPENSSL_INCLUDE_DIR="${ESYSROOT}/usr/include"
+		export OPENSSL_LIB_DIR="${ESYSROOT}/usr/$(get_libdir)"
+	fi
+
+	# Avoid bundled copies of libraries
+	export RUSTONIG_SYSTEM_LIBONIG=1
+	# Need to check if these can be optional
+	#export LIBSQLITE3_SYS_USE_PKG_CONFIG=1
+	#export LIBSSH2_SYS_USE_PKG_CONFIG=1
+
+	filter-lto # https://bugs.gentoo.org/862109 https://bugs.gentoo.org/866231
+
+	local rust_target="" rust_targets="" arch_cflags
+
+	# Collect rust target names to compile standard libs for all ABIs.
+	for v in $(multilib_get_enabled_abi_pairs); do
+		rust_targets+=",\"$(rust_abi $(get_abi_CHOST ${v##*.}))\""
+	done
+	if use wasm; then
+		rust_targets+=",\"wasm32-unknown-unknown\""
+		if use system-llvm; then
+			# un-hardcode rust-lld linker for this target
+			# https://bugs.gentoo.org/715348
+			sed -i '/linker:/ s/rust-lld/wasm-ld/' compiler/rustc_target/src/spec/base/wasm.rs || die
+		fi
+	fi
+	rust_targets="${rust_targets#,}"
+
+	# cargo and rustdoc are mandatory and should always be included
+	local tools='"cargo","rustdoc"'
+	use clippy && tools+=',"clippy"'
+	use rustfmt && tools+=',"rustfmt"'
+	use rust-analyzer && tools+=',"rust-analyzer","rust-analyzer-proc-macro-srv"'
+	use rust-src && tools+=',"src"'
+
+	if [[ ${PV} == *9999* ]]; then
+		use miri && tools+=',"miri"'
+	fi
+
+	local rust_stage0_root="$(${RUSTC} --print sysroot || die "Can't determine rust's sysroot")"
+	# in case of prefix it will be already prefixed, as --print sysroot returns full path
+	[[ -d ${rust_stage0_root} ]] || die "${rust_stage0_root} is not a directory"
+
+	rust_target="$(rust_abi)"
+	rust_build="$(rust_abi "${CBUILD}")"
+	rust_host="$(rust_abi "${CHOST}")"
+
+	RUST_EXPERIMENTAL_TARGETS=()
+	for _x in "${!ALL_RUST_EXPERIMENTAL_TARGETS[@]}"; do
+		if [[ ${ALL_RUST_EXPERIMENTAL_TARGETS[${_x}]} == 1 ]] && use ${_x} ; then
+			RUST_EXPERIMENTAL_TARGETS+=( ${_x#llvm_targets_} )
+		fi
+	done
+	RUST_EXPERIMENTAL_TARGETS=${RUST_EXPERIMENTAL_TARGETS[@]}
+
+	local cm_btype="$(usex debug DEBUG RELEASE)"
+	local build_channel
+	local build_miri="false"
+	case "${PV}" in
+		*9999*)
+			build_channel="nightly"
+			;;
+		*beta*)
+			build_channel="beta"
+			;;
+		*)
+			build_channel="stable"
+			;;
+	esac
+	cat <<- _EOF_ > "${S}"/bootstrap.toml
+		# Suppresses a warning about tracking changes which we don't care about.
+		change-id = "ignore"
+		# https://github.com/rust-lang/rust/issues/135358 (bug #947897)
+		profile = "dist"
+		[llvm]
+		download-ci-llvm = false
+		optimize = $(toml_usex !debug)
+		release-debuginfo = $(toml_usex debug)
+		assertions = $(toml_usex debug)
+		ninja = true
+		targets = "${LLVM_TARGETS// /;}"
+		experimental-targets = "${RUST_EXPERIMENTAL_TARGETS// /;}"
+		link-shared = $(toml_usex system-llvm)
+		$(if is_libcxx_linked; then
+			# https://bugs.gentoo.org/732632
+			echo "use-libcxx = true"
+			echo "static-libstdcpp = false"
+		fi)
+		$(case "${rust_target}" in
+			i586-*-linux-*)
+				# https://github.com/rust-lang/rust/issues/93059
+				echo 'cflags = "-fcf-protection=none"'
+				echo 'cxxflags = "-fcf-protection=none"'
+				echo 'ldflags = "-fcf-protection=none"'
+				;;
+			*)
+				;;
+		esac)
+		enable-warnings = false
+		[llvm.build-config]
+		CMAKE_VERBOSE_MAKEFILE = "ON"
+		$(if ! tc-is-cross-compiler; then
+			# When cross-compiling, LLVM is compiled twice, once for host and
+			# once for target.  Unfortunately, this build configuration applies
+			# to both, which means any flags applicable to one target but not
+			# the other will break.  Conditionally disable respecting user
+			# flags when cross-compiling.
+			echo "CMAKE_C_FLAGS_${cm_btype} = \"${CFLAGS}\""
+			echo "CMAKE_CXX_FLAGS_${cm_btype} = \"${CXXFLAGS}\""
+			echo "CMAKE_EXE_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
+			echo "CMAKE_MODULE_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
+			echo "CMAKE_SHARED_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
+			echo "CMAKE_STATIC_LINKER_FLAGS_${cm_btype} = \"${ARFLAGS}\""
+		fi)
+		[build]
+		build-stage = 2
+		test-stage = 2
+		build = "${rust_build}"
+		host = ["${rust_host}"]
+		target = [${rust_targets}]
+		cargo = "${rust_stage0_root}/bin/cargo"
+		rustc = "${rust_stage0_root}/bin/rustc"
+		rustfmt = "${rust_stage0_root}/bin/rustfmt"
+		description = "gentoo"
+		docs = $(toml_usex doc)
+		compiler-docs = false
+		submodules = false
+		python = "${EPYTHON}"
+		locked-deps = true
+		vendor = true
+		extended = true
+		tools = [${tools}]
+		verbose = 2
+		sanitizers = false
+		profiler = true
+		cargo-native-static = false
+		[install]
+		prefix = "${EPREFIX}/usr/lib/${PN}/${SLOT}"
+		sysconfdir = "etc"
+		docdir = "share/doc/rust"
+		bindir = "bin"
+		libdir = "lib"
+		mandir = "share/man"
+		[rust]
+		# https://github.com/rust-lang/rust/issues/54872
+		codegen-units-std = 1
+		optimize = true
+		debug = $(toml_usex debug)
+		debug-assertions = $(toml_usex debug)
+		debug-assertions-std = $(toml_usex debug)
+		debuginfo-level = $(usex debug 2 0)
+		debuginfo-level-rustc = $(usex debug 2 0)
+		debuginfo-level-std = $(usex debug 2 0)
+		debuginfo-level-tools = $(usex debug 2 0)
+		debuginfo-level-tests = 0
+		backtrace = true
+		incremental = false
+		$(if ! tc-is-cross-compiler; then
+			echo "default-linker = \"${CHOST}-cc\""
+		fi)
+		channel = "${build_channel}"
+		rpath = true
+		verbose-tests = true
+		optimize-tests = $(toml_usex !debug)
+		codegen-tests = true
+		omit-git-hash = false
+		dist-src = false
+		remap-debuginfo = true
+		lld = $(usex system-llvm false $(toml_usex wasm))
+		$(if use lto && tc-is-clang && ! tc-ld-is-mold; then
+			echo "use-lld = true"
+		fi)
+		# only deny warnings if doc+wasm are NOT requested, documenting stage0 wasm std fails without it
+		# https://github.com/rust-lang/rust/issues/74976
+		# https://github.com/rust-lang/rust/issues/76526
+		deny-warnings = $(usex wasm $(usex doc false true) true)
+		backtrace-on-ice = true
+		jemalloc = false
+		# See https://github.com/rust-lang/rust/issues/121124
+		lto = "$(usex lto thin off)"
+		[dist]
+		src-tarball = false
+		compression-formats = ["xz"]
+		compression-profile = "balanced"
+	_EOF_
+
+	for v in $(multilib_get_enabled_abi_pairs); do
+		rust_target=$(rust_abi $(get_abi_CHOST ${v##*.}))
+		arch_cflags="$(get_abi_CFLAGS ${v##*.})"
+
+		export CFLAGS_${rust_target//-/_}="${arch_cflags}"
+
+		cat <<- _EOF_ >> "${S}"/bootstrap.toml
+			[target.${rust_target}]
+			ar = "$(tc-getAR)"
+			cc = "$(tc-getCC)"
+			cxx = "$(tc-getCXX)"
+			linker = "$(tc-getCC)"
+			ranlib = "$(tc-getRANLIB)"
+			llvm-libunwind = "$(usex llvm-libunwind $(usex system-llvm system in-tree) no)"
+		_EOF_
+		if use system-llvm; then
+			cat <<- _EOF_ >> "${S}"/bootstrap.toml
+				llvm-config = "$(get_llvm_prefix)/bin/llvm-config"
+			_EOF_
+		fi
+		# by default librustc_target/spec/linux_musl_base.rs sets base.crt_static_default = true;
+		# but we patch it and set to false here as well
+		if use elibc_musl; then
+			cat <<- _EOF_ >> "${S}"/bootstrap.toml
+				crt-static = false
+				musl-root = "$($(tc-getCC) -print-sysroot)/usr"
+			_EOF_
+		fi
+	done
+	if use wasm; then
+		wasm_target="wasm32-unknown-unknown"
+		export CFLAGS_${wasm_target//-/_}="$(filter-flags '-mcpu*' '-march*' '-mtune*'; echo "$CFLAGS")"
+		cat <<- _EOF_ >> "${S}"/bootstrap.toml
+			[target.wasm32-unknown-unknown]
+			linker = "$(usex system-llvm lld rust-lld)"
+			# wasm target does not have profiler_builtins https://bugs.gentoo.org/848483
+			profiler = false
+		_EOF_
+	fi
+
+	if [[ -n ${I_KNOW_WHAT_I_AM_DOING_CROSS} ]]; then # whitespace intentionally shifted below
+	# experimental cross support
+	# discussion: https://bugs.gentoo.org/679878
+	# TODO: c*flags, clang, system-llvm, cargo.eclass target support
+	# it would be much better if we could split out stdlib
+	# complilation to separate ebuild and abuse CATEGORY to
+	# just install to /usr/lib/rustlib/<target>
+
+	# extra targets defined as a bash array
+	# spec format:  <LLVM target>:<rust-target>:<CTARGET>
+	# best place would be /etc/portage/env/dev-lang/rust
+	# Example:
+	# RUST_CROSS_TARGETS=(
+	#	"AArch64:aarch64-unknown-linux-gnu:aarch64-unknown-linux-gnu"
+	# )
+	# no extra hand holding is done, no target transformations, all
+	# values are passed as-is with just basic checks, so it's up to user to supply correct values
+	# valid rust targets can be obtained with
+	# 	rustc --print target-list
+	# matching cross toolchain has to be installed
+	# matching LLVM_TARGET has to be enabled for both rust and llvm (if using system one)
+	# only gcc toolchains installed with crossdev are checked for now.
+
+	# BUG: we can't pass host flags to cross compiler, so just filter for now
+	# BUG: this should be more fine-grained.
+	filter-flags '-mcpu=*' '-march=*' '-mtune=*'
+
+	local cross_target_spec
+	for cross_target_spec in "${RUST_CROSS_TARGETS[@]}";do
+		# extracts first element form <LLVM target>:<rust-target>:<CTARGET>
+		local cross_llvm_target="${cross_target_spec%%:*}"
+		# extracts toolchain triples, <rust-target>:<CTARGET>
+		local cross_triples="${cross_target_spec#*:}"
+		# extracts first element after before : separator
+		local cross_rust_target="${cross_triples%%:*}"
+		# extracts last element after : separator
+		local cross_toolchain="${cross_triples##*:}"
+		use llvm_targets_${cross_llvm_target} || die "need llvm_targets_${cross_llvm_target} target enabled"
+		command -v ${cross_toolchain}-gcc > /dev/null 2>&1 || die "need ${cross_toolchain} cross toolchain"
+
+		cat <<- _EOF_ >> "${S}"/bootstrap.toml
+			[target.${cross_rust_target}]
+			ar = "${cross_toolchain}-ar"
+			cc = "${cross_toolchain}-gcc"
+			cxx = "${cross_toolchain}-g++"
+			linker = "${cross_toolchain}-gcc"
+			ranlib = "${cross_toolchain}-ranlib"
+		_EOF_
+		if use system-llvm; then
+			cat <<- _EOF_ >> "${S}"/bootstrap.toml
+				llvm-config = "$(get_llvm_prefix)/bin/llvm-config"
+			_EOF_
+		fi
+		if [[ "${cross_toolchain}" == *-musl* ]]; then
+			cat <<- _EOF_ >> "${S}"/bootstrap.toml
+				musl-root = "$(${cross_toolchain}-gcc -print-sysroot)/usr"
+			_EOF_
+		fi
+
+		# append cross target to "normal" target list
+		# example 'target = ["powerpc64le-unknown-linux-gnu"]'
+		# becomes 'target = ["powerpc64le-unknown-linux-gnu","aarch64-unknown-linux-gnu"]'
+
+		rust_targets="${rust_targets},\"${cross_rust_target}\""
+		sed -i "/^target = \[/ s#\[.*\]#\[${rust_targets}\]#" bootstrap.toml || die
+
+		ewarn
+		ewarn "Enabled ${cross_rust_target} rust target"
+		ewarn "Using ${cross_toolchain} cross toolchain"
+		ewarn
+		if ! has_version -b 'sys-devel/binutils[multitarget]' ; then
+			ewarn "'sys-devel/binutils[multitarget]' is not installed"
+			ewarn "'strip' will be unable to strip cross libraries"
+			ewarn "cross targets will be installed with full debug information"
+			ewarn "enable 'multitarget' USE flag for binutils to be able to strip object files"
+			ewarn
+			ewarn "Alternatively llvm-strip can be used, it supports stripping any target"
+			ewarn "define STRIP=\"llvm-strip\" to use it (experimental)"
+			ewarn
+		fi
+	done
+	fi # I_KNOW_WHAT_I_AM_DOING_CROSS
+
+	einfo "Rust configured with the following flags:"
+	echo
+	echo RUSTFLAGS="\"${RUSTFLAGS}\""
+	echo RUSTFLAGS_BOOTSTRAP="\"${RUSTFLAGS_BOOTSTRAP}\""
+	echo RUSTFLAGS_NOT_BOOTSTRAP="\"${RUSTFLAGS_NOT_BOOTSTRAP}\""
+	echo MAGIC_EXTRA_RUSTFLAGS="\"${MAGIC_EXTRA_RUSTFLAGS}\""
+	env | grep "CARGO_TARGET_.*_RUSTFLAGS="
+	env | grep "CFLAGS_.*"
+	echo
+	einfo "bootstrap.toml contents:"
+	cat "${S}"/bootstrap.toml || die
+	echo
+}
+
+src_compile() {
+	# -v will show invocations, -vv "very verbose" is overkill, -vvv "very very verbose" is insane
+	RUST_BACKTRACE=1 "${EPYTHON}" ./x.py build -v --config="${S}"/bootstrap.toml -j$(makeopts_jobs) || die
+}
+
+src_test() {
+	# https://rustc-dev-guide.rust-lang.org/tests/intro.html
+
+	# those are basic and codegen tests.
+	local tests=(
+		codegen
+		codegen-units
+		compile-fail
+		incremental
+		mir-opt
+		pretty
+		run-make
+	)
+
+	# fails if llvm is not built with ALL targets.
+	# and known to fail with system llvm sometimes.
+	use system-llvm || tests+=( assembly )
+
+	# fragile/expensive/less important tests
+	# or tests that require extra builds
+	# TODO: instead of skipping, just make some nonfatal.
+	if [[ ${ERUST_RUN_EXTRA_TESTS:-no} != no ]]; then
+		tests+=(
+			rustdoc
+			rustdoc-js
+			rustdoc-js-std
+			rustdoc-ui
+			run-make-fulldeps
+			ui
+			ui-fulldeps
+		)
+	fi
+
+	local i failed=()
+	einfo "rust_src_test: enabled tests ${tests[@]/#/src/test/}"
+	for i in "${tests[@]}"; do
+		local t="src/test/${i}"
+		einfo "rust_src_test: running ${t}"
+		if ! RUST_BACKTRACE=1 "${EPYTHON}" ./x.py test -vv --config="${S}"/bootstrap.toml \
+				-j$(makeopts_jobs) --no-doc --no-fail-fast "${t}"
+		then
+				failed+=( "${t}" )
+				eerror "rust_src_test: ${t} failed"
+		fi
+	done
+
+	if [[ ${#failed[@]} -ne 0 ]]; then
+		eerror "rust_src_test: failure summary: ${failed[@]}"
+		die "aborting due to test failures"
+	fi
+}
+
+src_install() {
+	DESTDIR="${D}" "${EPYTHON}" ./x.py install -v --config="${S}"/bootstrap.toml -j$(makeopts_jobs) || die
+
+	docompress /usr/lib/${PN}/${SLOT}/share/man/
+
+	# bug #689562, #689160
+	rm -v "${ED}/usr/lib/${PN}/${SLOT}/etc/bash_completion.d/cargo" || die
+	rmdir -v "${ED}/usr/lib/${PN}/${SLOT}"/etc{/bash_completion.d,} || die
+
+	local symlinks=(
+		cargo
+		rustc
+		rustdoc
+		rust-gdb
+		rust-gdbgui
+		rust-lldb
+	)
+
+	use clippy && symlinks+=( clippy-driver cargo-clippy )
+	if [[ ${PV} = *9999* ]]; then
+		use miri && symlinks+=( miri cargo-miri )
+	fi
+	use rustfmt && symlinks+=( rustfmt cargo-fmt )
+	use rust-analyzer && symlinks+=( rust-analyzer )
+
+	einfo "installing eselect-rust symlinks and paths: ${symlinks[@]}"
+	local i
+	for i in "${symlinks[@]}"; do
+		# we need realpath on /usr/bin/* symlink return version-appended binary path.
+		# so /usr/bin/rustc should point to /usr/lib/rust/<ver>/bin/rustc-<ver>
+		# need to fix eselect-rust to remove this hack.
+		local ver_i="${i}-${PV%%_*}"
+		if [[ -f "${ED}/usr/lib/${PN}/${SLOT}/bin/${i}" ]]; then
+			einfo "Installing ${i} symlink"
+			ln -v "${ED}/usr/lib/${PN}/${SLOT}/bin/${i}" "${ED}/usr/lib/${PN}/${SLOT}/bin/${ver_i}" || die
+		else
+			ewarn "${i} symlink requested, but source file not found"
+			ewarn "please report this"
+		fi
+		dosym "../lib/${PN}/${SLOT}/bin/${ver_i}" "/usr/bin/${ver_i}"
+	done
+
+	# symlinks to switch components to active rust in eselect
+	dosym "${SLOT}/lib" "/usr/lib/${PN}/lib-${SLOT}"
+	use rust-analyzer && dosym "${SLOT}/libexec" "/usr/lib/${PN}/libexec-${SLOT}"
+	dosym "${SLOT}/share/man" "/usr/lib/${PN}/man-${SLOT}"
+	dosym "rust/${SLOT}/lib/rustlib" "/usr/lib/rustlib-${SLOT}"
+	dosym "../../lib/${PN}/${SLOT}/share/doc/rust" "/usr/share/doc/${P}"
+
+	newenvd - "50${P}" <<-_EOF_
+		MANPATH="${EPREFIX}/usr/lib/rust/man-${SLOT}"
+	_EOF_
+
+	rm -rf "${ED}/usr/lib/${PN}/${SLOT}"/*.old || die
+	rm -rf "${ED}/usr/lib/${PN}/${SLOT}/bin"/*.old || die
+	rm -rf "${ED}/usr/lib/${PN}/${SLOT}/doc"/*.old || die
+
+	# note: eselect-rust adds EROOT to all paths below
+	cat <<-_EOF_ > "${T}/provider-${PN}-${SLOT}"
+		/usr/bin/cargo
+		/usr/bin/rustdoc
+		/usr/bin/rust-gdb
+		/usr/bin/rust-gdbgui
+		/usr/bin/rust-lldb
+		/usr/lib/rustlib
+		/usr/lib/rust/lib
+		/usr/lib/rust/man
+		/usr/share/doc/rust
+	_EOF_
+
+	if use clippy; then
+		echo /usr/bin/clippy-driver >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-clippy >> "${T}/provider-${P}"
+	fi
+	if [[ ${SLOT} == *9999* ]] && use miri; then
+		echo /usr/bin/miri >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-miri >> "${T}/provider-${P}"
+	fi
+	if use rustfmt; then
+		echo /usr/bin/rustfmt >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-fmt >> "${T}/provider-${P}"
+	fi
+	if use rust-analyzer; then
+		echo /usr/lib/rust/libexec >> "${T}/provider-${P}"
+		echo /usr/bin/rust-analyzer >> "${T}/provider-${P}"
+	fi
+
+	insinto /etc/env.d/rust
+	doins "${T}/provider-${PN}-${SLOT}"
+
+	if use dist; then
+		"${EPYTHON}" ./x.py dist -v --config="${S}"/bootstrap.toml -j$(makeopts_jobs) || die
+		insinto "/usr/lib/${PN}/${SLOT}/dist"
+		doins -r "${S}/build/dist/."
+	fi
+}
+
+pkg_postinst() {
+
+	eselect rust update
+
+	if has_version dev-debug/gdb || has_version llvm-core/lldb; then
+		elog "Rust installs helper scripts for calling GDB and LLDB,"
+		elog "for convenience they are installed under /usr/bin/rust-{gdb,lldb}-${PV}."
+	fi
+
+	if has_version app-editors/emacs; then
+		optfeature "emacs support for rust" app-emacs/rust-mode
+	fi
+
+	if has_version app-editors/gvim || has_version app-editors/vim; then
+		optfeature "vim support for rust" app-vim/rust-vim
+	fi
+}
+
+pkg_postrm() {
+	eselect rust cleanup
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-9999.ebuild
index 1bb3c5f4711..3ef79e7077b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-9999.ebuild
@@ -10,7 +10,7 @@ RUST_PATCH_VER=${PVR}
 
 RUST_MAX_VER=${PV%%_*}
 if [[ ${PV} == *9999* ]]; then
-	RUST_MIN_VER="1.88.0" # Update this as new `beta` releases come out.
+	RUST_MIN_VER="1.89.0" # Update this as new `beta` releases come out.
 elif [[ ${PV} == *beta* ]]; then
 	RUST_MAX_VER="$(ver_cut 1).$(ver_cut 2).0"
 	RUST_MIN_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
@@ -320,6 +320,8 @@ src_prepare() {
 		${CARGO} generate-lockfile --offline || die "Failed to generate lockfiles"
 	fi
 
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
@@ -458,6 +460,7 @@ src_configure() {
 		cargo = "${rust_stage0_root}/bin/cargo"
 		rustc = "${rust_stage0_root}/bin/rustc"
 		rustfmt = "${rust_stage0_root}/bin/rustfmt"
+		description = "gentoo"
 		docs = $(toml_usex doc)
 		compiler-docs = false
 		submodules = false
@@ -495,7 +498,6 @@ src_configure() {
 			echo "default-linker = \"${CHOST}-cc\""
 		fi)
 		channel = "${build_channel}"
-		description = "gentoo"
 		rpath = true
 		verbose-tests = true
 		optimize-tests = $(toml_usex !debug)

From a3dc983b811ee3121684e9a306a222badc6396eb Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:56 +0000
Subject: [PATCH 027/122] dev-lang/rust-bin: Sync with Gentoo

It's from Gentoo commit cafdf38994b647f12fd6006c5767a7adb0fab626.
---
 .../portage-stable/dev-lang/rust-bin/Manifest |  49 +++
 .../dev-lang/rust-bin/rust-bin-1.87.0.ebuild  |   3 +
 .../dev-lang/rust-bin/rust-bin-1.88.0.ebuild  |  10 +-
 .../dev-lang/rust-bin/rust-bin-1.89.0.ebuild  | 318 ++++++++++++++++++
 4 files changed, 377 insertions(+), 3 deletions(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.89.0.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest
index 0168870676d..0b553581091 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest
@@ -541,6 +541,8 @@ DIST rust-1.87.0-powerpc64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B e762097c3bfd
 DIST rust-1.87.0-powerpc64-unknown-linux-musl.tar.xz 80980736 BLAKE2B bacf5aed3af21f8b825e54e7f58fd4c442c47d2898da26d120ffcda3238b4cb9d52ce3256ec37df1def2f0313d822424d6b9ba8e47cc48c072861c631a6b33bc SHA512 904dd60d80edcb1b9a9b34c4184b27cfc21f7480ebd2910447ad6e8e9d11872e4c84432e658ad5f6d8c439c687ccb2ec87611df9d499d73b21602cab13a97632
 DIST rust-1.87.0-powerpc64le-unknown-linux-gnu.tar.xz 271039948 BLAKE2B 1bf3516b146fa88b4460e15bfb51960ebce8ea46ea2d79ea391cd30c5685d7d5e0d7178450538577aab462180f777789bb5061d1f5a4460fb609784d0e35c636 SHA512 60fa1a2656c6b9273bf27ad87b04b676e2cb71219e2f26b5ad4ae045809378d5072b9e1dcc19829dc0eb46be9819f20f3a53731d83a2ef6b024d458ebfdcd656
 DIST rust-1.87.0-powerpc64le-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B fe05b3cd1746932222690932292bf36af9cd9ee36efa30598c52d66a4e7452220901f6da0acd9b498aabfc3de457f36e5d69e07799e51dd417ae98ef171c9482 SHA512 052512118f795c63bd9a4ba50a68212ef57f21bc031b70fcf88b5903f6a95b3251d43d2a7895d3a697637d94e76623b5ffc1b6c190c9e1e426d3955d71e7d549
+DIST rust-1.87.0-powerpc64le-unknown-linux-musl.tar.xz 276069796 BLAKE2B 9babd064bce24b081fa8f98a7ba0bca6aebe2cc153255c4407f874b1a0d13474958d07e0931668aeaa3848cddf94554bfdde9b0b2a46fd37df7b874f6672975c SHA512 46f53c1543276263be63936999e0e9bc5571d7feba59ad1cd2513ddbdb64a8cfdc723fb95fc1e04fd44b9fe5347f96a614f3dbc8fc25557c452b37601ba86814
+DIST rust-1.87.0-powerpc64le-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 53554e54b65f289a7f2cbdad908db3aabcc8284746c4ee155275cea0f628480d78644ac248f8e9194c46b07d841cd81a21fa01b1f8663d272de7094677e5c4e5 SHA512 827948466feee0eb4206e0bebc5764e3f7db67b394177939248336423f172f9a52a7746b54efdae465fd6da5ac1ea0d7a1dfe4e3e7492c2a101fe15202588085
 DIST rust-1.87.0-riscv64gc-unknown-linux-gnu.tar.xz 250242712 BLAKE2B d9d75de2381bdbf40ca77cb8dc1c8ecb23b5e209f2c919b56c08605aa557c4d827b92404bf0012093fcf551cd01520c41c6c8f9f2f56798104c6db8592b4d918 SHA512 e5520a5d6fbc0a50a54ccd9c850652475bac2e95e19ec2141e57c038d9a26ccf7cc2a046fb2fe4272b721005a4deabfc2c35c6c7d0a6cc2426e8e45e3e97834b
 DIST rust-1.87.0-riscv64gc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B e7c01e8a1027c408231812482418af16b1147ec577b6b67cea00172eba0716c58954b2a4378ee0213d839e35546efd7eab9f3d3b69ea57e8b560101229bad3d8 SHA512 4279b423334a9ec356d42d1973bf9d3388d5de8aa745b18c34d634d4d9d60c70cf165d851f571ab99a567e49bdd635eb0094c5c932571b0a5325408319403341
 DIST rust-1.87.0-riscv64gc-unknown-linux-musl.tar.xz 86942496 BLAKE2B 3c19dc3eb317518108cc269bc57c53296876d7f4d58a9dd0859dd2d42f377f204c7ee3337672875ee93f3f3a2459f9cdb882460d848dc4d12ca55bb0239e7a96 SHA512 872bb2a158159274b0eb70e21350ce56bf2edf5177ef3d9b8d63b7344930b6d93834d87ff24652f2487a1a997225e562567c53c906939836bff2cd374394e00b
@@ -565,20 +567,66 @@ DIST rust-1.88.0-i686-unknown-linux-gnu.tar.xz 261235476 BLAKE2B 5ff3f9167158844
 DIST rust-1.88.0-i686-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B dbcfa2e32906b07d4d9eb8d62af464f38c626d16b831e5d25fd9517f8f4e22ab60a2d6521f61ac3d36c0d9d6707a702ed3248fa0343462f62e1404574f83af9b SHA512 09f707dbed6f8d46872e4445e49c793a9f9cfedb71f3cc3b115b9447c7c4b86811081400bbf342c5a26b2f929738ffd9fb25f75ed1b13e333683ca6eedde430d
 DIST rust-1.88.0-loongarch64-unknown-linux-gnu.tar.xz 261520268 BLAKE2B 23d53eecaa14898537cb3647cbff114870223173f4e50cbdc19a7514f34995196792b0390337ad53387a7bb515ec34330502acdc361826429b8f3985a9341c8a SHA512 6f4a040e22de950e975c29f16563f19030fab9fbe9476f55a4542c3ad9eaa9c34500cdd4344819b5cc27831b32811d25d296845fef01475224a2bfbae7ef9ce7
 DIST rust-1.88.0-loongarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B ad7b0c85d6ec2085e6005f0789b6eaa30af0fefbf6e621b58f470b916320141e78ec6e112a4bb69867417b69ef740bc033db65a2fd3f54e5cfacfae56b58b57f SHA512 0fb6caa3fa06a28fa1f3a3657df6c2c1d4d87db9a94a74b9ccab14418af7057f3be75ff33556507f48bcec2e648324bc1629ef94c8c57e5ca62b8a9fbc49c9c3
+DIST rust-1.88.0-mips-unknown-linux-gnu.tar.xz 78511648 BLAKE2B 83c2cb810b9d884e06bdd74b55a59e305e9121c0b9f8808afc2f015d53e3e6c3bdbdc94621cbf4bafd64a923dca76229baa99cc9cce3cf08e3c24bb52121376b SHA512 de758b89d3a44727ccbdadf00e32c1c2dfdee2dcf0d291d92ff204c839d41b3dded08b0f045ffde67649af1c02903db65241f3449aa738bc7546420aee2b6a40
+DIST rust-1.88.0-mips64-unknown-linux-gnuabi64.tar.xz 78365128 BLAKE2B b71689ad4fcd9f6688250a3da28d7256eb3409a3b9799c2d431037781a1591abc39bd9070fd7e68cb86153a910a04600c0de8bdb07853c63320075dd969dc31b SHA512 1108adc0be1a3b558cd0d0bbf92c88dcba78660dda1cb2beb8662f16b76bb381272b7700bf17a4ee110d065ca44a2460fd59873e337521db519ce12a9e612d6c
+DIST rust-1.88.0-mips64el-unknown-linux-gnuabi64.tar.xz 79916392 BLAKE2B 71d41fba617da56603a49c371d854980eeb62b5aee31dc268a9068b2a401e06cdc23464c17d21786fb338157ee97b69ef65f22f994f756e43d1f3b4f55e64d46 SHA512 c3c42ed9ab87f84332ea6c4faa8ca7d7ba321ed31a16aaaef4dd0339b941c1df6d35536763a99efeced9f50783e66195fdb659228ed4e37eb9165a2588e8f61d
+DIST rust-1.88.0-mipsel-unknown-linux-gnu.tar.xz 80184380 BLAKE2B 232b96fae72abc499ce31e8b9f7c8f61baad8e2d29069dc49aff9bb455ca7ceaa300dbca88cffae90ca903ae945e7391b4ac8343abd82d3160ae0bedafcc84bb SHA512 6609a3fb037f65ac49e61c4a20e5e8ca8466f83adc4f7becbd1bcbc04df3418adf5a2894a934a159ef8d905ed86dfbbdaa38721c5db4d74e9a47ce4642180b9a
 DIST rust-1.88.0-powerpc-unknown-linux-gnu.tar.xz 255291852 BLAKE2B 4ef3d89f38bbbf12ef2ee190457f4ce96b5e60e02cc72a1e312a897c73fc28677277008f322381f7f084ae7d93671a9b3a46dc5e266a1b8c9987c780b26e61ac SHA512 f7100076968cbc4bf529ec2214f2ead865e87fc5e55f0a683ffa3034d3e31db0c9619fbcd9e854a7fba8d2e06732456edc59280bbd8de75e33df9897e65520d4
 DIST rust-1.88.0-powerpc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 7bf2a3229c6ae8a718812edd41dd0ffdd61dc792801d365dbeb46d7ae32cf12ecc7210ae67ba19be35349a27d656fa76a887a5d91d8e2dcd12b93600635d67df SHA512 2940a66102c6dc33dab8d410884f7bad88589c8df45f361c4f10a9be8a15d896c91a45c95f4c9b5f23a9d696af343b64d056274816b2454acba3adf1eccc0780
 DIST rust-1.88.0-powerpc64-unknown-linux-gnu.tar.xz 255371956 BLAKE2B 45607ff673bab803e794a3ddb070de237e94eeda43ca5fe52c49d006db2789433dfe324f706bd57d82d14f18bea0bb02372e71593c0251420628f5edba9c0fde SHA512 55889385893cfd957d85376ff68a677dd70886476392bf8f4f8ff671777d0ea168491e4d778c88f40a9a06f68717887b8b0ff3dbb0a65b956a98aa00e6b81dba
 DIST rust-1.88.0-powerpc64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 0625be465cbfdd2b73e73c8adf5ada2d7c0eaa4541f3735eec32d464cae44b475fa860cf126e433aa69a6f2de02d94af31bceae4ac23364ce394f34cf8f65586 SHA512 b25598551b7c0946adbd11ffdeb1761640f6bb255a9925cc734b4c12d82f666fc4344fdba9ab83fa63bdc82129dbc68df7ba125b8851238ca8558ca5de5c7dc5
+DIST rust-1.88.0-powerpc64-unknown-linux-musl.tar.xz 81542068 BLAKE2B a27027a975d87e7fbffc4d8bbad0f4b9ce8975eeff724e0607e2d26636bff075867a50b426ac79da1e6d1d0104869d39ac6f0215f012c438ee24a1293baab2ca SHA512 f6c643f2e86efa4e5793d745c04c2c37481bb7630ccf33735474554973926952d0b80ad3028f07e94b103cc28aae3b7c9b93e73786d215ab095c7ed104bc854a
 DIST rust-1.88.0-powerpc64le-unknown-linux-gnu.tar.xz 270351680 BLAKE2B 0b47e4e756d571232ec07d73fb99a2dd8e5542fa8d7046d565ed0277111ce07e5801815f2391fc0c19681f63b45e781c18d43a3fc818cc0352aee4c0a8da71fe SHA512 0e0d800f02bfebcc10792f71a48a7c70fe197bf965b5a055df07e54408e49a9cdee4dc744f4e06a2e400174265c833fbb4075f5a477508e72deacf48e955fdce
 DIST rust-1.88.0-powerpc64le-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B fdbf7a59a1a37c8ad09d0568e30487d01513734ae9bed276e3e3ba45cc0d39b14f958a377def77d9505e158d256780a7c1c936eaef40d7541279effa88f8c5e7 SHA512 1ccfe4f582783a80dc8bb0e50f5b782da661940930870c713ffd4a8ffed6df7e760829ee224e368bca583f611bdaad33eb46f3728fbe2b3062107510194671c9
+DIST rust-1.88.0-powerpc64le-unknown-linux-musl.tar.xz 275018668 BLAKE2B 3c6307a0bfa9b67be222f010533107b56a81860e8db07b44b2155464df5f24ec77a83753d00c71ae85f03cf1ebf3d91739a892a3af94f025c664c5fa0b276cdb SHA512 1eb9128f32432e9ccccf26f326946a734ad09416587ea0ba191f602e3335deb83cb1c45bbae08ee4ba711ac3ee6ca2de628efd008a4d6f39f6268dbfaec17dd1
+DIST rust-1.88.0-powerpc64le-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 283a3b9555499e5bc2f8d422e120802c5566593ac1aae625bc1d9ffefa7a746a53f1da5535c79a5b64eafccb112ebf0af50c6f04d83f9dcf7d2a15e9a83a8760 SHA512 62b75696fa82dd41677fbf878bcf36d9f5de489a2f2eb4733b800fa9b28009ad59287d72d5f9333fa9c67b1f68963d4295a376d2800c6392b60c0d55d7f715ad
 DIST rust-1.88.0-riscv64gc-unknown-linux-gnu.tar.xz 250151976 BLAKE2B 04b732c4d251af2d8279620a3a7da81a31161ec8f143396fc3cf39a5b6fa8dec5ff569253126b709a0ec147dfe7902a1748b313324173f0ef76ee89f54d1292c SHA512 389d92297915cce0155a8a96c0052df655768987fa1846e1e7f71a2f3da3e29e6b256f85f0d77f816b53cc33ddb7394f472f7ce92b81d40baad4c7fa0d2b2883
 DIST rust-1.88.0-riscv64gc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B f3602574232fe5e0af2e21e2a3178a227070aca5163230ba2a229d7ca63a798f0fa8564d2b16fb912493ef1d8d925cee5a21448c69843411c0df65f4454ad716 SHA512 b3036020032c51e6b739475c4c2c21aaaa742018ee6cad2a0b7f7a6eff193977eb93450cba01a5ef6c436d6b4ba491c79787c980a465306f42c85ed0dcc034ff
+DIST rust-1.88.0-riscv64gc-unknown-linux-musl.tar.xz 87040024 BLAKE2B 760b06ca652654f51268a9fef8e8eb026e6b0c6e22eecb161693b8d62f3f2fc1df34e4ab896d6d7d18e2a3d065fad6a133abb918a94dfe4b016b3251de87da13 SHA512 25db6caef2823b93bf7bfde00676ccb06344b500bf0a4013567354fa94002770ca8457e8f461b79944f506a6243091f8ac5162a79818d538c874e022ce34dfad
 DIST rust-1.88.0-s390x-unknown-linux-gnu.tar.xz 239909412 BLAKE2B e92e9f51f2af3c638b82fa8e7ed1c553b7f7537f32a67bd875ade77a04ba646e3b22a7ff88c28bdb3f02b6ddd753efa400962b4dbe36bda58ac5ae8326b9b35b SHA512 01d914bfcbfbe061ee2269445376112ca61fb87fff8acda07c3183aa051a50f270425d2a9761bf036a3d14c7b9cdabf392d3d532bce8a7e0d2ac9b5c22cc212e
 DIST rust-1.88.0-s390x-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 7a85b49f5e311bd3261ac0f6d967fe5505f73589c1d218481270adf00e72ee6bf57158d0da86f8289da7f4bce1452b3ba7447e1cf116175573eea8c07e58b0bd SHA512 349d119bbc4c12cc005e3ea9780b259413d93e4b052f5f7fc677a2e2bf71e7cbafa5db9770ed8378ec4a3053a2d590562c354c1db924247a74e20d1dcd4abdbe
+DIST rust-1.88.0-sparc64-unknown-linux-gnu.tar.xz 76772328 BLAKE2B 4958a6846edb1531793acdfaf3df064b17ebacc94d6485834c895cf4e1eff15bbc1e40645688ab981b0a1a0ea200bcf4256f182437377fe9339f27d7c096307b SHA512 e8225d15889cb82276ccf6490a6f2d534755b33d701a22501ac33ec4069eb8b47213d86ca7d2116d63702901780cc481935b4e6985c7a847bc4b92189cb64e9b
 DIST rust-1.88.0-x86_64-unknown-linux-gnu.tar.xz 197237052 BLAKE2B 5ce55a2b5faa41ccdb365764e1a3a10d46b385b678460de6dbaf3ef816e4f36164040070ef8c56183bdfe90389c1f81017bd7c411906d0a7b39899432f710e8d SHA512 ce97eb4697415bdb1fc33438ad62d9c410b00bfdb7c78c8c80e5887e6a23d3299302694918cbe259851c85b971f0ae3198ab6a89e26c94836a82bbf9e77cd80d
 DIST rust-1.88.0-x86_64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B d3bd096b1d1c7fce42f60cbd5f3b3a459c0063430366adc78c026a0159f379d2537d74d4f1fd768ea5b666a33cc28aa185a867aeed04ef1ae735a3eb794baa47 SHA512 62a5a9ffac0e95fbb547c504336b3aa160698e20b8ba322769c2233972c6ace48b2afdc42e84559b244099f9d8115cb96ba3c8f0923806559c53f80d3e248d04
 DIST rust-1.88.0-x86_64-unknown-linux-musl.tar.xz 291407088 BLAKE2B 17c8144b9acf12f190ed8bd3367a9602535ecea365a402e1248b26457f263103680b3d55d4b670aa381de816db76d263fa1c3d9715f60a3100c96765dac4d61d SHA512 d4da2f9cfeb50377616a48437ddab836717de94fc0362e6b8f4afcd7b4ca939be1c902db54b7204fb35863189e1f8b8d9b7bd4713e4e4729e42db9db2d249711
 DIST rust-1.88.0-x86_64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 31f344b4f8cb6beb58e2cbd62d7891abe764bb6a8a473b805ad55a7ef2b0952677e32481c22a2ec81146b61f74dafcbd384f629bdb7f7799ee642ce926f80953 SHA512 64824b1f927080e8272d29e4fee56e2237621a48b3178c2b4a5ae580519d1c954a85ce383232d0fcd98468a6530579353ae65f84b4205f90c4fc144188f3adb0
+DIST rust-1.89.0-aarch64-unknown-linux-gnu.tar.xz 167842432 BLAKE2B 222b9173c5a53c043df0c25e9ad28d4d41cdfdecf5008de73ab32886349ab5e173de6499e6bc53b7a3bd62389cc8a19d9b33697ce7a46cafd6f8d73bf0b78118 SHA512 bf3229189ce371dacdb02413e15ecbfa17e7e2c511e838e456810da5bbe81d31ca15f03b9a6d11176f63ff4653414910fdb5886bfa1ada0a1e79c3fd1f99b804
+DIST rust-1.89.0-aarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 1c5621234b00004a619070da70781cb5b7f4fc93cee9874b275c7be8098c240a02f7505e62c658dff4200023c0517fd62f6386fa0c36bc19a2898953e10375bf SHA512 300a870006b4a26f9d2a3a70f086b30784361bcccfe32cb80d77e8f1d0a8d24ae6dce5dc57ae705242ccd2147e631c9c26a0220a4dcc4f672e5d4879b46557b4
+DIST rust-1.89.0-aarch64-unknown-linux-musl.tar.xz 245117812 BLAKE2B d6ffc92c0da14e2048530b9bc01103b9a176361094f3eec8b85f3a5c8933a163caa54db98cc71b8db7d5672cfd93774525037bfff0e938fa3424fd7e3619df2e SHA512 0231db8b3bc0c2f7c14bc4681a7967677d3f23c1a8901b3a277a419739a0cb84331dadf7fa655a340021e41b8b30a0cd39f66ecf57990907fae4faf1f1364470
+DIST rust-1.89.0-aarch64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 071e14a76e3215dc7ca9cc627c9ae8b629e8f2167f88917dd7de033a873aa000461dfd2fd759f5e02d8a158ab7cc78d13c93b08da3c218d47b4c5be4100229b2 SHA512 70d9d1797ff592356a94f2792eca5eb29175199e1cad09be4310b9247ecb49d4b24212c3b3d4f0e1907e0dcf2a4b3fa156bd289e7d3583fdcc66e9446fc4b24c
+DIST rust-1.89.0-arm-unknown-linux-gnueabi.tar.xz 230269052 BLAKE2B 5b89fda89934a350d5135b3a2196bdffc65088f5db3167c1d68f79ce4e1bb6997aa3ba24aa780226431c2d921bed43f003ae8551e6c5f848f37d61258c10971d SHA512 c748ef69ad9617a8925a8f28237f561c6e9be102cf23f6f8f4a9a1ff40c24b1e89592f232f276fc35a813a01985ccdcdd8e33840d3c9c94fa2841f693454ef52
+DIST rust-1.89.0-arm-unknown-linux-gnueabi.tar.xz.asc 801 BLAKE2B b7da749fa9fa0f9a62d34cc1fd8436e3a173e34fff5a2e19e5d1ef9ca183db28f08410a88a5865bac4c5866194c8244c0a70329cc2f1101e79ea2561322f30a4 SHA512 f9445968e89239995614de933036c64e9e2d4f1f2f201161bd115aea722c0110d39c4299823d6423b81f40dc00a3733988b4968f709237e180afa4c8abd72a02
+DIST rust-1.89.0-arm-unknown-linux-gnueabihf.tar.xz 230569320 BLAKE2B e46ebf2fff070ef27fdc146d6f16fa0b093d3b0e65739bc6305b0d4fce8ed7320ba8964279b401f5386d3927dda8806d1291daab80bca11cee66ff07b83865fa SHA512 3eb78dab9c65e5aa90735c17bff2bcc49698a8f8a582b0273f8ebd3f3536767f8f604c432264ef1420d5909a8ca1d2ce8198ed21af5f91b8d34e367eba6edebb
+DIST rust-1.89.0-arm-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B 4019c8738028543f195d419e87c0938f765755f8604dddf5e46ee36a292d287b8fdb3b2f0ce56844cf4af30bb349c523f25dabe2b88eef02a862eaf4f9823dce SHA512 a8d2a1818707122121a00a61aa2219cd7a90cdf0eeebce10d49fb6be130072e985a996f7389566d565ae6958b43696c8199b824eba610440380b67f4d7cd9966
+DIST rust-1.89.0-armv7-unknown-linux-gnueabihf.tar.xz 236421804 BLAKE2B 7e52df2ec7a66546419abb24c37f74cea904aac72695af5ee6c29da06389be8e49d76675aa0d99058a2350297ef4217f7c50008a6d7c1252814346d59e377e12 SHA512 9aa477fcc4db6373941deced70de8354ba98763cb8fea71f49eb178c8e630bbd33db6b6b53fbecdf7dbd7979399f65338fba579a3eab2e6525e1cc0417c3a201
+DIST rust-1.89.0-armv7-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B 950e1f296a883bdb5c77435428bd59f961fd70a63efa5078516e81f3f49211e968fc5c32d60f8eb969e27416616428f1b5315d336339df7376eaeedde8d73825 SHA512 810733b44f59f7c86e7bc2fc8bd1f737601f6ab4fc834f00415f566f08b836076fcd8bc1e0d9f8c46218c90f08cdbefd9255b7d550798e2d2eda1b55e476c501
+DIST rust-1.89.0-i686-unknown-linux-gnu.tar.xz 263655764 BLAKE2B ff9f2fa8b1c268311de530ac815c0bdd07357a157abc9ef457a309b6211336fa423964a56e05fe736d6d190c946850585e480f234dd030ea18e1c7b847bb58c0 SHA512 122a3f1d9152bb4fdf3978d3b567c2662abe6a7aa7cf9993e0f5bbdf509980be10759a60872bd5a63fdd27f3c592e4b1751d9550b49b9232c68d94732523fa77
+DIST rust-1.89.0-i686-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 12622868707e549f99cc21fb42a4816a844f089df53f7c039d8df2129ad2847ec4300ee0d2fbbfa656730ce1476ad54d7c4603db98bdf7588cd33d8d7661da09 SHA512 ba548bc6c79b9bccaa15fd34d54a03a653cf3351727f8a918f6ef03b3c70d443116ace622388e84c92288ab0fa623f0fcaf2bf7222a5eb58dd55a68bcc5809df
+DIST rust-1.89.0-loongarch64-unknown-linux-gnu.tar.xz 262411344 BLAKE2B afd842e9b742bc61127b800190dd475e337bbcffb8e65c9c7a1e03a54de4ce9a661bdb81a6754dc89a4ec75f4f97417283a616ebce00f9196d464b739db57248 SHA512 8ac5d66a32348417cdd4b71379b089c95c7119f32621b2f9ea7f4a98f7a79a277f925bdde7d2c2606442f534782b01c6bd5b630b0a14395f935b70292e6d40ec
+DIST rust-1.89.0-loongarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 7089e317280245582e9ad414ff8c43f87b888ab7c451c07fbc7652b2bc59290e57a1fdf4583d4230f16cc5873277c4bc2dfbc8c07621c865df10f95ab314465b SHA512 014f822ac210e70370c7bc75581ecf6bcdac140795cefc61b9c25d8620843c6f0a3afee405026a46dbf05f038ab3520db0bdd08fa011cc7f502bb7a3acc90871
+DIST rust-1.89.0-mips-unknown-linux-gnu.tar.xz 79214364 BLAKE2B e08965697d3e804264f22a65354e4528c7d4198b6cb2e7fb64ca0cb321d072168670d3bac92918f4fec81fcef0d1f5e77e2b6a89e26296c11e0b3e7e2c282b42 SHA512 b0fa04f42bac729971bfae1b2ad4b439ec813782f70d4a8bba6cd98b9c34011c8197153d1ada9c91806458546f74b654fba8ffce4afe3667ae747b6bc95b70de
+DIST rust-1.89.0-mips64-unknown-linux-gnuabi64.tar.xz 79048664 BLAKE2B 1c3627737c551d1dae29c5502b97b6e2e9566bf4a773c75b55fc936e57a94072e3a83ed8283f3e01a0e76bfc7e781213ac9accc288db3e82d287e215264062c9 SHA512 b48d5543cb43e55ef3185a976bb71c42859845d7a4a33dff0fa7a722fba781d3f51e2f84bf1e8f029ac057d6c072880542017cefaf07995abbfda7b1fcb341d9
+DIST rust-1.89.0-mips64el-unknown-linux-gnuabi64.tar.xz 80772072 BLAKE2B 4872c27c64a9f629d9706aaca6b501ffae3ae82c457ca3ae0be9155615953f935da0d2da8672f697f53f15660bfbc56e058c3ae10c1cd18b17b9582ef0b93fd3 SHA512 f151ac5cb5260c8064e192a03de5ea30a615dd7201355f90af5172891f16064c8215ce8a6de5b7561cb3ea0e776fc666811ef9b2c79bb9fc89fa3cf6477e9b06
+DIST rust-1.89.0-mipsel-unknown-linux-gnu.tar.xz 80990052 BLAKE2B ba158d9f8834ea54ff2ed713ab200092d198907f4b397e2f0c06b3302cf65c77fa271f677df51dcf4370b07b4ffc909440c550fbd528af0217521ce4d8350f00 SHA512 eeca0d19c13320aed6847eefbf00ef7a71c94c580f02304235fc8738d766c4c797f14240e7cf5ae10390eb1835d4aea595c12b8ea6337852e8cce619258ec430
+DIST rust-1.89.0-powerpc-unknown-linux-gnu.tar.xz 255902040 BLAKE2B 655f2ac95fd93754d18ad592f8260065239cc2e9b1f4004c16f32381f595fc71d7323ee2082e3f644001ae21cf7984961af77e211d65ad9bc1077d7de4386c3d SHA512 d55a01a267e1103a079d2eaf1f560ad70b1aaa127064e4772b9badd350dd62be22183c89e97ddb1dee02a36a6ec53ff2bc6528b7c0fa86c54207ed85625657b6
+DIST rust-1.89.0-powerpc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 6397d58e1d35861bedca92318e2444fe3e427a0f8efd10f94301e0767159049fcc58cf35f265f0a3ebd5fd9270830ab099b67b93d0b6f78ca722db86d9207daf SHA512 8b08acd4572d2dd86fb0550ef41d9e5619309bd0ee7f0da518f652cf9b324169366f659250004ff490bf7fc65a4d4bed5834ec70253a160f9a9ffd1cc2fb1fe8
+DIST rust-1.89.0-powerpc64-unknown-linux-gnu.tar.xz 256734336 BLAKE2B 4b875c37b154226518d1251fdf33796637e612a8b35523fdbccd0d471adf42593a4936a02c51dd38e9d2580686a7f48d89289f3eac0a657f8d3cb1f3147e812e SHA512 4335b67f85e9af0b62373d576dbc06360678fd7d16ddab506a2f063a5a44664961b2e194cbbd92c351c97c93fadc79de11cefd2e1f73ccde6c47560b2b96f69e
+DIST rust-1.89.0-powerpc64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 3673a2627ce5c6b4c46fb7a5aa723aaaaecd90d1592236539e8246343ac2da3a513796eea09be7209b3d56d0552efab204a89112cb842c358a25c010c79c0ca4 SHA512 f00190f407709d3d86a395ebe89d9121662a8adc837727a42966a2cad319ba5e83ed652e19332eef7a8306c1be147249273932e7e6e14fcc0126f0453b1c49b0
+DIST rust-1.89.0-powerpc64-unknown-linux-musl.tar.xz 82545996 BLAKE2B da2db5c69f90a7153785104249e7eb36d7ae319ed0aec61dd7f5b95127e309935cb8b2071f1534af8eb02d3f9d33adf25ffbc60551a1a08386265b444ac03ba3 SHA512 1c8c61ecfcf4c2f700743d2fda4e960674d2802b3ac7af93dc34a839ee2fac01b817aad376d99eff4b9b558bd23851b01d2fcd727172e2a558fb54882bbedc0e
+DIST rust-1.89.0-powerpc64le-unknown-linux-gnu.tar.xz 271860376 BLAKE2B 7fdb2223384de0cee04b0d97f307f69ee739d15e5e7e260e7c8873b552f5395cf76f3fa005f7107d28b3dda49faddf96992c727a15ec3d69e7eea16e7d9c5db0 SHA512 2fb5f2a3d99fe35a10a78798328be16516776020848245aeee1f4ba35b8a567e0869cf28e6438333ade33ba3e992b63e77bf9f2dd14458c5d68fa804450155f0
+DIST rust-1.89.0-powerpc64le-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B ac64d25d1f8ef9c8fc27cc0aee48f9e8d6b423c733ee198a16490030a9188ca875d82747b2589b50cadf340b58d29c3000a911082fa5fe32564bb8a425b2ce9b SHA512 23b3f9f19f8fb69a518df9441cac824cd8bb2e733938acab174cdcef29f6bfa3d07db0dde1a9cd129931bf28743249e0e70ddf99f5074458b43c23350980bb4d
+DIST rust-1.89.0-powerpc64le-unknown-linux-musl.tar.xz 276967104 BLAKE2B 868eca61e9fa9a03806abcf8dea40d9468887cf839ee363468a67032a58aacf99624090a6337e93917bb5db5c95c2e91a0e4070c153ae16249c7122d3258b0e8 SHA512 4c3bc630ff662b0ee3d726db8e425333584881a88ae06afade906345c8a07fc7dca60b423b78b6817d114368039f847b1cec3b385a1f6b458125c5b137c50349
+DIST rust-1.89.0-powerpc64le-unknown-linux-musl.tar.xz.asc 801 BLAKE2B bb62a2240ab685f214cde51903ee1d37b5ddfeed6d57ac102a18fa497e51b5af6fa50e3b7970335a62e95f106632125c0db53f5f12628361d52eeb0a00e23d20 SHA512 c4d1e86eb0ec845edd9b272a28211c24ecff21e9b25ca1f1e3450d60f761f25bc3994df0cbfb4c0f9d6375aee37b302d2f7f0906999170893cbb28409620dc9d
+DIST rust-1.89.0-riscv64gc-unknown-linux-gnu.tar.xz 250747592 BLAKE2B b47ae43be1e46eec7f2333f30e63e47a94d504a8bbf546d2d0dea701c8f200780846e65a523f71430772c8630a4dafe33d215a3fc29215995db578cc93c8c771 SHA512 2efab720f427c973d3c8ca87f1a7d68280b4498882de13a5053cacf156afa56da62879818922eec6b92f083e7e7de2b882656efb7a7cdb61e053a28c9aeb0ffe
+DIST rust-1.89.0-riscv64gc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 98e4dfbe54459f15da2f202df43ae79a52bf51849d4a098f795f97290d7d35bec90da8e4e0ba48cf81ffca72d54d1bc1af3f0f2a063708637d45b1cdfdaaecc2 SHA512 3646552c993d0aca107ab6cc70f3cb585b4dd25f724e5de38940558a0a0c8bfa5ade8bbbb0220141ee1fa1fe7c21001d43bde599cd9a96a04b5fa92c33416c15
+DIST rust-1.89.0-riscv64gc-unknown-linux-musl.tar.xz 87810188 BLAKE2B 3f89f641f8026133fbb3af744cf50ae6e27a4f6221be3dcd6d1e90ed2c9b01fd759b1273d221ddfe39ec8b4bbbde46367069a8879fb5c396769a09d1ce607adb SHA512 18e07d95a8f6d566c71403eb9a17f44d95f8e4ca6de99ee687f099570c43078921f749546e1e24793ce2e1ebb9b70520c1206ed5a5d4e3b66dcb02c8ae76ade5
+DIST rust-1.89.0-s390x-unknown-linux-gnu.tar.xz 240848884 BLAKE2B 76c7983c847340d46987357624bd78cfd8f5efe1ebacbf3b7d8eabcdc990883a1f88a87d92214380f3087d81df73edceffdd97509f69c56a4327c6ade14d2730 SHA512 0ffc3cbbd334310a75c033e8f6f99adaa328fd9d360da833f3f4caae20a9f09017487a069baae76d54316d1382fca6b58c40bbf44170608b94a4b30e31937069
+DIST rust-1.89.0-s390x-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B c01aec9696803a49600608add339fe39d45c006abd71542a94c8109a3a1b2f2b0e1652356e6e04c7e5429e1373e7e33e1ff539ab58811e8cb820d6654abbb15f SHA512 1cb49912acec64c4fb00c79040f4f878c7fb1636f3512a189b52cb04d658d03923891944dfe77748f38b3e3071f0012f05d795d197f5a2048344ce4accce934b
+DIST rust-1.89.0-sparc64-unknown-linux-gnu.tar.xz 77659052 BLAKE2B f41d6ff704455db38ae16323ec592c2273efdf6712a6c176c73abfd5afe07d70b5aa751940af2e6ddef1fb901131a0e5ceac9f06f49d9b4b60f5f9cb7dabd64d SHA512 9cb64cba2ed5d1472020a812f9c6fa614295dbbd2002eb46596464918d6b060e7a612b905544f3a8c18b13272bb6b9d00ed8bf8a821d5c4a7324eb328f748dee
+DIST rust-1.89.0-x86_64-unknown-linux-gnu.tar.xz 201436760 BLAKE2B f0b77a74c27a7fd1396bb9d640ccd64b1549604dacc7638dae245d2380aaf8b1b9e2c0e7270708193ab725c2f5bde27cbb01621831d2a9404cb9953d18be062d SHA512 1eec2845633a30eb49aa8babbcaf9b6fa0cb617b32944dec17f4440518192ac2eb071bc391913ab1ef14e31e6e973e490d9651d9cc3f376eba4a7691ac917077
+DIST rust-1.89.0-x86_64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B cd7e0e527601b36bcb133f0fa2786bc2720e0dc35cd340acc839220cd4b13c1f2622ace457ed3dbc7dda70bcd5199873cebdab36eec0569b0905524ae68a7cca SHA512 8e366e0e70ea78dd4a6a8414fa0349c2a178dc17a11809f350f08b700c3ff3cb1baff0ff363ce9dc3532dcb2d7b7518b5b2b30c07623e0f35f7162bffe59aad8
+DIST rust-1.89.0-x86_64-unknown-linux-musl.tar.xz 292022352 BLAKE2B d1f268d67011824ce6b9b27581518620e6ba51f4b49cdcf9a215fd649550a22b8fdc9c2e154a9c6e39986e52b46036813b4d3c0c115dbd55a1ce04fc0482feb0 SHA512 e9bb0e4a45a273fb6cf1e46264b879fd410465ea2f3cc396cc8a797a744cc71a0c95db8af9754462ca1c9ec1fdc699ee64262483cbd625dffaef50476462eb32
+DIST rust-1.89.0-x86_64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 54b4b8a887c7fe441d3ee33bc37f6ad8f7f1b99d01f54b660bfaae0cb29cecfe7208e27cce9360db68bb275ee7aa0f760539ec3ae37fb5a44edc2365c1f115cb SHA512 666d87fd3ab91375dc081fe9a6300b945db6ffc317c8ba7f5f01e58421793d3f1ff68dd0d72aac1add426834a0bd81ce48949683ee379e60afe820c1baf960f0
 DIST rust-src-1.74.1.tar.xz 2544036 BLAKE2B d95431b69f102782f51878ff73ce8802cac6dab7909497c3231d1c479b95dc2a618cc6efd8bac9c6bd59a2b10dc6be05199f1e1bd74e45cc640ee52352c29268 SHA512 11467d0936193c5a5be8c2eba1aefe2b7028af48494698863de2c4057d68ce33dcee1fc66dc2d68b1d32f0202ce49e9b906727849de8f8d904dd07930e76d5a4
 DIST rust-src-1.75.0.tar.xz 2570256 BLAKE2B 9db7ccff07ffe6991233e9f530321fd6ba48c561dcf1226537afa70c7d045421d8e83c5300b0866ec6fccfaae96dd67b9f204e9e0e12108c0c766d467cd78909 SHA512 e7565cea2f1658a05237a698e38880df2544319b41b6d8b0805db5f1f94fd3bb4f986967d0440fcdfe3a135e33246f3c747665b964f57ff5942f56133af78cdd
 DIST rust-src-1.76.0.tar.xz 2590884 BLAKE2B d1a6215dab34d7b10c3177d2b248f997d3a846388f3442567572880aa5c5bc51b56398f5d4dc32727cee7c9dbef494430d6534a76b66c4ae5ac4fed07266644d SHA512 39d2fe58fae8c8c5a6cb3fb1ef2a1c7548c018fef6ccea531659fdfecd68a4aa77125299d2cbe5b58e500337b4d074928318fa9ebce358af500d0ef27260e3ca
@@ -596,3 +644,4 @@ DIST rust-src-1.85.1.tar.xz 3036412 BLAKE2B f137ffcebd2d231d8b3dc5c9072f6afe39a0
 DIST rust-src-1.86.0.tar.xz 3053544 BLAKE2B 2d1d8a4be4f9dc9355ce9a2d1599e0a57c5d1cb32f7b2eb413f6009dbce7d63db2533dc038cf50f5277a2d7bf4434f2076632c12a6fd33335ccf3a9f2ab685d1 SHA512 2818d94412bb0766ce53383932cd8ce96275a8e923f916c4bf7116fbcb7c2053cfb9714667add1a9d50b18366c973ba3ab4fe55d49c8abc8cc57656635c59f63
 DIST rust-src-1.87.0.tar.xz 3119800 BLAKE2B 6429eb419f17109537a2a5463b0c68f504b3cb0f55766e18f73cf053883b06eedc934ab4598756790cec147ff41c4eb30a807d2ce0b7e6af33310710fdc5a8c1 SHA512 9747c60268d772b7c6e7694260c0808d2b8a42028f5606499c81595d76f5bc32c9acf6b4b9aad168235f8fd77d980c56bc4afc3d40f5d0374b23d3e66e3de390
 DIST rust-src-1.88.0.tar.xz 3155272 BLAKE2B bca923d2264337366b8013c45f3a40cbdfc1e1b746775161eaa66a1db653aa4ccb2a55980368ecf9808d6f4885194e2dfbf1f678d0500a43f7b2fcc0f79d27c8 SHA512 6dfe1fc3565927a9ac2ff9821ef3222cca170ff538833e1969ebe662af2cad5257c1ab3d82f5ca10aeaab40f54916a25dd96fd16449cd59e4d104b631911931b
+DIST rust-src-1.89.0.tar.xz 3461444 BLAKE2B b1e43def4cc0f47f0e776d383954b339a62b3efa77d5db71180b7b7620a67bd2d2714afe0b08ae26a06d7d8c785eed03f545d91813d074cbe6641e883a2d40dd SHA512 055c09854e47d1bdfc7f393ac6f2783d35cb8cf13100deb227598ad91020f1d91e4cec1658d8e71db3c266dc6e267ab4172dc1007428cb05105dc4aac57bf89d
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.87.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.87.0.ebuild
index 94a82670eae..5cced8d50de 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.87.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.87.0.ebuild
@@ -24,6 +24,9 @@ else
 	# curl -Ls static.rust-lang.org/dist/channel-rust-${PV}.toml | grep "xz_url.*rust-src"
 	SRC_URI="$(rust_all_arch_uris "${PV}")
 		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/rust-}/2025-05-15/rust-src-${PV}.tar.xz )
+		ppc64? ( elibc_musl? ( !big-endian? (
+			$(rust_arch_uri powerpc64le-unknown-linux-musl ${PV})
+		) ) )
 	"
 	KEYWORDS="amd64 arm arm64 ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 fi
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.88.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.88.0.ebuild
index 5132ee797ad..047f7b9fcd6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.88.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.88.0.ebuild
@@ -23,8 +23,11 @@ else
 	# curl -Ls static.rust-lang.org/dist/channel-rust-${PV}.toml | grep "xz_url.*rust-src"
 	SRC_URI="$(rust_all_arch_uris "rust-${PV}")
 		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/2025-06-26/rust-src-${PV}.tar.xz )
+		ppc64? ( elibc_musl? ( !big-endian? (
+			$(rust_arch_uri powerpc64le-unknown-linux-musl rust-${PV})
+		) ) )
 	"
-	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~s390 ~x86"
+	KEYWORDS="amd64 arm arm64 ~loong ~mips ~ppc ppc64 ~riscv ~s390 ~sparc ~x86"
 fi
 
 GENTOO_BIN_BASEURI="https://github.com/projg2/rust-bootstrap/releases/download/${PVR}" # omit trailing slash
@@ -32,7 +35,7 @@ GENTOO_BIN_BASEURI="https://github.com/projg2/rust-bootstrap/releases/download/$
 DESCRIPTION="Systems programming language from Mozilla"
 HOMEPAGE="https://www.rust-lang.org/"
 
-if [[ ${PV} != *9999* && ${PV} != *beta* ]] && false ; then
+if [[ ${PV} != *9999* && ${PV} != *beta* ]] ; then
 	# Keep this separate to allow easy commenting out if not yet built
 	SRC_URI+=" sparc? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-sparc64-unknown-linux-gnu.tar.xz ) "
 	SRC_URI+=" mips? (
@@ -50,7 +53,6 @@ if [[ ${PV} != *9999* && ${PV} != *beta* ]] && false ; then
 	)"
 	SRC_URI+=" ppc64? ( elibc_musl? (
 		big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64-unknown-linux-musl.tar.xz )
-		!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64le-unknown-linux-musl.tar.xz )
 	) )"
 fi
 
@@ -58,9 +60,11 @@ LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
 SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
 IUSE="big-endian clippy cpu_flags_x86_sse2 doc prefix rust-analyzer rust-src rustfmt"
 
+# net-misc/curl is needed for our own bootstrapped rustc, since cross-compiling bundled curl is not supported
 RDEPEND="
 	>=app-eselect/eselect-rust-20190311
 	dev-libs/openssl
+	net-misc/curl
 	sys-apps/lsb-release
 	|| (
 		llvm-runtimes/libgcc
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.89.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.89.0.ebuild
new file mode 100644
index 00000000000..cd80f2761b1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.89.0.ebuild
@@ -0,0 +1,318 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( 20 )
+LLVM_OPTIONAL="yes"
+
+inherit edo llvm-r1 multilib prefix rust-toolchain verify-sig multilib-minimal optfeature
+
+if [[ ${PV} == *9999* ]]; then
+	# We need to fetch a tarball in src_unpack
+	PROPERTIES+=" live"
+elif [[ ${PV} == *beta* ]]; then
+	# curl -Ls static.rust-lang.org/dist/channel-rust-beta.toml | grep "xz_url.*rust-src"
+	betaver=${PV//*beta}
+	BETA_SNAPSHOT="${betaver:0:4}-${betaver:4:2}-${betaver:6:2}"
+	RUST_TOOLCHAIN_BASEURL=https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/
+	SRC_URI="$(rust_all_arch_uris rust-beta rust-${PV})
+		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/rust-src-beta.tar.xz -> rust-src-${PV}.tar.xz )
+	"
+else
+	# curl -Ls static.rust-lang.org/dist/channel-rust-${PV}.toml | grep "xz_url.*rust-src"
+	SRC_URI="$(rust_all_arch_uris "rust-${PV}")
+		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/2025-08-07/rust-src-${PV}.tar.xz )
+		ppc64? ( elibc_musl? ( !big-endian? (
+			$(rust_arch_uri powerpc64le-unknown-linux-musl rust-${PV})
+		) ) )
+	"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+GENTOO_BIN_BASEURI="https://github.com/projg2/rust-bootstrap/releases/download/${PVR}" # omit trailing slash
+
+DESCRIPTION="Systems programming language from Mozilla"
+HOMEPAGE="https://www.rust-lang.org/"
+
+if [[ ${PV} != *9999* && ${PV} != *beta* ]] ; then
+	# Keep this separate to allow easy commenting out if not yet built
+	SRC_URI+=" sparc? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-sparc64-unknown-linux-gnu.tar.xz ) "
+	SRC_URI+=" mips? (
+		abi_mips_o32? (
+			big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips-unknown-linux-gnu.tar.xz )
+			!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mipsel-unknown-linux-gnu.tar.xz )
+		)
+		abi_mips_n64? (
+			big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips64-unknown-linux-gnuabi64.tar.xz )
+			!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips64el-unknown-linux-gnuabi64.tar.xz )
+		)
+	)"
+	SRC_URI+=" riscv? (
+		elibc_musl? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-riscv64gc-unknown-linux-musl.tar.xz )
+	)"
+	SRC_URI+=" ppc64? ( elibc_musl? (
+		big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64-unknown-linux-musl.tar.xz )
+	) )"
+fi
+
+LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
+SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
+IUSE="big-endian clippy cpu_flags_x86_sse2 doc prefix rust-analyzer rust-src rustfmt"
+
+# net-misc/curl is needed for our own bootstrapped rustc, since cross-compiling bundled curl is not supported
+RDEPEND="
+	>=app-eselect/eselect-rust-20190311
+	dev-libs/openssl
+	net-misc/curl
+	sys-apps/lsb-release
+	|| (
+		llvm-runtimes/libgcc
+		sys-devel/gcc:*
+	)
+	!dev-lang/rust:stable
+	!dev-lang/rust-bin:stable
+"
+BDEPEND="
+	prefix? ( dev-util/patchelf )
+	verify-sig? ( sec-keys/openpgp-keys-rust )
+"
+[[ ${PV} == *9999* ]] && BDEPEND+=" net-misc/curl"
+
+REQUIRED_USE="x86? ( cpu_flags_x86_sse2 )"
+
+# stripping rust may break it (at least on x86_64)
+# https://github.com/rust-lang/rust/issues/112286
+RESTRICT="strip"
+
+QA_PREBUILT="
+	opt/rust-bin-${SLOT}/bin/.*
+	opt/rust-bin-${SLOT}/lib/.*.so*
+	opt/rust-bin-${SLOT}/libexec/.*
+	opt/rust-bin-${SLOT}/lib/rustlib/.*/bin/.*
+	opt/rust-bin-${SLOT}/lib/rustlib/.*/lib/.*
+"
+
+# An rmeta file is custom binary format that contains the metadata for the crate.
+# rmeta files do not support linking, since they do not contain compiled object files.
+# so we can safely silence the warning for this QA check.
+QA_EXECSTACK="opt/${PN}-${SLOT}/lib/rustlib/*/lib*.rlib:lib.rmeta"
+
+VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
+
+src_unpack() {
+	if [[ ${PV} == *9999* ]]; then
+		# We need to fetch the latest nightly listing and get the apprapriate src_uri for our arch
+		local rust_bin_url rustc_src_url
+		# Cut down on webrequests by fetching the nightly toml once
+		curl -Ls static.rust-lang.org/dist/channel-rust-nightly.toml > "${WORKDIR}/channel-rust-nightly.toml" ||
+			die "Failed to fetch nightly revision info"
+		rustc_src_url=$(grep 'xz_url.*rust-src' "${WORKDIR}/channel-rust-nightly.toml" | cut -d '"' -f 2)
+		rust_bin_url=$(grep "xz_url.*rust-nightly-$(rust_abi)" "${WORKDIR}/channel-rust-nightly.toml" | cut -d '"' -f 2)
+		einfo "Using nightly Rust from: ${rust_bin_url}"
+
+		if use rust-src; then
+			einfo "Using nightly Rust-src from: ${rustc_src_url}"
+			# We need to fetch the rust-src tarball
+			einfo "Fetching nightly rust-src tarball ..."
+			curl --progress-bar -L "${rustc_src_url}" -o "${WORKDIR}/rust-src-${PV}.tar.xz" ||
+				die "Failed to fetch nightly rust-src tarball."
+			# no verify-sig here, just unpack it
+			tar -xf "${WORKDIR}/rust-src-${PV}.tar.xz" || die "Failed to unpack nightly rust-src tarball"
+		fi
+
+		einfo "Fetching nightly Rust tarball ..."
+		curl --progress-bar -L "${rust_bin_url}" -O || die "Failed to fetch nightly tarball"
+		if use verify-sig; then
+			einfo "Fetching nightly signature ..."
+			curl --progress-bar -L "${rust_bin_url}.asc" -O || die "Failed to fetch nightly signature"
+			verify-sig_verify_detached "${WORKDIR}/rust-nightly-$(rust_abi).tar.xz" \
+				"${WORKDIR}/rust-nightly-$(rust_abi).tar.xz.asc"
+		fi
+		tar -xf "${WORKDIR}/rust-nightly-$(rust_abi).tar.xz" || die "Failed to unpack nightly tarball"
+	else
+		# sadly rust-src tarball does not have corresponding .asc file
+		# so do partial verification
+		if use verify-sig; then
+			for f in ${A}; do
+				if [[ -f ${DISTDIR}/${f}.asc ]]; then
+					verify-sig_verify_detached "${DISTDIR}/${f}" "${DISTDIR}/${f}.asc"
+				fi
+			done
+		fi
+
+		default_src_unpack
+
+	fi
+	case ${PV} in
+		*9999*)
+			mv "${WORKDIR}/rust-nightly-$(rust_abi)" "${S}" || die
+			;;
+		*beta*)
+			mv "${WORKDIR}/rust-beta-$(rust_abi)" "${S}" || die
+			;;
+		*)
+			mv "${WORKDIR}/rust-${PV}-$(rust_abi)" "${S}" || die
+			;;
+	esac
+}
+
+patchelf_for_bin() {
+	local filetype=$(file -b ${1})
+	if [[ ${filetype} == *ELF*interpreter* ]]; then
+		einfo "${1}'s interpreter changed"
+		patchelf ${1} --set-interpreter ${2} || die
+	elif [[ ${filetype} == *script* ]]; then
+		hprefixify ${1}
+	fi
+}
+
+rust_native_abi_install() {
+	pushd "${S}" >/dev/null || die
+	local analysis="$(grep 'analysis' ./components || die "analysis not found in components")"
+	local std="$(grep 'std' ./components || die "std not found in components")"
+	local components=( "rustc" "cargo" "${std}" )
+	use doc && components+=( "rust-docs" )
+	use clippy && components+=( "clippy-preview" )
+	use rustfmt && components+=( "rustfmt-preview" )
+	use rust-analyzer && components+=( "rust-analyzer-preview" "${analysis}" )
+	# Rust component 'rust-src' is extracted from separate archive
+	if use rust-src; then
+		einfo "Combining rust and rust-src installers"
+		case ${PV} in
+			*9999*)
+				mv -v "${WORKDIR}/rust-src-nightly/rust-src" "${S}" || die
+				;;
+			*beta*)
+				mv -v "${WORKDIR}/rust-src-beta/rust-src" "${S}" || die
+				;;
+			*)
+				mv -v "${WORKDIR}/rust-src-${PV}/rust-src" "${S}" || die
+				;;
+		esac
+		echo rust-src >> ./components || die
+		components+=( "rust-src" )
+	fi
+	edo ./install.sh \
+		--components="$(IFS=,; echo "${components[*]}")" \
+		--disable-verify \
+		--prefix="${ED}/opt/rust-bin-${SLOT}" \
+		--mandir="${ED}/opt/rust-bin-${SLOT}/man" \
+		--disable-ldconfig
+
+	docompress /opt/${P}/man/
+
+	if use prefix; then
+		local interpreter=$(patchelf --print-interpreter "${EPREFIX}"/bin/bash)
+		ebegin "Changing interpreter to ${interpreter} for Gentoo prefix at ${ED}/opt/${SLOT}/bin"
+		find "${ED}/opt/${SLOT}/bin" -type f -print0 | \
+			while IFS=  read -r -d '' filename; do
+				patchelf_for_bin ${filename} ${interpreter} \; || die
+			done
+		eend $?
+	fi
+
+	local symlinks=(
+		cargo
+		rustc
+		rustdoc
+		rust-gdb
+		rust-gdbgui
+		rust-lldb
+	)
+
+	use clippy && symlinks+=( clippy-driver cargo-clippy )
+	use rustfmt && symlinks+=( rustfmt cargo-fmt )
+	use rust-analyzer && symlinks+=( rust-analyzer )
+
+	einfo "installing eselect-rust symlinks and paths"
+	local i
+	for i in "${symlinks[@]}"; do
+		# we need realpath on /usr/bin/* symlink return version-appended binary path.
+		# so /usr/bin/rustc should point to /opt/rust-bin-<ver>/bin/rustc-<ver>
+		local ver_i="${i}-bin-${SLOT}"
+		ln -v "${ED}/opt/rust-bin-${SLOT}/bin/${i}" "${ED}/opt/rust-bin-${SLOT}/bin/${ver_i}" || die
+		dosym -r "/opt/rust-bin-${SLOT}/bin/${ver_i}" "/usr/bin/${ver_i}"
+	done
+
+	# symlinks to switch components to active rust in eselect
+	dosym -r "/opt/rust-bin-${SLOT}/lib" "/usr/lib/rust/lib-bin-${SLOT}"
+	dosym -r "/opt/rust-bin-${SLOT}/man" "/usr/lib/rust/man-bin-${SLOT}"
+	dosym -r "/opt/rust-bin-${SLOT}/lib/rustlib" "/usr/lib/rustlib-bin-${SLOT}"
+	dosym -r "/opt/rust-bin-${SLOT}/share/doc/rust" "/usr/share/doc/rust-bin-${SLOT}"
+
+	# make all capital underscored variable
+	local CARGO_TRIPLET="$(rust_abi)"
+	CARGO_TRIPLET="${CARGO_TRIPLET//-/_}"
+	CARGO_TRIPLET="${CARGO_TRIPLET^^}"
+	cat <<-_EOF_ > "${T}/50${P}"
+		MANPATH="${EPREFIX}/usr/lib/rust/man-bin-${SLOT}"
+	$(usev elibc_musl "CARGO_TARGET_${CARGO_TRIPLET}_RUSTFLAGS=\"-C target-feature=-crt-static\"")
+	_EOF_
+	doenvd "${T}/50${P}"
+
+	# note: eselect-rust adds EROOT to all paths below
+	cat <<-_EOF_ > "${T}/provider-${PN}-${SLOT}"
+	/usr/bin/cargo
+	/usr/bin/rustdoc
+	/usr/bin/rust-gdb
+	/usr/bin/rust-gdbgui
+	/usr/bin/rust-lldb
+	/usr/lib/rustlib
+	/usr/lib/rust/lib
+	/usr/lib/rust/man
+	/usr/share/doc/rust
+	_EOF_
+
+	if use clippy; then
+		echo /usr/bin/clippy-driver >> "${T}/provider-${PN}-${SLOT}"
+		echo /usr/bin/cargo-clippy >> "${T}/provider-${PN}-${SLOT}"
+	fi
+	if use rustfmt; then
+		echo /usr/bin/rustfmt >> "${T}/provider-${PN}-${SLOT}"
+		echo /usr/bin/cargo-fmt >> "${T}/provider-${PN}-${SLOT}"
+	fi
+	if use rust-analyzer; then
+		echo /usr/bin/rust-analyzer >> "${T}/provider-${PN}-${SLOT}"
+	fi
+
+	insinto /etc/env.d/rust
+	doins "${T}/provider-${PN}-${SLOT}"
+	popd >/dev/null || die
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi; then
+		rust_native_abi_install
+	else
+		local rust_target
+		rust_target="$(rust_abi $(get_abi_CHOST ${v##*.}))"
+		dodir "/opt/${P}/lib/rustlib"
+		cp -vr "${WORKDIR}/rust-${PV}-${rust_target}/rust-std-${rust_target}/lib/rustlib/${rust_target}"\
+			"${ED}/opt/${P}/lib/rustlib" || die
+	fi
+
+	# BUG: installs x86_64 binary on other arches
+	rm -f "${ED}/opt/${P}/lib/rustlib/"*/bin/rust-llvm-dwp || die
+}
+
+pkg_postinst() {
+	eselect rust update
+
+	if has_version dev-debug/gdb || has_version llvm-core/lldb; then
+		elog "Rust installs helper scripts for calling GDB and LLDB,"
+		elog "for convenience they are installed under /usr/bin/rust-{gdb,lldb}-${PV}."
+	fi
+
+	if has_version app-editors/emacs; then
+		optfeature "emacs support for rust" app-emacs/rust-mode
+	fi
+
+	if has_version app-editors/gvim || has_version app-editors/vim; then
+		optfeature "vim support for rust" app-vim/rust-vim
+	fi
+}
+
+pkg_postrm() {
+	eselect rust cleanup
+}

From 15ea564944be13ec7d337c1b718abfd9add698dd Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:57 +0000
Subject: [PATCH 028/122] dev-lang/rust-common: Sync with Gentoo

It's from Gentoo commit 573912135a8f349aa320cd174ff183f09959ff25.
---
 .../dev-lang/rust-common/Manifest             |  2 +
 .../rust-common/rust-common-1.88.0.ebuild     |  2 +-
 .../rust-common/rust-common-1.89.0.ebuild     | 73 +++++++++++++++++++
 3 files changed, 76 insertions(+), 1 deletion(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.89.0.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/Manifest
index c474e60ada6..da509c8bee0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/Manifest
@@ -14,3 +14,5 @@ DIST rustc-1.87.0-src.tar.xz 283604208 BLAKE2B 7ede723121ff8df3908674631ceaec757
 DIST rustc-1.87.0-src.tar.xz.asc 801 BLAKE2B c9740c03baedcd70defba3fd37831692adaf0e984ef6b11d259244330d044fcacf935e6dd76caf126848da0c40f38e5368c60e8aabed5d3c2655a61fdbdc7564 SHA512 ebc13374381839a997c63455b733fd2a7960b4fd497f19c29be948cce8bb59a31ddda5da54ca154c16f7de43dd1bacd6c6bd76f3b6b36c5b43f4cfaf1746b952
 DIST rustc-1.88.0-src.tar.xz 283294344 BLAKE2B fc17efbc8b2e54f2da61384097dcb3b8f595f27f7853f56cef034913f6b46a718113af0fe66f0e3b0afd184ec506b35f3b74172926cf727ddc061f567d54fa4c SHA512 e6c62af2953f49462b2369e9551b12f2bec114577f90e3e76049636da4279b1e7f4d53bc6896f5d0d4715d90ef6d29dacff529a45690ffac6af62ad64600db40
 DIST rustc-1.88.0-src.tar.xz.asc 801 BLAKE2B 858e987ad1fc49c1e1cbc5ea709f835c60fce907e89205e431c843bfad97dc0ccbcf399fc7d87319b8455561cbc24020bd88cb572cbe932cb8b80a8adec39687 SHA512 64ab398dc602fed3ad7bf232249e80cc0a9831aa90c7eb37658f7dc5b2af04ee391f9633aae7a1d90f743d019cec531318384f71384ecbe4f6169e6e88b7ba0e
+DIST rustc-1.89.0-src.tar.xz 267487572 BLAKE2B 9f6e3c595f843c239b57f14e26685e9856cffa10189b75627fee4dc82970a9b5f2c6f42e145d1c1042d934bd4db0334014c046450f7594d621b378d951546d5d SHA512 3ac0f02baaff12c67fe35cef4d56b315134d0a043bb6103a248a2842456c74733c6e3039f079bacfb8b8ab9b7487f92d678987e588bd41276abf9bf7c2f7870b
+DIST rustc-1.89.0-src.tar.xz.asc 801 BLAKE2B cd94da916d3646048d8f90c6de658de2981d0c815a1f8da01fe58ab6ec133e47180c8b506a41e22c68b3cb77aff5bd3bfc966a71ae2b73849918096d68764386 SHA512 006b91bf41fbedf91c39b8a6e483b089f69af7e78026f2903928fed64e44ee6aa53e46fd19bae31b1576b53a80dab66bf3e53a3bf79f820066d36285d706b90c
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.88.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.88.0.ebuild
index 26c4792d0fb..c2c09947292 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.88.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.88.0.ebuild
@@ -32,7 +32,7 @@ else
 		verify-sig? ( https://static.rust-lang.org/dist/rustc-${PV}-src.tar.xz.asc )
 	"
 	S="${WORKDIR}/rustc-${MY_PV}-src"
-	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	KEYWORDS="amd64 arm arm64 ~loong ~mips ~ppc ppc64 ~riscv ~sparc ~x86"
 fi
 
 LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.89.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.89.0.ebuild
new file mode 100644
index 00000000000..26c4792d0fb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.89.0.ebuild
@@ -0,0 +1,73 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/rust.asc
+inherit shell-completion verify-sig
+
+DESCRIPTION="Common files shared between multiple slots of Rust"
+HOMEPAGE="https://www.rust-lang.org/"
+
+if [[ ${PV} = *9999* ]]; then
+	inherit git-r3
+	# In case cargo is not in sync we'll fetch it as a submodule
+	# Nightly users will probably already have the repo cloned and up-to-date anyway.
+	EGIT_REPO_URI="https://github.com/rust-lang/rust.git"
+	EGIT_SUBMODULES=( "-*" "src/tools/cargo" )
+elif [[ ${PV} == *beta* ]]; then
+	# Identify the snapshot date of the beta release:
+	# curl -Ls static.rust-lang.org/dist/channel-rust-beta.toml | grep beta-src.tar.xz
+	MY_PV=beta
+	betaver=${PV//*beta}
+	BETA_SNAPSHOT="${betaver:0:4}-${betaver:4:2}-${betaver:6:2}"
+	SRC_URI="https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz -> rustc-${PV}-src.tar.xz
+		verify-sig? ( https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz.asc
+			-> rustc-${PV}-src.tar.xz.asc )
+	"
+	S="${WORKDIR}/rustc-${MY_PV}-src"
+else
+	MY_PV=${PV}
+	SRC_URI="https://static.rust-lang.org/dist/rustc-${PV}-src.tar.xz
+		verify-sig? ( https://static.rust-lang.org/dist/rustc-${PV}-src.tar.xz.asc )
+	"
+	S="${WORKDIR}/rustc-${MY_PV}-src"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+fi
+
+LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
+SLOT="0"
+
+# Legacy non-slotted versions bash completions will collide.
+RDEPEND="
+	!dev-lang/rust:stable
+	!dev-lang/rust-bin:stable
+"
+BDEPEND="verify-sig? ( sec-keys/openpgp-keys-rust )"
+
+src_unpack() {
+	if [[ ${PV} == *9999* ]]; then
+		git-r3_src_unpack
+	else
+		if use verify-sig ; then
+			verify-sig_verify_detached "${DISTDIR}"/rustc-${PV}-src.tar.xz "${DISTDIR}"/rustc-${PV}-src.tar.xz.asc
+		fi
+
+		# Avoid unpacking the whole tarball which would need check-reqs
+		tar -xf "${DISTDIR}"/rustc-${PV}-src.tar.xz \
+			"rustc-${MY_PV}-src/src/tools/cargo/src/etc/"{_cargo,cargo.bashcomp.sh} || die
+	fi
+}
+
+src_configure() {
+	:
+}
+
+src_compile() {
+	:
+}
+
+src_install() {
+	newbashcomp src/tools/cargo/src/etc/cargo.bashcomp.sh cargo
+	dozshcomp src/tools/cargo/src/etc/_cargo
+}

From 52da8bc1a5407c345dbc31eb574d41fcd1a7658b Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:08:59 +0000
Subject: [PATCH 029/122] dev-libs/cowsql: Sync with Gentoo

It's from Gentoo commit af554a15aa74198901714d65f09baaff1786f784.
---
 .../portage-stable/dev-libs/cowsql/cowsql-1.15.9.ebuild         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/cowsql/cowsql-1.15.9.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/cowsql/cowsql-1.15.9.ebuild
index 6c896c5972c..416284a6eb0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/cowsql/cowsql-1.15.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/cowsql/cowsql-1.15.9.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/cowsql/cowsql/archive/refs/tags/v${PV}.tar.gz -> ${P
 
 LICENSE="LGPL-3-with-linking-exception"
 SLOT="0"
-KEYWORDS="~amd64 ~arm64 ~x86"
+KEYWORDS="amd64 ~arm64 ~x86"
 IUSE="test"
 RESTRICT="!test? ( test )"
 

From 1051ad527af22701f1f7fc70aeccf772b1a8a51b Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:09:12 +0000
Subject: [PATCH 030/122] dev-libs/libffi: Sync with Gentoo

It's from Gentoo commit 8501c747e8a696b11b59ecb67f9ca615f2822838.
---
 .../portage-stable/dev-libs/libffi/Manifest   |  1 +
 .../dev-libs/libffi/libffi-3.5.2.ebuild       | 97 +++++++++++++++++++
 2 files changed, 98 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.5.2.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/Manifest
index 43e6da97445..5818fec3b70 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/Manifest
@@ -1,2 +1,3 @@
 DIST libffi-3.4.8.tar.gz 1397992 BLAKE2B 10b3d970dc598fb8689bca49751cda499ddc5216baf89d38625385b0d42d57f10d15cce3c4c044c9c73a4fce384c26f2a8e1b99269e9db1174c2631201c6bfd4 SHA512 05344c6c1a1a5b44704f6cf99277098d1ea3ac1dc11c2a691c501786a214f76184ec0637135588630db609ce79e49df3dbd00282dd61e7f21137afba70e24ffe
 DIST libffi-3.5.1.tar.gz 1419757 BLAKE2B eaeb04beeb4ab6e0ef5652175d5c9d29a18b6f1edbf05db819a3a6ac9c8ed47de32c54fca4c3a9a476283c0771650d5a577e7868f16c671ee46e25db27369066 SHA512 3da9e21fdb920e7962ceb01ee671ef36196df4d5dad62e0cdd8e87cc60e350f241c204350560ae26ea04cc898161b5585c8a5a5125bdbcc84508efbb7ea61eb8
+DIST libffi-3.5.2.tar.gz 1423124 BLAKE2B 35ce590926bcdd2556c30c94bb0fef3f0cfe8f32e809ffad00eb0bc7a8ba1ba40da844b108069c87e86bff278221cc42dc7c7aacd02a7b7bc408ea054085398c SHA512 76974a84e3aee6bbd646a6da2e641825ae0b791ca6efdc479b2d4cbcd3ad607df59cffcf5031ad5bd30822961a8c6de164ac8ae379d1804acd388b1975cdbf4d
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.5.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.5.2.ebuild
new file mode 100644
index 00000000000..441ddca3e01
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.5.2.ebuild
@@ -0,0 +1,97 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit dot-a multilib-minimal preserve-libs
+
+MY_PV=${PV/_rc/-rc}
+MY_P=${PN}-${MY_PV}
+
+DESCRIPTION="Portable, high level programming interface to various calling conventions"
+HOMEPAGE="https://sourceware.org/libffi/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/libffi/libffi"
+	inherit autotools git-r3
+else
+	inherit libtool
+	SRC_URI="https://github.com/libffi/libffi/releases/download/v${MY_PV}/${MY_P}.tar.gz"
+
+	if [[ ${PV} != *@(alpha|beta|pre|rc)* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+fi
+
+S="${WORKDIR}"/${MY_P}
+
+LICENSE="MIT"
+# This is a core package which is depended on by e.g. Python.
+# Please use preserve-libs.eclass in pkg_{pre,post}inst to cover users
+# with FEATURES="-preserved-libs" or another package manager if SONAME changes.
+SLOT="0/8" # SONAME=libffi.so.8
+IUSE="debug +exec-static-trampoline pax-kernel static-libs test"
+
+RESTRICT="!test? ( test )"
+BDEPEND="test? ( dev-util/dejagnu )"
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]] ; then
+		eautoreconf
+	else
+		elibtoolize
+	fi
+
+	if [[ ${CHOST} == arm64-*-darwin* ]] ; then
+		# ensure we use aarch64 asm, not x86 on arm64
+		sed -i -e 's/aarch64\*-\*-\*/arm64*-*-*|&/' \
+			configure configure.host || die
+	fi
+}
+
+src_configure() {
+	use static-libs && lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	# --includedir= path maintains a few properties:
+	# 1. have stable name across libffi versions: some packages like
+	#    dev-lang/ghc or kde-frameworks/networkmanager-qt embed
+	#    ${includedir} at build-time. Don't require those to be
+	#    rebuilt unless SONAME changes. bug #695788
+	#
+	#    We use /usr/.../${PN} (instead of former /usr/.../${P}).
+	#
+	# 2. have ${ABI}-specific location as ffi.h is target-dependent.
+	#
+	#    We use /usr/$(get_libdir)/... to have ABI identifier.
+	ECONF_SOURCE="${S}" econf \
+		--includedir="${EPREFIX}"/usr/$(get_libdir)/${PN}/include \
+		--disable-multi-os-directory \
+		--with-pic \
+		$(use_enable static-libs static) \
+		$(use_enable exec-static-trampoline exec-static-tramp) \
+		$(use_enable pax-kernel pax_emutramp) \
+		$(use_enable debug)
+}
+
+multilib_src_test() {
+	emake -Onone check
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -name "*.la" -delete || die
+	strip-lto-bytecode
+}
+
+pkg_preinst() {
+	preserve_old_lib /usr/$(get_libdir)/libffi.so.7
+}
+
+pkg_postinst() {
+	preserve_old_lib_notify /usr/$(get_libdir)/libffi.so.7
+}

From 674e63fba483efd7bf6bb811ea088a1503abcd8c Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:09:12 +0000
Subject: [PATCH 031/122] dev-libs/libgcrypt: Sync with Gentoo

It's from Gentoo commit 5ca60b0dc05e923f69bada62b342dfd5d708acca.
---
 .../dev-libs/libgcrypt/Manifest               |   4 +-
 .../libgcrypt/libgcrypt-1.11.1.ebuild         |   3 +
 .../libgcrypt/libgcrypt-1.11.2.ebuild         | 190 ++++++++++++++++++
 3 files changed, 196 insertions(+), 1 deletion(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.2.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/Manifest
index 2e4f0d3014f..b815865a75d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/Manifest
@@ -5,4 +5,6 @@ DIST libgcrypt-1.10.3.tar.bz2.sig 238 BLAKE2B 216baebca91b2e940f60d70a4260b6b6b8
 DIST libgcrypt-1.11.0.tar.bz2 4180345 BLAKE2B fe3f42480c0b9a0c50c24f4c54197404b4e1056d8baa9c0c07c671c9c05b90777580b4cbcde931b50ecb4dd93f5ddad89cea99aa36a35f86f796a003e3816f7d SHA512 8e093e69e3c45d30838625ca008e995556f0d5b272de1c003d44ef94633bcc0d0ef5d95e8725eb531bfafb4490ac273488633e0c801200d4666194f86c3e270e
 DIST libgcrypt-1.11.0.tar.bz2.sig 119 BLAKE2B e64d59dae5556e2826f6d297988a3300c36d05aeecfe19544c5092b5f7b777b9b3f37c5ddcfcba5a916ae237cf981efdd9e3bdec482f7c36b12ac5c70f9d4c52 SHA512 8c5ceb50d70ccdedcc1ff4b31a65a07198567b85f582e3e67699cc3e5d012bebf7b1d4903652d11905a9cd845976ad7d3642474804777d0bdc46c6847d92fe38
 DIST libgcrypt-1.11.1.tar.bz2 4233557 BLAKE2B 6416c6a782665e8a8d1c7993d94e620c586cfb65f273bde3d609bd7ca729a92d7ac3e156dabea42c34dbe50af7ce9b16333f63115f968aebb2b4a6dd37d4b99c SHA512 85846d62ce785e4250a2bf8a2b13ec24837e48ab8e10d537ad4a18d650d2cca747f82fd1501feab47ad3114b9593b36c9fa7a892f48139e2a71ef61295a47678
-DIST libgcrypt-1.11.1.tar.bz2.sig 119 BLAKE2B b8d5bca5b903b34f48694a49e6da2c1ce449b0b28a71b9a0a6ce156e413cd19510ae7bc051bbc194bb17eec07501ee58538b45baf89918803077645f22c2244c SHA512 a9b9e2466f32623f417574537656f776baf9a933fba96fd969dda26b6bf13864ee5765112654b269f79a7f20a4a0712cf8cec7be759966088045bca040e01edc
+DIST libgcrypt-1.11.1.tar.bz2.sig 238 BLAKE2B fb625c167b6939eaf795858cbbb3b09787c92b53f94a328611e7dc3c565d623ecf0ccbaddc656cb98f617723147978184c8a7a1dd072fa6477eb06a6a873518c SHA512 832119acbc094346b5648520ac6991a90a944db80886c31001f49bc17c77bf1e2c26dc99180c25c0ef4de010b159fc7b7576b8d80fba284acebc6da1706067db
+DIST libgcrypt-1.11.2.tar.bz2 4237802 BLAKE2B 8ad2dd84e8ec2bddb5c008c6823a6d72b8f2d6237972966bc590be0d89bb6b50a5cbba1b42631d0950c4bea125a6d9a845fbf703b756a38088f66054712efa9c SHA512 b706cea602cc8f0896e57ce979643bf78974b05faec27c1b053b773c57d8b04250e30e95a4ef5899e1df981d01d8d08f0a36e10b5820a5ec4183e74c02e5f1f0
+DIST libgcrypt-1.11.2.tar.bz2.sig 147 BLAKE2B 5126fa06a9a67b2b71711f76ecbf9f3596f300f97256378961768a2f3c3927321da649eb0df4ddfb653e4503712b8b3c363c252bcb83ca53c7eea89a3ac8d4d4 SHA512 73b1d6d53e2f9061f06628a0fe983919f745c1c92930fd6a9871a0a3a589878efe68ec48b4e17e3fd3c1e098bc38c38cc8895246cee25463377a8bfa8590b164
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.1.ebuild
index 006aad0fc98..fb7359c76eb 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.1.ebuild
@@ -101,6 +101,9 @@ src_configure() {
 	# least solve it the ebuild see https://bugs.gentoo.org/959349
 	use x86 && filter-flags -mfpmath=sse
 
+	# Temporary workaround for build failures with gcc-15, see bug 951267
+	append-cflags -std=gnu17
+
 	# Hardcodes the path to FGREP in libgcrypt-config
 	export ac_cv_path_SED="sed"
 	export ac_cv_path_EGREP="grep -E"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.2.ebuild
new file mode 100644
index 00000000000..c25e8ab2f46
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.2.ebuild
@@ -0,0 +1,190 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
+inherit autotools flag-o-matic linux-info multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="General purpose crypto library based on the code used in GnuPG"
+HOMEPAGE="https://www.gnupg.org/"
+SRC_URI="mirror://gnupg/${PN}/${P}.tar.bz2"
+SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
+
+LICENSE="LGPL-2.1+ GPL-2+ MIT"
+SLOT="0/20" # subslot = soname major version
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="+asm doc +getentropy static-libs"
+IUSE+=" cpu_flags_arm_neon cpu_flags_arm_aes cpu_flags_arm_sha1 cpu_flags_arm_sha2 cpu_flags_arm_sve"
+IUSE+=" cpu_flags_ppc_altivec cpu_flags_ppc_vsx2 cpu_flags_ppc_vsx3"
+IUSE+=" cpu_flags_x86_aes cpu_flags_x86_avx cpu_flags_x86_avx2 cpu_flags_x86_avx512f cpu_flags_x86_padlock cpu_flags_x86_sha cpu_flags_x86_sse4_1"
+
+# Build system only has --disable-arm-crypto-support right now
+# If changing this, update src_configure logic too.
+# ARM CPUs seem to, right now, support all-or-nothing for crypto extensions,
+# but this looks like it might change in future. This is just a safety check
+# in case people somehow do have a CPU which only supports some. They must
+# for now disable them all if that's the case.
+REQUIRED_USE="
+	cpu_flags_arm_aes? ( cpu_flags_arm_sha1 cpu_flags_arm_sha2 )
+	cpu_flags_arm_sha1? ( cpu_flags_arm_aes cpu_flags_arm_sha2 )
+	cpu_flags_arm_sha2? ( cpu_flags_arm_aes cpu_flags_arm_sha1 )
+	cpu_flags_ppc_vsx3? ( cpu_flags_ppc_altivec cpu_flags_ppc_vsx2 )
+	cpu_flags_ppc_vsx2? ( cpu_flags_ppc_altivec )
+"
+
+RDEPEND="
+	>=dev-libs/libgpg-error-1.49[${MULTILIB_USEDEP}]
+	getentropy? (
+		kernel_linux? (
+			elibc_glibc? ( >=sys-libs/glibc-2.25 )
+			elibc_musl? ( >=sys-libs/musl-1.1.20 )
+		)
+	)
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	doc? ( virtual/texi2dvi )
+	verify-sig? ( sec-keys/openpgp-keys-gnupg )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-multilib-syspath.patch
+	"${FILESDIR}"/${PN}-powerpc-darwin.patch
+)
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/libgcrypt-config
+)
+
+pkg_pretend() {
+	if [[ ${MERGE_TYPE} == buildonly ]]; then
+		return
+	fi
+	if use kernel_linux && use getentropy; then
+		unset KV_FULL
+		get_running_version
+		if [[ -n ${KV_FULL} ]] && kernel_is -lt 3 17; then
+			eerror "The getentropy function requires the getrandom syscall."
+			eerror "This was introduced in Linux 3.17."
+			eerror "Your system is currently running Linux ${KV_FULL}."
+			eerror "Disable the 'getentropy' USE flag or upgrade your kernel."
+			die "Kernel is too old for getentropy"
+		fi
+	fi
+}
+
+pkg_setup() {
+	:
+}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	# Sensitive to optimisation; parts of the codebase are built with
+	# -O0 already. Don't risk it with UB.
+	strip-flags
+
+	# Temporary workaround for a build failure (known gcc issue):
+	#
+	#  * https://bugs.gentoo.org/956605
+	#  * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110812
+	#
+	use riscv && filter-lto
+
+	# Temporary workaround for mfpmath=sse on x86 causing issues when -msse is
+	# stripped as it's not clear cut on how to handle in flag-o-matic we can at
+	# least solve it the ebuild see https://bugs.gentoo.org/959349
+	use x86 && filter-flags -mfpmath=sse
+
+	# Hardcodes the path to FGREP in libgcrypt-config
+	export ac_cv_path_SED="sed"
+	export ac_cv_path_EGREP="grep -E"
+	export ac_cv_path_EGREP_TRADITIONAL="grep -E"
+	export ac_cv_path_FGREP="grep -F"
+	export ac_cv_path_GREP="grep"
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	if [[ ${CHOST} == powerpc* ]] ; then
+		# ./configure does a lot of automagic, prevent that
+		# generic ppc32+ppc64 altivec
+		use cpu_flags_ppc_altivec || local -x gcry_cv_cc_ppc_altivec=no
+		use cpu_flags_ppc_altivec || local -x gcry_cv_cc_ppc_altivec_cflags=no
+		# power8 vector extension, aka arch 2.07 ISA, also checked below via ppc-crypto-support
+		use cpu_flags_ppc_vsx2 || local -x gcry_cv_gcc_inline_asm_ppc_altivec=no
+		# power9 vector extension, aka arch 3.00 ISA
+		use cpu_flags_ppc_vsx3 || local -x gcry_cv_gcc_inline_asm_ppc_arch_3_00=no
+	fi
+
+	append-ldflags $(test-flags-CCLD -Wl,--undefined-version)
+
+	local myeconfargs=(
+		CC_FOR_BUILD="$(tc-getBUILD_CC)"
+
+		--enable-noexecstack
+		$(use_enable cpu_flags_arm_neon neon-support)
+		# See REQUIRED_USE comment above
+		$(use_enable cpu_flags_arm_aes arm-crypto-support)
+		$(use_enable cpu_flags_arm_sve sve-support)
+		$(use_enable cpu_flags_ppc_vsx2 ppc-crypto-support)
+		$(use_enable cpu_flags_x86_aes aesni-support)
+		$(use_enable cpu_flags_x86_avx avx-support)
+		$(use_enable cpu_flags_x86_avx2 avx2-support)
+		$(use_enable cpu_flags_x86_avx512f avx512-support)
+		$(use_enable cpu_flags_x86_padlock padlock-support)
+		$(use_enable cpu_flags_x86_sha shaext-support)
+		$(use_enable cpu_flags_x86_sse4_1 sse41-support)
+		# required for sys-power/suspend[crypt], bug 751568
+		$(use_enable static-libs static)
+
+		# disabled due to various applications requiring privileges
+		# after libgcrypt drops them (bug #468616)
+		--without-capabilities
+
+		$(use asm || echo "--disable-asm")
+
+		GPG_ERROR_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpg-error-config"
+	)
+
+	if use kernel_linux; then
+		# --enable-random=getentropy requires getentropy/getrandom.
+		# --enable-random=linux enables legacy code that tries getrandom
+		# and falls back to reading /dev/random.
+		myeconfargs+=( --enable-random=$(usex getentropy getentropy linux) )
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}" \
+		$("${S}/configure" --help | grep -o -- '--without-.*-prefix')
+}
+
+multilib_src_compile() {
+	default
+	multilib_is_native_abi && use doc && VARTEXFONTS="${T}/fonts" emake -C doc gcrypt.pdf
+}
+
+multilib_src_test() {
+	# t-secmem and t-sexp need mlock which requires extra privileges; nspawn
+	# at least disallows that by default.
+	local -x GCRYPT_IN_ASAN_TEST=1
+	# Avoid running (very) expensive bench-slope test. On hppa, it
+	# takes at least 7 hours.
+	local -x GCRYPT_NO_BENCHMARKS=1
+
+	default
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+	multilib_is_native_abi && use doc && dodoc doc/gcrypt.pdf
+}
+
+multilib_src_install_all() {
+	default
+	find "${ED}" -type f -name '*.la' -delete || die
+}

From af1f00dc0e9dade3059468c3e2cce489f6c84963 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:09:15 +0000
Subject: [PATCH 032/122] dev-libs/libmspack: Sync with Gentoo

It's from Gentoo commit 9f9c3142541c81babbebf46baa679beacf0a883b.
---
 .../portage-stable/dev-libs/libmspack/metadata.xml           | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/metadata.xml
index 98cc0646bef..af8569780d4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/metadata.xml
@@ -1,10 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
 <pkgmetadata>
-	<maintainer type="person">
-		<email>reavertm@gentoo.org</email>
-		<name>Maciej Mrozowski</name>
-	</maintainer>
+	<!-- maintainer-needed -->
 	<upstream>
 		<remote-id type="github">kyz/libmspack</remote-id>
 	</upstream>

From 1c9a31ff10b99fc498fbdb40cf506c15bf0cfaaa Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:09:29 +0000
Subject: [PATCH 033/122] dev-libs/nettle: Sync with Gentoo

It's from Gentoo commit 218e02ad6b87620e430271f5401983dacf0019f1.
---
 .../portage-stable/dev-libs/nettle/nettle-3.10.2.ebuild         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/nettle/nettle-3.10.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/nettle/nettle-3.10.2.ebuild
index 9cc1bab040f..6a2054e35db 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/nettle/nettle-3.10.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/nettle/nettle-3.10.2.ebuild
@@ -14,7 +14,7 @@ SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.gz.sig )"
 LICENSE="|| ( GPL-2+ LGPL-3+ )"
 # Subslot = libnettle - libhogweed soname version
 SLOT="0/8-6"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="+asm doc +gmp static-libs cpu_flags_arm_neon cpu_flags_arm_aes cpu_flags_arm_sha1 cpu_flags_arm_sha2 cpu_flags_ppc_altivec cpu_flags_ppc_vsx2 cpu_flags_ppc_vsx3 cpu_flags_x86_aes cpu_flags_x86_sha cpu_flags_x86_pclmul"
 # The arm64 crypto option controls AES, SHA1, and SHA2 usage.
 REQUIRED_USE="

From 2d66a0c940c4c9a3efbacbf214e8d91e5b81373b Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:09:31 +0000
Subject: [PATCH 034/122] dev-libs/nspr: Sync with Gentoo

It's from Gentoo commit 93a67791b86c8a0cf0d9f2ba3b52020d90fabafd.
---
 .../third_party/portage-stable/dev-libs/nspr/nspr-4.37.ebuild   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/nspr/nspr-4.37.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/nspr/nspr-4.37.ebuild
index e631f62365a..3e59b7269b1 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/nspr/nspr-4.37.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/nspr/nspr-4.37.ebuild
@@ -13,7 +13,7 @@ SRC_URI="https://archive.mozilla.org/pub/nspr/releases/v${PV}/src/${P}.tar.gz"
 
 LICENSE="|| ( MPL-2.0 GPL-2 LGPL-2.1 )"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
 IUSE="debug"
 
 MULTILIB_CHOST_TOOLS=(

From 9c0548521c35210b5e93c4ae7fa473e3233b755a Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:09:32 +0000
Subject: [PATCH 035/122] dev-libs/openssl: Sync with Gentoo

It's from Gentoo commit b4be86fc84851f68b17d373422d22305aa0a053b.
---
 .../portage-stable/dev-libs/openssl/Manifest  |   2 +
 .../dev-libs/openssl/openssl-3.0.16.ebuild    |   3 +-
 .../dev-libs/openssl/openssl-3.0.17.ebuild    |   3 +-
 .../dev-libs/openssl/openssl-3.0.9999.ebuild  |   3 +-
 .../dev-libs/openssl/openssl-3.1.8.ebuild     |   3 +-
 .../dev-libs/openssl/openssl-3.1.9999.ebuild  |   3 +-
 .../dev-libs/openssl/openssl-3.2.4.ebuild     |   3 +-
 .../dev-libs/openssl/openssl-3.2.5.ebuild     |   3 +-
 .../dev-libs/openssl/openssl-3.2.9999.ebuild  |   3 +-
 .../dev-libs/openssl/openssl-3.3.3.ebuild     |   3 +-
 .../dev-libs/openssl/openssl-3.3.4.ebuild     |   3 +-
 .../dev-libs/openssl/openssl-3.3.9999.ebuild  |   3 +-
 .../dev-libs/openssl/openssl-3.4.1.ebuild     |   3 +-
 .../dev-libs/openssl/openssl-3.4.2.ebuild     |   3 +-
 .../dev-libs/openssl/openssl-3.4.9999.ebuild  |   3 +-
 .../dev-libs/openssl/openssl-3.5.0.ebuild     |   3 +-
 .../dev-libs/openssl/openssl-3.5.1.ebuild     |   3 +-
 .../dev-libs/openssl/openssl-3.5.2.ebuild     | 294 ++++++++++++++++++
 .../dev-libs/openssl/openssl-3.5.9999.ebuild  |   3 +-
 19 files changed, 330 insertions(+), 17 deletions(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.2.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/Manifest
index beb2c8497ab..7bfceb9d377 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/Manifest
@@ -25,3 +25,5 @@ DIST openssl-3.5.0.tar.gz 53136912 BLAKE2B 9bf55ad242863123ec117296ff4d3067a27da
 DIST openssl-3.5.0.tar.gz.asc 833 BLAKE2B 3c92d7f08ae64b175140215be633e72b80fb49de0ef3485ab0738999fa339b40ca09bdc3ae9fb4b0738ae7182b3d5821cb4d04811796775e6648621fcfc8941b SHA512 6a73755c34f4caabf531d2b4335bf1c800548b41c6e6436ed4bf3ab25cf7c01f1a0594d641deac7e1aa66c3beed00091265d49c2711dadaacd8bba1ce2075d02
 DIST openssl-3.5.1.tar.gz 53158817 BLAKE2B 172db56ac41cee78bcb5d2223c33d78baf3326d8d466115f39be414384d265ad4541e00096d3f53435f9f89119882ae587b20b1ac05dc2ace46a0d43d7cc6996 SHA512 0fa152ae59ab5ea066319de039dfb1d24cbb247172d7512feb5dd920db3740f219d76b0195ea562f84fe5eae36c23772302eddfbb3509df13761452b4dafb9d3
 DIST openssl-3.5.1.tar.gz.asc 833 BLAKE2B 4d0ecaaf72ccf0c28f050b9c451bc44c142670caed7188fdaa3275391c0c5b41e3265ad8ea3bf29b4fcc6d38214c48c7964b95991d38b4a1d07aca3ce566360c SHA512 1682a767380ce375ae7d1f31363c68ce8af9e4575361265893c49a12a7cb720b2528d2c8229c472feadd8369b447991bf04fa066b88960e173ad7d6d76f3c644
+DIST openssl-3.5.2.tar.gz 53180161 BLAKE2B fd6179457b85d7a2ae87ee432de4d9e0d5b5dba30b6b57d0f289a0d034c6d7de7c7166b1f69f00d822105c5119bfa44fd52bf5b9035a14aae21015ad3fe2d224 SHA512 db2c7a88bea432f96d867a98af15f850f371d4136c657338de93cb88a39a3578c025b5df7310e195a02fc715ad5a2422a319a44f0247c6a7e2ba8b36aad77651
+DIST openssl-3.5.2.tar.gz.asc 833 BLAKE2B f22883c76bc636f6d5916913486ef0873da91b0e29dd24569def0409e8573ebe23f28b9e3b3ed6120fb85afaa3181470b8fc83959b40389d8b1cd2dc4852f404 SHA512 2be00d03e5b246833f8e47f59bd7ca3dbaec519f2160fd9dfed3a7b2c65b9977703811c06662c17b301e456bbfc73477c76e3b444329741e99e2576005900580
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.16.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.16.ebuild
index 5af9adcda85..978763db405 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.16.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.16.ebuild
@@ -268,7 +268,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.17.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.17.ebuild
index 6d7eefcece5..c183d21b68d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.17.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.17.ebuild
@@ -268,7 +268,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.9999.ebuild
index 6d7eefcece5..c183d21b68d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.9999.ebuild
@@ -268,7 +268,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.1.8.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.1.8.ebuild
index 417b482e59d..e1103cfa929 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.1.8.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.1.8.ebuild
@@ -269,7 +269,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.1.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.1.9999.ebuild
index 56f9601dd58..1ae5a138a77 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.1.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.1.9999.ebuild
@@ -269,7 +269,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.4.ebuild
index fe3dcd069ee..63b9b878fe3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.4.ebuild
@@ -276,7 +276,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.5.ebuild
index 7cdb49b1373..270945bf5ed 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.5.ebuild
@@ -276,7 +276,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.9999.ebuild
index 162a9453a62..1e01d73e617 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.9999.ebuild
@@ -275,7 +275,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.3.ebuild
index bbe688813d5..c91a29912aa 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.3.ebuild
@@ -277,7 +277,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.4.ebuild
index 0cd678123ea..5ce8a7074aa 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.4.ebuild
@@ -277,7 +277,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.9999.ebuild
index 41de3131f21..f492950eefa 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.9999.ebuild
@@ -273,7 +273,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.1.ebuild
index 99f230c3fbd..7d052d23daf 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.1.ebuild
@@ -273,7 +273,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.2.ebuild
index 41de3131f21..f492950eefa 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.2.ebuild
@@ -273,7 +273,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.9999.ebuild
index 41de3131f21..f492950eefa 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.9999.ebuild
@@ -273,7 +273,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.0.ebuild
index a7df1d73c9c..ab2f92680e2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.0.ebuild
@@ -273,7 +273,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		einfo "Running openssl fipsinstall"
-		sysroot_run_prefixed "${ED}/usr/bin/openssl" fipsinstall \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			sysroot_run_prefixed "${ED}/usr/bin/openssl" fipsinstall \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so" \
 			|| die "fipsinstall failed"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.1.ebuild
index a7df1d73c9c..ab2f92680e2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.1.ebuild
@@ -273,7 +273,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		einfo "Running openssl fipsinstall"
-		sysroot_run_prefixed "${ED}/usr/bin/openssl" fipsinstall \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			sysroot_run_prefixed "${ED}/usr/bin/openssl" fipsinstall \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so" \
 			|| die "fipsinstall failed"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.2.ebuild
new file mode 100644
index 00000000000..ab2f92680e2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.2.ebuild
@@ -0,0 +1,294 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
+inherit edo flag-o-matic linux-info sysroot toolchain-funcs
+inherit multilib multilib-minimal multiprocessing preserve-libs
+
+DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
+HOMEPAGE="https://openssl-library.org/"
+
+MY_P=${P/_/-}
+
+if [[ ${PV} == *9999 ]] ; then
+	[[ ${PV} == *.*.9999 ]] && EGIT_BRANCH="openssl-${PV%%.9999}"
+	EGIT_REPO_URI="https://github.com/openssl/openssl.git"
+
+	inherit git-r3
+else
+	inherit verify-sig
+	SRC_URI="
+		https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz
+		verify-sig? (
+			https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz.asc
+		)
+	"
+
+	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+
+	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
+fi
+
+S="${WORKDIR}"/${MY_P}
+
+LICENSE="Apache-2.0"
+SLOT="0/$(ver_cut 1)" # .so version of libssl/libcrypto
+IUSE="+asm cpu_flags_x86_sse2 fips ktls +quic rfc3779 sctp static-libs test tls-compression vanilla weak-ssl-ciphers"
+RESTRICT="!test? ( test )"
+
+COMMON_DEPEND="
+	!<net-misc/openssh-9.2_p1-r3
+	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
+"
+BDEPEND+="
+	>=dev-lang/perl-5
+	sctp? ( >=net-misc/lksctp-tools-1.0.12 )
+	test? (
+		sys-apps/diffutils
+		app-alternatives/bc
+		sys-process/procps
+	)
+"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}"
+PDEPEND="app-misc/ca-certificates"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/openssl/configuration.h
+)
+
+pkg_setup() {
+	if use ktls ; then
+		if kernel_is -lt 4 18 ; then
+			ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!"
+		else
+			CONFIG_CHECK="~TLS ~TLS_DEVICE"
+			ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!"
+			ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!"
+			use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER"
+
+			linux-info_pkg_setup
+		fi
+	fi
+
+	[[ ${MERGE_TYPE} == binary ]] && return
+
+	# must check in pkg_setup; sysctl doesn't work with userpriv!
+	if use test && use sctp ; then
+		# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
+		# if sctp.auth_enable is not enabled.
+		local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
+		if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
+			die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Make sure we only ever touch Makefile.org and avoid patching a file
+	# that gets blown away anyways by the Configure script in src_configure
+	rm -f Makefile || die
+
+	if ! use vanilla ; then
+		PATCHES+=(
+			# Add patches which are Gentoo-specific customisations here
+		)
+	fi
+
+	default
+
+	if use test && use sctp && has network-sandbox ${FEATURES} ; then
+		einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
+		rm test/recipes/80-test_ssl_new.t || die
+	fi
+
+	# Test fails depending on kernel configuration, bug #699134
+	rm test/recipes/30-test_afalg.t || die
+}
+
+src_configure() {
+	# Keep this in sync with app-misc/c_rehash
+	SSL_CNF_DIR="/etc/ssl"
+
+	# Quiet out unknown driver argument warnings since openssl
+	# doesn't have well-split CFLAGS and we're making it even worse
+	# and 'make depend' uses -Werror for added fun (bug #417795 again)
+	tc-is-clang && append-flags -Qunused-arguments
+
+	# We really, really need to build OpenSSL w/ strict aliasing disabled.
+	# It's filled with violations and it *will* result in miscompiled
+	# code. This has been in the ebuild for > 10 years but even in 2022,
+	# it's still relevant:
+	# - https://github.com/llvm/llvm-project/issues/55255
+	# - https://github.com/openssl/openssl/issues/12247
+	# - https://github.com/openssl/openssl/issues/18225
+	# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
+	# Don't remove the no strict aliasing bits below!
+	filter-flags -fstrict-aliasing
+	append-flags -fno-strict-aliasing
+	# The OpenSSL developers don't test with LTO right now, it leads to various
+	# warnings/errors (which may or may not be false positives), it's considered
+	# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
+	filter-lto
+
+	append-flags $(test-flags-CC -Wa,--noexecstack)
+
+	# bug #895308 -- check inserts GNU ld-compatible arguments
+	[[ ${CHOST} == *-darwin* ]] || append-atomic-flags
+	# Configure doesn't respect LIBS
+	export LDLIBS="${LIBS}"
+
+	# bug #197996
+	unset APPS
+	# bug #312551
+	unset SCRIPTS
+	# bug #311473
+	unset CROSS_COMPILE
+
+	tc-export AR CC CXX RANLIB RC
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
+
+	local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
+
+	# See if our toolchain supports __uint128_t.  If so, it's 64bit
+	# friendly and can use the nicely optimized code paths, bug #460790.
+	#local ec_nistp_64_gcc_128
+	#
+	# Disable it for now though (bug #469976)
+	# Do NOT re-enable without substantial discussion first!
+	#
+	#echo "__uint128_t i;" > "${T}"/128.c
+	#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
+	#       ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
+	#fi
+
+	local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
+	einfo "Using configuration: ${sslout:-(openssl knows best)}"
+
+	# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
+	local myeconfargs=(
+		${sslout}
+
+		$(multilib_is_native_abi || echo "no-docs")
+		$(use cpu_flags_x86_sse2 || echo "no-sse2")
+		enable-camellia
+		enable-ec
+		enable-ec2m
+		enable-sm2
+		enable-srp
+		$(use elibc_musl && echo "no-async")
+		enable-idea
+		enable-mdc2
+		enable-rc5
+		$(use fips && echo "enable-fips")
+		$(use quic && echo "enable-quic")
+		$(use_ssl asm)
+		$(use_ssl ktls)
+		$(use_ssl rfc3779)
+		$(use_ssl sctp)
+		$(use test || echo "no-tests")
+		$(use_ssl tls-compression zlib)
+		$(use_ssl weak-ssl-ciphers)
+
+		--prefix="${EPREFIX}"/usr
+		--openssldir="${EPREFIX}"${SSL_CNF_DIR}
+		--libdir=$(get_libdir)
+
+		shared
+		threads
+	)
+
+	edo perl "${S}/Configure" "${myeconfargs[@]}"
+}
+
+multilib_src_compile() {
+	emake build_sw
+}
+
+multilib_src_test() {
+	# See https://github.com/openssl/openssl/blob/master/test/README.md for options.
+	#
+	# VFP = show subtests verbosely and show failed tests verbosely
+	# Normal V=1 would show everything verbosely but this slows things down.
+	#
+	# -j1 here for https://github.com/openssl/openssl/issues/21999, but it
+	# shouldn't matter as tests were already built earlier, and HARNESS_JOBS
+	# controls running the tests.
+	emake -Onone -j1 HARNESS_JOBS="$(makeopts_jobs)" VFP=1 test
+}
+
+multilib_src_install() {
+	# Only -j1 is supported for the install targets:
+	# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
+	emake DESTDIR="${D}" -j1 install_sw
+	if use fips; then
+		emake DESTDIR="${D}" -j1 install_fips
+		# Regen this in pkg_preinst, bug 900625
+		rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
+	fi
+
+	if multilib_is_native_abi; then
+		emake DESTDIR="${D}" -j1 install_ssldirs
+		emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
+	fi
+
+	# This is crappy in that the static archives are still built even
+	# when USE=static-libs. But this is due to a failing in the openssl
+	# build system: the static archives are built as PIC all the time.
+	# Only way around this would be to manually configure+compile openssl
+	# twice; once with shared lib support enabled and once without.
+	if ! use static-libs ; then
+		rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
+	fi
+}
+
+multilib_src_install_all() {
+	# openssl installs perl version of c_rehash by default, but
+	# we provide a shell version via app-misc/c_rehash
+	rm "${ED}"/usr/bin/c_rehash || die
+
+	dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
+
+	# Create the certs directory
+	keepdir ${SSL_CNF_DIR}/certs
+
+	# bug #254521
+	dodir /etc/sandbox.d
+	echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
+
+	diropts -m0700
+	keepdir ${SSL_CNF_DIR}/private
+}
+
+pkg_preinst() {
+	if use fips; then
+		# Regen fipsmodule.cnf, bug 900625
+		einfo "Running openssl fipsinstall"
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			sysroot_run_prefixed "${ED}/usr/bin/openssl" fipsinstall \
+			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
+			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so" \
+			|| die "fipsinstall failed"
+	fi
+
+	preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
+
+pkg_postinst() {
+	ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
+	openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
+	eend $?
+
+	preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.9999.ebuild
index a7df1d73c9c..ab2f92680e2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.9999.ebuild
@@ -273,7 +273,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		einfo "Running openssl fipsinstall"
-		sysroot_run_prefixed "${ED}/usr/bin/openssl" fipsinstall \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			sysroot_run_prefixed "${ED}/usr/bin/openssl" fipsinstall \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so" \
 			|| die "fipsinstall failed"

From 38325cf82fd69d2881776d7ed529f01df52e8487 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:09:37 +0000
Subject: [PATCH 036/122] dev-libs/tree-sitter: Sync with Gentoo

It's from Gentoo commit e3ab14821d12e3e9477ffe830c3fb18c3209eeeb.
---
 .../dev-libs/tree-sitter/Manifest             |  3 +-
 .../tree-sitter/tree-sitter-0.25.2.ebuild     | 50 -------------------
 .../tree-sitter/tree-sitter-0.25.6.ebuild     |  2 +-
 ....25.1.ebuild => tree-sitter-0.25.8.ebuild} |  0
 4 files changed, 2 insertions(+), 53 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.2.ebuild
 rename sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/{tree-sitter-0.25.1.ebuild => tree-sitter-0.25.8.ebuild} (100%)

diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/Manifest
index 287d94a46e0..679072f48dd 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/Manifest
@@ -1,6 +1,5 @@
 DIST tree-sitter-0.23.0.tar.gz 2977346 BLAKE2B e10846d5bd0a6aa1ecac362e2ab2ccf0f0bdb17c5fde796d8d65f8bc84a6e054d86c18a42e66e8effef865f95013c38ff6bd6ab5498a680ae172d7d57020604e SHA512 ab821be564ac7223cc4f9659c08922a78016af9dd3bd69166706fb6a889ac175ba2712a337a1303aceb8f44beaf58640a183e77dddc2c57e35da23079d0cd7b9
 DIST tree-sitter-0.24.3.tar.gz 3018668 BLAKE2B fa703b6250e11274d0c5ebccb741cc41f521cc5e882383d8f891369540ce6b3b4b048eddb4d0c88186e57516e2d01977e76b42352f26759b3f6093a339cc6a11 SHA512 2d934c03b0ee71419654d03bf6e4ca759b4ef3217b8837fcaef64ee5b4bc8ea8298ff685ae4aaa477b615d11d538ff960b92529b11f13e936b85bad52e369cd3
-DIST tree-sitter-0.25.1.tar.gz 855493 BLAKE2B 6b9e4bf454c50e9b7341aa94d5131d333f45a0a047090ca04da71bfc54357568d0c098c6f7df65ee9d20ede7050537342fc394e281f4070f2d021a7e4134cedf SHA512 9861b18c7209e3c37d180a399bcae181cea46c4e58eff743ff6044ed0f2923ee838fa88993f1266272e07163748d5df1bef7d7dc6d8800e004e8af1227e489af
-DIST tree-sitter-0.25.2.tar.gz 855826 BLAKE2B 5c2cdaeba229c58d40f5d9b2c4af920d4e1d9fd60ce1d49e632cd660d441d3c32632864b1e226e4c99b4e8f054bfc0082a80c2eb1cdca0684f899b913378a17d SHA512 8acdb410c8b5c2552e9dd5524d80ab1d529e418f408d7c495619e6781f3b70ea2d61b6f69b5b3d1ebd753b739c0f9dd744302808d9a3051b5c7dcf68dba30002
 DIST tree-sitter-0.25.3.tar.gz 856455 BLAKE2B 4527d13ea702dced09d9227ad9f6a18484e8517c5da1840c22c5e69686084dbc46de0c07e7e06980e6dde4cf07791fe88fba10f90684a2ef29b58f84b59a2176 SHA512 a626dcea5378774511aa1ef669e4dbada3079440b596882172a676c61e53aa6f701b537e3575851af9e10b1e264da25a9f6487b01f43a896cf1a22d58ca7e623
 DIST tree-sitter-0.25.6.tar.gz 857070 BLAKE2B 3bb6b6130e1a96c96b5af4608bf60f8bbd00cbf1fdc9905b7a6169db52351c2ae3a907eca444363ab2b3185a54d0080aa487cbe252e6e015c1cd7a735e420679 SHA512 47213b68233d376e145e3f42b4674d64e7ff27436f4a028e751d9ad8494469ff67b002ce184346d3f6848df2c91386c28127827c43a8bea34da5e84f2530f02f
+DIST tree-sitter-0.25.8.tar.gz 857462 BLAKE2B aa3f0d9056544bb6ef1127723563449c7672e06b5289e1596f2c1b5826905c578830c7e6c3bc58a91e388d647a5a5629e71f5f0af2a431e73c3be4f93ce5b6f4 SHA512 0d26d0699f61fa27b5adbc298ff53f8e0f5b9f2f1b216744200f6f50cff777c9c5a5a5b92304a4d1889fccd9d8a6dd6b7d4947bac907a91850322281f754ea53
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.2.ebuild
deleted file mode 100644
index 7121e61d879..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.2.ebuild
+++ /dev/null
@@ -1,50 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-inherit optfeature toolchain-funcs
-
-DESCRIPTION="Tree-sitter is a parser generator tool and an incremental parsing library"
-HOMEPAGE="https://github.com/tree-sitter/tree-sitter"
-
-if [[ ${PV} == *9999* ]]; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/${PN}/${PN}"
-else
-	SRC_URI="https://github.com/${PN}/${PN}/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
-fi
-
-LICENSE="MIT"
-# ABI is not stable. Revisit after tree-sitter-1.0.
-# https://bugs.gentoo.org/930039
-# https://github.com/tree-sitter/tree-sitter/pull/3302
-SLOT="0/${PV}"
-RESTRICT="test" # tests are for CLI and not the lib
-
-PATCHES=(
-	"${FILESDIR}/${PN}-0.22.2-no-static.patch"
-)
-
-src_prepare() {
-	default
-	tc-export CC
-}
-
-src_compile() {
-	emake \
-		PREFIX="${EPREFIX}/usr" \
-		LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
-		STRIP="" # bug 930020
-}
-
-src_install() {
-	emake DESTDIR="${D}" \
-		  PREFIX="${EPREFIX}/usr" \
-		  LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
-		  install
-}
-
-pkg_postinst() {
-	optfeature "building and testing grammars" dev-util/tree-sitter-cli
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.6.ebuild
index 7121e61d879..20863acffab 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.6.ebuild
@@ -12,7 +12,7 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://github.com/${PN}/${PN}"
 else
 	SRC_URI="https://github.com/${PN}/${PN}/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-macos"
 fi
 
 LICENSE="MIT"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.8.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.8.ebuild

From 3109916cb36776e7496cf6eee79b0ec65f81a9dd Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:09:44 +0000
Subject: [PATCH 037/122] dev-python/cffi: Sync with Gentoo

It's from Gentoo commit d1512d55b4b0a454045c6af4bb5df6bb72e0fb1c.
---
 .../portage-stable/dev-python/cffi/Manifest   |  1 +
 .../dev-python/cffi/cffi-2.0.0_beta1.ebuild   | 70 +++++++++++++++++++
 2 files changed, 71 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/cffi/cffi-2.0.0_beta1.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cffi/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/cffi/Manifest
index 39184736f5e..39fa548c09d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cffi/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cffi/Manifest
@@ -1 +1,2 @@
 DIST cffi-1.17.1.tar.gz 516621 BLAKE2B 902844a14c0765ada6adf5054a9462a195b49b2ea4d7441deeff97dd6d9209accd29257697002ee1bad7e143ebf983a2d98077b17e08b060dd1ee75dc682e3d8 SHA512 907129891d56351ca5cb885aae62334ad432321826d6eddfaa32195b4c7b7689a80333e6d14d0aab479a646aba148b9852c0815b80344dfffa4f183a5e74372c
+DIST cffi-2.0.0b1.tar.gz 521625 BLAKE2B a62b15652e02ed62ce33cc92f6bfd4454a81a6a7c3fb84cc048fbf8cc39325af09c19f5c2a2f1e6c80063e9fc8ae6537d1b917a01f15e8e56c2bb847bd79bfac SHA512 974f724a4c819f0a32da38a7209c6f54e63810817794bab286e8721bab6c59ce50c2c0992c828af54088ff8f1dec40480ffe37155d979cadc26c79cdc6b78f54
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cffi/cffi-2.0.0_beta1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cffi/cffi-2.0.0_beta1.ebuild
new file mode 100644
index 00000000000..1f850d13ea6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cffi/cffi-2.0.0_beta1.ebuild
@@ -0,0 +1,70 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+# DO NOT ADD pypy to PYTHON_COMPAT
+# pypy bundles a modified version of cffi. Use python_gen_cond_dep instead.
+PYTHON_COMPAT=( python3_{11..14} python3_14t )
+
+inherit distutils-r1 toolchain-funcs pypi
+
+DESCRIPTION="Foreign Function Interface for Python calling C code"
+HOMEPAGE="
+	https://cffi.readthedocs.io/
+	https://pypi.org/project/cffi/
+"
+
+LICENSE="MIT"
+SLOT="0/${PV}"
+
+# Needs recent libffi for HPPA fixes
+DEPEND="
+	>=dev-libs/libffi-3.4.4-r1:=
+"
+# setuptools as a modern distutils provider
+RDEPEND="
+	${DEPEND}
+	dev-python/pycparser[${PYTHON_USEDEP}]
+	dev-python/setuptools[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	${RDEPEND}
+	virtual/pkgconfig
+	test? (
+		dev-python/py[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_sphinx doc/source
+EPYTEST_PLUGINS=()
+distutils_enable_tests pytest
+
+PATCHES=(
+	"${FILESDIR}"/cffi-1.14.0-darwin-no-brew.patch
+)
+
+src_prepare() {
+	if [[ ${CHOST} == *darwin* ]] ; then
+		# Don't obsessively try to find libffi
+		sed -i -e "s/.*\-iwithsysroot\/usr\/include\/ffi.*/\tpass/" setup.py || die
+	fi
+	distutils-r1_src_prepare
+}
+
+src_configure() {
+	tc-export PKG_CONFIG
+}
+
+python_test() {
+	local EPYTEST_IGNORE=(
+		# these tests call pip
+		testing/cffi0/test_zintegration.py
+	)
+
+	"${EPYTHON}" -c "import _cffi_backend as backend" || die
+	epytest src/c testing
+}

From 0f1d059e4de39643577c4be5881ad9f7860008cd Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:09:45 +0000
Subject: [PATCH 038/122] dev-python/charset-normalizer: Sync with Gentoo

It's from Gentoo commit 84a2dde112828dbe645061776858123049927c27.
---
 .../dev-python/charset-normalizer/Manifest    |  1 +
 .../charset-normalizer-3.4.3.ebuild           | 31 +++++++++++++++++++
 2 files changed, 32 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/charset-normalizer-3.4.3.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/Manifest
index 87228c0a45c..7f2d979a1ba 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/Manifest
@@ -1 +1,2 @@
 DIST charset_normalizer-3.4.2.tar.gz 126367 BLAKE2B a83f719394753e7612657caee102c2a662980ef78e2be25a7f109913eb2650ec94b6a01a885a4f7a66b6ca8d47c680c163fdaf6bd043226b340a7aec6f15ab78 SHA512 702d9c23fe68d3538e4f45d5d9451beb02853ecf1ec6b36a7068ed8ade707bd0fd2a1764137381294590d0e5ffc2e296866f402dff33f65ec0458cf1102970fe
+DIST charset_normalizer-3.4.3.tar.gz 122371 BLAKE2B 9735b4419aec98a11e3b53fc96e892f63299d89653cda489a5938e90526d24241ee2224f2aed149ae2e4becdf2742335175e8c25a2952b76098cfca61edef72a SHA512 b8ee22e9da98d09a3a36b2cd49e0bb27956a444dd59a1d27f1244040147a4e09fbd67d112ec59ace2133fe92b72a4de3a26f0b678bc2b6455c3ead2c2aaa9cfd
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/charset-normalizer-3.4.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/charset-normalizer-3.4.3.ebuild
new file mode 100644
index 00000000000..1f0970c976a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/charset-normalizer-3.4.3.ebuild
@@ -0,0 +1,31 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=standalone
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="The Real First Universal Charset Detector"
+HOMEPAGE="
+	https://pypi.org/project/charset-normalizer/
+	https://github.com/jawah/charset_normalizer/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos"
+
+BDEPEND="
+	dev-python/setuptools[${PYTHON_USEDEP}]
+"
+
+EPYTEST_PLUGINS=()
+distutils_enable_tests pytest
+
+python_test() {
+	epytest -o addopts=
+}

From c0ea7c5c62d4c98c893c6022ff39075d93481d4a Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:09:47 +0000
Subject: [PATCH 039/122] dev-python/cryptography: Sync with Gentoo

It's from Gentoo commit 062469f72f8d6c17ab9375ac399001f966ba24c3.
---
 .../dev-python/cryptography/Manifest          |   2 +
 .../cryptography/cryptography-45.0.6.ebuild   | 133 ++++++++++++++++++
 2 files changed, 135 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/cryptography/cryptography-45.0.6.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cryptography/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/cryptography/Manifest
index d4c4920deeb..d961954d28d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cryptography/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cryptography/Manifest
@@ -7,8 +7,10 @@ DIST cc-1.2.23.crate 106527 BLAKE2B 0fd9e69ad743f4df15da3d25f85e1a422ef64b81b72a
 DIST cfg-if-1.0.0.crate 7934 BLAKE2B e99a5589c11d79d77a4537b34ce0a45d37b981c123b79b807cea836c89fc3926d693458893baca2882448d3d44e3f64e06141f6d916b748daa10b8cc1ae16d1b SHA512 0fb16a8882fd30e86b62c5143b1cb18ab564e84e75bd1f28fd12f24ffdc4a42e0d2e012a99abb606c12efe3c11061ff5bf8e24ab053e550ae083f7d90f6576ff
 DIST cryptography-45.0.4.tar.gz 744890 BLAKE2B 34687a369894b0dfcf8a81c6d1b8cbb0b4a711fd17d4419c5368c41b7e5192cad7233295976a236a52c20493b980a5df77ff4af5a9d54925510d00e833971a22 SHA512 d5bdb21956b80675ccfae78be3d56a2e3bfe8c6ceac15c87c9a3ca470605cb798774018c6c9b9597e90a6918912c9a6b5d83eac9f446364b917d7e8888b83eee
 DIST cryptography-45.0.5.tar.gz 744903 BLAKE2B c8bee14a11b613b8e37fa9ed57dc8fc65b136c738ebe41a2aa753e9dbfed1976bebb429a62e869fd0a138ff222860d629280589b2340a4654f85b5b968af3a8c SHA512 1704f17250d8da6a33ac361f0fe07f6f91ebf087e81cee8fa783b220e118eba83f5c79eab001d79b383d7577b6dabd1e18de718cb16b5780d2f145107bf9cc79
+DIST cryptography-45.0.6.tar.gz 744949 BLAKE2B 271143188d0a7485066b5c89fc0397e6f9e5f5219844961a85e9fd382fb0b05521a093fb943252ea2985bb89645a285345fcf66a6022a58176fe809a83376a81 SHA512 2c675834fa26db0773fe51855c248927a2a7d45963e07144afdfa73573ce1e6940d40849d23fb45f7599c0821e4dbbec956ce2bd993c614617312b8e67fe7f1f
 DIST cryptography_vectors-45.0.4.tar.gz 35345034 BLAKE2B 578bd6dc066079a47cc8291a6b4ecec055b2374046efe12fdc1479505fd9bd5afbc9750e879d6d66b896ff7465abf4f1c133eb41dc4a75c57f5dc635ed8163f0 SHA512 0f2b6310eec21add1caa8ab60e8bb1399177b5a4bc50832fb5db581ed94d030871d2fdd53256e3764c67f58391673005db0527e15063554876306364a8111972
 DIST cryptography_vectors-45.0.5.tar.gz 35344700 BLAKE2B 620d31f2ef2482990567bfaeb21163a96b4da20829c80367511a9803bfc2ecad9edb54e37ad1d3c2848c747d14db61323d9613765bd94462adb9228d8a6d43fc SHA512 7d5706243ec69ae670a7d8e0e6e7a650d4ba7e10b5bd8b05641d7f0e2291cd719c3b2bfccb975c429046a1a347316aa86f40d128160ef176efa294c1d843ff86
+DIST cryptography_vectors-45.0.6.tar.gz 35344645 BLAKE2B 78e8cc7b27eefdf9f499ce64479c67be9ea320967fa6791f19e89c298b783972845728fe43b3c7e6d37fbe1bcd894b268a63cf47be7cc10c5487612cd3587cc5 SHA512 0571c8b5b6e6f7b8787f6bcd395f75460ef615cb9cfd2c779b11326c74b38f285dcb1d84123d3a7996530976fdda78ec266d5c849ea9d6c51835c5ef933b9bfa
 DIST foreign-types-0.3.2.crate 7504 BLAKE2B 520818b702d990d296ecd31a8646850202509ccfa18edd0e1b260289619a6c351e758f317ec0824bd76eccb209b6f087057c25f1bd01a47897715013dd834867 SHA512 bf27b8243ed482c202d120383374f19ff09422535e24b9c1aebccc66529bf300ca17b8bbc76d67f98ac092e614497afe3add9dc68aa69c93074df05762f91232
 DIST foreign-types-shared-0.1.1.crate 5672 BLAKE2B d2e42e04b6657e7a69fe0bd20c672176629c743e49a55fd007bb30e289710b70045d445ae9cae0eeaa747ee708c90e8abd9b5fc39bad8ec0666befe1b696d4f1 SHA512 bafdb2143e136fb0818e2ffd90b5c862b7181647d6568947d4e4531012bbf7a57b597221ec7056c1b562dfc0c3b5dead26d1a4111ebc15e7863737a873518a4a
 DIST heck-0.5.0.crate 11517 BLAKE2B 5365ec43b2239a76b33a174f1a4292ece4147f9d382a68c6c60db78fdc8bad0afb1d51a65bcb25e96675372faa4ea37c318265030b0546ba51942f7c929e1835 SHA512 f044fc9c3d22466629fd8f772ec0555350fd611c0cfadca51d99a3d2f10e155f77c1091916c8a95a6b9b499f366c2e99a5fbf45b010f988bfb9b2501bf9f6a76
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cryptography/cryptography-45.0.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cryptography/cryptography-45.0.6.ebuild
new file mode 100644
index 00000000000..c157835b21c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cryptography/cryptography-45.0.6.ebuild
@@ -0,0 +1,133 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+CARGO_OPTIONAL=yes
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=maturin
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
+PYTHON_REQ_USE="threads(+)"
+
+CRATES="
+	asn1@0.21.3
+	asn1_derive@0.21.3
+	autocfg@1.4.0
+	base64@0.22.1
+	bitflags@2.9.1
+	cc@1.2.23
+	cfg-if@1.0.0
+	foreign-types-shared@0.1.1
+	foreign-types@0.3.2
+	heck@0.5.0
+	indoc@2.0.6
+	itoa@1.0.15
+	libc@0.2.172
+	memoffset@0.9.1
+	once_cell@1.21.3
+	openssl-macros@0.1.1
+	openssl-sys@0.9.108
+	openssl@0.10.72
+	pem@3.0.5
+	pkg-config@0.3.32
+	portable-atomic@1.11.0
+	proc-macro2@1.0.95
+	pyo3-build-config@0.25.0
+	pyo3-ffi@0.25.0
+	pyo3-macros-backend@0.25.0
+	pyo3-macros@0.25.0
+	pyo3@0.25.0
+	quote@1.0.40
+	self_cell@1.2.0
+	shlex@1.3.0
+	syn@2.0.101
+	target-lexicon@0.13.2
+	unicode-ident@1.0.18
+	unindent@0.2.4
+	vcpkg@0.2.15
+"
+
+inherit cargo distutils-r1 flag-o-matic pypi
+
+VEC_P=cryptography_vectors-$(ver_cut 1-3)
+DESCRIPTION="Library providing cryptographic recipes and primitives"
+HOMEPAGE="
+	https://github.com/pyca/cryptography/
+	https://pypi.org/project/cryptography/
+"
+SRC_URI+="
+	${CARGO_CRATE_URIS}
+	test? (
+		$(pypi_sdist_url cryptography_vectors "$(ver_cut 1-3)")
+	)
+"
+
+LICENSE="|| ( Apache-2.0 BSD ) PSF-2"
+# Dependent crate licenses
+LICENSE+="
+	Apache-2.0 Apache-2.0-with-LLVM-exceptions BSD MIT Unicode-3.0
+"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+
+RDEPEND="
+	>=dev-libs/openssl-1.0.2o-r6:0=
+	$(python_gen_cond_dep '
+		>=dev-python/cffi-1.8:=[${PYTHON_USEDEP}]
+	' 'python*')
+"
+DEPEND="
+	${RDEPEND}
+"
+
+BDEPEND="
+	${RUST_DEPEND}
+	>=dev-util/maturin-1.8.6[${PYTHON_USEDEP}]
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	test? (
+		dev-python/certifi[${PYTHON_USEDEP}]
+		dev-python/iso8601[${PYTHON_USEDEP}]
+		dev-python/pretend[${PYTHON_USEDEP}]
+		dev-python/pyasn1-modules[${PYTHON_USEDEP}]
+		dev-python/pytz[${PYTHON_USEDEP}]
+	)
+"
+
+# Files built without CFLAGS/LDFLAGS, acceptable for rust
+QA_FLAGS_IGNORED="usr/lib.*/py.*/site-packages/cryptography/hazmat/bindings/_rust.*.so"
+
+EPYTEST_PLUGINS=( hypothesis pytest-subtests )
+EPYTEST_XDIST=1
+distutils_enable_tests pytest
+
+src_unpack() {
+	cargo_src_unpack
+}
+
+src_prepare() {
+	distutils-r1_src_prepare
+
+	sed -i -e 's:--benchmark-disable::' pyproject.toml || die
+
+	# work around availability macros not supported in GCC (yet)
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		local darwinok=0
+		if [[ ${CHOST##*-darwin} -ge 16 ]] ; then
+			darwinok=1
+		fi
+		sed -i -e 's/__builtin_available(macOS 10\.12, \*)/'"${darwinok}"'/' \
+			src/_cffi_src/openssl/src/osrandom_engine.c || die
+	fi
+}
+
+python_configure_all() {
+	filter-lto # bug #903908
+}
+
+python_test() {
+	local -x PYTHONPATH="${PYTHONPATH}:${WORKDIR}/cryptography_vectors-${PV}"
+	local EPYTEST_IGNORE=(
+		tests/bench
+	)
+	epytest
+}

From 4d9de104441b7ac768f1c16f1eaa0dfd6508e5aa Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:09:47 +0000
Subject: [PATCH 040/122] dev-python/cython: Sync with Gentoo

It's from Gentoo commit dc59f99625fd4f57065c84f27bbb3e17ff81bef5.
---
 .../portage-stable/dev-python/cython/Manifest |   1 +
 .../dev-python/cython/cython-3.1.3.ebuild     | 129 ++++++++++++++++++
 2 files changed, 130 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.3.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest
index 204f84dc5fa..f2b8fe13693 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest
@@ -1 +1,2 @@
 DIST cython-3.1.2.tar.gz 3184825 BLAKE2B 8be6016f3e9a5a7db71fd1cab65424db1a1cd8e9d0118f01432964eb816135021f77542aff2b1f0fd2af8f657f952ebce2f420d7610ae37c6c6956f94e54a636 SHA512 c674027dae58377ea71d8d8b15601e6e0c80435807603251e685608218805fef2e6eac4bbebd3c50c319cd7da660ff9ce1a6daeb673eb40ce70bbfe7f0069600
+DIST cython-3.1.3.tar.gz 3186689 BLAKE2B 520adbaf737b2625a5b6d5802484d84dccf12867ec4c6d379816b84c4413e9a766ee3c21f0ce4209f7961b19346f5e874ab09ed7bf9dc9a259afb8e65ae2359e SHA512 dbf14b486e9dc3cf978abd80f0fcc16d9ed8077d5a44c66b669291d6cc89beeae3e901e4975cee44208dcf52f11ba331a8d73587bf55891976a9ec4818a2470b
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.3.ebuild
new file mode 100644
index 00000000000..204789b2555
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.3.ebuild
@@ -0,0 +1,129 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_FULLY_TESTED=( python3_{11..14} )
+PYTHON_TESTED=( "${PYTHON_FULLY_TESTED[@]}" pypy3_11 )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_{13,14}t )
+PYTHON_REQ_USE="threads(+)"
+
+inherit distutils-r1 multiprocessing pypi toolchain-funcs
+
+DESCRIPTION="A Python to C compiler"
+HOMEPAGE="
+	https://cython.org/
+	https://github.com/cython/cython/
+	https://pypi.org/project/Cython/
+"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="test test-full"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	${RDEPEND}
+	test? (
+		test-full? (
+			$(python_gen_cond_dep '
+				dev-python/numpy[${PYTHON_USEDEP}]
+			' "${PYTHON_FULLY_TESTED[@]}")
+		)
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-0.29.22-spawn-multiprocessing.patch"
+	"${FILESDIR}/${PN}-0.29.23-pythran-parallel-install.patch"
+)
+
+distutils_enable_sphinx docs \
+	dev-python/jinja2 \
+	dev-python/sphinx-issues \
+	dev-python/sphinx-tabs
+
+python_compile() {
+	# Python gets confused when it is in sys.path before build.
+	local -x PYTHONPATH=
+
+	if use elibc_musl ; then
+		# Workaround for bug #925318
+		local -x LDFLAGS="${LDFLAGS} -Wl,-z,stack-size=2097152"
+	fi
+
+	distutils-r1_python_compile
+}
+
+python_test() {
+	# PYTHON_TESTED controls whether we expect the testsuite to
+	# pass at all, while PYTHON_FULLY_TESTED allows skipping before
+	# numpy is ported (and possibly other deps in future).
+	if ! has "${EPYTHON/./_}" "${PYTHON_TESTED[@]}"; then
+		einfo "Skipping tests on ${EPYTHON} (xfail)"
+		return
+	fi
+
+	# Needed to avoid confusing cache tests
+	unset CYTHON_FORCE_REGEN
+
+	tc-export CC
+
+	local testargs=(
+		-vv
+		-j "$(makeopts_jobs)"
+		--work-dir "${BUILD_DIR}"/tests
+
+		--no-examples
+		--no-code-style
+
+		# Fails to find embedded.c
+		--exclude 'embedded'
+		# coverage_installed_pkg needs dev-python/pip and doesn't like
+		# 'externally-managed' (bug #927995), but we don't really
+		# want automagic test dependencies at all, so just skip
+		# unimportant-for-us coverage tests entirely.
+		--exclude 'run.coverage*'
+		--exclude 'Cython.Coverage'
+		# Automagic on dev-python/python-tests, could add this in future
+		--exclude 'run.test_exceptions'
+		# TODO: Unpackaged dev-python/interpreters-pep-734 (interpreters_backport)
+		# This only shows up as a failure with >=3.13.
+		--exclude 'subinterpreters_threading_stress_test'
+
+		# The fix for https://github.com/cython/cython/issues/6938
+		# changes these tests s.t. they break with our build layout.
+		--exclude 'build.depfile*'
+	)
+
+	if [[ ${EPYTHON} == pypy3* ]] ; then
+		testargs+=(
+			# Recursion issue
+			--exclude 'run.if_else_expr'
+			--exclude 'run.test_patma*'
+			# Slight output difference (missing '<')
+			--exclude 'run.cpp_exception_ptr_just_handler'
+
+		)
+	fi
+
+	# Keep test-full for numpy as it's large and doesn't pass tests itself
+	# on niche arches.
+	if ! use test-full || ! has "${EPYTHON/./_}" "${PYTHON_FULLY_TESTED[@]}"; then
+		testargs+=(
+			--exclude 'run.numpy*'
+			--exclude 'run.ufunc'
+			--exclude 'numpy*'
+		)
+	fi
+
+	"${PYTHON}" runtests.py "${testargs[@]}" || die "Tests fail with ${EPYTHON}"
+}
+
+python_install_all() {
+	local DOCS=( CHANGES.rst README.rst ToDo.txt USAGE.txt )
+	distutils-r1_python_install_all
+}

From 789494688141173ba4264a9805445107d365c6e0 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:09:48 +0000
Subject: [PATCH 041/122] dev-python/distlib: Sync with Gentoo

It's from Gentoo commit 6029c3cf729c495296e6a8b074d2951bdfd6b4aa.
---
 .../dev-python/distlib/Manifest               |  1 -
 .../dev-python/distlib/distlib-0.3.9.ebuild   | 59 -------------------
 .../dev-python/distlib/distlib-0.4.0.ebuild   |  2 +-
 .../files/distlib-0.3.9-freethreading.patch   | 26 --------
 4 files changed, 1 insertion(+), 87 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.3.9.ebuild
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-python/distlib/files/distlib-0.3.9-freethreading.patch

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/distlib/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/distlib/Manifest
index a1ccbd45923..18301c9762d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/distlib/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/distlib/Manifest
@@ -1,2 +1 @@
-DIST distlib-0.3.9.gh.tar.gz 1244538 BLAKE2B 08f5257f5a1125c1c76a23b9a78ded6a08f26d2f1491be9b104ab1e02a9737ae49f3750a607d3c7c744397879aeb3cd1a94a355743c95c702eec8a3cfebd70cb SHA512 d89b3ae450a02f634db10baef8d2ff445afa99cd69377f40ef07d591b4bbb2e24fff43c92eeeb93628eaee292fa1e8324eb1a842cf9401feb1f309dbb6f20a25
 DIST distlib-0.4.0.gh.tar.gz 1245571 BLAKE2B c36fe726918bc04849465a55a2708b8686d2ba0b05baa7ff0595e03b7ff95a1afc45b037dbeab9bd14ec7a26ec49807ea5a7c458d8f8da16038c92f32291c62e SHA512 ff61f9ab4e38061d5fee3168c8b26c741a21403d793476477e0733b28b2ba5b1fb31ae6ddb5275efe7ad6936b7e79a5e7ec1b160c86bfbfe6b4ecff10e0193d2
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.3.9.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.3.9.ebuild
deleted file mode 100644
index ff73d11048e..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.3.9.ebuild
+++ /dev/null
@@ -1,59 +0,0 @@
-# Copyright 2021-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
-
-inherit distutils-r1
-
-DESCRIPTION="Low-level components of distutils2/packaging"
-HOMEPAGE="
-	https://pypi.org/project/distlib/
-	https://github.com/pypa/distlib/
-"
-SRC_URI="
-	https://github.com/pypa/distlib/archive/${PV}.tar.gz -> ${P}.gh.tar.gz
-"
-
-LICENSE="PSF-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-macos"
-IUSE="test"
-RESTRICT="!test? ( test )"
-
-# pypiserver is called as external executable
-BDEPEND="
-	test? (
-		dev-python/pypiserver
-		dev-python/test[${PYTHON_USEDEP}]
-	)
-"
-
-src_prepare() {
-	local PATCHES=(
-		# use system pypiserver instead of bundled one
-		"${FILESDIR}"/distlib-0.3.9-system-pypiserver.py
-		# https://github.com/pypa/distlib/pull/244
-		"${FILESDIR}/${P}-freethreading.patch"
-	)
-
-	# make sure it's not used
-	rm tests/pypi-server-standalone.py || die
-
-	distutils-r1_src_prepare
-}
-
-python_test() {
-	local -x SKIP_ONLINE=1
-	local -x PYTHONHASHSEED=0
-
-	# disable system-site-packages -- distlib has no deps, and is very
-	# fragile to packages actually installed on the system
-	sed -i -e '/system-site-packages/s:true:false:' \
-		"${BUILD_DIR}/install${EPREFIX}/usr/pyvenv.cfg" || die
-
-	"${EPYTHON}" tests/test_all.py -v -x ||
-		die "Tests failed with ${EPYTHON}"
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.4.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.4.0.ebuild
index 16f1bea342b..e14e6a98b58 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.4.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.4.0.ebuild
@@ -19,7 +19,7 @@ SRC_URI="
 
 LICENSE="PSF-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-macos"
 IUSE="test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/distlib/files/distlib-0.3.9-freethreading.patch b/sdk_container/src/third_party/portage-stable/dev-python/distlib/files/distlib-0.3.9-freethreading.patch
deleted file mode 100644
index 5f7ccb28bfc..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/distlib/files/distlib-0.3.9-freethreading.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 99248e3681036af5132bf5338ec939148da13478 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Micha=C5=82=20G=C3=B3rny?= <mgorny@gentoo.org>
-Date: Fri, 18 Apr 2025 16:33:35 +0200
-Subject: [PATCH] Update `test_wheel.WheelTestCase.test_abi` for freethreading
-
-Update `test_wheel.WheelTestCase.test_abi` to account for the `t` suffix
-added in freethreaded CPython builds.
-
-Fixes #243
----
- tests/test_wheel.py | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/tests/test_wheel.py b/tests/test_wheel.py
-index da5bd58..c14bba3 100644
---- a/tests/test_wheel.py
-+++ b/tests/test_wheel.py
-@@ -719,6 +719,8 @@ def test_abi(self):
-                 us = sysconfig.get_config_var('Py_UNICODE_SIZE')
-                 if us == 4 or (us is None and sys.maxunicode == 0x10FFFF):
-                     parts.append('u')
-+            if bool(sysconfig.get_config_var("Py_GIL_DISABLED")):
-+                parts.append('t')
-         if vi < (3, 5):
-             abi = ABI
-         else:

From 82a4c04068d447f82c9f0085132c51dea69ff548 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:09:49 +0000
Subject: [PATCH 042/122] dev-python/docutils: Sync with Gentoo

It's from Gentoo commit 73995650f6d096890f66d84c17a3512a60f4cc81.
---
 .../dev-python/docutils/Manifest              |  4 +-
 ...s-0.22_rc2.ebuild => docutils-0.22.ebuild} |  1 +
 .../docutils/docutils-0.22_rc3.ebuild         | 61 -------------------
 .../docutils/docutils-0.22_rc5.ebuild         | 61 -------------------
 4 files changed, 2 insertions(+), 125 deletions(-)
 rename sdk_container/src/third_party/portage-stable/dev-python/docutils/{docutils-0.22_rc2.ebuild => docutils-0.22.ebuild} (88%)
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc3.ebuild
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc5.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest
index 7449657682a..8e95d338409 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest
@@ -1,4 +1,2 @@
 DIST docutils-0.21.2.tar.gz 2204444 BLAKE2B 727c2f97fc5835a0ffa62e38ea85af366cd89ad1eaec0b8af8b1f3b12e6cddfddb65161ba34f9109952d37ba2cf8985f3c3b6905ebb2ac1c9a984cce3fb4d170 SHA512 7fafa331f5687448e80d299c20cdccc4b49819fa471b5f586bf0ab18c694ba43a70f58e7c76b0a70a16267585548389214e11a4998ad7fdc19a27f0f7644539c
-DIST docutils-0.22rc2.tar.gz 2275875 BLAKE2B 62140304e9715e31d8be69c9b65fa382832805368cbf3c184b6319405f22d6c05a16b3b28b5444b4e498c21f4bb7baee8520ef80b445123341aaab7a6a6965d6 SHA512 fcb347d29315a5c2e9f070057962094457bdaf08693c1393a649ae24bab572be027c253deb98561c5cd5a27f2d1f994cf7dea63d0cb74c3a3993c4cea45e0a48
-DIST docutils-0.22rc3.tar.gz 2278230 BLAKE2B 650373b87230bc376c785becfbe2d61e2d67e561facd364f877bd580113223e39b42053b1b5fcab09990f0fc0be9f7aebaff0fc5fdb4fd524e6f45bc4de34a89 SHA512 7fa2cdceb818a69bc1b52ee16680ce23f9d15dc51b684097b479204611e2b320d778e32d5494f88543d77bc1424ee04628680610ed2dc1f5c0798a18b8da5cbd
-DIST docutils-0.22rc5.tar.gz 2279312 BLAKE2B b0473cddb656c0ebcba2177ac46b8c4d246902d646e8baa486df7e33556d88c8f659df6443adfe83efe5a00a7a642fc6ec01843b04f416c85b08b465fd1bc8f3 SHA512 60e98478f331959c55cc6c7bcc7ecb33c0f1a4d6760500ec6186a0d7f5b5c0140ebd690f86221418dcf7d4976ff9386a0f2a83d00d823f6d5dcb97d7b9917c2e
+DIST docutils-0.22.tar.gz 2277984 BLAKE2B 8ad9fc3d064e39bb618f5bac7ef6b69a77e7e811ff2f7c4c1b34f4f8bc1ba793f995e653d20ba536d24af5905f68b8e3f636a0f28f1c9eef46bb6f755d988bc2 SHA512 09082eb3bdd5f9b3e977d356740efee47725a50fbaca7bf35c7fddff06003c2b2177a38d160a9956f9e96261f881c0d870c0aa9fef84f90d0cac079ccc73669d
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22.ebuild
similarity index 88%
rename from sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc2.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22.ebuild
index d5ea86951ef..00820ad3bd1 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22.ebuild
@@ -17,6 +17,7 @@ HOMEPAGE="
 # GPL-3+ only for emacs/rst.el
 LICENSE="BSD BSD-2 GPL-3+ PSF-2.4 public-domain"
 SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 RDEPEND="
 	dev-python/pillow[${PYTHON_USEDEP}]
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc3.ebuild
deleted file mode 100644
index d5ea86951ef..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc3.ebuild
+++ /dev/null
@@ -1,61 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Python Documentation Utilities (reference reStructuredText impl.)"
-HOMEPAGE="
-	https://docutils.sourceforge.io/
-	https://pypi.org/project/docutils/
-"
-
-# GPL-3+ only for emacs/rst.el
-LICENSE="BSD BSD-2 GPL-3+ PSF-2.4 public-domain"
-SLOT="0"
-
-RDEPEND="
-	dev-python/pillow[${PYTHON_USEDEP}]
-	dev-python/pygments[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	${RDEPEND}
-"
-
-python_compile_all() {
-	# Generate html docs from reStructured text sources.
-
-	# Place html4css1.css in base directory to ensure that the generated reference to it is correct.
-	cp docutils/writers/html4css1/html4css1.css . || die
-
-	cd tools || die
-	"${EPYTHON}" buildhtml.py --input-encoding=utf-8 --no-datestamp \
-		--stylesheet-path=../html4css1.css, --traceback ../docs || die
-}
-
-src_test() {
-	cd test || die
-	distutils-r1_src_test
-}
-
-python_test() {
-	"${EPYTHON}" alltests.py -v || die "Testing failed with ${EPYTHON}"
-}
-
-python_install() {
-	distutils-r1_python_install
-
-	# Install tools.
-	python_doscript tools/buildhtml.py
-}
-
-python_install_all() {
-	local DOCS=( *.rst )
-	local HTML_DOCS=( docs tools docutils/writers/html4css1/html4css1.css )
-
-	distutils-r1_python_install_all
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc5.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc5.ebuild
deleted file mode 100644
index d5ea86951ef..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc5.ebuild
+++ /dev/null
@@ -1,61 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Python Documentation Utilities (reference reStructuredText impl.)"
-HOMEPAGE="
-	https://docutils.sourceforge.io/
-	https://pypi.org/project/docutils/
-"
-
-# GPL-3+ only for emacs/rst.el
-LICENSE="BSD BSD-2 GPL-3+ PSF-2.4 public-domain"
-SLOT="0"
-
-RDEPEND="
-	dev-python/pillow[${PYTHON_USEDEP}]
-	dev-python/pygments[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	${RDEPEND}
-"
-
-python_compile_all() {
-	# Generate html docs from reStructured text sources.
-
-	# Place html4css1.css in base directory to ensure that the generated reference to it is correct.
-	cp docutils/writers/html4css1/html4css1.css . || die
-
-	cd tools || die
-	"${EPYTHON}" buildhtml.py --input-encoding=utf-8 --no-datestamp \
-		--stylesheet-path=../html4css1.css, --traceback ../docs || die
-}
-
-src_test() {
-	cd test || die
-	distutils-r1_src_test
-}
-
-python_test() {
-	"${EPYTHON}" alltests.py -v || die "Testing failed with ${EPYTHON}"
-}
-
-python_install() {
-	distutils-r1_python_install
-
-	# Install tools.
-	python_doscript tools/buildhtml.py
-}
-
-python_install_all() {
-	local DOCS=( *.rst )
-	local HTML_DOCS=( docs tools docutils/writers/html4css1/html4css1.css )
-
-	distutils-r1_python_install_all
-}

From d764f32d53eac6d46c8a0c58e18b800d76eec0da Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:09:50 +0000
Subject: [PATCH 043/122] dev-python/ensurepip-pip: Sync with Gentoo

It's from Gentoo commit 4a09de5621a218e52eb57ec57458f0590292f8ef.
---
 .../dev-python/ensurepip-pip/Manifest         |   2 +-
 .../ensurepip-pip-25.1.1-r1.ebuild            |   2 +-
 .../ensurepip-pip/ensurepip-pip-25.1.1.ebuild |  20 --
 .../ensurepip-pip/ensurepip-pip-25.2.ebuild   | 181 ++++++++++++++++++
 .../files/pip-25.2-test-wheels.patch          |  74 +++++++
 5 files changed, 257 insertions(+), 22 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.1.1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.2.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/files/pip-25.2-test-wheels.patch

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/Manifest
index 3622d339ccd..86f564765d0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/Manifest
@@ -1,2 +1,2 @@
-DIST pip-25.1.1-py3-none-any.whl 1825227 BLAKE2B 13170fa08dd26edced5e5fe8d89b38f5b3b63882489d2a951a7238f950a332ce0df11109482840595984bca187960d8fe2b7aeabfcbdaf94e5586631cc1de4e3 SHA512 e0c56f04a306cba9e13ed87f7460ad5a3bda7d6c37e05098082c58acb1f7493c8061e48df279f2c476e75d12df12d0f1a74d82e00e6fc2badffe484d281c56fc
 DIST pip-25.1.1.gh.tar.gz 9219969 BLAKE2B eb443451deeb71888c2fc56ac5c8cb2d0515ec0efff975fab98cfa65d1fc5e66948243b3acebf1f4b0446e46082abb9fd350816579a4f5af1292c160490ce930 SHA512 ce61c9861265139b3c5ea9be9dc246097cd75c21687cf8301f80a377d02420c4524f0d6307d2ca0232ff8715b1105343bcfdb9cac6b69503780ab2c4645558dc
+DIST pip-25.2.gh.tar.gz 9121715 BLAKE2B 3bfe61d6d0d6f3a79c3fd801f5cb40b203fd12085d925ae7cde53adca3c5ee523fdfd9449546e1bc8ca719b3e8766cfef3162919e13a77f7adc0d20a951d11c7 SHA512 5cc65c9091fdda7905e26ce32ddaa3a1c2fd287d69fd3da67c814ba7e8e5be59301d8327c06cdca78c1b95f4a5b5f75c87f36a549022408cc0e8f9411c0db11e
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.1.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.1.1-r1.ebuild
index bf8abb59726..6aa83df3777 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.1.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.1.1-r1.ebuild
@@ -24,7 +24,7 @@ S=${WORKDIR}/${MY_P}
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="test test-rust"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.1.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.1.1.ebuild
deleted file mode 100644
index 23904e1f43a..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.1.1.ebuild
+++ /dev/null
@@ -1,20 +0,0 @@
-# Copyright 2022-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit pypi
-
-DESCRIPTION="Shared pip wheel for ensurepip Python module"
-HOMEPAGE="https://pypi.org/project/pip/"
-SRC_URI="$(pypi_wheel_url "${PN#ensurepip-}")"
-S=${DISTDIR}
-
-LICENSE="Apache-2.0 BSD BSD-2 ISC LGPL-2.1+ MIT MPL-2.0 PSF-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-src_install() {
-	insinto /usr/lib/python/ensurepip
-	doins "${A}"
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.2.ebuild
new file mode 100644
index 00000000000..93cadffb584
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.2.ebuild
@@ -0,0 +1,181 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+# PYTHON_COMPAT is used only for testing
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} )
+PYTHON_REQ_USE="ssl(+),threads(+)"
+
+inherit distutils-r1
+
+MY_P=${P#ensurepip-}
+DESCRIPTION="Shared pip wheel for ensurepip Python module"
+HOMEPAGE="
+	https://pip.pypa.io/en/stable/
+	https://pypi.org/project/pip/
+	https://github.com/pypa/pip/
+"
+SRC_URI="
+	https://github.com/pypa/pip/archive/${PV}.tar.gz -> ${MY_P}.gh.tar.gz
+"
+S=${WORKDIR}/${MY_P}
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="test test-rust"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	${RDEPEND}
+	test? (
+		<dev-python/ensurepip-setuptools-80
+		dev-python/ensurepip-wheel
+		dev-python/freezegun[${PYTHON_USEDEP}]
+		dev-python/pretend[${PYTHON_USEDEP}]
+		dev-python/scripttest[${PYTHON_USEDEP}]
+		dev-python/virtualenv[${PYTHON_USEDEP}]
+		dev-python/werkzeug[${PYTHON_USEDEP}]
+		dev-python/wheel[${PYTHON_USEDEP}]
+		test-rust? (
+			dev-python/cryptography[${PYTHON_USEDEP}]
+		)
+		dev-vcs/git
+	)
+"
+
+EPYTEST_PLUGINS=()
+EPYTEST_RERUNS=5
+EPYTEST_XDIST=1
+distutils_enable_tests pytest
+
+declare -A VENDOR_LICENSES=(
+	[cachecontrol]=Apache-2.0
+	[certifi]=MPL-2.0
+	[dependency_groups]=MIT
+	[distlib]=PSF-2
+	[distro]=Apache-2.0
+	[idna]=BSD
+	[msgpack]=Apache-2.0
+	[packaging]="|| ( Apache-2.0 MIT )"
+	[pkg_resources]=MIT
+	[platformdirs]=MIT
+	[pygments]=BSD-2
+	[pyproject_hooks]=MIT
+	[requests]=Apache-2.0
+	[resolvelib]=ISC
+	[rich]=MIT
+	[tomli]=MIT
+	[tomli_w]=MIT
+	[truststore]=MIT
+	[urllib3]=MIT
+)
+LICENSE+=" ${VENDOR_LICENSES[*]}"
+
+python_prepare_all() {
+	local PATCHES=(
+		# remove coverage & pytest-subket wheel expectation from test suite
+		# (from dev-python/pip)
+		"${FILESDIR}/pip-25.2-test-wheels.patch"
+	)
+
+	distutils-r1_python_prepare_all
+
+	if use test; then
+		local wheels=(
+			"${BROOT}"/usr/lib/python/ensurepip/{setuptools,wheel}-*.whl
+		)
+		mkdir tests/data/common_wheels/ || die
+		cp "${wheels[@]}" tests/data/common_wheels/ || die
+	fi
+
+	# Verify that we've covered licenses for all vendored packages
+	cd src/pip/_vendor || die
+	local packages=( */ )
+	local pkg missing=()
+	for pkg in "${packages[@]%/}"; do
+		if [[ ! -v "VENDOR_LICENSES[${pkg}]" ]]; then
+			missing+=( "${pkg}" )
+		else
+			unset "VENDOR_LICENSES[${pkg}]"
+		fi
+	done
+
+	if [[ ${missing[@]} || ${VENDOR_LICENSES[@]} ]]; then
+		[[ ${missing[@]} ]] &&
+			eerror "License missing for packages: ${missing[*]}"
+		[[ ${VENDOR_LICENSES[@]} ]] &&
+			eerror "Vendored packages removed: ${!VENDOR_LICENSES[*]}"
+		die "VENDOR_LICENSES outdated"
+	fi
+
+	local upstream_count=$(wc -l < vendor.txt || die)
+	if [[ ${#packages[@]} -ne ${upstream_count} ]]; then
+		eerror "VENDOR_LICENSES: ${#packages[@]}"
+		eerror "vendor.txt:      ${upstream_count}"
+		die "Not all vendored packages matched"
+	fi
+}
+
+python_test() {
+	local EPYTEST_DESELECT=(
+		tests/functional/test_inspect.py::test_inspect_basic
+		# Internet
+		tests/functional/test_config_settings.py::test_backend_sees_config_via_sdist
+		tests/functional/test_install.py::test_double_install_fail
+		tests/functional/test_install.py::test_install_sdist_links
+		tests/functional/test_install_config.py::test_prompt_for_keyring_if_needed
+		tests/functional/test_lock.py::test_lock_archive
+		tests/functional/test_lock.py::test_lock_vcs
+		# broken by system site-packages use
+		tests/functional/test_freeze.py::test_freeze_with_setuptools
+		tests/functional/test_pip_runner_script.py::test_runner_work_in_environments_with_no_pip
+		tests/functional/test_uninstall.py::test_basic_uninstall_distutils
+		tests/unit/test_base_command.py::test_base_command_global_tempdir_cleanup
+		tests/unit/test_base_command.py::test_base_command_local_tempdir_cleanup
+		tests/unit/test_base_command.py::test_base_command_provides_tempdir_helpers
+	)
+	local EPYTEST_IGNORE=(
+		# from upstream options
+		src/pip/_vendor
+		tests/tests_cache
+		# requires proxy.py
+		tests/functional/test_proxy.py
+	)
+
+	case ${EPYTHON} in
+		pypy3*)
+			EPYTEST_DESELECT+=(
+				# unexpected tempfiles?
+				tests/functional/test_install_config.py::test_do_not_prompt_for_authentication
+				tests/functional/test_install_config.py::test_prompt_for_authentication
+			)
+			;;
+	esac
+
+	if ! has_version "dev-python/cryptography[${PYTHON_USEDEP}]"; then
+		EPYTEST_DESELECT+=(
+			tests/functional/test_install.py::test_install_sends_client_cert
+			tests/functional/test_install_config.py::test_do_not_prompt_for_authentication
+			tests/functional/test_install_config.py::test_prompt_for_authentication
+			tests/functional/test_install_config.py::test_prompt_for_keyring_if_needed
+		)
+	fi
+
+	local -x PIP_DISABLE_PIP_VERSION_CHECK=1
+	# rerunfailures because test suite breaks if packages are installed
+	# in parallel
+	epytest -m "not network" -o addopts= -o tmp_path_retention_policy=all \
+		--use-venv
+}
+
+src_install() {
+	if [[ ${DISTUTILS_WHEEL_PATH} != *py3-none-any.whl ]]; then
+		die "Non-pure wheel produced?! ${DISTUTILS_WHEEL_PATH}"
+	fi
+	# TODO: compress it?
+	insinto /usr/lib/python/ensurepip
+	doins "${DISTUTILS_WHEEL_PATH}"
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/files/pip-25.2-test-wheels.patch b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/files/pip-25.2-test-wheels.patch
new file mode 100644
index 00000000000..c99af85681d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/files/pip-25.2-test-wheels.patch
@@ -0,0 +1,74 @@
+From f172db76c62cf8e00fb547828c43cd8bf78a31ef Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20G=C3=B3rny?= <mgorny@gentoo.org>
+Date: Thu, 31 Jul 2025 05:10:08 +0200
+Subject: [PATCH] Disable coverage & socket plugins inside test venvs
+
+---
+ tests/conftest.py | 33 ---------------------------------
+ 1 file changed, 33 deletions(-)
+
+diff --git a/tests/conftest.py b/tests/conftest.py
+index c98b87117..f4ef35a7e 100644
+--- a/tests/conftest.py
++++ b/tests/conftest.py
+@@ -444,25 +444,6 @@ def wheel_install(tmpdir_factory: pytest.TempPathFactory, common_wheels: Path) -
+     return _common_wheel_editable_install(tmpdir_factory, common_wheels, "wheel")
+ 
+ 
+-@pytest.fixture(scope="session")
+-def coverage_install(
+-    tmpdir_factory: pytest.TempPathFactory, common_wheels: Path
+-) -> Path:
+-    return _common_wheel_editable_install(tmpdir_factory, common_wheels, "coverage")
+-
+-
+-@pytest.fixture(scope="session")
+-def socket_install(tmpdir_factory: pytest.TempPathFactory, common_wheels: Path) -> Path:
+-    lib_dir = _common_wheel_editable_install(
+-        tmpdir_factory, common_wheels, "pytest_subket"
+-    )
+-    # pytest-subket is only included so it can intercept and block unexpected
+-    # network requests. It should NOT be visible to the pip under test.
+-    dist_info = next(lib_dir.glob("*.dist-info"))
+-    shutil.rmtree(dist_info)
+-    return lib_dir
+-
+-
+ def install_pth_link(
+     venv: VirtualEnvironment, project_name: str, lib_dir: Path
+ ) -> None:
+@@ -479,8 +460,6 @@ def virtualenv_template(
+     pip_editable_parts: tuple[Path, ...],
+     setuptools_install: Path,
+     wheel_install: Path,
+-    coverage_install: Path,
+-    socket_install: Path,
+ ) -> VirtualEnvironment:
+     venv_type: VirtualEnvironmentType
+     if request.config.getoption("--use-venv"):
+@@ -494,11 +473,7 @@ def virtualenv_template(
+ 
+     # Install setuptools, wheel, pytest-subket, and pip.
+     install_pth_link(venv, "setuptools", setuptools_install)
+     install_pth_link(venv, "wheel", wheel_install)
+-    install_pth_link(venv, "pytest_subket", socket_install)
+-    # Also copy pytest-subket's .pth file so it can intercept socket calls.
+-    with open(venv.site / "pytest_socket.pth", "w") as f:
+-        f.write(socket_install.joinpath("pytest_socket.pth").read_text())
+ 
+     pth, dist_info = pip_editable_parts
+ 
+@@ -511,13 +485,6 @@ def virtualenv_template(
+     # detects changed files.
+     venv.site.joinpath("easy-install.pth").touch()
+ 
+-    # Install coverage and pth file for executing it in any spawned processes
+-    # in this virtual environment.
+-    install_pth_link(venv, "coverage", coverage_install)
+-    # zz prefix ensures the file is after easy-install.pth.
+-    with open(venv.site / "zz-coverage-helper.pth", "a") as f:
+-        f.write("import coverage; coverage.process_startup()")
+-
+     # Drop (non-relocatable) launchers.
+     for exe in os.listdir(venv.bin):
+         if not exe.startswith(("python", "libpy")):  # Don't remove libpypy-c.so...

From 2580f28ddb325a2ed5d028e22809c2c7c7a2d2fb Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:09:50 +0000
Subject: [PATCH 044/122] dev-python/ensurepip-setuptools: Sync with Gentoo

It's from Gentoo commit 0658624abdcb4902850c4c0a19508ea0673a6c89.
---
 .../dev-python/ensurepip-setuptools/Manifest  |  1 -
 .../ensurepip-setuptools-80.9.0-r1.ebuild     |  2 +-
 .../ensurepip-setuptools-80.9.0.ebuild        | 20 -------------------
 3 files changed, 1 insertion(+), 22 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.9.0.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest
index 7db4debdccc..36450563226 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest
@@ -1,3 +1,2 @@
 DIST setuptools-79.0.1-py3-none-any.whl 1256281 BLAKE2B 8ae51bdd1c0ccada116757c2bd765225fcf4bedc7ada18567ae12f09b6978cdbcddd4f635a39a5568b6d3ed4388e4f73af5c33a7060f2ac0d0907fc82d8fd74f SHA512 fef6cfc6f95a5bb7320f1680e1c665cb8d9a4e4227cde4d8aab8a50bed4bcf04320085b9d7d5343359f887008db5c5a861e57f3d08b7b0b2311a28adaeee6b4a
-DIST setuptools-80.9.0-py3-none-any.whl 1201486 BLAKE2B 79895683ef4df387aee698984dfdf13adb14314f2d0267f41291c1c1ca68f4383a4273f004b6f3457463913eb19f8d386f32e2630ceaceaaf27ef32c4f61b7ed SHA512 2a0420f7faaa33d2132b82895a8282688030e939db0225ad8abb95a47bdb87b45318f10985fc3cee271a9121441c1526caa363d7f2e4a4b18b1a674068766e87
 DIST setuptools-80.9.0.tar.gz 1319958 BLAKE2B ab367912eec92b0d1251916d09c1dd2e311767eec87225beaff870dff923b47ba1732d2f7393b7d9e55d1ff1249c612e4403019e0021048951f9fc3b775c04c9 SHA512 36eb1f219d29c6b9e135936bde2001ad70a971c8069cd0175d3a5325b450e6843a903d3f70043c9f534768ebeab8ab0c544b8f44456555d333f1ed72daa5c18b
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.9.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.9.0-r1.ebuild
index 525cda9611b..b07355376bf 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.9.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.9.0-r1.ebuild
@@ -19,7 +19,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.9.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.9.0.ebuild
deleted file mode 100644
index 473fddfd3cc..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.9.0.ebuild
+++ /dev/null
@@ -1,20 +0,0 @@
-# Copyright 2022-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit pypi
-
-DESCRIPTION="Shared setuptools wheel for ensurepip Python module"
-HOMEPAGE="https://pypi.org/project/setuptools/"
-SRC_URI="$(pypi_wheel_url "${PN#ensurepip-}")"
-S=${DISTDIR}
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-src_install() {
-	insinto /usr/lib/python/ensurepip
-	doins "${A}"
-}

From d576dab9b0a5ba9e8011aa9e317cb1254859b041 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:09:53 +0000
Subject: [PATCH 045/122] dev-python/fasteners: Sync with Gentoo

It's from Gentoo commit 94f9696287565341e11e78bf5e5cabf1ed5974f6.
---
 .../dev-python/fasteners/Manifest             |  1 +
 .../fasteners/fasteners-0.20.ebuild           | 37 +++++++++++++++++++
 2 files changed, 38 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/fasteners/fasteners-0.20.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/fasteners/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/fasteners/Manifest
index 5c4944fb527..2b4a392aded 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/fasteners/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/fasteners/Manifest
@@ -1 +1,2 @@
 DIST fasteners-0.19.gh.tar.gz 43188 BLAKE2B c30f4dc3da6605aa2552f58ae1071b51efefe2aea59ca8815fd50eebdbe7e826756cd9923485d6fb99dcc39196def485f4c1346a234bc7af09e2426c84b6a0d3 SHA512 47db216ff5bad5c669ca2d9be0ee09feba4a3d55ed0eac8d3623bd3d112b0b87fb9019f8785d035ec32ad9fa9e4ae7d1c92a576c97eec29acc82711d7e71a465
+DIST fasteners-0.20.gh.tar.gz 42740 BLAKE2B 89d3f3432bff3ec6716a96b51867227a4cebfe05cb8ed9554480dbcc0d31b2afa1d173b3dd4cf786688f74e994c6ab390c77898fc045b5636d10ab626103e57c SHA512 539ce5b16f70a73fe6b7296a1bab3b751eff7b7385b980eba3e4d6e42eb263448fd074f325529a30d982e1c366a122aef46bc359578a370ef1278225c09a5f71
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/fasteners/fasteners-0.20.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/fasteners/fasteners-0.20.ebuild
new file mode 100644
index 00000000000..7b3769d5b94
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/fasteners/fasteners-0.20.ebuild
@@ -0,0 +1,37 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{11..13} )
+
+inherit distutils-r1
+
+DESCRIPTION="Python package that provides useful locks"
+HOMEPAGE="
+	https://github.com/harlowja/fasteners/
+	https://pypi.org/project/fasteners/
+"
+SRC_URI="
+	https://github.com/harlowja/fasteners/archive/${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos"
+
+BDEPEND="
+	test? (
+		dev-python/diskcache[${PYTHON_USEDEP}]
+		dev-python/more-itertools[${PYTHON_USEDEP}]
+	)
+"
+
+EPYTEST_PLUGINS=()
+distutils_enable_tests pytest
+
+EPYTEST_IGNORE=(
+	tests/test_eventlet.py
+)

From cb90fc16c71723ca8d77871e2e2c9664cfe06152 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:09:53 +0000
Subject: [PATCH 046/122] dev-python/fastjsonschema: Sync with Gentoo

It's from Gentoo commit 24f7840a27a04ebe90259928de701aa342b5917b.
---
 .../dev-python/fastjsonschema/Manifest        |  1 +
 .../fastjsonschema-2.21.2.ebuild              | 26 +++++++++++++++++++
 2 files changed, 27 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/fastjsonschema/fastjsonschema-2.21.2.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/fastjsonschema/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/fastjsonschema/Manifest
index 740e3e3b089..b3c6b27a2ec 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/fastjsonschema/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/fastjsonschema/Manifest
@@ -1 +1,2 @@
 DIST fastjsonschema-2.21.1.tar.gz 373939 BLAKE2B 2cd91b1ff6aa6e9996faf93d3f0d49cacb7f1b2bbb7001e0e01ce8bf385ac8ff84ce6d1c1c5f8607d05d675b0d42f3f5caee781547907f96717d504312d0902b SHA512 935c68ede28f7026825114ec588ae39713cf28eba9bafc68e106111da92f7cf1f25101a06c4b841f7198f55540af719853efe04f5e25f0cc92ef6638d638c54e
+DIST fastjsonschema-2.21.2.tar.gz 374130 BLAKE2B 198cca481d765b43b21101020718b59e3ccba2728a0a2a0ce56c7b73ce1ff6102c2e3916c9fd4c8fe8f2f3e931d87fd7ffc76e6d7983c5a2d87eca2cfa5aa721 SHA512 9e16f533065267ba48eeda70e8a41fdc10b1b99832a3ddaa0d48d01a783e4555d2fb790201ca3f47b959d3e1f06f68b9f83672f90cc1969355d28f0f24cb9837
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/fastjsonschema/fastjsonschema-2.21.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/fastjsonschema/fastjsonschema-2.21.2.ebuild
new file mode 100644
index 00000000000..1056cdd4537
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/fastjsonschema/fastjsonschema-2.21.2.ebuild
@@ -0,0 +1,26 @@
+# Copyright 2020-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Fast JSON schema validator for Python"
+HOMEPAGE="
+	https://github.com/horejsek/python-fastjsonschema/
+	https://pypi.org/project/fastjsonschema/
+"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+
+EPYTEST_PLUGINS=()
+distutils_enable_tests pytest
+
+EPYTEST_IGNORE=(
+	tests/benchmarks
+)

From ee4c715f40113e2c8214ae627627c31b7ebe90f4 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:09:56 +0000
Subject: [PATCH 047/122] dev-python/gpep517: Sync with Gentoo

It's from Gentoo commit 24e422909f5453b92621dccfc6de2b37ba1fb72a.
---
 .../portage-stable/dev-python/gpep517/gpep517-19.ebuild       | 2 +-
 .../portage-stable/dev-python/gpep517/metadata.xml            | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-19.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-19.ebuild
index e90e21de647..982c3d1ddc4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-19.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-19.ebuild
@@ -27,10 +27,10 @@ RDEPEND="
 	>=dev-python/installer-0.5.0[${PYTHON_USEDEP}]
 "
 
+EPYTEST_PLUGINS=()
 distutils_enable_tests pytest
 
 python_test() {
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
 	epytest -o tmp_path_retention_policy=all
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/gpep517/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-python/gpep517/metadata.xml
index d4f25a6234e..3350822dd5d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/gpep517/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/dev-python/gpep517/metadata.xml
@@ -5,6 +5,10 @@
 		<email>mgorny@gentoo.org</email>
 		<name>Michał Górny</name>
 	</maintainer>
+	<maintainer type="project">
+		<email>python@gentoo.org</email>
+		<name>Python</name>
+	</maintainer>
 	<stabilize-allarches/>
 	<upstream>
 		<remote-id type="github">projg2/gpep517</remote-id>

From 77f5af215cf82119cfc6ac88bc0ffd0c006f91d2 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:10:05 +0000
Subject: [PATCH 048/122] dev-python/markdown-it-py: Sync with Gentoo

It's from Gentoo commit d321afd72b7ca5703e497798b6302b5d3a06a410.
---
 .../dev-python/markdown-it-py/Manifest        |  1 +
 .../markdown-it-py-4.0.0.ebuild               | 41 +++++++++++++++++++
 2 files changed, 42 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/markdown-it-py/markdown-it-py-4.0.0.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/markdown-it-py/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/markdown-it-py/Manifest
index 7afaac0b4e5..941b68deb9b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/markdown-it-py/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/markdown-it-py/Manifest
@@ -1 +1,2 @@
 DIST markdown-it-py-3.0.0.gh.tar.gz 275478 BLAKE2B ab264d6de015262e770b5da9c26a48a9fa40209119e38e12e4185aa8b5141986df62f2ff44d80c2d62732e75408b3a70bf35ae9b7ca899ae284636cc62ded710 SHA512 820265595ab650f5ac64419d5c2687d1ee361d2a0550b9d94e86ec826cfe5e89cbd69e59d6582aac41d3b95f00ce4a0b7213bf6cd590fdbd8fd9b743c7418759
+DIST markdown-it-py-4.0.0.gh.tar.gz 279903 BLAKE2B c878259ae684875dfd9dd017ff5b541b842f2ef917e0f23fa00df77646684794f904eb3693106ce859853a375f8bd2e877346ef775341ed4452856f1793aa8a9 SHA512 617927d7038e2918b395c720d4b8d8327342c266c75b6fd5957961944c2bed51a8e2f01a9c184e5d85dfc4fd8b28e07f3cc1d677aa29192e1a8e54f29d6a0829
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/markdown-it-py/markdown-it-py-4.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/markdown-it-py/markdown-it-py-4.0.0.ebuild
new file mode 100644
index 00000000000..a8b82654bb1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/markdown-it-py/markdown-it-py-4.0.0.ebuild
@@ -0,0 +1,41 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
+
+inherit distutils-r1
+
+DESCRIPTION="Python port of markdown-it, Markdown parser"
+HOMEPAGE="
+	https://pypi.org/project/markdown-it-py/
+	https://github.com/executablebooks/markdown-it-py/
+"
+SRC_URI="
+	https://github.com/executablebooks/markdown-it-py/archive/v${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+
+RDEPEND="
+	<dev-python/linkify-it-py-3[${PYTHON_USEDEP}]
+	dev-python/mdurl[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	test? (
+		dev-python/requests[${PYTHON_USEDEP}]
+	)
+"
+
+EPYTEST_PLUGINS=( pytest-{datadir,regressions} )
+distutils_enable_tests pytest
+
+EPYTEST_IGNORE=(
+	# No need to benchmark
+	benchmarking/
+)

From 26e35071b2094b82ebe8935c4d8ac68c178f0b6a Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:10:15 +0000
Subject: [PATCH 049/122] dev-python/pip: Sync with Gentoo

It's from Gentoo commit a101ef012188824865db9689743b8f7f697da1ed.
---
 .../portage-stable/dev-python/pip/Manifest    |   1 +
 .../pip/files/pip-25.2-test-wheels.patch      |  74 +++++++
 .../dev-python/pip/pip-25.2.ebuild            | 191 ++++++++++++++++++
 3 files changed, 266 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/pip/files/pip-25.2-test-wheels.patch
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/pip/pip-25.2.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pip/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/pip/Manifest
index 08cbb3a739a..86f564765d0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pip/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pip/Manifest
@@ -1 +1,2 @@
 DIST pip-25.1.1.gh.tar.gz 9219969 BLAKE2B eb443451deeb71888c2fc56ac5c8cb2d0515ec0efff975fab98cfa65d1fc5e66948243b3acebf1f4b0446e46082abb9fd350816579a4f5af1292c160490ce930 SHA512 ce61c9861265139b3c5ea9be9dc246097cd75c21687cf8301f80a377d02420c4524f0d6307d2ca0232ff8715b1105343bcfdb9cac6b69503780ab2c4645558dc
+DIST pip-25.2.gh.tar.gz 9121715 BLAKE2B 3bfe61d6d0d6f3a79c3fd801f5cb40b203fd12085d925ae7cde53adca3c5ee523fdfd9449546e1bc8ca719b3e8766cfef3162919e13a77f7adc0d20a951d11c7 SHA512 5cc65c9091fdda7905e26ce32ddaa3a1c2fd287d69fd3da67c814ba7e8e5be59301d8327c06cdca78c1b95f4a5b5f75c87f36a549022408cc0e8f9411c0db11e
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pip/files/pip-25.2-test-wheels.patch b/sdk_container/src/third_party/portage-stable/dev-python/pip/files/pip-25.2-test-wheels.patch
new file mode 100644
index 00000000000..c99af85681d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pip/files/pip-25.2-test-wheels.patch
@@ -0,0 +1,74 @@
+From f172db76c62cf8e00fb547828c43cd8bf78a31ef Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20G=C3=B3rny?= <mgorny@gentoo.org>
+Date: Thu, 31 Jul 2025 05:10:08 +0200
+Subject: [PATCH] Disable coverage & socket plugins inside test venvs
+
+---
+ tests/conftest.py | 33 ---------------------------------
+ 1 file changed, 33 deletions(-)
+
+diff --git a/tests/conftest.py b/tests/conftest.py
+index c98b87117..f4ef35a7e 100644
+--- a/tests/conftest.py
++++ b/tests/conftest.py
+@@ -444,25 +444,6 @@ def wheel_install(tmpdir_factory: pytest.TempPathFactory, common_wheels: Path) -
+     return _common_wheel_editable_install(tmpdir_factory, common_wheels, "wheel")
+ 
+ 
+-@pytest.fixture(scope="session")
+-def coverage_install(
+-    tmpdir_factory: pytest.TempPathFactory, common_wheels: Path
+-) -> Path:
+-    return _common_wheel_editable_install(tmpdir_factory, common_wheels, "coverage")
+-
+-
+-@pytest.fixture(scope="session")
+-def socket_install(tmpdir_factory: pytest.TempPathFactory, common_wheels: Path) -> Path:
+-    lib_dir = _common_wheel_editable_install(
+-        tmpdir_factory, common_wheels, "pytest_subket"
+-    )
+-    # pytest-subket is only included so it can intercept and block unexpected
+-    # network requests. It should NOT be visible to the pip under test.
+-    dist_info = next(lib_dir.glob("*.dist-info"))
+-    shutil.rmtree(dist_info)
+-    return lib_dir
+-
+-
+ def install_pth_link(
+     venv: VirtualEnvironment, project_name: str, lib_dir: Path
+ ) -> None:
+@@ -479,8 +460,6 @@ def virtualenv_template(
+     pip_editable_parts: tuple[Path, ...],
+     setuptools_install: Path,
+     wheel_install: Path,
+-    coverage_install: Path,
+-    socket_install: Path,
+ ) -> VirtualEnvironment:
+     venv_type: VirtualEnvironmentType
+     if request.config.getoption("--use-venv"):
+@@ -494,11 +473,7 @@ def virtualenv_template(
+ 
+     # Install setuptools, wheel, pytest-subket, and pip.
+     install_pth_link(venv, "setuptools", setuptools_install)
+     install_pth_link(venv, "wheel", wheel_install)
+-    install_pth_link(venv, "pytest_subket", socket_install)
+-    # Also copy pytest-subket's .pth file so it can intercept socket calls.
+-    with open(venv.site / "pytest_socket.pth", "w") as f:
+-        f.write(socket_install.joinpath("pytest_socket.pth").read_text())
+ 
+     pth, dist_info = pip_editable_parts
+ 
+@@ -511,13 +485,6 @@ def virtualenv_template(
+     # detects changed files.
+     venv.site.joinpath("easy-install.pth").touch()
+ 
+-    # Install coverage and pth file for executing it in any spawned processes
+-    # in this virtual environment.
+-    install_pth_link(venv, "coverage", coverage_install)
+-    # zz prefix ensures the file is after easy-install.pth.
+-    with open(venv.site / "zz-coverage-helper.pth", "a") as f:
+-        f.write("import coverage; coverage.process_startup()")
+-
+     # Drop (non-relocatable) launchers.
+     for exe in os.listdir(venv.bin):
+         if not exe.startswith(("python", "libpy")):  # Don't remove libpypy-c.so...
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pip/pip-25.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pip/pip-25.2.ebuild
new file mode 100644
index 00000000000..fbfd75f3e9f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pip/pip-25.2.ebuild
@@ -0,0 +1,191 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# please bump dev-python/ensurepip-pip along with this package!
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_TESTED=( pypy3_11 python3_{11..14} )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" )
+PYTHON_REQ_USE="ssl(+),threads(+)"
+
+inherit distutils-r1 shell-completion
+
+DESCRIPTION="The PyPA recommended tool for installing Python packages"
+HOMEPAGE="
+	https://pip.pypa.io/en/stable/
+	https://pypi.org/project/pip/
+	https://github.com/pypa/pip/
+"
+SRC_URI="
+	https://github.com/pypa/pip/archive/${PV}.tar.gz -> ${P}.gh.tar.gz
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="test test-rust"
+RESTRICT="!test? ( test )"
+
+# see src/pip/_vendor/vendor.txt
+RDEPEND="
+	>=dev-python/cachecontrol-0.14.3[${PYTHON_USEDEP}]
+	>=dev-python/dependency-groups-1.3.0[${PYTHON_USEDEP}]
+	>=dev-python/distlib-0.4.0[${PYTHON_USEDEP}]
+	>=dev-python/distro-1.9.0[${PYTHON_USEDEP}]
+	>=dev-python/msgpack-1.1.1[${PYTHON_USEDEP}]
+	>=dev-python/packaging-25.0[${PYTHON_USEDEP}]
+	>=dev-python/platformdirs-4.3.8[${PYTHON_USEDEP}]
+	>=dev-python/pyproject-hooks-1.2.0[${PYTHON_USEDEP}]
+	>=dev-python/requests-2.32.4[${PYTHON_USEDEP}]
+	>=dev-python/rich-14.1.0[${PYTHON_USEDEP}]
+	>=dev-python/resolvelib-1.2.0[${PYTHON_USEDEP}]
+	>=dev-python/setuptools-70.3.0[${PYTHON_USEDEP}]
+	>=dev-python/tomli-w-1.2.0[${PYTHON_USEDEP}]
+	>=dev-python/truststore-0.10.1[${PYTHON_USEDEP}]
+	>=dev-python/typing-extensions-4.13.2[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	${RDEPEND}
+	test? (
+		$(python_gen_cond_dep '
+			dev-python/ensurepip-setuptools
+			dev-python/ensurepip-wheel
+			dev-python/freezegun[${PYTHON_USEDEP}]
+			dev-python/pretend[${PYTHON_USEDEP}]
+			dev-python/pytest[${PYTHON_USEDEP}]
+			dev-python/pytest-rerunfailures[${PYTHON_USEDEP}]
+			dev-python/pytest-xdist[${PYTHON_USEDEP}]
+			dev-python/scripttest[${PYTHON_USEDEP}]
+			<dev-python/setuptools-80[${PYTHON_USEDEP}]
+			dev-python/virtualenv[${PYTHON_USEDEP}]
+			dev-python/werkzeug[${PYTHON_USEDEP}]
+			dev-python/wheel[${PYTHON_USEDEP}]
+			test-rust? (
+				dev-python/cryptography[${PYTHON_USEDEP}]
+			)
+			dev-vcs/git
+		' "${PYTHON_TESTED[@]}")
+	)
+"
+
+python_prepare_all() {
+	local PATCHES=(
+		# remove coverage & pytest-subket wheel expectation from test suite
+		"${FILESDIR}/pip-25.2-test-wheels.patch"
+		# prepare to unbundle dependencies
+		"${FILESDIR}/pip-25.0.1-unbundle.patch"
+	)
+
+	distutils-r1_python_prepare_all
+
+	# unbundle dependencies
+	rm -r src/pip/_vendor || die
+	find -name '*.py' -exec sed -i \
+		-e 's:from pip\._vendor import:import:g' \
+		-e 's:from pip\._vendor\.:from :g' \
+		{} + || die
+
+	if use test; then
+		local wheels=(
+			"${BROOT}"/usr/lib/python/ensurepip/{setuptools,wheel}-*.whl
+		)
+		mkdir tests/data/common_wheels/ || die
+		cp "${wheels[@]}" tests/data/common_wheels/ || die
+	fi
+}
+
+python_configure() {
+	if use test && has_version "dev-python/pip[${PYTHON_USEDEP}]"; then
+		"${EPYTHON}" -m pip check ||
+			die "${EPYTHON} -m pip check failed, tests will fail"
+	fi
+}
+
+python_compile_all() {
+	# 'pip completion' command embeds full $0 into completion script, which confuses
+	# 'complete' and causes QA warning when running as "${PYTHON} -m pip".
+	# This trick sets correct $0 while still calling just installed pip.
+	local pipcmd='if True:
+		import sys
+		sys.argv[0] = "pip"
+		__file__ = ""
+		from pip._internal.cli.main import main
+		sys.exit(main())
+	'
+	"${EPYTHON}" -c "${pipcmd}" completion --bash > completion.bash || die
+	"${EPYTHON}" -c "${pipcmd}" completion --zsh > completion.zsh || die
+}
+
+python_test() {
+	if ! has "${EPYTHON}" "${PYTHON_TESTED[@]/_/.}"; then
+		einfo "Skipping tests on ${EPYTHON}"
+		return 0
+	fi
+
+	local EPYTEST_DESELECT=(
+		tests/functional/test_inspect.py::test_inspect_basic
+		# Internet
+		tests/functional/test_config_settings.py::test_backend_sees_config_via_sdist
+		tests/functional/test_install.py::test_double_install_fail
+		tests/functional/test_install.py::test_install_sdist_links
+		tests/functional/test_install_config.py::test_prompt_for_keyring_if_needed
+		tests/functional/test_lock.py::test_lock_archive
+		tests/functional/test_lock.py::test_lock_vcs
+		# broken by system site-packages use
+		tests/functional/test_freeze.py::test_freeze_with_setuptools
+		tests/functional/test_pip_runner_script.py::test_runner_work_in_environments_with_no_pip
+		tests/functional/test_uninstall.py::test_basic_uninstall_distutils
+		tests/unit/test_base_command.py::test_base_command_global_tempdir_cleanup
+		tests/unit/test_base_command.py::test_base_command_local_tempdir_cleanup
+		tests/unit/test_base_command.py::test_base_command_provides_tempdir_helpers
+		# broken by unbundling
+		"tests/functional/test_debug.py::test_debug[vendored library versions:]"
+		tests/functional/test_debug.py::test_debug__library_versions
+		tests/functional/test_python_option.py::test_python_interpreter
+		tests/functional/test_uninstall.py::test_uninstall_non_local_distutils
+	)
+	local EPYTEST_IGNORE=(
+		# from upstream options
+		tests/tests_cache
+		# requires proxy.py
+		tests/functional/test_proxy.py
+	)
+
+	case ${EPYTHON} in
+		pypy3*)
+			EPYTEST_DESELECT+=(
+				# unexpected tempfiles?
+				tests/functional/test_install_config.py::test_do_not_prompt_for_authentication
+				tests/functional/test_install_config.py::test_prompt_for_authentication
+			)
+			;;
+	esac
+
+	if ! has_version "dev-python/cryptography[${PYTHON_USEDEP}]"; then
+		EPYTEST_DESELECT+=(
+			tests/functional/test_install.py::test_install_sends_client_cert
+			tests/functional/test_install_config.py::test_do_not_prompt_for_authentication
+			tests/functional/test_install_config.py::test_prompt_for_authentication
+			tests/functional/test_install_config.py::test_prompt_for_keyring_if_needed
+		)
+	fi
+
+	local -x PIP_DISABLE_PIP_VERSION_CHECK=1
+	local EPYTEST_PLUGINS=()
+	# rerunfailures because test suite breaks if packages are installed
+	# to system site-packages while it's running
+	local EPYTEST_RERUNS=5
+	local EPYTEST_XDIST=1
+	epytest -m "not network" -o addopts= -o tmp_path_retention_policy=all \
+		--use-venv
+}
+
+python_install_all() {
+	local DOCS=( AUTHORS.txt docs/html/**/*.rst )
+	distutils-r1_python_install_all
+
+	newbashcomp completion.bash pip
+	newzshcomp completion.zsh _pip
+}

From f5e26c2e33adde31e9f9abfe765ca58d3c8d7594 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:10:17 +0000
Subject: [PATCH 050/122] dev-python/ply: Sync with Gentoo

It's from Gentoo commit e11e4d9d319031d4f3c8b72cd29fdea7c007ad43.
---
 .../portage-stable/dev-python/ply/ply-3.11-r2.ebuild            | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ply/ply-3.11-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ply/ply-3.11-r2.ebuild
index a0b371d6e84..7826d080a02 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ply/ply-3.11-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ply/ply-3.11-r2.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 

From 156f5be802c65a9d13d07a7bc6d8d8453ac1b632 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:10:18 +0000
Subject: [PATCH 051/122] dev-python/pycparser: Sync with Gentoo

It's from Gentoo commit 0c049b1ae878000fb48ce244d307b28c07c244ce.
---
 .../portage-stable/dev-python/pycparser/pycparser-2.22.ebuild   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pycparser/pycparser-2.22.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pycparser/pycparser-2.22.ebuild
index 3ed190f94ed..1a66d95adbe 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pycparser/pycparser-2.22.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pycparser/pycparser-2.22.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 

From 6cfb87325e3ae42c410684555fa6e0aba9034540 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:10:25 +0000
Subject: [PATCH 052/122] dev-python/rich: Sync with Gentoo

It's from Gentoo commit acfca20efde52ebba89566b7e48f0d08ebc86db5.
---
 .../src/third_party/portage-stable/dev-python/rich/Manifest  | 2 +-
 .../rich/{rich-14.0.0.ebuild => rich-14.1.0.ebuild}          | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)
 rename sdk_container/src/third_party/portage-stable/dev-python/rich/{rich-14.0.0.ebuild => rich-14.1.0.ebuild} (93%)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/rich/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/rich/Manifest
index 6600432e8cd..2ab4c21eb8c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/rich/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/rich/Manifest
@@ -1 +1 @@
-DIST rich-14.0.0.gh.tar.gz 15065886 BLAKE2B b1e47ee163561f714cbddf6d809e7f5b2c28d09c196ec0132a04bdcaa05415fe7189a9c471bd68d3cb18e526d4aecb4499229cf3adac85164cf6309c77f53b74 SHA512 e3192d75d35d9f63fa687a8e9e7893ea273ef193b7e27c266d2f1a1c62c7fa44e83cfb6ea3fef716fff6d337a826af393c223d5d4bddc52b4ec84aa6554379ef
+DIST rich-14.1.0.gh.tar.gz 15070577 BLAKE2B b1ce2783dc3292df250f416812a6bd7d1c6cc2f15a979f50dd6811771de3beb01f4baf8d5b1ec50c2929dd572578daac58e332017e62e60f51b45e34ed5ac953 SHA512 39971d8811b754e708aa422f71a777164aee1ec0b76df3b350b637fdd6c3d3a715ccc36dfce587355b4ec95ce73a8d197da1179be13c7c1d936ba45bd2073a64
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.1.0.ebuild
similarity index 93%
rename from sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.0.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.1.0.ebuild
index 5cf4037f031..899620cbea9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.0.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.1.0.ebuild
@@ -38,6 +38,7 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-14.0.0-py314.patch
 )
 
+EPYTEST_PLUGINS=()
 distutils_enable_tests pytest
 
 python_test() {
@@ -50,6 +51,9 @@ python_test() {
 		tests/test_markdown.py::test_inline_code
 		tests/test_syntax.py::test_blank_lines
 		tests/test_syntax.py::test_python_render_simple_indent_guides
+		# pygments version?
+		tests/test_syntax.py::test_from_path
+		tests/test_syntax.py::test_syntax_guess_lexer
 	)
 	# version-specific output -- the usual deal
 	case ${EPYTHON} in
@@ -72,7 +76,6 @@ python_test() {
 	esac
 
 	local -x COLUMNS=80
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
 	epytest
 }
 

From 743ebc2e4203503a026199a45ecfe8165b3de06d Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:10:25 +0000
Subject: [PATCH 053/122] dev-python/setuptools: Sync with Gentoo

It's from Gentoo commit 7df8bfd860de36329ddab85381cb5c42a168cb27.
---
 .../setuptools/setuptools-80.9.0-r1.ebuild    |   2 +-
 .../setuptools/setuptools-80.9.0.ebuild       | 130 ------------------
 2 files changed, 1 insertion(+), 131 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.9.0.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.9.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.9.0-r1.ebuild
index f983770caa7..f04da78c52e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.9.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.9.0-r1.ebuild
@@ -21,7 +21,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
 IUSE="test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.9.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.9.0.ebuild
deleted file mode 100644
index 26356f533d5..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.9.0.ebuild
+++ /dev/null
@@ -1,130 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
-EAPI=8
-
-# please bump dev-python/ensurepip-setuptools along with this package!
-
-DISTUTILS_USE_PEP517=standalone
-PYTHON_TESTED=( python3_{11..14} pypy3_11 )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_{13,14}t )
-PYTHON_REQ_USE="xml(+)"
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Collection of extensions to Distutils"
-HOMEPAGE="
-	https://github.com/pypa/setuptools/
-	https://pypi.org/project/setuptools/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
-IUSE="test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	dev-python/jaraco-collections[${PYTHON_USEDEP}]
-	>=dev-python/jaraco-functools-4[${PYTHON_USEDEP}]
-	>=dev-python/jaraco-text-3.7.0-r1[${PYTHON_USEDEP}]
-	>=dev-python/more-itertools-8.12.0-r1[${PYTHON_USEDEP}]
-	>=dev-python/packaging-24.2[${PYTHON_USEDEP}]
-	>=dev-python/platformdirs-4.2.2[${PYTHON_USEDEP}]
-	>=dev-python/wheel-0.44.0[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	${RDEPEND}
-	test? (
-		$(python_gen_cond_dep '
-			>=dev-python/build-1.0.3[${PYTHON_USEDEP}]
-			>=dev-python/ini2toml-0.14[${PYTHON_USEDEP}]
-			>=dev-python/filelock-3.4.0[${PYTHON_USEDEP}]
-			>=dev-python/jaraco-envs-2.2[${PYTHON_USEDEP}]
-			>=dev-python/jaraco-path-3.7.2[${PYTHON_USEDEP}]
-			>=dev-python/jaraco-test-5.5[${PYTHON_USEDEP}]
-			dev-python/pip[${PYTHON_USEDEP}]
-			dev-python/pyproject-hooks[${PYTHON_USEDEP}]
-			dev-python/pytest[${PYTHON_USEDEP}]
-			>=dev-python/pytest-home-0.5[${PYTHON_USEDEP}]
-			dev-python/pytest-subprocess[${PYTHON_USEDEP}]
-			dev-python/pytest-timeout[${PYTHON_USEDEP}]
-			dev-python/pytest-xdist[${PYTHON_USEDEP}]
-			>=dev-python/tomli-w-1.0.0[${PYTHON_USEDEP}]
-			>=dev-python/virtualenv-20[${PYTHON_USEDEP}]
-		' "${PYTHON_TESTED[@]}")
-	)
-"
-# setuptools-scm is here because installing plugins apparently breaks stuff at
-# runtime, so let's pull it early. See bug #663324.
-#
-# trove-classifiers are optionally used in validation, if they are
-# installed.  Since we really oughtn't block them, let's always enforce
-# the newest version for the time being to avoid errors.
-# https://github.com/pypa/setuptools/issues/4459
-PDEPEND="
-	dev-python/setuptools-scm[${PYTHON_USEDEP}]
-	>=dev-python/trove-classifiers-2024.10.16[${PYTHON_USEDEP}]
-"
-
-src_prepare() {
-	local PATCHES=(
-		# TODO: remove this when we're 100% PEP517 mode
-		"${FILESDIR}/setuptools-62.4.0-py-compile.patch"
-		# https://github.com/abravalheri/validate-pyproject/pull/221
-		"${FILESDIR}/setuptools-75.6.0-disable-trove-classifiers.patch"
-	)
-
-	distutils-r1_src_prepare
-
-	# breaks tests
-	sed -i -e '/--import-mode/d' pytest.ini || die
-
-	# remove bundled dependencies
-	rm -r */_vendor || die
-}
-
-python_test() {
-	if ! has "${EPYTHON}" "${PYTHON_TESTED[@]/_/.}"; then
-		return
-	fi
-
-	local EPYTEST_DESELECT=(
-		# network
-		setuptools/tests/integration/test_pbr.py::test_pbr_integration
-		setuptools/tests/test_build_meta.py::test_legacy_editable_install
-		setuptools/tests/test_develop.py::TestNamespaces::test_namespace_package_importable
-		setuptools/tests/test_distutils_adoption.py
-		setuptools/tests/test_editable_install.py
-		setuptools/tests/test_virtualenv.py::test_no_missing_dependencies
-		setuptools/tests/test_virtualenv.py::test_test_command_install_requirements
-		# TODO
-		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_basic
-		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_ignore_errors
-		# expects bundled deps in virtualenv
-		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_in_sdist
-		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_not_in_wheel
-		# fails if python-xlib is installed
-		setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_allow_hosts
-		# TODO, probably some random package
-		setuptools/tests/config/test_setupcfg.py::TestOptions::test_cmdclass
-		# broken by unbundling
-		setuptools/tests/test_setuptools.py::test_wheel_includes_vendored_metadata
-		# fails on normalized metadata, perhaps different dep version?
-		setuptools/tests/test_build_meta.py::TestBuildMetaBackend::test_build_with_pyproject_config
-		# TODO
-		setuptools/tests/test_sdist.py::test_sanity_check_setuptools_own_sdist
-		# relies on -Werror
-		setuptools/_static.py::setuptools._static.Dict
-		setuptools/_static.py::setuptools._static.List
-		setuptools/tests/test_bdist_egg.py::Test::test_bdist_egg
-		# TODO
-		setuptools/dist.py::setuptools.dist.Distribution._find_pattern
-	)
-
-	local EPYTEST_XDIST=1
-	local -x PRE_BUILT_SETUPTOOLS_WHEEL=${DISTUTILS_WHEEL_PATH}
-	epytest -o tmp_path_retention_policy=all \
-		-m "not uses_network" setuptools
-}

From 527a4580b2fcf40b03bfbb2a235e5fd228b310a1 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:10:25 +0000
Subject: [PATCH 054/122] dev-python/setuptools-scm: Sync with Gentoo

It's from Gentoo commit 6ce67122bc7f1098995138b60a9713a60ff18068.
---
 .../dev-python/setuptools-scm/Manifest        |  4 ++
 .../setuptools-scm-9.0.0.ebuild               | 62 +++++++++++++++++++
 .../setuptools-scm-9.0.3.ebuild               | 62 +++++++++++++++++++
 .../setuptools-scm-9.1.1.ebuild               | 52 ++++++++++++++++
 .../setuptools-scm-9.2.0.ebuild               | 52 ++++++++++++++++
 5 files changed, 232 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-9.0.0.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-9.0.3.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-9.1.1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-9.2.0.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/Manifest
index 08b01bd3e37..972bf4a4982 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/Manifest
@@ -1 +1,5 @@
 DIST setuptools_scm-8.3.1.tar.gz 78088 BLAKE2B 6cedb55fc16830d12a28fe5b662c371b134bc4d7ef0e6de446b71152e5d83a031cf763b0753042c96745e82bf9dc42fa7cfee05a9a7e7824a4cf659b0a401a51 SHA512 e924abf81c7ee466241c5d66c39b416c8b308f01df9e1498c55ad6ed9812fbf883d8bcafd6fdcdcb96c5ec42b868ae04088de1870ca09a650fa07eb3ea9901c8
+DIST setuptools_scm-9.0.0.tar.gz 184752 BLAKE2B f6ec73dd4733b7cf24cd67bebde9cc96e1c611187774c35fa33e96a29b8aab29c13069ba68e52406dee30e1bf19d2fe38f61031f66b4abb7aeec60a5d3cb72aa SHA512 2d22695ac7036d70d23d8c2613b1c9a9948cc517754b93f38d561065746b8df001d6bae9878477f2df622711b6809b8e178c2c21ad82bdd9c7877b5816251e47
+DIST setuptools_scm-9.0.3.tar.gz 187006 BLAKE2B 8e936eda4802aae82d3aafa4ee8d4cfd3beae7afc7df0719e97a268d63a3f1e701334734fcb94c31fa16b11f67b3e38f2097fd9c7951b1d185bc4cfc1d2f6809 SHA512 642b11ec216a7f332492d6cfa6b4972aa7e58bdf6181f62f0e9d8ab8dba24feb771aa4e87facf704aabad500bd75a12d2ad420f00b0f36fb61d3b35158a71ea7
+DIST setuptools_scm-9.1.1.tar.gz 191499 BLAKE2B 1da62adeabc697195c0ebf43131d00bea8a8b85fa556e228bd03b7ec4a110f61938aef5e3c433862c1a93af1e0112f0b327519181b17a9be22927837c7c90a21 SHA512 142affb002a72de841ca18461ebd40ac2a0f5f2599a9c82c020ee0081975871701e17b64e40e8eebbd7be469a572f6eacd1b82d26600c787a168c5cb0066be55
+DIST setuptools_scm-9.2.0.tar.gz 201229 BLAKE2B b2633c1a4f5a8a4b0ff23bf9b866e9bcb5f5c7b3a5fff9159d207b7405f8e3d76efddf3dda6a3083efdbd83bd3ff9d3399ebd2bcbe87598a93d36494ac169753 SHA512 da76f5440d03cadc545d0ed4275476c2d5b42013a100ee3948e77a05fdb61087fe208785bbb460d96423da7f6849b5eab45914f0054b21fd1d0c36ce0eac1795
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-9.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-9.0.0.ebuild
new file mode 100644
index 00000000000..ea65d71e9c5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-9.0.0.ebuild
@@ -0,0 +1,62 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=standalone
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Manage versions by scm tags via setuptools"
+HOMEPAGE="
+	https://github.com/pypa/setuptools-scm/
+	https://pypi.org/project/setuptools-scm/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+# there's an optional dep on rich for cute logs
+RDEPEND="
+	dev-python/packaging[${PYTHON_USEDEP}]
+	>=dev-python/setuptools-64[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	test? (
+		dev-python/build[${PYTHON_USEDEP}]
+		dev-python/typing-extensions[${PYTHON_USEDEP}]
+		dev-vcs/git
+	)
+"
+
+EPYTEST_PLUGINS=( pytest-timeout )
+distutils_enable_tests pytest
+
+python_test() {
+	local EPYTEST_DESELECT=(
+		# the usual nondescript gpg-agent failure
+		testing/test_git.py::test_git_getdate_signed_commit
+
+		# fetching from the Internet
+		testing/test_regressions.py::test_pip_download
+
+		# calls flake8, unpredictable
+		testing/test_functions.py::test_dump_version_flake8
+
+		# incompatible with current mypy version
+		testing/test_functions.py::test_dump_version_mypy
+	)
+
+	if has_version dev-python/nose; then
+		EPYTEST_DESELECT+=(
+			# https://bugs.gentoo.org/892639
+			testing/test_integration.py::test_pyproject_support
+		)
+	fi
+
+	epytest
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-9.0.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-9.0.3.ebuild
new file mode 100644
index 00000000000..ea65d71e9c5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-9.0.3.ebuild
@@ -0,0 +1,62 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=standalone
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Manage versions by scm tags via setuptools"
+HOMEPAGE="
+	https://github.com/pypa/setuptools-scm/
+	https://pypi.org/project/setuptools-scm/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+# there's an optional dep on rich for cute logs
+RDEPEND="
+	dev-python/packaging[${PYTHON_USEDEP}]
+	>=dev-python/setuptools-64[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	test? (
+		dev-python/build[${PYTHON_USEDEP}]
+		dev-python/typing-extensions[${PYTHON_USEDEP}]
+		dev-vcs/git
+	)
+"
+
+EPYTEST_PLUGINS=( pytest-timeout )
+distutils_enable_tests pytest
+
+python_test() {
+	local EPYTEST_DESELECT=(
+		# the usual nondescript gpg-agent failure
+		testing/test_git.py::test_git_getdate_signed_commit
+
+		# fetching from the Internet
+		testing/test_regressions.py::test_pip_download
+
+		# calls flake8, unpredictable
+		testing/test_functions.py::test_dump_version_flake8
+
+		# incompatible with current mypy version
+		testing/test_functions.py::test_dump_version_mypy
+	)
+
+	if has_version dev-python/nose; then
+		EPYTEST_DESELECT+=(
+			# https://bugs.gentoo.org/892639
+			testing/test_integration.py::test_pyproject_support
+		)
+	fi
+
+	epytest
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-9.1.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-9.1.1.ebuild
new file mode 100644
index 00000000000..acf15a322b5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-9.1.1.ebuild
@@ -0,0 +1,52 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=standalone
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Manage versions by scm tags via setuptools"
+HOMEPAGE="
+	https://github.com/pypa/setuptools-scm/
+	https://pypi.org/project/setuptools-scm/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+# there's an optional dep on rich for cute logs
+RDEPEND="
+	dev-python/packaging[${PYTHON_USEDEP}]
+	>=dev-python/setuptools-64[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	test? (
+		dev-python/build[${PYTHON_USEDEP}]
+		dev-python/typing-extensions[${PYTHON_USEDEP}]
+		dev-vcs/git
+	)
+"
+
+EPYTEST_PLUGINS=( pytest-timeout )
+distutils_enable_tests pytest
+
+EPYTEST_DESELECT=(
+	# the usual nondescript gpg-agent failure
+	testing/test_git.py::test_git_getdate_signed_commit
+
+	# fetching from the Internet
+	testing/test_integration.py::test_xmlsec_download_regression
+	testing/test_regressions.py::test_pip_download
+
+	# calls flake8, unpredictable
+	testing/test_functions.py::test_dump_version_flake8
+
+	# incompatible with current mypy version
+	testing/test_functions.py::test_dump_version_mypy
+)
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-9.2.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-9.2.0.ebuild
new file mode 100644
index 00000000000..acf15a322b5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-9.2.0.ebuild
@@ -0,0 +1,52 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=standalone
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Manage versions by scm tags via setuptools"
+HOMEPAGE="
+	https://github.com/pypa/setuptools-scm/
+	https://pypi.org/project/setuptools-scm/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+# there's an optional dep on rich for cute logs
+RDEPEND="
+	dev-python/packaging[${PYTHON_USEDEP}]
+	>=dev-python/setuptools-64[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	test? (
+		dev-python/build[${PYTHON_USEDEP}]
+		dev-python/typing-extensions[${PYTHON_USEDEP}]
+		dev-vcs/git
+	)
+"
+
+EPYTEST_PLUGINS=( pytest-timeout )
+distutils_enable_tests pytest
+
+EPYTEST_DESELECT=(
+	# the usual nondescript gpg-agent failure
+	testing/test_git.py::test_git_getdate_signed_commit
+
+	# fetching from the Internet
+	testing/test_integration.py::test_xmlsec_download_regression
+	testing/test_regressions.py::test_pip_download
+
+	# calls flake8, unpredictable
+	testing/test_functions.py::test_dump_version_flake8
+
+	# incompatible with current mypy version
+	testing/test_functions.py::test_dump_version_mypy
+)

From 949cd50601c73a7cd6a919acbd2b570d1ec7a4fa Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:10:29 +0000
Subject: [PATCH 055/122] dev-python/tree-sitter: Sync with Gentoo

It's from Gentoo commit 0428110c88f0c23924936741681fd4f7e30ffef5.
---
 .../dev-python/tree-sitter/Manifest           |  2 +
 .../tree-sitter/tree-sitter-0.25.0.ebuild     | 58 +++++++++++++++++++
 .../tree-sitter/tree-sitter-0.25.1.ebuild     | 58 +++++++++++++++++++
 3 files changed, 118 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.25.0.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.25.1.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/Manifest
index a0d5a62778d..335acadcc5e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/Manifest
@@ -1,3 +1,5 @@
 DIST tree-sitter-0.23.0.gh.tar.gz 167761 BLAKE2B 694e90f608f51fe4f9add476cd5ebcd0ce04a7b027efc4948ce49a6cc0f05ebf4f15e0fe3f365f89f3e04cfec542cb3f1db1e5b05ff7ca23d3134561ea3dcf36 SHA512 67a6f3359c6283c58afcdbe5b6a521cdfcf2585a5361fb69a55eff82941726a143528a402e6d609286d8846c77e20d0a38551525d761e35abb21045ad9c5a2f8
 DIST tree-sitter-0.23.1.gh.tar.gz 168079 BLAKE2B fe3f8d9dae426d7771eab7775d78a0af72e59bf3448005cec1e597a3263b2ac89d7b2c1a80aa12da42db54b242da10d0395673412257d57dff557b2cf4763869 SHA512 39ed2d5d8a737bd72d539701a2dab5abc501b151a3666180f127645895582757eba2ec98607bbeb07bf90377fccad4a93cb385ce16565ed3420908129cea4f57
 DIST tree-sitter-0.24.0.gh.tar.gz 170141 BLAKE2B 3d7f076f947192105be2fc9d93831eb331c1ec189619f6db860db8b6b6c1f2f33cd03edf315c09a5de6637d870351d06d5507d9c0de8a4dadc4e9e863ac233e8 SHA512 471d605cc29bcf7fd228eefe8a3bc2dd39c163d584e941cfd8ac0e498ff1815c7cadb9a7a45c643f704b8c9f12932bcc53597c835e23b5988da087f9a6a59067
+DIST tree-sitter-0.25.0.gh.tar.gz 173820 BLAKE2B 63dbb9992fb6c4212a7a7cffd44b852d94d78a9699ec856807ce333ac494409f7dcd5cf3d8b0fdfa03c03a484ed3d5b0ee51c3847667474a04c811ae561f0918 SHA512 357a0aa1c9393f9ec1a056e87b54e5178abbd6b2525a863b2ed5ba788337a9ae555a52092fe89803215487d324e287f2c2cbe2d60f878e1c053cf6b41a387eeb
+DIST tree-sitter-0.25.1.gh.tar.gz 174288 BLAKE2B 2580e7909e28ea05dfe8a015eb0e26d465318a0962666dc8de3d82d80c7647a62398abee093ccea13a04119e685dac3365ed098a70f7c50fac383cef34f7cb62 SHA512 37a6035921d44a13ef2128c8ff5dd7d8424dd50c1b5089a143ecfd921848304d91339d17108fa9e2f7ea0a6755b03413061ed6a6561ef1d8473534e8cf4636ef
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.25.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.25.0.ebuild
new file mode 100644
index 00000000000..cee8a94c10a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.25.0.ebuild
@@ -0,0 +1,58 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{11..14} )
+
+inherit distutils-r1
+
+DESCRIPTION="Python bindings to the Tree-sitter parsing library"
+HOMEPAGE="
+	https://github.com/tree-sitter/py-tree-sitter/
+	https://pypi.org/project/tree-sitter/
+"
+SRC_URI="
+	https://github.com/tree-sitter/py-tree-sitter/archive/v${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+"
+S=${WORKDIR}/py-${P}
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+
+# setuptools is needed for distutils import
+DEPEND=">=dev-libs/tree-sitter-0.25.0:="
+RDEPEND="${DEPEND}
+	$(python_gen_cond_dep '
+		dev-python/setuptools[${PYTHON_USEDEP}]
+	' 3.12 3.13)
+"
+BDEPEND="
+	test? (
+		>=dev-libs/tree-sitter-html-0.23.2[python,${PYTHON_USEDEP}]
+		>=dev-libs/tree-sitter-javascript-0.23.1[python,${PYTHON_USEDEP}]
+		>=dev-libs/tree-sitter-json-0.24.8[python,${PYTHON_USEDEP}]
+		>=dev-libs/tree-sitter-python-0.23.6[python,${PYTHON_USEDEP}]
+		>=dev-libs/tree-sitter-rust-0.23.2[python,${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.22.2-unbundle.patch
+)
+
+src_unpack() {
+	default
+	rmdir "${S}/tree_sitter/core" || die
+}
+
+src_test() {
+	rm -r tree_sitter || die
+	distutils-r1_src_test
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.25.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.25.1.ebuild
new file mode 100644
index 00000000000..cee8a94c10a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.25.1.ebuild
@@ -0,0 +1,58 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{11..14} )
+
+inherit distutils-r1
+
+DESCRIPTION="Python bindings to the Tree-sitter parsing library"
+HOMEPAGE="
+	https://github.com/tree-sitter/py-tree-sitter/
+	https://pypi.org/project/tree-sitter/
+"
+SRC_URI="
+	https://github.com/tree-sitter/py-tree-sitter/archive/v${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+"
+S=${WORKDIR}/py-${P}
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+
+# setuptools is needed for distutils import
+DEPEND=">=dev-libs/tree-sitter-0.25.0:="
+RDEPEND="${DEPEND}
+	$(python_gen_cond_dep '
+		dev-python/setuptools[${PYTHON_USEDEP}]
+	' 3.12 3.13)
+"
+BDEPEND="
+	test? (
+		>=dev-libs/tree-sitter-html-0.23.2[python,${PYTHON_USEDEP}]
+		>=dev-libs/tree-sitter-javascript-0.23.1[python,${PYTHON_USEDEP}]
+		>=dev-libs/tree-sitter-json-0.24.8[python,${PYTHON_USEDEP}]
+		>=dev-libs/tree-sitter-python-0.23.6[python,${PYTHON_USEDEP}]
+		>=dev-libs/tree-sitter-rust-0.23.2[python,${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.22.2-unbundle.patch
+)
+
+src_unpack() {
+	default
+	rmdir "${S}/tree_sitter/core" || die
+}
+
+src_test() {
+	rm -r tree_sitter || die
+	distutils-r1_src_test
+}

From 800bb02af0b3c201f2a2786ec1ac090ebb8728dc Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:10:30 +0000
Subject: [PATCH 056/122] dev-python/trove-classifiers: Sync with Gentoo

It's from Gentoo commit e768bf670da915220a294ce293a5968857cbb8fb.
---
 .../dev-python/trove-classifiers/Manifest     |  1 +
 .../trove-classifiers-2025.8.6.13.ebuild      | 46 +++++++++++++++++++
 2 files changed, 47 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.8.6.13.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest
index 0808d7839f2..c53b51160f8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest
@@ -1 +1,2 @@
 DIST trove_classifiers-2025.5.9.12.tar.gz 16940 BLAKE2B f6143f341d280eca611269c1a04b7f795d8f8733e97518d81d5872b8e1e13f745f7428737993a5c50285de24f56f899737d05fe073c683ddd69765b6081a6ebe SHA512 ee858f52c08b867fe4845ebb19f9b431308d216b5313e2bc030d63340860205d40125ef6cee218f734ccd49e5ae36011c8e3415f03d0ace182cb518ed5f2318d
+DIST trove_classifiers-2025.8.6.13.tar.gz 16932 BLAKE2B f4567cd2362897fe6cacea6c7a554bd1501d5ac176b7cc83d55a53a53599f8996efaa7c0d57f6911ed0a66f441d24127391bfab0f87ff81ea0d0ac4e5c46905e SHA512 14c9c4b082f4f92d02b84103e5fbb205ea8a716635e1db77c549776c6ce5caa46d4891bd79702f80323e0b140f65d2c9e0779cc168717c938fd471c046ae3102
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.8.6.13.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.8.6.13.ebuild
new file mode 100644
index 00000000000..362573b9839
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.8.6.13.ebuild
@@ -0,0 +1,46 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} python3_{13,14}t )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Canonical source for classifiers on PyPI (pypi.org)"
+HOMEPAGE="
+	https://github.com/pypa/trove-classifiers/
+	https://pypi.org/project/trove-classifiers/
+"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+EPYTEST_PLUGINS=()
+distutils_enable_tests pytest
+
+src_configure() {
+	grep -q 'build-backend = "setuptools' pyproject.toml ||
+		die "Upstream changed build-backend, recheck"
+	# write a custom pyproject.toml to ease hatchling bootstrap
+	cat > pyproject.toml <<-EOF || die
+		[build-system]
+		requires = ["flit_core >=3.2,<4"]
+		build-backend = "flit_core.buildapi"
+
+		[project]
+		name = "trove-classifiers"
+		version = "${PV}"
+		description = "Canonical source for classifiers on PyPI (pypi.org)."
+
+		[project.scripts]
+		trove-classifiers = "trove_classifiers.__main__:cli"
+	EOF
+}
+
+python_test() {
+	epytest
+	"${EPYTHON}" -m tests.lib || die
+}

From cbe53299b63a5b4af24aa4d2053a42d36cd44d1b Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:10:30 +0000
Subject: [PATCH 057/122] dev-python/truststore: Sync with Gentoo

It's from Gentoo commit 01753d23f6ab9fbc0c03814abb670577fddceab1.
---
 .../dev-python/truststore/Manifest            |  2 +
 .../truststore/truststore-0.10.1.ebuild       |  9 +----
 .../truststore/truststore-0.10.3.ebuild       | 40 +++++++++++++++++++
 .../truststore/truststore-0.10.4.ebuild       | 40 +++++++++++++++++++
 4 files changed, 83 insertions(+), 8 deletions(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.3.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.4.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/truststore/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/truststore/Manifest
index d97c8d06d81..6edfde706f9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/truststore/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/truststore/Manifest
@@ -1 +1,3 @@
 DIST truststore-0.10.1.gh.tar.gz 29120 BLAKE2B 2efb72b04f3e6fd5365d0d4f8fda12fcaa6fd2008cb17fdc76a679b4bff965040d30465cf78dc0a2cec2e02430100b5e6cc1f4ec4102326805a6d9bd52c38b10 SHA512 8a1c1269d44c0c33444c67d4302484eddcd3223b3e792b133efcf547ed1292cdca0ebc15447f68e7078928ea01d5c2108692dffb703d6bbdad0b9f1c23eeebe9
+DIST truststore-0.10.3.gh.tar.gz 29678 BLAKE2B b7731c471d749c2e685a84964d64afda93161d55fe74316da465ded4dabba01656b4e51e95b41cd0ce9e2745472f2835c5b2ad2cd4e393fa3891ee83bba54fa3 SHA512 64db26581aab8a010382f99b7609b46f4b6508b89430c75398d5f7c3f07b8bf666b12d7f82ff407aa163fbd614eaf309a00c8aac55eae0f7c031a4f66c9822de
+DIST truststore-0.10.4.gh.tar.gz 30349 BLAKE2B 0fe52c60dcd627c06eafae4a40946b14e81e2cbaf3a3c5c65b75a17c4a749688448813f353fce1f1836c30810552102402e44539d0ed5c4223c22458b7fe1f0a SHA512 b3cd9ca84ad2f82b8911ded4053686b0fc128d8bfee4bc217dc5e7df6294caf888fccfc1e8b87cf76f24638806ddc1e0b5cea4c37bc72c075c5078f4e85bef13
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.1.ebuild
index 3ad6dfe6683..acbd352144e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.1.ebuild
@@ -28,20 +28,13 @@ RESTRICT="test"
 BDEPEND="
 	test? (
 		dev-python/aiohttp[${PYTHON_USEDEP}]
-		dev-python/flaky[${PYTHON_USEDEP}]
 		dev-python/httpx[${PYTHON_USEDEP}]
 		dev-python/pyopenssl[${PYTHON_USEDEP}]
-		dev-python/pytest-asyncio[${PYTHON_USEDEP}]
-		dev-python/pytest-httpserver[${PYTHON_USEDEP}]
 		dev-python/requests[${PYTHON_USEDEP}]
 		dev-python/trustme[${PYTHON_USEDEP}]
 		dev-python/urllib3[${PYTHON_USEDEP}]
 	)
 "
 
+EPYTEST_PLUGINS=( pytest-{asyncio,httpserver,rerunfailures} )
 distutils_enable_tests pytest
-
-python_test() {
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	epytest -p asyncio -p pytest_httpserver
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.3.ebuild
new file mode 100644
index 00000000000..c7fedfd0565
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.3.ebuild
@@ -0,0 +1,40 @@
+# Copyright 2023-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} )
+
+inherit distutils-r1
+
+DESCRIPTION="Verify certificates using native system trust stores"
+HOMEPAGE="
+	https://github.com/sethmlarson/truststore/
+	https://pypi.org/project/truststore/
+"
+SRC_URI="
+	https://github.com/sethmlarson/truststore/archive/v${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+# The vast majority of tests require Internet access.
+PROPERTIES="test_network"
+RESTRICT="test"
+
+BDEPEND="
+	test? (
+		dev-python/aiohttp[${PYTHON_USEDEP}]
+		dev-python/httpx[${PYTHON_USEDEP}]
+		dev-python/pyopenssl[${PYTHON_USEDEP}]
+		dev-python/requests[${PYTHON_USEDEP}]
+		dev-python/trustme[${PYTHON_USEDEP}]
+		dev-python/urllib3[${PYTHON_USEDEP}]
+	)
+"
+
+EPYTEST_PLUGINS=( pytest-{asyncio,httpserver,rerunfailures} )
+distutils_enable_tests pytest
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.4.ebuild
new file mode 100644
index 00000000000..c7fedfd0565
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.4.ebuild
@@ -0,0 +1,40 @@
+# Copyright 2023-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} )
+
+inherit distutils-r1
+
+DESCRIPTION="Verify certificates using native system trust stores"
+HOMEPAGE="
+	https://github.com/sethmlarson/truststore/
+	https://pypi.org/project/truststore/
+"
+SRC_URI="
+	https://github.com/sethmlarson/truststore/archive/v${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+# The vast majority of tests require Internet access.
+PROPERTIES="test_network"
+RESTRICT="test"
+
+BDEPEND="
+	test? (
+		dev-python/aiohttp[${PYTHON_USEDEP}]
+		dev-python/httpx[${PYTHON_USEDEP}]
+		dev-python/pyopenssl[${PYTHON_USEDEP}]
+		dev-python/requests[${PYTHON_USEDEP}]
+		dev-python/trustme[${PYTHON_USEDEP}]
+		dev-python/urllib3[${PYTHON_USEDEP}]
+	)
+"
+
+EPYTEST_PLUGINS=( pytest-{asyncio,httpserver,rerunfailures} )
+distutils_enable_tests pytest

From 1d29fff3ed49942304af0e9b43c734daf8fdb43e Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:10:33 +0000
Subject: [PATCH 058/122] dev-util/bpftool: Sync with Gentoo

It's from Gentoo commit 59562ff709bac6eb61bafe8e3425c0f17a4853b3.
---
 .../portage-stable/dev-util/bpftool/Manifest  |   1 +
 .../dev-util/bpftool/bpftool-7.5.0-r1.ebuild  |   2 +-
 .../dev-util/bpftool/bpftool-7.6.0.ebuild     | 150 ++++++++++++++++++
 .../dev-util/bpftool/bpftool-9999.ebuild      |   2 +-
 4 files changed, 153 insertions(+), 2 deletions(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.6.0.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/Manifest
index 2f0798f394c..307d8b5b171 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/Manifest
@@ -1 +1,2 @@
 DIST bpftool-libbpf-v7.5.0-sources.tar.gz 1510032 BLAKE2B cc9beac4034317f89ae3c1088d1b1a1948778bcdb51d7ed7f566e4e5ab720c1128ca467d51d0bc3ffe7b1f69800249362baef5dfaf858275050f96b744fdbca6 SHA512 db12c305b77fea3689dbc1ce94527f0f21fa9de21fcdb36385e3fe492137335bb393f90e456c06601495ccc984230a531c432709db6514b545e0aeeda7ca3c99
+DIST bpftool-libbpf-v7.6.0-sources.tar.gz 1527883 BLAKE2B 5918519009b1ee258c33506cb52d216b08fbcd6365083a71d74b11e2c788fd4c6f7cfd78c84bb85074eb463dfa8d087b8e35c79d00f3a0810979640af6b334e6 SHA512 d443601227acd9a0db15896da186b0a47d426c44f2b6eaa822391594aa23d617a94ee94f284abb841529d41ef7c585a1087dd5ab1708ce068cc02b3c08b0a51b
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.5.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.5.0-r1.ebuild
index 2d8c0adfad3..970f2542062 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.5.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.5.0-r1.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 LLVM_COMPAT=( {15..20} )
 LLVM_OPTIONAL=1
-PYTHON_COMPAT=( python3_{11..13} )
+PYTHON_COMPAT=( python3_{11..14} )
 
 inherit bash-completion-r1 linux-info llvm-r1 python-any-r1 toolchain-funcs
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.6.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.6.0.ebuild
new file mode 100644
index 00000000000..b7516d18f9e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.6.0.ebuild
@@ -0,0 +1,150 @@
+# Copyright 2021-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( {15..20} )
+LLVM_OPTIONAL=1
+PYTHON_COMPAT=( python3_{11..14} )
+
+inherit bash-completion-r1 linux-info llvm-r1 python-any-r1 toolchain-funcs
+
+DESCRIPTION="Tool for inspection and simple manipulation of eBPF programs and maps"
+HOMEPAGE="https://github.com/libbpf/bpftool"
+
+if [[ ${PV} == *9999* ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/libbpf/bpftool.git"
+	EGIT_SUBMODULES=(libbpf)
+else
+	# bpftool typically vendors whatever libbpf is current at the time
+	# of a release, while libbpf publishes minor updates more frequently.
+	# Uncomment the following to bundle an updated libbpf e.g. in case of
+	# security or crasher bugs in libbpf and to keep the two synchronized.
+	# This allows us to quickly update the vendored lib with a revbump.
+	# Currently bpftool-x.y vendors libbpf-1.y; DO NOT mix different y versions.
+	# See the libbpf repo (https://github.com/libbpf/libbpf) for possible updates.
+	# LIBBPF_VERSION=1.5.0
+
+	if [[ ! -z ${LIBBPF_VERSION} ]] ; then
+		SRC_URI="https://github.com/libbpf/bpftool/archive/refs/tags/v${PV}.tar.gz -> bpftool-${PV}.tar.gz
+			https://github.com/libbpf/libbpf/archive/refs/tags/v${LIBBPF_VERSION}.tar.gz
+			  -> libbpf-${LIBBPF_VERSION}.tar.gz"
+	else
+		# use tarball with bundled libbpf
+		SRC_URI="https://github.com/libbpf/bpftool/releases/download/v${PV}/bpftool-libbpf-v${PV}-sources.tar.gz"
+		S="${WORKDIR}/bpftool-libbpf-v${PV}-sources"
+	fi
+
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+LICENSE="|| ( GPL-2 BSD-2 )"
+SLOT="0"
+IUSE="caps +clang llvm"
+REQUIRED_USE="llvm? ( ${LLVM_REQUIRED_USE} )"
+
+RDEPEND="
+	caps? ( sys-libs/libcap:= )
+	llvm? ( $(llvm_gen_dep 'llvm-core/llvm:${LLVM_SLOT}') )
+	!llvm? ( sys-libs/binutils-libs:= )
+	sys-libs/zlib:=
+	virtual/libelf:=
+"
+DEPEND="
+	${RDEPEND}
+	>=sys-kernel/linux-headers-5.8
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	app-arch/tar
+	dev-python/docutils
+	clang? ( $(llvm_gen_dep 'llvm-core/clang:${LLVM_SLOT}[llvm_targets_BPF]') )
+	!clang? ( sys-devel/bpf-toolchain )
+"
+
+CONFIG_CHECK="~DEBUG_INFO_BTF"
+
+pkg_setup() {
+	python-any-r1_pkg_setup
+	use llvm && llvm-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	# prepare libbpf if necessary
+	if [[ ! -z ${LIBBPF_VERSION} ]] ; then
+		rm -rf libbpf || die
+		ln -s "${WORKDIR}/libbpf-${LIBBPF_VERSION}" libbpf || die
+	fi
+
+	# remove -Werror from libbpf (bug 887981)
+	sed -i -e 's/\-Werror//g' libbpf/src/Makefile || die
+
+	# remove -Werror from bpftool feature detection
+	sed -i -e 's/-Werror//g' src/Makefile.feature || die
+
+	# remove hardcoded/unhelpful flags from bpftool
+	sed -i -e '/CFLAGS += -O2/d' -e 's/-W //g' -e 's/-Wextra //g' src/Makefile || die
+
+	# always build bpf bits with std=gnu11 for kernel compatibility (bug 955156)
+	sed -i 's/-fno-stack-protector/& -std=gnu11/g' src/Makefile || die
+
+	if ! use clang; then
+		# make people aware of what they are doing
+		ewarn "Using bpf-toolchain instead of clang due to USE=-clang."
+		ewarn "Please report any odd behaviours you observe, since using gcc for BPF"
+		ewarn "is still under development in both the Linux kernel and gcc itself."
+
+		# prevent attribute warning about preserve_access_index
+		# since gcc does not support '#pragma clang attribute push':
+		# https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=675b4e2
+		sed -i 's/std=gnu11/& -DBPF_NO_PRESERVE_ACCESS_INDEX/g' src/Makefile || die
+
+		# remove bpf target & add assembly annotations to fix CO-RE feature detection
+		sed -i -e 's/-target bpf/-dA/' src/Makefile.feature || die
+
+		# remove bpf target from skeleton build
+		sed -i -e 's/--target=bpf//g' src/Makefile || die
+	fi
+
+	# Use rst2man or rst2man.py depending on which one exists (#930076)
+	type -P rst2man >/dev/null || sed -i -e 's/rst2man/rst2man.py/g' docs/Makefile || die
+}
+
+bpftool_make() {
+	# which BPF compiler should we use?
+	if use clang; then
+		export CLANG="$(get_llvm_prefix -b)/bin/clang"
+		export LLVM_STRIP="$(get_llvm_prefix -b)/bin/llvm-strip"
+	else
+		# use bpf-toolchain
+		export CLANG="bpf-unknown-none-gcc"
+		export LLVM_STRIP="bpf-unknown-none-strip"
+	fi
+
+	tc-export AR CC LD
+
+	emake \
+		ARCH="$(tc-arch-kernel)" \
+		HOSTAR="$(tc-getBUILD_AR)" \
+		HOSTCC="$(tc-getBUILD_CC)" \
+		HOSTLD="$(tc-getBUILD_LD)" \
+		bash_compdir="$(get_bashcompdir)" \
+		feature-libcap="$(usex caps 1 0)" \
+		feature-llvm="$(usex llvm 1 0)" \
+		prefix="${EPREFIX}"/usr \
+		V=1 \
+		"$@"
+}
+
+src_compile() {
+	bpftool_make -C src
+	bpftool_make -C docs
+}
+
+src_install() {
+	bpftool_make DESTDIR="${D}" -C src install
+	bpftool_make mandir="${ED}"/usr/share/man -C docs install
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-9999.ebuild
index 0139c6ee78d..b7516d18f9e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-9999.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 LLVM_COMPAT=( {15..20} )
 LLVM_OPTIONAL=1
-PYTHON_COMPAT=( python3_{11..13} )
+PYTHON_COMPAT=( python3_{11..14} )
 
 inherit bash-completion-r1 linux-info llvm-r1 python-any-r1 toolchain-funcs
 

From 75cded2d7a673f31c6ca9f6d5299abeee64c0739 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:10:37 +0000
Subject: [PATCH 059/122] dev-util/maturin: Sync with Gentoo

It's from Gentoo commit 7e3cfdff6c0f7c885b8faf627f83e142a5a884ec.
---
 .../portage-stable/dev-util/maturin/Manifest  |   4 +
 .../dev-util/maturin/maturin-1.9.2.ebuild     | 157 ++++++++++++++++++
 .../dev-util/maturin/maturin-1.9.3.ebuild     | 157 ++++++++++++++++++
 3 files changed, 318 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.9.2.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.9.3.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-util/maturin/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/maturin/Manifest
index e7fb803301e..8c6b974834b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/maturin/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/maturin/Manifest
@@ -2,3 +2,7 @@ DIST maturin-1.8.6-vendor.tar.xz 15035340 BLAKE2B 0bc4016f460c704ac2be81af27842f
 DIST maturin-1.8.6.gh.tar.gz 551946 BLAKE2B 4fbeadeb25b69e99286238c9f7b7acb2bdde05242af760a0279664277334831a8cd03db49ddb3a0d528b6acd827d3ee3863e283318270ee53c3710c103c7461f SHA512 2616b3bcdbb96c77a3efeda5a24841675fded9d1299507c64905c94e57af15afa855c329f013a1e36527c2b8de4bf7acfb060e5d2828558da658a7b86d88bf8f
 DIST maturin-1.9.1-vendor.tar.xz 15643332 BLAKE2B cf7fd445186c5de8d09c99eb4a270b85c547bcf8dddf891c24bf0d2a75f634f49115de7841b1bce88c97391d784119e9dd4873a6a4903735443ce05958056a3b SHA512 93665219f09bb16f1abcf810bc60e3b9056521d42b03d5b42d03e76ad782f56c86f1ead5077ab260eb530ff444dd16cd7ce18df89cd72d3ac8f6dcb588f46582
 DIST maturin-1.9.1.gh.tar.gz 559847 BLAKE2B 8c69a437f7cabb71242e231baefb02b2f5c2a2f361318ddbcab18055d13b08836f36d690eac55307c61134e15f03511ea6bf711288f10871aff9578be41e6b44 SHA512 d4bc9994966cc654f109596a65d450924bdfd84b2ad5c1ea21ab93f8861b313258e0c60edc0843eeeb7d0d975a2f64f76d784868f1ef301fbb7748fc1ce56b96
+DIST maturin-1.9.2-vendor.tar.xz 15642720 BLAKE2B 59ac8c7371fa576b4e8514cafa14badeb750052ea89e197c2149ba83bd7f08a7197d1b3d56c8c20c3295676fbf103eb8ee84f6dc47504c4d84a6d9e2ac47b935 SHA512 3d34a10ebfaa4a3ad34442d71f113651ef91c5a6bd46daaff60b73d9eff36b6091a50c25484cb883a8afbffb84180c051ff6b9f60c1f4455b10b54f211752540
+DIST maturin-1.9.2.gh.tar.gz 562400 BLAKE2B 1cb97591e611a17bff562010178c1424a6f47ebb0c28c5ef2758a68b03936e88fc4447f73c87f2ec699959bf26d803343e0ee3870cbc4ab6439ab8528a298ade SHA512 537f2cf1e44339dca6631408a57e3136e2c2a4f9c5de8fa0b3ee52798776d9cede2f5f8691fe0e23b4d055eb3070367585253bbc28bb24509ad06337be593030
+DIST maturin-1.9.3-vendor.tar.xz 15638528 BLAKE2B bde95efcdcf0bcd0e559df0753b402756c1b8fa354c9be0b927f9dc969adb6b0b186914c6f35fcc0d7a02919c28e882de6b4d779fd51037ae3d6e963b23a1f16 SHA512 a3441ea6fd36e9284f6f8229ba2e370f5f43130e7bc4437e21d6a1612fb07b0671f29d98c2092c848db5dc22e1072ce06ae75f33bdc6a59e9297273c1fedcaf4
+DIST maturin-1.9.3.gh.tar.gz 563145 BLAKE2B a9b303d9279f007ce86f51fb423787e53e8a86e9c0cfda03795d85c8e781eca8141258e2ce7eeb8c0841205f69005d14ded6641e631cab872d2337c5e7f9969c SHA512 9c0c2e428db725b2f6e3bd06b166e2bb3448018c8f3b2e3e85effc4294cb0b7f25918761ac2fce70b4e98890b3f3fbeb93db64f5e5de39886d009ba8bc62a707
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.9.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.9.2.ebuild
new file mode 100644
index 00000000000..0b54cdcc1fa
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.9.2.ebuild
@@ -0,0 +1,157 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+DISTUTILS_UPSTREAM_PEP517=standalone
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} )
+RUST_MIN_VER=1.75.0
+inherit cargo distutils-r1 flag-o-matic shell-completion toolchain-funcs
+
+DESCRIPTION="Build and publish crates with pyo3, rust-cpython and cffi bindings"
+HOMEPAGE="https://www.maturin.rs/"
+SRC_URI="
+	https://github.com/PyO3/maturin/archive/refs/tags/v${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+	https://dev.gentoo.org/~ionen/distfiles/${P}-vendor.tar.xz
+"
+# ^ tarball also includes test-crates' Cargo.lock(s) crates for tests
+
+LICENSE="|| ( Apache-2.0 MIT ) doc? ( CC-BY-4.0 OFL-1.1 )"
+LICENSE+="
+	0BSD Apache-2.0 Apache-2.0-with-LLVM-exceptions BSD Boost-1.0 MIT
+	MPL-2.0 Unicode-3.0 Unicode-DFS-2016
+" # crates
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="doc +ssl test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	app-arch/xz-utils
+	app-arch/zstd:=
+	ssl? ( dev-libs/openssl:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	virtual/pkgconfig
+	doc? ( app-text/mdbook )
+	test? (
+		$(python_gen_cond_dep 'dev-python/cffi[${PYTHON_USEDEP}]' 'python*')
+		dev-python/boltons[${PYTHON_USEDEP}]
+		dev-python/virtualenv[${PYTHON_USEDEP}]
+		dev-vcs/git
+		elibc_musl? ( dev-util/patchelf )
+	)
+"
+
+QA_FLAGS_IGNORED="usr/bin/${PN}"
+
+src_prepare() {
+	distutils-r1_src_prepare
+
+	# we build the Rust executable (just once) via cargo_src_compile
+	sed -i -e '/setuptools_rust/d' -e '/rust_extensions/d' setup.py || die
+
+	if use test; then
+		# used to prevent use of network during tests, and silence pip
+		# if it finds unrelated issues with system packages (bug #913613)
+		cat > "${T}"/pip.conf <<-EOF || die
+			[global]
+			quiet = 2
+
+			[install]
+			no-index = yes
+			no-dependencies = yes
+		EOF
+
+		# uv does not work easily w/ network-sandbox, force virtualenv
+		sed -i 's/"uv"/"uv-not-found"/' tests/common/mod.rs || die
+
+		# increase timeouts for tests (bug #950332)
+		sed -i '/^#\[timeout/s/secs(60)/secs(300)/' tests/run.rs || die
+
+		# used by *git_sdist_generator tests
+		git init -q || die
+		git config --global user.email "larry@gentoo.org" || die
+		git config --global user.name "Larry the Cow" || die
+		git add . || die
+		git commit -qm init || die
+	fi
+}
+
+src_configure() {
+	export OPENSSL_NO_VENDOR=1
+	export ZSTD_SYS_USE_PKG_CONFIG=1
+
+	# https://github.com/rust-lang/stacker/issues/79
+	use s390 && ! is-flagq '-march=*' &&
+		append-cflags $(test-flags-CC -march=z10)
+
+	local myfeatures=(
+		# like release.yml + native-tls for better platform support than rustls
+		full
+		password-storage
+		$(usev ssl native-tls)
+	)
+
+	cargo_src_configure --no-default-features
+}
+
+python_compile_all() {
+	cargo_src_compile
+
+	use !doc || mdbook build -d html guide || die
+
+	if ! tc-is-cross-compiler; then
+		local maturin=$(cargo_target_dir)/maturin
+		"${maturin}" completions bash > "${T}"/${PN} || die
+		"${maturin}" completions fish > "${T}"/${PN}.fish || die
+		"${maturin}" completions zsh > "${T}"/_${PN} || die
+	else
+		ewarn "shell completion files were skipped due to cross-compilation"
+	fi
+}
+
+python_test() {
+	local -x MATURIN_TEST_PYTHON=${EPYTHON}
+	local -x PIP_CONFIG_FILE=${T}/pip.conf
+	local -x VIRTUALENV_SYSTEM_SITE_PACKAGES=1
+
+	# need this for (new) python versions not yet recognized by pyo3
+	local -x PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1
+
+	local skip=(
+		# picky cli output test that easily benignly fail (bug #937992)
+		--skip cli_tests
+		# avoid need for wasm over a single hello world test
+		--skip integration_wasm_hello_world
+		# fragile depending on rust version, also wants libpypy*-c.so for pypy
+		--skip pyo3_no_extension_module
+		# unimportant tests that require uv, and not obvious to get it
+		# to work with network-sandbox (not worth the trouble)
+		--skip develop_hello_world::case_2
+		--skip develop_pyo3_ffi_pure::case_2
+		# compliance test using zig requires an old libc to pass (bug #946967)
+		--skip integration_pyo3_mixed_py_subdir
+		# fails on sparc since rust-1.74 (bug #934573), skip for now given
+		# should not affect the pep517 backend which is all we need on sparc
+		$(usev sparc '--skip build_context::test::test_macosx_deployment_target')
+	)
+
+	cargo_src_test -- "${skip[@]}"
+}
+
+python_install_all() {
+	cargo_src_install
+
+	dodoc Changelog.md README.md
+	use doc && dodoc -r guide/html
+
+	if ! tc-is-cross-compiler; then
+		dobashcomp "${T}"/${PN}
+		dofishcomp "${T}"/${PN}.fish
+		dozshcomp "${T}"/_${PN}
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.9.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.9.3.ebuild
new file mode 100644
index 00000000000..0b54cdcc1fa
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.9.3.ebuild
@@ -0,0 +1,157 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+DISTUTILS_UPSTREAM_PEP517=standalone
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} )
+RUST_MIN_VER=1.75.0
+inherit cargo distutils-r1 flag-o-matic shell-completion toolchain-funcs
+
+DESCRIPTION="Build and publish crates with pyo3, rust-cpython and cffi bindings"
+HOMEPAGE="https://www.maturin.rs/"
+SRC_URI="
+	https://github.com/PyO3/maturin/archive/refs/tags/v${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+	https://dev.gentoo.org/~ionen/distfiles/${P}-vendor.tar.xz
+"
+# ^ tarball also includes test-crates' Cargo.lock(s) crates for tests
+
+LICENSE="|| ( Apache-2.0 MIT ) doc? ( CC-BY-4.0 OFL-1.1 )"
+LICENSE+="
+	0BSD Apache-2.0 Apache-2.0-with-LLVM-exceptions BSD Boost-1.0 MIT
+	MPL-2.0 Unicode-3.0 Unicode-DFS-2016
+" # crates
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="doc +ssl test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	app-arch/xz-utils
+	app-arch/zstd:=
+	ssl? ( dev-libs/openssl:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	virtual/pkgconfig
+	doc? ( app-text/mdbook )
+	test? (
+		$(python_gen_cond_dep 'dev-python/cffi[${PYTHON_USEDEP}]' 'python*')
+		dev-python/boltons[${PYTHON_USEDEP}]
+		dev-python/virtualenv[${PYTHON_USEDEP}]
+		dev-vcs/git
+		elibc_musl? ( dev-util/patchelf )
+	)
+"
+
+QA_FLAGS_IGNORED="usr/bin/${PN}"
+
+src_prepare() {
+	distutils-r1_src_prepare
+
+	# we build the Rust executable (just once) via cargo_src_compile
+	sed -i -e '/setuptools_rust/d' -e '/rust_extensions/d' setup.py || die
+
+	if use test; then
+		# used to prevent use of network during tests, and silence pip
+		# if it finds unrelated issues with system packages (bug #913613)
+		cat > "${T}"/pip.conf <<-EOF || die
+			[global]
+			quiet = 2
+
+			[install]
+			no-index = yes
+			no-dependencies = yes
+		EOF
+
+		# uv does not work easily w/ network-sandbox, force virtualenv
+		sed -i 's/"uv"/"uv-not-found"/' tests/common/mod.rs || die
+
+		# increase timeouts for tests (bug #950332)
+		sed -i '/^#\[timeout/s/secs(60)/secs(300)/' tests/run.rs || die
+
+		# used by *git_sdist_generator tests
+		git init -q || die
+		git config --global user.email "larry@gentoo.org" || die
+		git config --global user.name "Larry the Cow" || die
+		git add . || die
+		git commit -qm init || die
+	fi
+}
+
+src_configure() {
+	export OPENSSL_NO_VENDOR=1
+	export ZSTD_SYS_USE_PKG_CONFIG=1
+
+	# https://github.com/rust-lang/stacker/issues/79
+	use s390 && ! is-flagq '-march=*' &&
+		append-cflags $(test-flags-CC -march=z10)
+
+	local myfeatures=(
+		# like release.yml + native-tls for better platform support than rustls
+		full
+		password-storage
+		$(usev ssl native-tls)
+	)
+
+	cargo_src_configure --no-default-features
+}
+
+python_compile_all() {
+	cargo_src_compile
+
+	use !doc || mdbook build -d html guide || die
+
+	if ! tc-is-cross-compiler; then
+		local maturin=$(cargo_target_dir)/maturin
+		"${maturin}" completions bash > "${T}"/${PN} || die
+		"${maturin}" completions fish > "${T}"/${PN}.fish || die
+		"${maturin}" completions zsh > "${T}"/_${PN} || die
+	else
+		ewarn "shell completion files were skipped due to cross-compilation"
+	fi
+}
+
+python_test() {
+	local -x MATURIN_TEST_PYTHON=${EPYTHON}
+	local -x PIP_CONFIG_FILE=${T}/pip.conf
+	local -x VIRTUALENV_SYSTEM_SITE_PACKAGES=1
+
+	# need this for (new) python versions not yet recognized by pyo3
+	local -x PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1
+
+	local skip=(
+		# picky cli output test that easily benignly fail (bug #937992)
+		--skip cli_tests
+		# avoid need for wasm over a single hello world test
+		--skip integration_wasm_hello_world
+		# fragile depending on rust version, also wants libpypy*-c.so for pypy
+		--skip pyo3_no_extension_module
+		# unimportant tests that require uv, and not obvious to get it
+		# to work with network-sandbox (not worth the trouble)
+		--skip develop_hello_world::case_2
+		--skip develop_pyo3_ffi_pure::case_2
+		# compliance test using zig requires an old libc to pass (bug #946967)
+		--skip integration_pyo3_mixed_py_subdir
+		# fails on sparc since rust-1.74 (bug #934573), skip for now given
+		# should not affect the pep517 backend which is all we need on sparc
+		$(usev sparc '--skip build_context::test::test_macosx_deployment_target')
+	)
+
+	cargo_src_test -- "${skip[@]}"
+}
+
+python_install_all() {
+	cargo_src_install
+
+	dodoc Changelog.md README.md
+	use doc && dodoc -r guide/html
+
+	if ! tc-is-cross-compiler; then
+		dobashcomp "${T}"/${PN}
+		dofishcomp "${T}"/${PN}.fish
+		dozshcomp "${T}"/_${PN}
+	fi
+}

From 2dbe78a8ac95a304ca9770025104a95afe3a5dd0 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:10:41 +0000
Subject: [PATCH 060/122] dev-util/perf: Sync with Gentoo

It's from Gentoo commit 9b56ad9962fa9184a4b7acf7bad9460f79dba36c.
---
 .../portage-stable/dev-util/perf/Manifest     |   1 +
 .../dev-util/perf/perf-6.16.ebuild            | 350 ++++++++++++++++++
 2 files changed, 351 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.16.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
index 990a78cd9b1..7d4480bc210 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
@@ -1,3 +1,4 @@
 DIST linux-6.14.tar.xz 149408504 BLAKE2B 11835719804b406fe281ea1c276a84dc0cbaa808552ddcca9233d3eaeb1c001d0455c7205379b02de8e8db758c1bae6fe7ceb6697e63e3cf9ae7187dc7a9715e SHA512 71dcaa3772d8d9797c3ae30cae9c582b11a7047a3bbcb8dfd479a4dffb40ff0da74cf3d45175f50cc9992e338bcadd46c9c570f54054ca3bde6661768d3d22eb
 DIST linux-6.15.tar.xz 151168812 BLAKE2B 465596c6dc053ff3a3966302a906d3edb4f7ee1ef82f8c20b96360196d3414f5b1deeafa67b8340fcdecd3617280ba9b756d7073ad15c707865e256397b4af53 SHA512 d03788ffa8d8ae1b84ef1286bb44a08fc01432e509dfec6cccae5c5a5a47201d378aec2bcd21e6f0bbd1e625b26f47780c06ee9c1cef3775358f98b160923f30
+DIST linux-6.16.tar.xz 152620004 BLAKE2B 87bc4da7e89cc8265aebffea7ec6c09f711be24fee87cb1c03a264c03fd5a538d66aa806640835aa5103926e612cdfbc52d7c861d7f7065f1a8bb11d893b0921 SHA512 55a00f89ad6db6db2e26ff5dc5cfc96bbf6654e5bd5d17d2a3b944a47640367e54139716d230923187bebc6cb7756edc9511a620fb8abc6f32c50a658a734784
 DIST linux-6.7.tar.xz 141406528 BLAKE2B cecdbd19905e43e485ab73b352ced18b37f2a138c97a6956cadcda5d3d271001117dc1cf896b166ff019fc7f405f9539e2ed0d6112b0890efb04d182adf4fd0e SHA512 de06de556191614bd9daf077ae239360352a402bab407748e67f1e5108c92fd933e451707840ab22fe0f9976db3d1e1b60ca9d41cf894f015ca09b3f652b74ad
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.16.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.16.ebuild
new file mode 100644
index 00000000000..7f0ba7a9ef0
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.16.ebuild
@@ -0,0 +1,350 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( {18..20} )
+PYTHON_COMPAT=( python3_{10..14} python3_{13,14}t)
+inherit bash-completion-r1 estack flag-o-matic linux-info llvm-r1 toolchain-funcs python-r1
+
+DESCRIPTION="Userland tools for Linux Performance Counters"
+HOMEPAGE="https://perfwiki.github.io/main/"
+
+LINUX_V="${PV:0:1}.x"
+if [[ ${PV} == *_rc* ]] ; then
+	LINUX_VER=$(ver_cut 1-2).$(($(ver_cut 3)-1))
+	PATCH_VERSION=$(ver_cut 1-3)
+	LINUX_PATCH=patch-${PV//_/-}.xz
+	SRC_URI="https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/testing/${LINUX_PATCH}
+		https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/testing/v${PATCH_VERSION}/${LINUX_PATCH}"
+elif [[ ${PV} == *.*.* ]] ; then
+	# stable-release series
+	LINUX_VER=$(ver_cut 1-2)
+	LINUX_PATCH=patch-${PV}.xz
+	SRC_URI="https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/${LINUX_PATCH}"
+else
+	LINUX_VER=${PV}
+fi
+
+LINUX_SOURCES="linux-${LINUX_VER}.tar.xz"
+SRC_URI+=" https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/${LINUX_SOURCES}"
+
+S_K="${WORKDIR}/linux-${LINUX_VER}"
+S="${S_K}/tools/perf"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86 ~amd64-linux ~x86-linux"
+IUSE="abi_mips_o32 abi_mips_n32 abi_mips_n64 babeltrace capstone big-endian bpf caps crypt debug +doc gtk java libpfm +libtraceevent +libtracefs lzma numa perl +python +slang systemtap tcmalloc unwind"
+
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+"
+
+# setuptools (and Python) are always needed even if not building Python bindings
+BDEPEND="
+	${LINUX_PATCH+dev-util/patchutils}
+	${PYTHON_DEPS}
+	>=app-arch/tar-1.34-r2
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	app-alternatives/yacc
+	app-alternatives/lex
+	sys-apps/which
+	virtual/pkgconfig
+	doc? (
+		app-text/asciidoc
+		app-text/sgml-common
+		app-text/xmlto
+		sys-process/time
+	)
+"
+
+RDEPEND="
+	babeltrace? ( dev-util/babeltrace:0/1 )
+	bpf? (
+		dev-libs/libbpf
+		dev-util/bpftool
+		dev-util/pahole
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}=
+			llvm-core/llvm:${LLVM_SLOT}=
+		')
+	)
+	caps? ( sys-libs/libcap )
+	capstone? ( dev-libs/capstone )
+	crypt? ( dev-libs/openssl:= )
+	gtk? ( x11-libs/gtk+:2 )
+	java? ( virtual/jre:* )
+	libpfm? ( dev-libs/libpfm:= )
+	libtraceevent? ( dev-libs/libtraceevent )
+	libtracefs? ( dev-libs/libtracefs )
+	lzma? ( app-arch/xz-utils )
+	numa? ( sys-process/numactl )
+	perl? ( dev-lang/perl:= )
+	python? ( ${PYTHON_DEPS} )
+	slang? ( sys-libs/slang )
+	systemtap? ( dev-debug/systemtap )
+	tcmalloc? ( dev-util/google-perftools )
+	unwind? ( sys-libs/libunwind:= )
+	app-arch/zstd:=
+	dev-libs/elfutils
+	sys-libs/binutils-libs:=
+	sys-libs/zlib
+	virtual/libcrypt
+"
+
+DEPEND="${RDEPEND}
+	>=sys-kernel/linux-headers-5.10
+	java? ( virtual/jdk )
+"
+
+QA_FLAGS_IGNORED=(
+	'usr/bin/perf-read-vdso32' # not linked with anything except for libc
+	'usr/libexec/perf-core/dlfilters/.*' # plugins
+)
+
+pkg_pretend() {
+	if ! use doc ; then
+		ewarn "Without the doc USE flag you won't get any documentation nor man pages."
+		ewarn "And without man pages, you won't get any --help output for perf and its"
+		ewarn "sub-tools."
+	fi
+}
+
+pkg_setup() {
+	local CONFIG_CHECK="
+		~!SCHED_OMIT_FRAME_POINTER
+		~DEBUG_INFO
+		~FRAME_POINTER
+		~FTRACE
+		~FTRACE_SYSCALLS
+		~FUNCTION_TRACER
+		~KALLSYMS
+		~KALLSYMS_ALL
+		~KPROBES
+		~KPROBE_EVENTS
+		~PERF_EVENTS
+		~STACKTRACE
+		~TRACEPOINTS
+		~UPROBES
+		~UPROBE_EVENTS
+	"
+
+	use bpf && llvm-r1_pkg_setup
+	# We enable python unconditionally as libbpf always generates
+	# API headers using python script
+	python_setup
+
+	if use bpf ; then
+		CONFIG_CHECK+="~BPF ~BPF_EVENTS ~BPF_SYSCALL ~DEBUG_INFO_BTF ~HAVE_EBPF_JIT ~UNWINDER_FRAME_POINTER"
+	fi
+
+	linux-info_pkg_setup
+}
+
+# src_unpack and src_prepare are copied to dev-util/bpftool since
+# it's building from the same tarball, please keep it in sync with bpftool
+src_unpack() {
+	local paths=(
+		'arch/*/include/*' 'arch/*/lib/*' 'arch/*/tools/*' 'include/*'
+		'kernel/bpf/*' 'lib/*' 'scripts/*' 'tools/arch/*' 'tools/bpf/*'
+		'tools/build/*' 'tools/include/*' 'tools/lib/*' 'tools/perf/*'
+		'tools/scripts/*'
+	)
+
+	# We expect the tar implementation to support the -j option (both
+	# GNU tar and libarchive's tar support that).
+	echo ">>> Unpacking ${LINUX_SOURCES} (${paths[*]}) to ${PWD}"
+	gtar --wildcards -xpf "${DISTDIR}"/${LINUX_SOURCES} \
+		"${paths[@]/#/linux-${LINUX_VER}/}" || die
+
+	if [[ -n ${LINUX_PATCH} ]] ; then
+		eshopts_push -o noglob
+		ebegin "Filtering partial source patch"
+		xzcat "${DISTDIR}"/${LINUX_PATCH} | filterdiff -p1 ${paths[@]/#/-i} > ${P}.patch
+		assert -n "Unpacking to ${P} from ${DISTDIR}/${LINUX_PATCH} failed"
+		eend $? || die "filterdiff failed"
+		test -s ${P}.patch || die "patch is empty?!"
+		eshopts_pop
+	fi
+
+	local a
+	for a in ${A}; do
+		[[ ${a} == ${LINUX_SOURCES} ]] && continue
+		[[ ${a} == ${LINUX_PATCH} ]] && continue
+		unpack ${a}
+	done
+}
+
+src_prepare() {
+	default
+	if [[ -n ${LINUX_PATCH} ]] ; then
+		pushd "${S_K}" >/dev/null || die
+		eapply "${WORKDIR}"/${P}.patch
+		popd || die
+	fi
+
+	pushd "${S_K}" >/dev/null || die
+	# Gentoo patches go here
+	popd || die
+
+	# Drop some upstream too-developer-oriented flags and fix the
+	# Makefile in general
+	sed -i \
+		-e "s@\$(sysconfdir_SQ)/bash_completion.d@$(get_bashcompdir)@" \
+		"${S}"/Makefile.perf || die
+	# A few places still use -Werror w/out $(WERROR) protection.
+	sed -i -e 's@-Werror@@' \
+		"${S}"/Makefile.perf "${S_K}"/tools/lib/bpf/Makefile \
+		"${S_K}"/tools/lib/perf/Makefile || die
+
+	# Avoid the call to make kernelversion
+	sed -i -e '/PERF-VERSION-GEN/d' Makefile.perf || die
+	echo "#define PERF_VERSION \"${PV}\"" > PERF-VERSION-FILE
+
+	# The code likes to compile local assembly files which lack ELF markings.
+	find -name '*.S' -exec sed -i '$a.section .note.GNU-stack,"",%progbits' {} +
+}
+
+puse() { usex $1 "" 1; }
+perf_make() {
+	# The arch parsing is a bit funky.  The perf tools package is integrated
+	# into the kernel, so it wants an ARCH that looks like the kernel arch,
+	# but it also wants to know about the split value -- i386/x86_64 vs just
+	# x86.  We can get that by telling the func to use an older linux version.
+	# It's kind of a hack, but not that bad ...
+
+	# LIBDIR sets a search path of perf-gtk.so. Bug 515954
+
+	local arch=$(tc-arch-kernel)
+	local java_dir
+	use java && java_dir="${EPREFIX}/etc/java-config-2/current-system-vm"
+
+	# sync this with the whitelist in tools/perf/Makefile.config
+	local disable_libdw
+	if ! use amd64 && ! use x86 && \
+	   ! use arm && \
+	   ! use arm64 && \
+	   ! use ppc && ! use ppc64 \
+	   ! use s390 && \
+	   ! use riscv && \
+	   ! use loong
+	then
+		disable_libdw=1
+	fi
+
+	# perf directly invokes LD for linking without going through CC, on mips
+	# it is required to specify the emulation.  port of below buildroot patch
+	# https://patchwork.ozlabs.org/project/buildroot/patch/20170217105905.32151-1-Vincent.Riera@imgtec.com/
+	local linker="$(tc-getLD)"
+	if use mips
+	then
+		if use big-endian
+		then
+			use abi_mips_n64 && linker+=" -m elf64btsmip"
+			use abi_mips_n32 && linker+=" -m elf32btsmipn32"
+			use abi_mips_o32 && linker+=" -m elf32btsmip"
+		else
+			use abi_mips_n64 && linker+=" -m elf64ltsmip"
+			use abi_mips_n32 && linker+=" -m elf32ltsmipn32"
+			use abi_mips_o32 && linker+=" -m elf32ltsmip"
+		fi
+	fi
+
+	# FIXME: NO_CORESIGHT
+	local emakeargs=(
+		V=1 VF=1
+		HOSTCC="$(tc-getBUILD_CC)" HOSTLD="$(tc-getBUILD_LD)"
+		CC="$(tc-getCC)" CXX="$(tc-getCXX)" AR="$(tc-getAR)" LD="${linker}" NM="$(tc-getNM)"
+		CLANG="${CHOST}-clang"
+		PKG_CONFIG="$(tc-getPKG_CONFIG)"
+		prefix="${EPREFIX}/usr" bindir_relative="bin"
+		tipdir="share/doc/${PF}"
+		EXTRA_CFLAGS="${CFLAGS}"
+		EXTRA_LDFLAGS="${LDFLAGS}"
+		ARCH="${arch}"
+		BUILD_BPF_SKEL=$(usex bpf 1 "") \
+		BUILD_NONDISTRO=1
+		JDIR="${java_dir}"
+		CORESIGHT=
+		GTK2=$(usex gtk 1 "")
+		feature-gtk2-infobar=$(usex gtk 1 "")
+		NO_AUXTRACE=
+		NO_BACKTRACE=
+		NO_CAPSTONE=$(puse capstone)
+		NO_DEMANGLE=
+		NO_JEVENTS=$(puse python)
+		NO_JVMTI=$(puse java)
+		NO_LIBAUDIT=1
+		NO_LIBBABELTRACE=$(puse babeltrace)
+		NO_LIBBIONIC=1
+		NO_LIBBPF=$(puse bpf)
+		NO_LIBCAP=$(puse caps)
+		NO_LIBCRYPTO=$(puse crypt)
+		NO_LIBDW_DWARF_UNWIND="${disable_libdw}"
+		NO_LIBELF=
+		NO_LIBLLVM=$(puse bpf)
+		NO_LIBNUMA=$(puse numa)
+		NO_LIBPERL=$(puse perl)
+		NO_LIBPFM4=$(puse libpfm)
+		NO_LIBPYTHON=$(puse python)
+		NO_LIBTRACEEVENT=$(puse libtraceevent)
+		NO_LIBUNWIND=$(puse unwind)
+		NO_SDT=$(puse systemtap)
+		NO_SHELLCHECK=1
+		NO_SLANG=$(puse slang)
+		NO_LZMA=$(puse lzma)
+		NO_ZLIB=
+		TCMALLOC=$(usex tcmalloc 1 "")
+		WERROR=0
+		DEBUG=$(usex debug 1 "")
+		LIBDIR="/usr/libexec/perf-core"
+		libdir="${EPREFIX}/usr/$(get_libdir)"
+		plugindir="${EPREFIX}/usr/$(get_libdir)/perf/plugins"
+		"$@"
+	)
+	emake "${emakeargs[@]}"
+}
+
+src_compile() {
+	filter-lto
+
+	perf_make -f Makefile.perf
+	use doc && perf_make -C Documentation man
+}
+
+src_test() {
+	:
+}
+
+src_install() {
+	_install_python_ext() {
+		perf_make -f Makefile.perf install-python_ext DESTDIR="${D}"
+	}
+
+	perf_make -f Makefile.perf install DESTDIR="${D}"
+
+	if use python; then
+		python_foreach_impl _install_python_ext
+	fi
+
+	if use gtk; then
+		local libdir
+		libdir="$(get_libdir)"
+		# on some arches it ends up in lib even on 64bit, ppc64 for instance.
+		[[ -f "${ED}"/usr/lib/libperf-gtk.so ]] && libdir="lib"
+		mv "${ED}"/usr/${libdir}/libperf-gtk.so \
+			"${ED}"/usr/libexec/perf-core || die
+	fi
+
+	dodoc CREDITS
+
+	dodoc *txt Documentation/*.txt
+
+	# perf needs this decompressed to print out tips for users
+	docompress -x /usr/share/doc/${PF}/tips.txt
+
+	if use doc ; then
+		doman Documentation/*.1
+	fi
+}

From 80317adbf286ebe2fcf4f512859ee84b92584447 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:10:42 +0000
Subject: [PATCH 061/122] dev-util/pkgcheck: Sync with Gentoo

It's from Gentoo commit 73d14684113ef377a34369d2ec1b357453d325fc.
---
 .../portage-stable/dev-util/pkgcheck/Manifest |   1 +
 .../files/pkgcheck-0.10.36-ts0.25.patch       |  66 ++++++++++++
 ...0.36.ebuild => pkgcheck-0.10.36-r1.ebuild} |   5 +
 .../dev-util/pkgcheck/pkgcheck-0.10.37.ebuild | 102 ++++++++++++++++++
 .../dev-util/pkgcheck/pkgcheck-9999.ebuild    |   4 +-
 5 files changed, 177 insertions(+), 1 deletion(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/files/pkgcheck-0.10.36-ts0.25.patch
 rename sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/{pkgcheck-0.10.36.ebuild => pkgcheck-0.10.36-r1.ebuild} (96%)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.37.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/Manifest
index 7bed1e46c94..ee0d282ddb3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/Manifest
@@ -1,2 +1,3 @@
 DIST pkgcheck-0.10.34.tar.gz 382566 BLAKE2B d91302f673326bf4756e06c2bad1ad89b10f14a08ac54a24a6a00d7a95d4313e5e1755393aefa55e1057a396483b023cc38e67902238e2620a76961feb8b2a81 SHA512 57ec0ccea00cde4187219f85d23f755878e2298f6219cb9b18eb35f927a685aac2d9b9c73045f6750f90959abb6313a1ed99dedaae4f0ec6b59f08585253a410
 DIST pkgcheck-0.10.36.tar.gz 383659 BLAKE2B 1129695650790409d338f0a885d305dd4713c7f5222ae812ea6381c004b4c28321929df963240cd2a27c5dd0db7dd96f1a2829fff72dc627cdbd1399c600bb4e SHA512 c6c87ccd2d63e558efd7613142b2ac6dcfe4b4ea55b0e78d4502760d508015158189debebe26579e0cb26447fc4529ccb779fa4462d78af75e1c216f8a85177b
+DIST pkgcheck-0.10.37.tar.gz 388402 BLAKE2B 8e93290da49ed9d8231550a7602300c93d16f2dc4be040f88690bf4cf996b51f8aac3cb26b2478345b10dfb1faddc185d6316810d5bac091fc5cae504ced459d SHA512 84c1717fad6a7f41dcc069dbdb68e73062606d7e0497286cba7255e415e8b317cb4aa396d9bc46f873712a65fa0e3cd95216df368ca73381f81c160308329f15
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/files/pkgcheck-0.10.36-ts0.25.patch b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/files/pkgcheck-0.10.36-ts0.25.patch
new file mode 100644
index 00000000000..0e728e848ce
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/files/pkgcheck-0.10.36-ts0.25.patch
@@ -0,0 +1,66 @@
+Subject: [PATCH] bash: update support to tree-sitter~=0.25
+
+Also add backward compatible code for tree-sitter < 0.25.
+
+Signed-off-by: Arthur Zamarin <arthurzam@gentoo.org>
+--- a/pyproject.toml
++++ b/pyproject.toml
+@@ -6,7 +6,7 @@ requires = [
+ 	"lazy-object-proxy",
+ 	"lxml",
+ 	"pathspec",
+-	"tree-sitter~=0.24.0",
++	"tree-sitter~=0.25.0",
+ 	"tree-sitter-bash~=0.23.1",
+ 	"snakeoil~=0.10.11",
+ 	"pkgcore~=0.12.30",
+@@ -45,7 +45,7 @@ dependencies = [
+ 	"lazy-object-proxy",
+ 	"lxml",
+ 	"pathspec",
+-	"tree-sitter~=0.24.0",
++	"tree-sitter~=0.25.0",
+ 	"tree-sitter-bash~=0.23.1",
+ 	"snakeoil~=0.10.11",
+ 	"pkgcore~=0.12.30",
+--- a/src/pkgcheck/bash/__init__.py
++++ b/src/pkgcheck/bash/__init__.py
+@@ -6,7 +6,17 @@ import tree_sitter_bash
+ from tree_sitter import Language, Parser, Query
+
+ lang = Language(tree_sitter_bash.language())
+-query = lang.query
++
++try:
++    from tree_sitter import QueryCursor
++
++    def query(query_str: str) -> "QueryCursor":
++        return QueryCursor(Query(lang, query_str))
++except ImportError:  # tree-sitter < 0.25
++    QueryCursor = Query
++    query = lang.query
++
++
+ parser = Parser(language=lang)
+
+ # various parse tree queries
+@@ -29,14 +39,14 @@ class ParseTree:
+         """Return the ebuild string associated with a given parse tree node."""
+         return self.data[node.start_byte : node.end_byte].decode("utf8")
+
+-    def global_query(self, query: Query):
++    def global_query(self, query: QueryCursor):
+         """Run a given parse tree query returning only those nodes in global scope."""
+         for x in self.tree.root_node.children:
+             # skip nodes in function scope
+             if x.type != "function_definition":
+                 yield from chain.from_iterable(query.captures(x).values())
+
+-    def func_query(self, query: Query):
++    def func_query(self, query: QueryCursor):
+         """Run a given parse tree query returning only those nodes in function scope."""
+         for x in self.tree.root_node.children:
+             # only return nodes in function scope
+--
+2.50.1
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.36.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.36-r1.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.36.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.36-r1.ebuild
index dedc375e9b1..ffa0bc88512 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.36.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.36-r1.ebuild
@@ -55,8 +55,13 @@ BDEPEND="${RDEPEND}
 	)
 "
 
+PATCHES=(
+	"${FILESDIR}"/${P}-ts0.25.patch
+)
+
 SITEFILE="50${PN}-gentoo.el"
 
+EPYTEST_PLUGINS=( pkgcore )
 distutils_enable_tests pytest
 
 export USE_SYSTEM_TREE_SITTER_BASH=1
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.37.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.37.ebuild
new file mode 100644
index 00000000000..ac92e160714
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.37.ebuild
@@ -0,0 +1,102 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=standalone
+PYTHON_COMPAT=( python3_{11..14} )
+inherit elisp-common distutils-r1 optfeature
+
+if [[ ${PV} == *9999 ]] ; then
+	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/pkgcore/pkgcheck.git
+		https://github.com/pkgcore/pkgcheck.git"
+	inherit git-r3
+else
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
+	inherit pypi
+fi
+
+DESCRIPTION="pkgcore-based QA utility for ebuild repos"
+HOMEPAGE="https://github.com/pkgcore/pkgcheck"
+
+LICENSE="BSD MIT"
+SLOT="0"
+IUSE="emacs"
+
+if [[ ${PV} == *9999 ]]; then
+	RDEPEND="
+		~dev-python/snakeoil-9999[${PYTHON_USEDEP}]
+		~sys-apps/pkgcore-9999[${PYTHON_USEDEP}]"
+else
+	RDEPEND="
+		>=dev-python/snakeoil-0.10.11[${PYTHON_USEDEP}]
+		>=sys-apps/pkgcore-0.12.30[${PYTHON_USEDEP}]"
+fi
+RDEPEND+="
+	app-arch/zstd
+	>=dev-libs/tree-sitter-bash-0.21.0[python,${PYTHON_USEDEP}]
+	dev-python/chardet[${PYTHON_USEDEP}]
+	dev-python/lazy-object-proxy[${PYTHON_USEDEP}]
+	dev-python/lxml[${PYTHON_USEDEP}]
+	dev-python/pathspec[${PYTHON_USEDEP}]
+	>=dev-python/tree-sitter-0.25.0[${PYTHON_USEDEP}]
+	emacs? (
+		>=app-editors/emacs-24.1:*
+		app-emacs/ebuild-mode
+		app-emacs/flycheck
+	)
+"
+BDEPEND="${RDEPEND}
+	>=dev-python/flit-core-3.8[${PYTHON_USEDEP}]
+	test? (
+		dev-python/pytest[${PYTHON_USEDEP}]
+		dev-python/requests[${PYTHON_USEDEP}]
+		dev-vcs/git
+	)
+"
+
+SITEFILE="50${PN}-gentoo.el"
+
+EPYTEST_PLUGINS=( pkgcore )
+distutils_enable_tests pytest
+
+export USE_SYSTEM_TREE_SITTER_BASH=1
+
+src_prepare() {
+	distutils-r1_src_prepare
+
+	# unpin dependencies
+	sed -i -e 's:~=:>=:' pyproject.toml || die
+}
+
+src_compile() {
+	distutils-r1_src_compile
+
+	if use emacs ; then
+	   pushd "${S}"/contrib/emacs >/dev/null || die
+	   elisp-compile *.el
+	   popd >/dev/null || die
+	fi
+}
+
+python_install_all() {
+	local DOCS=( NEWS.rst )
+	[[ ${PV} == *9999 ]] || doman build/sphinx/man/*
+	distutils-r1_python_install_all
+
+	if use emacs ; then
+		elisp-install ${PN} "${S}"/contrib/emacs/*.el{,c}
+		elisp-site-file-install "${FILESDIR}/${SITEFILE}"
+	fi
+}
+
+pkg_postinst() {
+	use emacs && elisp-site-regen
+
+	optfeature "Network check support" dev-python/requests
+	optfeature "Perl module version check support" dev-perl/Gentoo-PerlMod-Version
+}
+
+pkg_postrm() {
+	use emacs && elisp-site-regen
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-9999.ebuild
index 8a8dae53dfc..ac92e160714 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-9999.ebuild
@@ -33,12 +33,13 @@ else
 		>=sys-apps/pkgcore-0.12.30[${PYTHON_USEDEP}]"
 fi
 RDEPEND+="
+	app-arch/zstd
 	>=dev-libs/tree-sitter-bash-0.21.0[python,${PYTHON_USEDEP}]
 	dev-python/chardet[${PYTHON_USEDEP}]
 	dev-python/lazy-object-proxy[${PYTHON_USEDEP}]
 	dev-python/lxml[${PYTHON_USEDEP}]
 	dev-python/pathspec[${PYTHON_USEDEP}]
-	>=dev-python/tree-sitter-0.23.0[${PYTHON_USEDEP}]
+	>=dev-python/tree-sitter-0.25.0[${PYTHON_USEDEP}]
 	emacs? (
 		>=app-editors/emacs-24.1:*
 		app-emacs/ebuild-mode
@@ -56,6 +57,7 @@ BDEPEND="${RDEPEND}
 
 SITEFILE="50${PN}-gentoo.el"
 
+EPYTEST_PLUGINS=( pkgcore )
 distutils_enable_tests pytest
 
 export USE_SYSTEM_TREE_SITTER_BASH=1

From a4fa2918f535cfa4c1eb6de735f23f60f9c59c1f Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:10:42 +0000
Subject: [PATCH 062/122] dev-util/pkgconf: Sync with Gentoo

It's from Gentoo commit 83c1daf24323d0e9890503ea2a6c64518cc979fa.
---
 .../portage-stable/dev-util/pkgconf/pkgconf-2.5.1.ebuild        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.5.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.5.1.ebuild
index 6654342ab94..38d7f542b36 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.5.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.5.1.ebuild
@@ -10,7 +10,7 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/pkgconf/pkgconf"
 else
 	SRC_URI="https://distfiles.ariadne.space/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 DESCRIPTION="pkg-config compatible replacement with no dependencies other than C99"

From d761672c31ccef81b08b98ee61f1f96eb4c6868f Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:10:43 +0000
Subject: [PATCH 063/122] dev-util/xdelta: Sync with Gentoo

It's from Gentoo commit 6830dcba0cff81ab45f862a1c37d467640a06ea8.
---
 .../portage-stable/dev-util/xdelta/xdelta-3.0.11-r1.ebuild    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-util/xdelta/xdelta-3.0.11-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/xdelta/xdelta-3.0.11-r1.ebuild
index ca61eeba127..b1164367d23 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/xdelta/xdelta-3.0.11-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/xdelta/xdelta-3.0.11-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 2002-2022 Gentoo Authors
+# Copyright 2002-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -12,7 +12,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="GPL-2"
 SLOT="3"
-KEYWORDS="~alpha amd64 ~arm64 ~hppa ~loong ppc ppc64 ~riscv sparc x86"
+KEYWORDS="~alpha amd64 arm64 ~hppa ~loong ppc ppc64 ~riscv sparc x86"
 IUSE="examples lzma"
 
 RDEPEND="lzma? ( app-arch/xz-utils:= )"

From 22f0d5608aa3912289587dcb687a85ce37117bef Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:11:09 +0000
Subject: [PATCH 064/122] eclass/dist-kernel-utils: Sync with Gentoo

It's from Gentoo commit 42eddd2bb0c152f2247810e74d2a643358b7ad66.
---
 .../portage-stable/eclass/dist-kernel-utils.eclass         | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/sdk_container/src/third_party/portage-stable/eclass/dist-kernel-utils.eclass b/sdk_container/src/third_party/portage-stable/eclass/dist-kernel-utils.eclass
index 49977c18795..975efd2d63c 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/dist-kernel-utils.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/dist-kernel-utils.eclass
@@ -180,7 +180,14 @@ dist-kernel_reinstall_initramfs() {
 	local kernel_dir=${1:-${KV_DIR}}
 	local ver=${2:-${KV_FULL}}
 
+	# If this is set it will have an effect on the name of the output
+	# image. Set this variable to track this setting.
+	if grep -q "CONFIG_EFI_ZBOOT=y" "${kernel_dir}/.config"; then
+		KERNEL_EFI_ZBOOT=1
+	fi
+
 	local image_path=${kernel_dir}/$(dist-kernel_get_image_path)
+
 	if [[ ! -f ${image_path} ]]; then
 		eerror "Kernel install missing, image not found:"
 		eerror "  ${image_path}"

From 36aff3fe409f4337b37814d21ceffd8d83cbfff8 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:11:09 +0000
Subject: [PATCH 065/122] eclass/distutils-r1: Sync with Gentoo

It's from Gentoo commit 7297f99fe2ccfed6490f66e6f5b7e2e3a8e8a8a7.
---
 .../third_party/portage-stable/eclass/distutils-r1.eclass  | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
index 7b025261eb2..e9826f4cf3d 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
@@ -292,7 +292,7 @@ _distutils_set_globals() {
 			;;
 		scikit-build-core)
 			bdep+='
-				>=dev-python/scikit-build-core-0.10.7[${PYTHON_USEDEP}]
+				>=dev-python/scikit-build-core-0.11.5[${PYTHON_USEDEP}]
 			'
 			;;
 		setuptools)
@@ -554,6 +554,9 @@ distutils_enable_tests() {
 			;&
 		pytest)
 			test_pkgs+=' >=dev-python/pytest-7.4.4[${PYTHON_USEDEP}]'
+			if [[ -n ${EPYTEST_RERUNS} ]]; then
+				test_pkgs+=' dev-python/pytest-rerunfailures[${PYTHON_USEDEP}]'
+			fi
 			if [[ -n ${EPYTEST_TIMEOUT} ]]; then
 				test_pkgs+=' dev-python/pytest-timeout[${PYTHON_USEDEP}]'
 			fi
@@ -1142,9 +1145,9 @@ distutils_pep517_install() {
 					ninjaopts = shlex.split(os.environ["NINJAOPTS"])
 					print(json.dumps({
 						"build.tool-args": ninjaopts,
+						"build.verbose": True,
 						"cmake.args": ";".join(sys.argv[1:]),
 						"cmake.build-type": "${CMAKE_BUILD_TYPE}",
-						"cmake.verbose": True,
 						"install.strip": False,
 					}))
 				EOF

From fddf4a46e92bb4236adfd7dc5ff28a8c921c6ccd Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:11:25 +0000
Subject: [PATCH 066/122] eclass/fcaps: Sync with Gentoo

It's from Gentoo commit 2e32af007cf8a21bd77002ca45c9bccc711a2bd0.
---
 .../portage-stable/eclass/fcaps.eclass        | 36 ++++++++++---------
 1 file changed, 19 insertions(+), 17 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/eclass/fcaps.eclass b/sdk_container/src/third_party/portage-stable/eclass/fcaps.eclass
index 5cb781a7a75..81c1ca62368 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/fcaps.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/fcaps.eclass
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # @ECLASS: fcaps.eclass
@@ -84,13 +84,16 @@ esac
 # appropriate path var ($D/$ROOT/etc...) will be prefixed based on the current
 # ebuild phase.
 #
-# The caps mode (default 711) is used to set the permission on the file if
-# capabilities were properly set on the file.
+# The caps mode is used to set the permission on the file if capabilities
+# were properly set on the file.  No change is applied by default.
 #
 # If the system is unable to set capabilities, it will use the specified user,
-# group, and mode (presumably to make the binary set*id).  The defaults there
-# are 0:0 and 4711.  Otherwise, the ownership and permissions will be
-# unchanged.
+# group, and mode.  The user and group default to 0.  If mode is unspecified, no
+# change is applied.
+#
+# For example, "-m u+s" may be used to enable suid as a fallback when file caps
+# are unavailable.  This should be used with care, typically when the
+# application is written to handle dropping privileges itself.
 fcaps() {
 	debug-print-function ${FUNCNAME} "$@"
 
@@ -102,14 +105,9 @@ fcaps() {
 	# Process the user options first.
 	local owner='0'
 	local group='0'
-	local mode=u+s
+	local mode=
 	local caps_mode=
 
-	if [[ -n ${FCAPS_DENY_WORLD_READ} ]]; then
-		mode=u+s,go-r
-		caps_mode=go-r
-	fi
-
 	while [[ $# -gt 0 ]] ; do
 		case $1 in
 		-o) owner=$2; shift;;
@@ -143,12 +141,16 @@ fcaps() {
 	for file ; do
 		[[ ${file} != /* ]] && file="${root}/${file}"
 
+		# Remove the read bits if requested.
+		if [[ -n ${FCAPS_DENY_WORLD_READ} ]]; then
+			chmod go-r "${file}" || die
+		fi
+
 		if use filecaps ; then
 			# Try to set capabilities.  Ignore errors when the
 			# fs doesn't support it, but abort on all others.
 			debug-print "${FUNCNAME}: setting caps '${caps}' on '${file}'"
 
-			# Remove the read bits if requested.
 			if [[ -n ${caps_mode} ]]; then
 				chmod ${caps_mode} "${file}" || die
 			fi
@@ -182,11 +184,11 @@ fcaps() {
 		fi
 
 		# If we're still here, setcaps failed.
-		if [[ -n ${owner} || -n ${group} ]]; then
-			debug-print "${FUNCNAME}: setting owner on '${file}'"
-			chown "${owner}:${group}" "${file}" || die
-		fi
 		if [[ -n ${mode} ]]; then
+			if [[ -n ${owner} || -n ${group} ]]; then
+				debug-print "${FUNCNAME}: setting owner on '${file}'"
+				chown "${owner}:${group}" "${file}" || die
+			fi
 			debug-print "${FUNCNAME}: setting mode on '${file}'"
 			chmod ${mode} "${file}" || die
 		fi

From 9866fc9ed9b03834d1641a0bfe92c90fe9983979 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:11:43 +0000
Subject: [PATCH 067/122] eclass/java-pkg-opt-2: Sync with Gentoo

It's from Gentoo commit 528b99658a59955f36055f2529ebe189dae556d1.
---
 .../third_party/portage-stable/eclass/java-pkg-opt-2.eclass | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/eclass/java-pkg-opt-2.eclass b/sdk_container/src/third_party/portage-stable/eclass/java-pkg-opt-2.eclass
index 7b3e79749fb..47594c3b702 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/java-pkg-opt-2.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/java-pkg-opt-2.eclass
@@ -1,4 +1,4 @@
-# Copyright 2004-2023 Gentoo Authors
+# Copyright 2004-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # @ECLASS: java-pkg-opt-2.eclass
@@ -6,7 +6,7 @@
 # java@gentoo.org
 # @AUTHOR:
 # Thomas Matthijs <axxo@gentoo.org>
-# @SUPPORTED_EAPIS: 7 8
+# @SUPPORTED_EAPIS: 8
 # @PROVIDES: java-utils-2
 # @BLURB: Eclass for package with optional Java support
 # @DESCRIPTION:
@@ -14,7 +14,7 @@
 # support.
 
 case ${EAPI} in
-	7|8) ;;
+	8) ;;
 	*) die "${ECLASS}: EAPI ${EAPI:-0} not supported" ;;
 esac
 

From 68a6e62f7a925dc56b27f650d7c895b3eff651ec Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:11:43 +0000
Subject: [PATCH 068/122] eclass/java-utils-2: Sync with Gentoo

It's from Gentoo commit 3569dfc72dc6aba486bdd4598ac73cd86859d6ee.
---
 .../src/third_party/portage-stable/eclass/java-utils-2.eclass | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/eclass/java-utils-2.eclass b/sdk_container/src/third_party/portage-stable/eclass/java-utils-2.eclass
index c11f1652fc5..3b2b9d6a5b2 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/java-utils-2.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/java-utils-2.eclass
@@ -6,7 +6,7 @@
 # java@gentoo.org
 # @AUTHOR:
 # Thomas Matthijs <axxo@gentoo.org>, Karl Trygve Kalleberg <karltk@gentoo.org>
-# @SUPPORTED_EAPIS: 7 8
+# @SUPPORTED_EAPIS: 8
 # @BLURB: Base eclass for Java packages
 # @DESCRIPTION:
 # This eclass provides functionality which is used by java-pkg-2.eclass and
@@ -20,7 +20,7 @@ if [[ -z ${_JAVA_UTILS_2_ECLASS} ]] ; then
 _JAVA_UTILS_2_ECLASS=1
 
 case ${EAPI} in
-	7|8) ;;
+	8) ;;
 	*) die "${ECLASS}: EAPI ${EAPI:-0} not supported" ;;
 esac
 

From aca0982531b3d1e0321171709af19494a9639f40 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:12:51 +0000
Subject: [PATCH 069/122] eclass/python-utils-r1: Sync with Gentoo

It's from Gentoo commit 87a034bd840d2d9095bccb29e7cc0922ec29b4ad.
---
 .../eclass/python-utils-r1.eclass             | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
index 9cdfdc87019..13ed8750120 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
@@ -1354,6 +1354,16 @@ _set_epytest_plugins() {
 	fi
 }
 
+# @ECLASS_VARIABLE: EPYTEST_RERUNS
+# @DEFAULT_UNSET
+# @DESCRIPTION:
+# If set to a non-empty value, enables pytest-rerunfailures plugin
+# and sets rerun count to the specified value.  This variable can be
+# either set in ebuilds with flaky tests, or by user to try if it helps.
+# If this variable is set prior to calling distutils_enable_tests
+# in distutils-r1, a test dependency on dev-python/pytest-rerunfailures
+# is added automatically.
+
 # @ECLASS_VARIABLE: EPYTEST_TIMEOUT
 # @DEFAULT_UNSET
 # @DESCRIPTION:
@@ -1517,6 +1527,18 @@ epytest() {
 		)
 	fi
 
+	if [[ -n ${EPYTEST_RERUNS} ]]; then
+		if [[ ${PYTEST_PLUGINS} != *pytest_rerunfailures* ]]; then
+			args+=(
+				-p rerunfailures
+			)
+		fi
+
+		args+=(
+			"--reruns=${EPYTEST_RERUNS}"
+		)
+	fi
+
 	if [[ -n ${EPYTEST_TIMEOUT} ]]; then
 		if [[ ${PYTEST_PLUGINS} != *pytest_timeout* ]]; then
 			args+=(

From 0b37680800f2ab6d72e03f1112801658a2fa7f5f Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:13:01 +0000
Subject: [PATCH 070/122] eclass/rust: Sync with Gentoo

It's from Gentoo commit 19e4eb1d5f5229dfc0ec1f4bcf3cbb0c9ca4af5d.
---
 sdk_container/src/third_party/portage-stable/eclass/rust.eclass | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sdk_container/src/third_party/portage-stable/eclass/rust.eclass b/sdk_container/src/third_party/portage-stable/eclass/rust.eclass
index 183d5cd4efa..3c9693e00f5 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/rust.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/rust.eclass
@@ -68,6 +68,7 @@ fi
 # Definitive list of Rust slots and the associated LLVM slot, newest first.
 declare -A -g -r _RUST_LLVM_MAP=(
 	["9999"]=20
+	["1.89.0"]=20
 	["1.88.0"]=20
 	["1.87.0"]=20
 	["1.86.0"]=19
@@ -95,6 +96,7 @@ declare -A -g -r _RUST_LLVM_MAP=(
 # this array is used to store the Rust slots in a more convenient order for iteration.
 declare -a -g -r _RUST_SLOTS_ORDERED=(
 	"9999"
+	"1.89.0"
 	"1.88.0"
 	"1.87.0"
 	"1.86.0"

From 8351d3e37252deece998288e61f72c1240cc689d Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:13:07 +0000
Subject: [PATCH 071/122] eclass/sgml-catalog-r1: Sync with Gentoo

It's from Gentoo commit 790bbc296c0607d3fdd1bc3ffcb374dd428a7a4f.
---
 .../portage-stable/eclass/sgml-catalog-r1.eclass            | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/eclass/sgml-catalog-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/sgml-catalog-r1.eclass
index eff6db31062..4b4d5334670 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/sgml-catalog-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/sgml-catalog-r1.eclass
@@ -1,4 +1,4 @@
-# Copyright 2019-2023 Gentoo Authors
+# Copyright 2019-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # @ECLASS: sgml-catalog-r1.eclass
@@ -6,14 +6,14 @@
 # Michał Górny <mgorny@gentoo.org>
 # @AUTHOR:
 # Michał Górny <mgorny@gentoo.org>
-# @SUPPORTED_EAPIS: 7
+# @SUPPORTED_EAPIS: 7 8
 # @BLURB: Functions for installing SGML catalogs
 # @DESCRIPTION:
 # This eclass regenerates /etc/sgml/catalog as necessary for the DocBook
 # tooling. This is done via exported pkg_postinst and pkg_postrm phases.
 
 case ${EAPI} in
-	7) ;;
+	7|8) ;;
 	*) die "${ECLASS}: EAPI ${EAPI:-0} not supported" ;;
 esac
 

From c38c8bf3d7f0874ac79e38c88480fff68fde94b3 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:13:21 +0000
Subject: [PATCH 072/122] eclass/toolchain: Sync with Gentoo

It's from Gentoo commit 96c789720745edbfefb924e9c2d94c2961c2cae8.
---
 .../src/third_party/portage-stable/eclass/toolchain.eclass    | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass b/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
index 274789559d5..efa78f61367 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
@@ -1199,6 +1199,8 @@ toolchain_setup_d() {
 toolchain_src_configure() {
 	BUILD_CONFIG_TARGETS=()
 	is-flagq '-O3' && BUILD_CONFIG_TARGETS+=( bootstrap-O3 )
+	is-flagq '-fsanitize=address' && BUILD_CONFIG_TARGETS+=( bootstrap-asan )
+	is-flagq '-fsanitize=undefined' && BUILD_CONFIG_TARGETS+=( bootstrap-ubsan )
 
 	downgrade_arch_flags
 	gcc_do_filter_flags
@@ -2178,7 +2180,7 @@ gcc_do_filter_flags() {
 	fi
 
 	if ver_test -lt 16.1 ; then
-		filter-flags -fdiagnostics-details
+		filter-flags '-fdiagnostics-show-context=*'
 	fi
 
 	# Ada: PR116226

From 067239bd09dec755feed88a2b42cf8a08d406373 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:13:45 +0000
Subject: [PATCH 073/122] licenses: Sync with Gentoo

It's from Gentoo commit 783cd80342ba02428c5fe725a850c795201adf47.
---
 .../src/third_party/portage-stable/licenses/CC-BY-4.0      | 6 +++---
 .../src/third_party/portage-stable/licenses/CC-BY-NC-4.0   | 6 +++---
 .../third_party/portage-stable/licenses/CC-BY-NC-ND-4.0    | 7 +++----
 .../third_party/portage-stable/licenses/CC-BY-NC-SA-4.0    | 6 +++---
 .../src/third_party/portage-stable/licenses/CC-BY-ND-4.0   | 7 +++----
 .../src/third_party/portage-stable/licenses/CC-BY-SA-4.0   | 6 +++---
 6 files changed, 18 insertions(+), 20 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/licenses/CC-BY-4.0 b/sdk_container/src/third_party/portage-stable/licenses/CC-BY-4.0
index 521adbb24eb..79c4cbfc057 100644
--- a/sdk_container/src/third_party/portage-stable/licenses/CC-BY-4.0
+++ b/sdk_container/src/third_party/portage-stable/licenses/CC-BY-4.0
@@ -33,7 +33,7 @@ exhaustive, and do not form part of our licenses.
      material not subject to the license. This includes other CC-
      licensed material, or material used under an exception or
      limitation to copyright. More considerations for licensors:
-	wiki.creativecommons.org/Considerations_for_licensors
+     wiki.creativecommons.org/Considerations_for_licensors
 
      Considerations for the public: By using one of our public
      licenses, a licensor grants the public permission to use the
@@ -50,7 +50,7 @@ exhaustive, and do not form part of our licenses.
      Although not required by our licenses, you are encouraged to
      respect those requests where reasonable. More considerations
      for the public:
-	wiki.creativecommons.org/Considerations_for_licensees
+     wiki.creativecommons.org/Considerations_for_licensees
 
 =======================================================================
 
@@ -378,7 +378,7 @@ Section 8 -- Interpretation.
 Creative Commons is not a party to its public
 licenses. Notwithstanding, Creative Commons may elect to apply one of
 its public licenses to material it publishes and in those instances
-will be considered the “Licensor.” The text of the Creative Commons
+will be considered the "Licensor." The text of the Creative Commons
 public licenses is dedicated to the public domain under the CC0 Public
 Domain Dedication. Except for the limited purpose of indicating that
 material is shared under a Creative Commons public license or as
diff --git a/sdk_container/src/third_party/portage-stable/licenses/CC-BY-NC-4.0 b/sdk_container/src/third_party/portage-stable/licenses/CC-BY-NC-4.0
index 5243f3cfe9d..fb7554e7ed7 100644
--- a/sdk_container/src/third_party/portage-stable/licenses/CC-BY-NC-4.0
+++ b/sdk_container/src/third_party/portage-stable/licenses/CC-BY-NC-4.0
@@ -33,7 +33,7 @@ exhaustive, and do not form part of our licenses.
      material not subject to the license. This includes other CC-
      licensed material, or material used under an exception or
      limitation to copyright. More considerations for licensors:
-	wiki.creativecommons.org/Considerations_for_licensors
+     wiki.creativecommons.org/Considerations_for_licensors
 
      Considerations for the public: By using one of our public
      licenses, a licensor grants the public permission to use the
@@ -50,7 +50,7 @@ exhaustive, and do not form part of our licenses.
      Although not required by our licenses, you are encouraged to
      respect those requests where reasonable. More considerations
      for the public:
-	wiki.creativecommons.org/Considerations_for_licensees
+     wiki.creativecommons.org/Considerations_for_licensees
 
 =======================================================================
 
@@ -392,7 +392,7 @@ Section 8 -- Interpretation.
 Creative Commons is not a party to its public
 licenses. Notwithstanding, Creative Commons may elect to apply one of
 its public licenses to material it publishes and in those instances
-will be considered the “Licensor.” The text of the Creative Commons
+will be considered the "Licensor." The text of the Creative Commons
 public licenses is dedicated to the public domain under the CC0 Public
 Domain Dedication. Except for the limited purpose of indicating that
 material is shared under a Creative Commons public license or as
diff --git a/sdk_container/src/third_party/portage-stable/licenses/CC-BY-NC-ND-4.0 b/sdk_container/src/third_party/portage-stable/licenses/CC-BY-NC-ND-4.0
index cfe676c5418..f48ef2078ae 100644
--- a/sdk_container/src/third_party/portage-stable/licenses/CC-BY-NC-ND-4.0
+++ b/sdk_container/src/third_party/portage-stable/licenses/CC-BY-NC-ND-4.0
@@ -33,7 +33,7 @@ exhaustive, and do not form part of our licenses.
      material not subject to the license. This includes other CC-
      licensed material, or material used under an exception or
      limitation to copyright. More considerations for licensors:
-    wiki.creativecommons.org/Considerations_for_licensors
+     wiki.creativecommons.org/Considerations_for_licensors
 
      Considerations for the public: By using one of our public
      licenses, a licensor grants the public permission to use the
@@ -50,7 +50,7 @@ exhaustive, and do not form part of our licenses.
      Although not required by our licenses, you are encouraged to
      respect those requests where reasonable. More considerations
      for the public:
-    wiki.creativecommons.org/Considerations_for_licensees
+     wiki.creativecommons.org/Considerations_for_licensees
 
 =======================================================================
 
@@ -385,7 +385,7 @@ Section 8 -- Interpretation.
 Creative Commons is not a party to its public
 licenses. Notwithstanding, Creative Commons may elect to apply one of
 its public licenses to material it publishes and in those instances
-will be considered the “Licensor.” The text of the Creative Commons
+will be considered the "Licensor." The text of the Creative Commons
 public licenses is dedicated to the public domain under the CC0 Public
 Domain Dedication. Except for the limited purpose of indicating that
 material is shared under a Creative Commons public license or as
@@ -400,4 +400,3 @@ the avoidance of doubt, this paragraph does not form part of the
 public licenses.
 
 Creative Commons may be contacted at creativecommons.org.
-
diff --git a/sdk_container/src/third_party/portage-stable/licenses/CC-BY-NC-SA-4.0 b/sdk_container/src/third_party/portage-stable/licenses/CC-BY-NC-SA-4.0
index 1a3e7c4adec..73b24cb3ad9 100644
--- a/sdk_container/src/third_party/portage-stable/licenses/CC-BY-NC-SA-4.0
+++ b/sdk_container/src/third_party/portage-stable/licenses/CC-BY-NC-SA-4.0
@@ -33,7 +33,7 @@ exhaustive, and do not form part of our licenses.
      material not subject to the license. This includes other CC-
      licensed material, or material used under an exception or
      limitation to copyright. More considerations for licensors:
-	wiki.creativecommons.org/Considerations_for_licensors
+     wiki.creativecommons.org/Considerations_for_licensors
 
      Considerations for the public: By using one of our public
      licenses, a licensor grants the public permission to use the
@@ -50,7 +50,7 @@ exhaustive, and do not form part of our licenses.
      Although not required by our licenses, you are encouraged to
      respect those requests where reasonable. More considerations
      for the public:
-	wiki.creativecommons.org/Considerations_for_licensees
+     wiki.creativecommons.org/Considerations_for_licensees
 
 =======================================================================
 
@@ -422,7 +422,7 @@ Section 8 -- Interpretation.
 Creative Commons is not a party to its public
 licenses. Notwithstanding, Creative Commons may elect to apply one of
 its public licenses to material it publishes and in those instances
-will be considered the “Licensor.” The text of the Creative Commons
+will be considered the "Licensor." The text of the Creative Commons
 public licenses is dedicated to the public domain under the CC0 Public
 Domain Dedication. Except for the limited purpose of indicating that
 material is shared under a Creative Commons public license or as
diff --git a/sdk_container/src/third_party/portage-stable/licenses/CC-BY-ND-4.0 b/sdk_container/src/third_party/portage-stable/licenses/CC-BY-ND-4.0
index 2c02bbea44b..15f32b18867 100644
--- a/sdk_container/src/third_party/portage-stable/licenses/CC-BY-ND-4.0
+++ b/sdk_container/src/third_party/portage-stable/licenses/CC-BY-ND-4.0
@@ -33,7 +33,7 @@ exhaustive, and do not form part of our licenses.
      material not subject to the license. This includes other CC-
      licensed material, or material used under an exception or
      limitation to copyright. More considerations for licensors:
-    wiki.creativecommons.org/Considerations_for_licensors
+     wiki.creativecommons.org/Considerations_for_licensors
 
      Considerations for the public: By using one of our public
      licenses, a licensor grants the public permission to use the
@@ -50,7 +50,7 @@ exhaustive, and do not form part of our licenses.
      Although not required by our licenses, you are encouraged to
      respect those requests where reasonable. More considerations
      for the public:
-    wiki.creativecommons.org/Considerations_for_licensees
+     wiki.creativecommons.org/Considerations_for_licensees
 
 
 =======================================================================
@@ -373,7 +373,7 @@ Section 8 -- Interpretation.
 Creative Commons is not a party to its public
 licenses. Notwithstanding, Creative Commons may elect to apply one of
 its public licenses to material it publishes and in those instances
-will be considered the “Licensor.” The text of the Creative Commons
+will be considered the "Licensor." The text of the Creative Commons
 public licenses is dedicated to the public domain under the CC0 Public
 Domain Dedication. Except for the limited purpose of indicating that
 material is shared under a Creative Commons public license or as
@@ -388,4 +388,3 @@ the avoidance of doubt, this paragraph does not form part of the
 public licenses.
 
 Creative Commons may be contacted at creativecommons.org.
-
diff --git a/sdk_container/src/third_party/portage-stable/licenses/CC-BY-SA-4.0 b/sdk_container/src/third_party/portage-stable/licenses/CC-BY-SA-4.0
index 4681ab80f2b..8833efaec54 100644
--- a/sdk_container/src/third_party/portage-stable/licenses/CC-BY-SA-4.0
+++ b/sdk_container/src/third_party/portage-stable/licenses/CC-BY-SA-4.0
@@ -33,7 +33,7 @@ exhaustive, and do not form part of our licenses.
      material not subject to the license. This includes other CC-
      licensed material, or material used under an exception or
      limitation to copyright. More considerations for licensors:
-	wiki.creativecommons.org/Considerations_for_licensors
+     wiki.creativecommons.org/Considerations_for_licensors
 
      Considerations for the public: By using one of our public
      licenses, a licensor grants the public permission to use the
@@ -50,7 +50,7 @@ exhaustive, and do not form part of our licenses.
      Although not required by our licenses, you are encouraged to
      respect those requests where reasonable. More considerations
      for the public:
-	wiki.creativecommons.org/Considerations_for_licensees
+     wiki.creativecommons.org/Considerations_for_licensees
 
 =======================================================================
 
@@ -410,7 +410,7 @@ Section 8 -- Interpretation.
 Creative Commons is not a party to its public
 licenses. Notwithstanding, Creative Commons may elect to apply one of
 its public licenses to material it publishes and in those instances
-will be considered the “Licensor.” The text of the Creative Commons
+will be considered the "Licensor." The text of the Creative Commons
 public licenses is dedicated to the public domain under the CC0 Public
 Domain Dedication. Except for the limited purpose of indicating that
 material is shared under a Creative Commons public license or as

From 56780bc6464f509e07c009e342bc662d87b817b3 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:13:45 +0000
Subject: [PATCH 074/122] media-libs/libpng: Sync with Gentoo

It's from Gentoo commit a31fd56a7e95d03c6cf8ac05054c3182f454ee30.
---
 .../portage-stable/media-libs/libpng/libpng-1.6.50-r1.ebuild    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/media-libs/libpng/libpng-1.6.50-r1.ebuild b/sdk_container/src/third_party/portage-stable/media-libs/libpng/libpng-1.6.50-r1.ebuild
index c99936a12cb..4079e1b4c9c 100644
--- a/sdk_container/src/third_party/portage-stable/media-libs/libpng/libpng-1.6.50-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/media-libs/libpng/libpng-1.6.50-r1.ebuild
@@ -19,7 +19,7 @@ SRC_URI="
 
 LICENSE="libpng2"
 SLOT="0/16"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="apng cpu_flags_x86_sse static-libs test"
 RESTRICT="!test? ( test )"
 

From 0afb83dfcddeda43645a6be8c3f786c3d429f99a Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:13:53 +0000
Subject: [PATCH 075/122] net-dns/bind: Sync with Gentoo

It's from Gentoo commit 35170f98ea6e1c368eeaa04903db8d462465d18a.
---
 .../portage-stable/net-dns/bind/Manifest      |   2 +
 .../net-dns/bind/bind-9.18.37-r1.ebuild       |   2 +-
 .../net-dns/bind/bind-9.18.38.ebuild          | 282 +++++++++++++++++
 .../net-dns/bind/bind-9.20.11.ebuild          | 287 ++++++++++++++++++
 4 files changed, 572 insertions(+), 1 deletion(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.38.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.20.11.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/Manifest b/sdk_container/src/third_party/portage-stable/net-dns/bind/Manifest
index ae799017076..1c4fc567ffb 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind/Manifest
@@ -1,6 +1,8 @@
 DIST bind-9.18.29.tar.xz 5562720 BLAKE2B f3e7de6936362bcce4993e401ed8fdd9d597459e82ad908a918fff1da619f91ef4896595ea210b43f2b492d763d7be2b71105495858da55431b60874c7fd2312 SHA512 6c2676e2e2cb90f3bd73afb367813c54d1c961e12df1e12e41b9d0ee5a1d5cdf368d81410469753eaef37e43358b56796f078f3b2f20c3b247c4bef91d56c716
 DIST bind-9.18.31.tar.xz 5385812 BLAKE2B e069ab3caab887a87220b54804e5b19a4c21b8d3e4e8f1bc6a7135b3990a228d6c48b1ca4a22c75242485275eff1de145a9aff89addf81124e7dfcafd8ab30cf SHA512 e51873484be3ee367eb1e601b8e0adc45abcdb16df04021ea42ffcc51b99821f8b30f67b2a693a90ad3efa51698a651c8da9d7947ee8fa19680f627afe1f7034
 DIST bind-9.18.37.tar.xz 5358128 BLAKE2B 59753a594e1e8249b9104377260701a9453eeecb6a233a94a33c6a134a6368c5c0b9473c4e08d956d0746a331dc7b121550f5e426a521d6c8d0441d9164f0547 SHA512 9789cb3fa7739cc7e1b137d1642861d9517adc4391e2f8c526bfa271e13f7489794ed20cb5f64c26e432d7b79cfe7aa1f7d59c476fd2749bc2dccfb85c514943
+DIST bind-9.18.38.tar.xz 5362772 BLAKE2B 04a7eeba174dc0333f5f4f3a0767ac66a0f81665dc26dc5a88434ab1c1c12fdd2deaee91b62f77001a92283d40942a0487f6d314b465d9dac6c817d4f78166d4 SHA512 38710646a817dca0df6247b660cd244c79da13d0fed2898da139ae206bc8732fddd93af6fc2cbeca805c0c0d0789ec22eacf26789db288154581478ab2eaf44c
 DIST bind-9.20.10.tar.xz 5677276 BLAKE2B e5a7824ff5b901be447a2f4f067aa8b3345eb8187ed86f3bf6bc623e2b6c812722667eefd1f915026dab078846011e222336a30c4da640c4e54aa828398b180d SHA512 2d4510e2e73aed94424b065b9371a1422f1b53ec8c01b281fdc78f90401dcd229b7095a175bb4f4d44b07d81e5edbee78bbfb1bf31b981e26fe1ea6df53d415d
+DIST bind-9.20.11.tar.xz 5674856 BLAKE2B 582e6de2699713e870dfc853f461c78b2d2b505bed0b571f853c94a731be9006783f45a4f897692289c1a9411725eac0b4de3818f1641221e62754316f410081 SHA512 bacc19eaf37133d37202db521e2c6727fc4e494562caad68e7c22e8dad84411684ba2c7430aa3bb2d916b9078c3aab8277d35e0f9b1f9893b89071de7ad7eee4
 DIST bind-9.20.7.tar.xz 5655168 BLAKE2B c5198939382e7295b4dfcb2ddbd86e5bccc10047d5e963dab2381404eb7a14543218e3caa438b395a2982cb607da84012f3a76a41c790a48ed615238bc080b5c SHA512 b9570c0c6588819108017d30dc7fb5e2f34361f941186d29da3d2830bbe3333c8c16bdb6581f5bec4786d90b74db860a9cad5f66d4f1c65168eae69f401a9df0
 DIST bind-9.20.9.tar.xz 5668452 BLAKE2B 40a1428d2da9d92b3604f04234b2ff44701abcf2ea22883caea7fb4ee157547125fd68accb8fe10853ff64cd5018fa89e36eeb53021fa3ee9bc056e05ac228d6 SHA512 78efb4c4a5d78bd04efe222982efa1d6bb6748965e40d816d9e4329d6f2687a43d1e439bc3f98c00c85abaf8fc435063bcbe2d96a61b252fe3df0a8affa19f8f
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.37-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.37-r1.ebuild
index bbf5a130a51..eb7820cebb1 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.37-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.37-r1.ebuild
@@ -15,7 +15,7 @@ S="${WORKDIR}/${PN}-${MY_PV}"
 
 LICENSE="MPL-2.0"
 SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 IUSE="+caps dnstap doc doh fixed-rrset idn jemalloc geoip gssapi lmdb selinux static-libs test xml"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.38.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.38.ebuild
new file mode 100644
index 00000000000..d5fe3e00d7d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.38.ebuild
@@ -0,0 +1,282 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit eapi9-ver systemd tmpfiles toolchain-funcs
+
+MY_PV="${PV/_p/-P}"
+MY_PV="${MY_PV/_rc/rc}"
+
+DESCRIPTION="Berkeley Internet Name Domain - Name Server"
+HOMEPAGE="https://www.isc.org/software/bind"
+SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="MPL-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+IUSE="+caps dnstap doc doh fixed-rrset idn jemalloc geoip gssapi lmdb selinux static-libs test xml"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	acct-group/named
+	acct-user/named
+	dev-libs/json-c:=
+	>=dev-libs/libuv-1.37.0:=
+	sys-libs/zlib:=
+	dev-libs/openssl:=[-bindist(-)]
+	caps? ( >=sys-libs/libcap-2.1.0 )
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c
+	)
+	doh? ( net-libs/nghttp2:= )
+	geoip? ( dev-libs/libmaxminddb )
+	gssapi? ( virtual/krb5 )
+	idn? ( net-dns/libidn2 )
+	jemalloc? ( dev-libs/jemalloc:= )
+	lmdb? ( dev-db/lmdb )
+	xml? ( dev-libs/libxml2:= )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-bind )
+	sys-process/psmisc
+	!<net-dns/bind-tools-9.18.0
+"
+# sphinx required for man-page and html creation
+BDEPEND="
+	dev-lang/perl
+	virtual/pkgconfig
+	doc? ( dev-python/sphinx )
+	test? (
+		dev-util/cmocka
+	)
+"
+
+src_prepare() {
+	default
+
+	# Don't clobber our toolchain defaults
+	sed -i -e '/FORTIFY_SOURCE=/d' configure || die
+
+	# Test is (notoriously) slow/resource intensive
+	sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/isc/netmgr_test.c || die
+
+	# Relies on -Wl,--wrap (bug #877741)
+	if tc-is-lto ; then
+		sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/ns/query_test.c || die
+	fi
+}
+
+src_configure() {
+	# configure automagically uses sphinx even if prebuilt man pages
+	# are available. Force fallback to prebuilt ones.
+	use doc || export ac_cv_path_SPHINX_BUILD= SPHINX_BUILD=
+
+	local myeconfargs=(
+		--prefix="${EPREFIX}"/usr
+		--sysconfdir="${EPREFIX}"/etc/bind
+		--localstatedir="${EPREFIX}"/var
+		--enable-full-report
+		--without-readline
+		--with-openssl="${ESYSROOT}"/usr
+		--with-json-c
+		--with-zlib
+		$(use_enable caps linux-caps)
+		--disable-dnsrps
+		$(use_enable dnstap)
+		$(use_enable doh)
+		$(use_with doh libnghttp2)
+		$(use_enable fixed-rrset)
+		$(use_enable static-libs static)
+		$(use_enable geoip)
+		$(use_with test cmocka)
+		$(use_with geoip maxminddb)
+		$(use_with gssapi)
+		$(use_with idn libidn2)
+		$(use_with jemalloc)
+		$(use_with lmdb)
+		$(use_with xml libxml2)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	# system tests ('emake test') require network configuration for IPs etc
+	# so we run the unit tests instead.
+	CI=1 emake unit V=1
+
+	# libtest is an internal test helper library, it has no tests,
+	# so suppress the QA warning.
+	rm tests/libtest/test-suite.log || die
+}
+
+src_install() {
+	default
+
+	if use doc; then
+		docinto misc
+		dodoc -r doc/misc/
+
+		docinto html
+		dodoc -r doc/arm/
+
+		docinto dnssec-guide
+		dodoc -r doc/dnssec-guide/
+
+		docinto contrib
+		dodoc contrib/scripts/nanny.pl
+	fi
+
+	insinto /etc/bind
+	newins "${FILESDIR}"/named.conf-r9 named.conf
+	newins "${FILESDIR}"/named.conf.auth named.conf.auth
+
+	newinitd "${FILESDIR}"/named.init-r15 named
+	newconfd "${FILESDIR}"/named.confd-r8 named
+
+	newenvd "${FILESDIR}"/10bind.env 10bind
+
+	if ! use static-libs ; then
+		find "${ED}"/usr/lib* -name '*.la' -delete || die
+	fi
+
+	#
+	# /var/bind
+	#
+	# These need to remain for now because CONFIG_PROTECT won't
+	# save them and we shipped configs for years containing references
+	# to them.
+	#
+	# ftp://ftp.rs.internic.net/domain/named.cache:
+	insinto /var/bind
+	newins "${FILESDIR}"/named.cache-r4 named.cache
+	# bug #450406
+	dosym named.cache /var/bind/root.cache
+	#
+	insinto /var/bind/pri
+	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
+
+	dosym -r /var/bind/pri /etc/bind/pri
+	dosym -r /var/bind/sec /etc/bind/sec
+	dosym -r /var/bind/dyn /etc/bind/dyn
+	keepdir /var/bind/{pri,sec,dyn} /var/log/named
+
+	fowners root:named /{etc,var}/bind /var/log/named /var/bind/{sec,pri,dyn}
+	fowners root:named /etc/bind/{bind.keys,named.conf,named.conf.auth}
+	fperms 0640 /etc/bind/{bind.keys,named.conf,named.conf.auth}
+	fperms 0750 /etc/bind /var/bind/pri
+	fperms 0770 /var/log/named /var/bind/{,sec,dyn}
+
+	systemd_newunit "${FILESDIR}/named.service-r2" named.service
+	dotmpfiles "${FILESDIR}"/named.conf
+	exeinto /usr/libexec
+	doexe "${FILESDIR}/generate-rndc-key.sh"
+}
+
+pkg_postinst() {
+	tmpfiles_process named.conf
+
+	if [[ -z ${ROOT} && ! -f ${EPREFIX}/etc/bind/rndc.key && ! -f ${EPREFIX}/etc/bind/rndc.conf ]]; then
+		einfo "Generating rndc.key"
+		"${EPREFIX}"/usr/sbin/rndc-confgen -a || die
+		chown root:named "${EPREFIX}"/etc/bind/rndc.key || die
+		chmod 0640 "${EPREFIX}"/etc/bind/rndc.key || die
+	fi
+
+	einfo
+	einfo "You can edit /etc/conf.d/named to customize named settings"
+	einfo
+
+	einfo "If you'd like to run bind in a chroot AND this is a new"
+	einfo "install OR your bind doesn't already run in a chroot:"
+	einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named."
+	einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`"
+	einfo
+
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named 2>/dev/null; echo ${CHROOT})
+	if [[ -n ${CHROOT} ]]; then
+		elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		elog "To enable the old behaviour (without using mount) uncomment the"
+		elog "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		elog "If you decide to use the new/default method, ensure to make backup"
+		elog "first and merge your existing configs/zones to /etc/bind and"
+		elog "/var/bind because bind will now mount the needed directories into"
+		elog "the chroot dir."
+	fi
+
+	# show only when upgrading to 9.18
+	if ver_replacing -lt 9.18; then
+		elog "As this is a major bind version upgrade, please read:"
+		elog "   https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918"
+		elog "for differences in functionality."
+		elog ""
+		ewarn "In particular, please note that bind-9.18 does not need a root hints file anymore"
+		ewarn "and we only ship with one as a stop-gap. If your current configuration specifies a"
+		ewarn "root hints file - usually called named.cache - bind will not start as it will not be able"
+		ewarn "to find the specified file. Best practice is to delete the offending lines that"
+		ewarn "reference named.cache file from your configuration."
+	fi
+}
+
+pkg_config() {
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT})
+	CHROOT_NOMOUNT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_NOMOUNT})
+	CHROOT_GEOIP=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_GEOIP})
+
+	if [[ -z "${CHROOT}" ]]; then
+		eerror "This config script is designed to automate setting up"
+		eerror "a chrooted bind/named. To do so, please first uncomment"
+		eerror "and set the CHROOT variable in '/etc/conf.d/named'."
+		die "Unset CHROOT"
+	fi
+
+	if [[ -d "${CHROOT}" ]]; then
+		ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		ewarn "To enable the old behaviour (without using mount) uncomment the"
+		ewarn "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		ewarn
+		ewarn "${CHROOT} already exists... some things might become overridden"
+		ewarn "press CTRL+C if you don't want to continue"
+		sleep 10
+	fi
+
+	echo; einfo "Setting up the chroot directory..."
+
+	mkdir -m 0750 -p "${CHROOT}" || die
+	mkdir -m 0755 -p "${CHROOT}"/{dev,etc,var/log,run} || die
+	mkdir -m 0750 -p "${CHROOT}"/etc/bind || die
+	mkdir -m 0770 -p "${CHROOT}"/var/{bind,log/named} "${CHROOT}"/run/named/ || die
+
+	chown root:named \
+		"${CHROOT}" \
+		"${CHROOT}"/var/{bind,log/named} \
+		"${CHROOT}"/run/named/ \
+		"${CHROOT}"/etc/bind \
+		|| die
+
+	mknod "${CHROOT}"/dev/null c 1 3 || die
+	chmod 0666 "${CHROOT}"/dev/null || die
+
+	mknod "${CHROOT}"/dev/zero c 1 5 || die
+	chmod 0666 "${CHROOT}"/dev/zero || die
+
+	if [[ "${CHROOT_NOMOUNT:-0}" -ne 0 ]]; then
+		cp -a /etc/bind "${CHROOT}"/etc/ || die
+		cp -a /var/bind "${CHROOT}"/var/ || die
+	fi
+
+	if [[ "${CHROOT_GEOIP:-0}" -eq 1 ]]; then
+		if use geoip; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP || die
+		elif use geoip2; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP2 || die
+		fi
+	fi
+
+	elog "You may need to add the following line to your syslog-ng.conf:"
+	elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };"
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.20.11.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.20.11.ebuild
new file mode 100644
index 00000000000..0c8dc469f9f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.20.11.ebuild
@@ -0,0 +1,287 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit eapi9-ver systemd tmpfiles toolchain-funcs
+
+MY_PV="${PV/_p/-P}"
+MY_PV="${MY_PV/_rc/rc}"
+
+DESCRIPTION="Berkeley Internet Name Domain - Name Server"
+HOMEPAGE="https://www.isc.org/bind/"
+SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="MPL-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+IUSE="dnstap doc doh fixed-rrset idn jemalloc geoip gssapi lmdb selinux static-libs systemtap test xml"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	acct-group/named
+	acct-user/named
+	dev-libs/json-c:=
+	dev-libs/userspace-rcu:=
+	>=dev-libs/libuv-1.37.0:=
+	sys-libs/zlib:=
+	dev-libs/openssl:=[-bindist(-)]
+	>=sys-libs/libcap-2.1.0
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c
+	)
+	doh? ( net-libs/nghttp2:= )
+	geoip? ( dev-libs/libmaxminddb )
+	gssapi? ( virtual/krb5 )
+	idn? ( net-dns/libidn2 )
+	jemalloc? ( dev-libs/jemalloc:= )
+	lmdb? ( dev-db/lmdb )
+	xml? ( dev-libs/libxml2:= )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-bind )
+	sys-process/psmisc
+	!<net-dns/bind-tools-9.18.0
+"
+# sphinx required for man-page and html creation
+BDEPEND="
+	dev-lang/perl
+	virtual/pkgconfig
+	doc? ( dev-python/sphinx )
+	test? (
+		dev-util/cmocka
+	)
+	systemtap? (
+		dev-debug/systemtap
+	)
+"
+
+src_prepare() {
+	default
+
+	# Don't clobber our toolchain defaults
+	sed -i -e '/FORTIFY_SOURCE=/d' configure || die
+
+	# Relies on -Wl,--wrap (bug #877741)
+	if tc-is-lto ; then
+		sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/ns/query_test.c || die
+	fi
+}
+
+src_configure() {
+	# configure automagically uses sphinx even if prebuilt man pages
+	# are available. Force fallback to prebuilt ones.
+	use doc || export ac_cv_path_SPHINX_BUILD= SPHINX_BUILD=
+
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		export DTRACE="${BROOT}"/usr/bin/stap-dtrace
+	fi
+
+	local myeconfargs=(
+		--prefix="${EPREFIX}"/usr
+		--sysconfdir="${EPREFIX}"/etc/bind
+		--localstatedir="${EPREFIX}"/var
+		--enable-full-report
+		--without-readline
+		--with-openssl="${ESYSROOT}"/usr
+		--with-json-c
+		--with-zlib
+		--disable-dnsrps
+		$(use_enable dnstap)
+		$(use_enable doh)
+		$(use_with doh libnghttp2)
+		$(use_enable static-libs static)
+		$(use_enable geoip)
+		$(use_enable systemtap tracing)
+		$(use_with test cmocka)
+		$(use_with geoip maxminddb)
+		$(use_with gssapi)
+		$(use_with idn libidn2)
+		$(use_with jemalloc)
+		$(use_with lmdb)
+		$(use_with xml libxml2)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	# system tests ('emake test') require network configuration for IPs etc
+	# so we run the unit tests instead.
+	CI=1 emake unit V=1
+
+	# libtest is an internal test helper library, it has no tests,
+	# so suppress the QA warning.
+	rm tests/libtest/test-suite.log || die
+}
+
+src_install() {
+	default
+
+	if use doc; then
+		docinto misc
+		dodoc -r doc/misc/
+
+		docinto html
+		dodoc -r doc/arm/
+
+		docinto dnssec-guide
+		dodoc -r doc/dnssec-guide/
+
+		docinto contrib
+		dodoc contrib/scripts/nanny.pl
+	fi
+
+	insinto /etc/bind
+	newins "${FILESDIR}"/named.conf-r9 named.conf
+	newins "${FILESDIR}"/named.conf.auth named.conf.auth
+
+	newinitd "${FILESDIR}"/named.init-r15 named
+	newconfd "${FILESDIR}"/named.confd-r8 named
+
+	newenvd "${FILESDIR}"/10bind.env 10bind
+
+	if ! use static-libs ; then
+		find "${ED}"/usr/lib* -name '*.la' -delete || die
+	fi
+
+	#
+	# /var/bind
+	#
+	# These need to remain for now because CONFIG_PROTECT won't
+	# save them and we shipped configs for years containing references
+	# to them.
+	#
+	# ftp://ftp.rs.internic.net/domain/named.cache:
+	insinto /var/bind
+	newins "${FILESDIR}"/named.cache-r4 named.cache
+	# bug #450406
+	dosym named.cache /var/bind/root.cache
+	#
+	insinto /var/bind/pri
+	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
+
+	dosym -r /var/bind/pri /etc/bind/pri
+	dosym -r /var/bind/sec /etc/bind/sec
+	dosym -r /var/bind/dyn /etc/bind/dyn
+	keepdir /var/bind/{pri,sec,dyn} /var/log/named
+
+	fowners root:named /{etc,var}/bind /var/log/named /var/bind/{sec,pri,dyn}
+	fowners root:named /etc/bind/{named.conf,named.conf.auth}
+	fperms 0640 /etc/bind/{named.conf,named.conf.auth}
+	fperms 0750 /etc/bind /var/bind/pri
+	fperms 0770 /var/log/named /var/bind/{,sec,dyn}
+
+	systemd_newunit "${FILESDIR}/named.service-r2" named.service
+	dotmpfiles "${FILESDIR}"/named.conf
+	exeinto /usr/libexec
+	doexe "${FILESDIR}/generate-rndc-key.sh"
+}
+
+pkg_postinst() {
+	tmpfiles_process named.conf
+
+	if [[ -z ${ROOT} && ! -f ${EPREFIX}/etc/bind/rndc.key && ! -f ${EPREFIX}/etc/bind/rndc.conf ]]; then
+		einfo "Generating rndc.key"
+		"${EPREFIX}"/usr/sbin/rndc-confgen -a || die
+		chown root:named "${EPREFIX}"/etc/bind/rndc.key || die
+		chmod 0640 "${EPREFIX}"/etc/bind/rndc.key || die
+	fi
+
+	einfo
+	einfo "You can edit /etc/conf.d/named to customize named settings"
+	einfo
+
+	einfo "If you'd like to run bind in a chroot AND this is a new"
+	einfo "install OR your bind doesn't already run in a chroot:"
+	einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named."
+	einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`"
+	einfo
+
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named 2>/dev/null; echo ${CHROOT})
+	if [[ -n ${CHROOT} ]]; then
+		elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		elog "To enable the old behaviour (without using mount) uncomment the"
+		elog "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		elog "If you decide to use the new/default method, ensure to make backup"
+		elog "first and merge your existing configs/zones to /etc/bind and"
+		elog "/var/bind because bind will now mount the needed directories into"
+		elog "the chroot dir."
+	fi
+
+	# show only when upgrading to 9.18
+	if ver_replacing -lt 9.18; then
+		elog "As this is a major bind version upgrade, please read:"
+		elog "   https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918"
+		elog "for differences in functionality."
+		elog ""
+		ewarn "In particular, please note that bind-9.18 does not need a root hints file anymore"
+		ewarn "and we only ship with one as a stop-gap. If your current configuration specifies a"
+		ewarn "root hints file - usually called named.cache - bind will not start as it will not be able"
+		ewarn "to find the specified file. Best practice is to delete the offending lines that"
+		ewarn "reference named.cache file from your configuration."
+	fi
+}
+
+pkg_config() {
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT})
+	CHROOT_NOMOUNT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_NOMOUNT})
+	CHROOT_GEOIP=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_GEOIP})
+
+	if [[ -z "${CHROOT}" ]]; then
+		eerror "This config script is designed to automate setting up"
+		eerror "a chrooted bind/named. To do so, please first uncomment"
+		eerror "and set the CHROOT variable in '/etc/conf.d/named'."
+		die "Unset CHROOT"
+	fi
+
+	if [[ -d "${CHROOT}" ]]; then
+		ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		ewarn "To enable the old behaviour (without using mount) uncomment the"
+		ewarn "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		ewarn
+		ewarn "${CHROOT} already exists... some things might become overridden"
+		ewarn "press CTRL+C if you don't want to continue"
+		sleep 10
+	fi
+
+	echo; einfo "Setting up the chroot directory..."
+
+	mkdir -m 0750 -p "${CHROOT}" || die
+	mkdir -m 0755 -p "${CHROOT}"/{dev,etc,var/log,run} || die
+	mkdir -m 0750 -p "${CHROOT}"/etc/bind || die
+	mkdir -m 0770 -p "${CHROOT}"/var/{bind,log/named,run/named} "${CHROOT}"/run/named/ || die
+
+	chown root:named \
+		"${CHROOT}" \
+		"${CHROOT}"/var/{bind,log/named,run/named} \
+		"${CHROOT}"/run/named/ \
+		"${CHROOT}"/etc/bind \
+		|| die
+
+	mknod "${CHROOT}"/dev/null c 1 3 || die
+	chmod 0666 "${CHROOT}"/dev/null || die
+
+	mknod "${CHROOT}"/dev/zero c 1 5 || die
+	chmod 0666 "${CHROOT}"/dev/zero || die
+
+	if [[ "${CHROOT_NOMOUNT:-0}" -ne 0 ]]; then
+		cp -a /etc/bind "${CHROOT}"/etc/ || die
+		cp -a /var/bind "${CHROOT}"/var/ || die
+	fi
+
+	if [[ "${CHROOT_GEOIP:-0}" -eq 1 ]]; then
+		if use geoip; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP || die
+		elif use geoip2; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP2 || die
+		fi
+	fi
+
+	elog "You may need to add the following line to your syslog-ng.conf:"
+	elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };"
+}

From b7433b15d490e7a51cba61c7501af71d717ee5cc Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:14:02 +0000
Subject: [PATCH 076/122] net-firewall/nftables: Sync with Gentoo

It's from Gentoo commit 77de687ed653774e00f38d2080aa4d985f44f077.
---
 .../net-firewall/nftables/Manifest            |   2 +
 .../nftables/nftables-1.1.4.ebuild            | 236 ++++++++++++++++++
 .../nftables/nftables-9999.ebuild             |   4 +-
 3 files changed, 240 insertions(+), 2 deletions(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/net-firewall/nftables/nftables-1.1.4.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/nftables/Manifest b/sdk_container/src/third_party/portage-stable/net-firewall/nftables/Manifest
index 49c3f0569c6..7e8118eb337 100644
--- a/sdk_container/src/third_party/portage-stable/net-firewall/nftables/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-firewall/nftables/Manifest
@@ -2,3 +2,5 @@ DIST nftables-1.1.1.tar.xz 989700 BLAKE2B f273c78369ba755049c6afa63eba195cf29f92
 DIST nftables-1.1.1.tar.xz.sig 566 BLAKE2B b7debda3373972f69af9b4b23e1b66a8fd156440187aafba605bb7342c267207e5aa628256e96432ebd4583a6a9436e1969a33636111d2bd8d57185a01e2d502 SHA512 fc23034c512f686167203e827ff2a8f7cb64530211ce92a28793bd49577ce3bf519ffbe910b0071cb21925898497cb5cbf70121c68bfcdbfa4460c63a14203ac
 DIST nftables-1.1.3.tar.xz 990172 BLAKE2B 35f4ece6c27b29a14bc71bb7893971134950509a713e84453e1f87df6b07cda327314d6dbbf048032a047652b8817f8ee8a5d74a56e356088495edd1dbbed000 SHA512 b5c244cb6db73eb232e5c999e07403b60c543efb9c4b9991838cc9c43a1bd08ca7b2926233536cbb0cc66e2a9acc4fbddc4b5565f5665e753c107a8739a86040
 DIST nftables-1.1.3.tar.xz.sig 566 BLAKE2B 4f0e9c89213b46d3445a729bf96b1790adc53725f31134f9028297e99d83ac43f5094f9cfa0efee903dc691781dd5d67a814583ff1c645776f1a46266dc2681f SHA512 7aa972c146e0dfaacc8faaef9b9ebbe419f7cbc5814d1fb978b35a4972d384aabe2e6e053fefc6d5d042acb9bff5f35e5f97cbee0c4a0152c53ab9c2e5b0335f
+DIST nftables-1.1.4.tar.xz 1005044 BLAKE2B 359d23c89462125be72d4a103bd063cb9acf4c929ecc345d11c895b990ab7a7d96e73ac2d5e39036a7a6593edcb82d1b407e49c6fbb95aba8e31270f4b2d0917 SHA512 861beb92bdf668c92054becded5497369c9182124df45a175a8534aa1eb5b3d5e69f85e4e10f468f61f7493370e99b51ebe6f6e6e207670211167d88fa9e63aa
+DIST nftables-1.1.4.tar.xz.sig 566 BLAKE2B 87d84b3f4e896923c7c59701ab98aec289dd5a5413f6ff1b4680a98238ce9ccba452e23cc686b04a84c70be4c153d3aac5d73db8c7a7c61021226b20c0c11fab SHA512 4aa1d7f2b219e24cbc41fa397afcc605b3cf1c55a14b97827c0581cc2af9c5def0308ed69aa243b30690f7f14501c573a7902a75003582d0adf26ab086ca8356
diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/nftables/nftables-1.1.4.ebuild b/sdk_container/src/third_party/portage-stable/net-firewall/nftables/nftables-1.1.4.ebuild
new file mode 100644
index 00000000000..424d52e5fec
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-firewall/nftables/nftables-1.1.4.ebuild
@@ -0,0 +1,236 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_OPTIONAL=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{11..14} )
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/netfilter.org.asc
+inherit eapi9-ver edo linux-info distutils-r1 systemd verify-sig
+
+DESCRIPTION="Linux kernel firewall, NAT and packet mangling tools"
+HOMEPAGE="https://netfilter.org/projects/nftables/"
+
+if [[ ${PV} =~ ^[9]{4,}$ ]]; then
+	inherit autotools git-r3
+	EGIT_REPO_URI="https://git.netfilter.org/${PN}"
+	BDEPEND="app-alternatives/yacc"
+else
+	inherit libtool
+	SRC_URI="
+		https://netfilter.org/projects/nftables/files/${P}.tar.xz
+		verify-sig? ( https://netfilter.org/projects/nftables/files/${P}.tar.xz.sig )
+	"
+	KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-netfilter-20240415 )"
+fi
+
+# See COPYING: new code is GPL-2+, existing code is GPL-2
+LICENSE="GPL-2 GPL-2+"
+SLOT="0/1"
+IUSE="debug doc +gmp json libedit python +readline static-libs test xtables"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=net-libs/libmnl-1.0.4:=
+	>=net-libs/libnftnl-1.3.0:=
+	gmp? ( dev-libs/gmp:= )
+	json? ( dev-libs/jansson:= )
+	python? ( ${PYTHON_DEPS} )
+	readline? ( sys-libs/readline:= )
+	xtables? ( >=net-firewall/iptables-1.6.1:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND+="
+	app-alternatives/lex
+	virtual/pkgconfig
+	doc? (
+		app-text/asciidoc
+		>=app-text/docbook2X-0.8.8-r4
+	)
+	python? ( ${DISTUTILS_DEPS} )
+"
+
+REQUIRED_USE="
+	python? ( ${PYTHON_REQUIRED_USE} )
+	libedit? ( !readline )
+"
+
+src_prepare() {
+	default
+
+	if [[ ${PV} =~ ^[9]{4,}$ ]] ; then
+		eautoreconf
+	else
+		elibtoolize
+	fi
+
+	if use python; then
+		pushd py >/dev/null || die
+		distutils-r1_src_prepare
+		popd >/dev/null || die
+	fi
+}
+
+src_configure() {
+	local myeconfargs=(
+		--sbindir="${EPREFIX}"/sbin
+		$(use_enable debug)
+		$(use_enable doc man-doc)
+		$(use_with !gmp mini_gmp)
+		$(use_with json)
+		$(use_with libedit cli editline)
+		$(use_with readline cli readline)
+		$(use_enable static-libs static)
+		$(use_with xtables)
+	)
+
+	econf "${myeconfargs[@]}"
+
+	if use python; then
+		pushd py >/dev/null || die
+		distutils-r1_src_configure
+		popd >/dev/null || die
+	fi
+}
+
+src_compile() {
+	default
+
+	if use python; then
+		pushd py >/dev/null || die
+		distutils-r1_src_compile
+		popd >/dev/null || die
+	fi
+}
+
+src_test() {
+	emake check
+
+	if [[ ${EUID} == 0 ]]; then
+		edo tests/shell/run-tests.sh -v
+	else
+		ewarn "Skipping shell tests (requires root)"
+	fi
+
+	if use python; then
+		pushd tests/py >/dev/null || die
+		distutils-r1_src_test
+		popd >/dev/null || die
+	fi
+}
+
+python_test() {
+	if [[ ${EUID} == 0 ]]; then
+		edo "${EPYTHON}" nft-test.py
+	else
+		ewarn "Skipping Python tests (requires root)"
+	fi
+}
+
+src_install() {
+	default
+
+	if ! use doc && [[ ! ${PV} =~ ^[9]{4,}$ ]]; then
+		pushd doc >/dev/null || die
+		doman *.?
+		popd >/dev/null || die
+	fi
+
+	# Do it here instead of in src_prepare to avoid eautoreconf
+	# rmdir lets us catch if more files end up installed in /etc/nftables
+	dodir /usr/share/doc/${PF}/skels/
+	mv "${ED}"/etc/nftables/osf "${ED}"/usr/share/doc/${PF}/skels/osf || die
+	rmdir "${ED}"/etc/nftables || die
+
+	exeinto /usr/libexec/${PN}
+	newexe "${FILESDIR}"/libexec/${PN}-mk.sh ${PN}.sh
+	newconfd "${FILESDIR}"/${PN}-mk.confd ${PN}
+	newinitd "${FILESDIR}"/${PN}-mk.init-r1 ${PN}
+	keepdir /var/lib/nftables
+
+	systemd_dounit "${FILESDIR}"/systemd/${PN}-load.service
+	systemd_dounit "${FILESDIR}"/systemd/${PN}-store.service
+
+	if use python ; then
+		pushd py >/dev/null || die
+		distutils-r1_src_install
+		popd >/dev/null || die
+	fi
+
+	find "${ED}" -type f -name "*.la" -delete || die
+}
+
+pkg_preinst() {
+	local stderr
+
+	# There's a history of regressions with nftables upgrades. Perform a
+	# safety check to help us spot them earlier. For the check to pass, the
+	# currently loaded ruleset, if any, must be successfully evaluated by
+	# the newly built instance of nft(8).
+	if [[ -n ${ROOT} ]] || [[ ! -d /sys/module/nftables ]] || [[ ! -x /sbin/nft ]]; then
+		# Either nftables isn't yet in use or nft(8) cannot be executed.
+		return
+	elif ! stderr=$(umask 177; /sbin/nft -t list ruleset 2>&1 >"${T}"/ruleset.nft); then
+		# Report errors induced by trying to list the ruleset but don't
+		# treat them as being fatal.
+		printf '%s\n' "${stderr}" >&2
+	elif [[ ${stderr} == *"is managed by iptables-nft"* ]]; then
+		# Rulesets generated by iptables-nft are special in nature and
+		# will not always be printed in a way that constitutes a valid
+		# syntax for ntf(8). Ignore them.
+		return
+	elif set -- "${ED}"/usr/lib*/libnftables.so;
+		! LD_LIBRARY_PATH=${1%/*} "${ED}"/sbin/nft -c -f -- "${T}"/ruleset.nft
+	then
+		eerror "Your currently loaded ruleset cannot be parsed by the newly built instance of"
+		eerror "nft. This probably means that there is a regression introduced by v${PV}."
+		eerror "(To make the ebuild fail instead of warning, set NFTABLES_ABORT_ON_RELOAD_FAILURE=1.)"
+		if [[ -n ${NFTABLES_ABORT_ON_RELOAD_FAILURE} ]] ; then
+			die "Aborting because of failed nft reload!"
+		fi
+	fi
+}
+
+pkg_postinst() {
+	local save_file
+	save_file="${EROOT}"/var/lib/nftables/rules-save
+
+	# In order for the nftables-load systemd service to start
+	# the save_file must exist.
+	if [[ ! -f "${save_file}" ]]; then
+		( umask 177; touch "${save_file}" )
+	elif [[ $(( "$( stat --printf '%05a' "${save_file}" )" & 07177 )) -ne 0 ]]; then
+		ewarn "Your system has dangerous permissions for ${save_file}"
+		ewarn "It is probably affected by bug #691326."
+		ewarn "You may need to fix the permissions of the file. To do so,"
+		ewarn "you can run the command in the line below as root."
+		ewarn "    'chmod 600 \"${save_file}\"'"
+	fi
+
+	if has_version 'sys-apps/systemd'; then
+		if ver_replacing -lt "1.1.1-r1"; then
+			elog "Starting with ${PN}-1.1.1-r1, the ${PN}-restore.service has"
+			elog "been split into ${PN}-load.service and ${PN}-store.service."
+			elog
+		fi
+		elog "If you wish to enable the firewall rules on boot (on systemd) you"
+		elog "will need to enable the nftables-load service."
+		elog "    'systemctl enable ${PN}-load.service'"
+		elog
+		elog "Enable nftables-store.service if you want firewall rules to be"
+		elog "saved at shutdown."
+	fi
+
+	if has_version 'sys-apps/openrc'; then
+		elog "If you wish to enable the firewall rules on boot (on openrc) you"
+		elog "will need to enable the nftables service."
+		elog "    'rc-update add ${PN} default'"
+		elog
+		elog "If you are creating or updating the firewall rules and wish to save"
+		elog "them to be loaded on the next restart, use the \"save\" functionality"
+		elog "in the init script."
+		elog "    'rc-service ${PN} save'"
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/nftables/nftables-9999.ebuild b/sdk_container/src/third_party/portage-stable/net-firewall/nftables/nftables-9999.ebuild
index 8e90c611107..429e8feece7 100644
--- a/sdk_container/src/third_party/portage-stable/net-firewall/nftables/nftables-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-firewall/nftables/nftables-9999.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 DISTUTILS_OPTIONAL=1
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/netfilter.org.asc
 inherit eapi9-ver edo linux-info distutils-r1 systemd verify-sig
 
@@ -34,7 +34,7 @@ RESTRICT="!test? ( test )"
 
 RDEPEND="
 	>=net-libs/libmnl-1.0.4:=
-	>=net-libs/libnftnl-1.2.9:=
+	>=net-libs/libnftnl-1.3.0:=
 	gmp? ( dev-libs/gmp:= )
 	json? ( dev-libs/jansson:= )
 	python? ( ${PYTHON_DEPS} )

From d616ccd831b6d0fcbfd470fc3bd2abbdf2372fdb Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:14:03 +0000
Subject: [PATCH 077/122] net-fs/samba: Sync with Gentoo

It's from Gentoo commit 7f39d401ccd8ca316b5e8752519c174fb2a86f40.
---
 .../portage-stable/net-fs/samba/samba-4.20.8-r1.ebuild        | 4 ----
 .../portage-stable/net-fs/samba/samba-4.21.7.ebuild           | 4 ----
 .../portage-stable/net-fs/samba/samba-4.22.3.ebuild           | 4 ----
 3 files changed, 12 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.20.8-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.20.8-r1.ebuild
index ec9a9ee1ef8..8f5eefc426b 100644
--- a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.20.8-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.20.8-r1.ebuild
@@ -209,10 +209,6 @@ src_prepare() {
 	# Ugly hackaround for bug #592502
 	#cp /usr/include/tevent_internal.h "${S}"/lib/tevent/ || die
 
-	sed -e 's:<gpgme\.h>:<gpgme/gpgme.h>:' \
-		-i source4/dsdb/samdb/ldb_modules/password_hash.c \
-		|| die
-
 	# WAF
 	multilib_copy_sources
 }
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.21.7.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.21.7.ebuild
index 2cdfea3e095..859ebf0287f 100644
--- a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.21.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.21.7.ebuild
@@ -208,10 +208,6 @@ src_prepare() {
 	# Ugly hackaround for bug #592502
 	#cp /usr/include/tevent_internal.h "${S}"/lib/tevent/ || die
 
-	sed -e 's:<gpgme\.h>:<gpgme/gpgme.h>:' \
-		-i source4/dsdb/samdb/ldb_modules/password_hash.c \
-		|| die
-
 	# bug #943942
 	append-cflags -std=gnu17
 
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.22.3.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.22.3.ebuild
index 3fa4ed236dd..27bc11609d6 100644
--- a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.22.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.22.3.ebuild
@@ -208,10 +208,6 @@ src_prepare() {
 	# Ugly hackaround for bug #592502
 	#cp /usr/include/tevent_internal.h "${S}"/lib/tevent/ || die
 
-	sed -e 's:<gpgme\.h>:<gpgme/gpgme.h>:' \
-		-i source4/dsdb/samdb/ldb_modules/password_hash.c \
-		|| die
-
 	# bug #943942
 	append-cflags -std=gnu17
 

From 1662c9d88e8c95e9f3db2016fcfa80974afd10ca Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:14:03 +0000
Subject: [PATCH 078/122] net-libs/gnutls: Sync with Gentoo

It's from Gentoo commit 72869150dab2757ef39fa95cc3bc7d33ff92903f.
---
 .../portage-stable/net-libs/gnutls/gnutls-3.8.10.ebuild         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.10.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.10.ebuild
index e017318e002..6e1308a4f6e 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.10.ebuild
@@ -17,7 +17,7 @@ LICENSE="GPL-3 LGPL-2.1+"
 # Subslot format:
 # <libgnutls.so number>.<libgnutlsxx.so number>
 SLOT="0/30.30"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="brotli +cxx dane doc examples +idn nls +openssl pkcs11 sslv2 sslv3 static-libs test test-full +tls-heartbeat tools zlib zstd"
 REQUIRED_USE="test-full? ( cxx dane doc examples idn nls openssl pkcs11 tls-heartbeat tools )"
 RESTRICT="!test? ( test )"

From 8aef081ee4b811778745bb10acb755a84c32ba68 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:14:23 +0000
Subject: [PATCH 079/122] net-libs/libnftnl: Sync with Gentoo

It's from Gentoo commit ec88a17d44bf63f3adc518f8b09c32964df78632.
---
 .../portage-stable/net-libs/libnftnl/Manifest |  2 +
 .../net-libs/libnftnl/libnftnl-1.3.0.ebuild   | 76 +++++++++++++++++++
 2 files changed, 78 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/net-libs/libnftnl/libnftnl-1.3.0.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/Manifest b/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/Manifest
index f19183e2c56..85ba2e865a8 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/Manifest
@@ -2,3 +2,5 @@ DIST libnftnl-1.2.8.tar.xz 343732 BLAKE2B 274fcdd9c7c0de173e9b2b35d79613e3f6f41d
 DIST libnftnl-1.2.8.tar.xz.sig 566 BLAKE2B 2c8eae671d41f84b1ded96f7dc98e214a240cc4025265e3008b986554c2d30d830c5f15c2e4b77d0a80d889cd7a0a85403c80bc905019734611baa25575b9daf SHA512 f56a5f049dab8397f4ff84070d782f17b701b46bd42c84cb3fb2b7241a7543f0b5f2877e7d6d95fb942f36119e54c939f89af964ea08858d2c41dc9fd7323b16
 DIST libnftnl-1.2.9.tar.xz 345708 BLAKE2B c29591c78afae0d76b3c412d95999ad5e3d7e581dd1187858a1e57f7b6ff74caf1910724f553de6d716b37529cdf44f23a7a37ff63f04e554d294af398e06df5 SHA512 48f6a3e67ad368340690bed2c8db8d0fab5528f23bc9cf3f5f6dca81c90db340b526d7dbeff1fb59989337e80d3b16cf02443e2a2d5c07b54c8963d2bf4c56e3
 DIST libnftnl-1.2.9.tar.xz.sig 566 BLAKE2B e983fff8be369391670379b5c4eb5b253e4f24b2a76fd9eb7343ff98ecf1c3282d17c7f3e16e8742667438d4211a9ef6b63d31dda03a33348278e9138bacc940 SHA512 a6d521a0f8da337f5c52567397ceacd396fc3eec1df272534ae62901fa59b4892e7535cca9c8213220c037090265825289a32800e83cca21c8433ccc1fda0099
+DIST libnftnl-1.3.0.tar.xz 344440 BLAKE2B 2aeab26089676d3e5231e1dc93ca4e20d1e5cbdf65cfe926a9e5dd3a51162c16f9f32087e3c0b082cacc11f1b5018d0ce3da49acbcce042a2bceac754442bbb8 SHA512 a2220dba97cc9a1bbd0d093a0bd0afd491120a814be6343aef35cbeba0e4781289fa84ced36510b6b9d76e99b3ba35f3964a9a40a21f38e2e0fad90c34fd3916
+DIST libnftnl-1.3.0.tar.xz.sig 566 BLAKE2B 32fe99eb590d2cd65d0c0f07b8c111c433309c38d683426fbdff9231c3b0834e601f5dc58bddfec5a0896789491bd80a7553b04d6cc38f1ae1226d6d08be8333 SHA512 251707a6a981e84ec0d723885f033c0d03f83f7f64deab3ba83b11cea728b8ab345d07699120909e58c1c233a0c8401db27bf9054e61913223867ec5eb2a501e
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/libnftnl-1.3.0.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/libnftnl-1.3.0.ebuild
new file mode 100644
index 00000000000..d15923402a8
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/libnftnl-1.3.0.ebuild
@@ -0,0 +1,76 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/netfilter.org.asc
+inherit linux-info verify-sig
+
+DESCRIPTION="Netlink API to the in-kernel nf_tables subsystem"
+HOMEPAGE="https://netfilter.org/projects/nftables/"
+
+if [[ ${PV} =~ ^[9]{4,}$ ]]; then
+	inherit autotools git-r3
+	EGIT_REPO_URI="https://git.netfilter.org/${PN}"
+else
+	inherit libtool
+	SRC_URI="
+		https://netfilter.org/projects/${PN}/files/${P}.tar.xz
+		verify-sig? ( https://netfilter.org/projects/${PN}/files/${P}.tar.xz.sig )
+	"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+
+	BDEPEND+="verify-sig? ( >=sec-keys/openpgp-keys-netfilter-20240415 )"
+fi
+
+LICENSE="GPL-2"
+SLOT="0/11" # libnftnl.so version
+IUSE="examples static-libs test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=net-libs/libmnl-1.0.4:=
+"
+BDEPEND+="
+	virtual/pkgconfig
+"
+DEPEND="${RDEPEND}"
+
+pkg_setup() {
+	if kernel_is ge 3 13; then
+		CONFIG_CHECK="~NF_TABLES"
+		linux-info_pkg_setup
+	else
+		eerror "This package requires kernel version 3.13 or newer to work properly."
+	fi
+}
+
+src_prepare() {
+	default
+
+	if [[ ${PV} =~ ^[9]{4,}$ ]] ; then
+		eautoreconf
+	else
+		elibtoolize
+	fi
+}
+
+src_configure() {
+	local myeconfargs=(
+		$(use_enable static-libs static)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	find "${ED}" -type f -name '*.la' -delete || die
+
+	if use examples; then
+		find examples/ -name 'Makefile*' -delete || die "Could not rm examples"
+		dodoc -r examples
+		docompress -x /usr/share/doc/${PF}/examples
+	fi
+}

From 511f9c0250f473a093f4633f5e1cadc06d80d7d9 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:14:34 +0000
Subject: [PATCH 080/122] net-misc/curl: Sync with Gentoo

It's from Gentoo commit 9ffb9285267b4617e06eaf535fe51dacb43809b6.
---
 .../third_party/portage-stable/net-misc/curl/curl-8.14.1.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.14.1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.14.1.ebuild
index e01979662a9..71e07d9d6ef 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.14.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.14.1.ebuild
@@ -22,7 +22,7 @@ else
 		S="${WORKDIR}/${P//_/-}"
 	else
 		CURL_URI="https://curl.se/download/"
-		KEYWORDS="~alpha amd64 arm ~arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 	SRC_URI="
 		${CURL_URI}${P//_/-}.tar.xz

From 0db61c1f3d9ff52fb1fbcceb24f0d5055fb739c9 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:14:36 +0000
Subject: [PATCH 081/122] net-misc/iperf: Sync with Gentoo

It's from Gentoo commit ea89684d4a7ddac08608f77f8ea660c4a0e4a03c.
---
 .../portage-stable/net-misc/iperf/Manifest    |   3 +-
 .../files/iperf-3.17.1-Unbundle-cJSON.patch   | 110 ------------------
 .../net-misc/iperf/iperf-2.2.1.ebuild         |  44 +++++++
 .../net-misc/iperf/iperf-2.9999.ebuild        |  31 +++--
 ...perf-3.17.1.ebuild => iperf-3.19.1.ebuild} |  13 +--
 .../net-misc/iperf/metadata.xml               |   2 +-
 6 files changed, 73 insertions(+), 130 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/net-misc/iperf/files/iperf-3.17.1-Unbundle-cJSON.patch
 create mode 100644 sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-2.2.1.ebuild
 rename sdk_container/src/third_party/portage-stable/net-misc/iperf/{iperf-3.17.1.ebuild => iperf-3.19.1.ebuild} (62%)

diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iperf/Manifest b/sdk_container/src/third_party/portage-stable/net-misc/iperf/Manifest
index cda2049c198..e2a566d9c91 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/iperf/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iperf/Manifest
@@ -1,4 +1,5 @@
 DIST iperf-2.0.13.tar.gz 326148 BLAKE2B 2a40aea9e2d7fdc935b91be5e4e586bf68dd27604375d2570570145e5db1ea5837469a4989f47586986932bef33cba05ed19ed3a9ce40c0a5531581c6d3ba982 SHA512 40fcfb8f4d27887f53a743ac07396511fb2a7ac59f4b300fe36896bd0241e191945fa253705990711772ee776d5e4227ed62760fc92abebdfebcedd11c27c0ea
-DIST iperf-3.17.1.tar.gz 670547 BLAKE2B 90afa47ba2de2f789b118ea42d7eabe3a7ec202116d51915b05350932231788a95ae142bdf2cff041f5504e67ae5ac1da2c66f408bc302c4e230ef4b7e496e15 SHA512 99c731e2e060d2b241d3137742bf92a975f2b7a94c6c723c9c1625f69c294fd7fe15b7dbf085a6120038fc1dd7628c83d2c7d16b059849fdbecbc88e48fb0974
+DIST iperf-2.2.1.tar.gz 509514 BLAKE2B 9075df9513e98beeaed5c2f6799f62f72fbfd8fc63696674018b7435dae87d5edeca3fb0541775c37c188bd61bd8394c3125a8a8c07e0c4ba1c2efa86a602404 SHA512 07a08afe647e87939e05c9cd55601ca1227c91f44ef32fdf305a0e15e524d1de29d38e9a3f66253d7308585224e54db395d7dec654d31eea746f45c6947ebc2a
 DIST iperf-3.18.tar.gz 688037 BLAKE2B 64272ab8288cb217603d4fa438bc547967baa964bc518c91f9f1f1c85d9a0a9a7ca5b4c558b3e2c68507c1cb76b40592fd9a80f0bb4cc8a1716e029b32289276 SHA512 a458292c34c29a60cce60eb6be4afd15220d4cf29f225a1c1be9ec8ef86baa85fa4e174e747cacfa5711c6957ad16d448c2d3d4029b6bfd58db9c39269f30caa
+DIST iperf-3.19.1.tar.gz 698445 BLAKE2B fae065d3e8131c072bd70666c87067c85b2ea56fcee70197bea1d5b82266b1d2f4dbb9318b566fdd4add08776dadb1feebe9915108531d3af9e13a777e2b60e7 SHA512 7239eddf55197c45aa751d05b6518a0782ec4f2ce4d9b4246b74c41dc21077102f3f5cc3359129c32c6842d482f4a9557a92ab84d96e0a9c7063052c9cbed4f6
 DIST iperf-3.19.tar.gz 694741 BLAKE2B b6f5e9bdef5ee3fc38bef893144bc6ad003ccbc7b3db4793dbd2aec5998faa55cac215a0db06ab37729dc1c05787ebacbf09db8a6e6517f82492a6c67ec3d9e6 SHA512 f0631cd1158a90dc402fa30563e6f26dbdbc5d5b0665bed25248f9153118f55296913abeb89bf0b1db760ca2c68f60e0c9cf2df82aa096318ca618ca09176388
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iperf/files/iperf-3.17.1-Unbundle-cJSON.patch b/sdk_container/src/third_party/portage-stable/net-misc/iperf/files/iperf-3.17.1-Unbundle-cJSON.patch
deleted file mode 100644
index 856403ca6b6..00000000000
--- a/sdk_container/src/third_party/portage-stable/net-misc/iperf/files/iperf-3.17.1-Unbundle-cJSON.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-Date: Tue, 30 Jul 2024 21:11:48 +0300
-Subject: [PATCH] Unbundle cJSON
-
-Signed-off-by: Arthur Zamarin <arthurzam@gentoo.org>
---- a/configure.ac
-+++ b/configure.ac
-@@ -61,6 +61,8 @@ AC_ARG_ENABLE([profiling],
-     AS_HELP_STRING([--enable-profiling], [Enable iperf3 profiling binary]))
- AM_CONDITIONAL([ENABLE_PROFILING], [test x$enable_profiling = xyes])
- 
-+PKG_CHECK_MODULES([libcjson], [libcjson >= 1.7.15])
-+
- # Check for the math library (needed by cjson on some platforms)
- AC_SEARCH_LIBS(floor, [m], [], [
- echo "floor()"
---- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -10,8 +10,6 @@ include_HEADERS         = iperf_api.h                                   # Define
- 
- # Specify the source files and flags for the iperf library
- libiperf_la_SOURCES     = \
--                        cjson.c \
--                        cjson.h \
-                         flowlabel.h \
-                         iperf.h \
-                         iperf_api.c \
-@@ -46,10 +44,13 @@ libiperf_la_SOURCES     = \
-                         units.c \
-                         units.h \
-                         version.h
-+libiperf_la_CPPFLAGS    = $(CPPFLAGS) @libcjson_CFLAGS@
-+libiperf_la_LIBADD      = @libcjson_LIBS@
- 
- # Specify the sources and various flags for the iperf binary
- iperf3_SOURCES          = main.c
--iperf3_LDADD            = libiperf.la
-+iperf3_CPPFLAGS         = $(CPPFLAGS) @libcjson_CFLAGS@
-+iperf3_LDADD            = libiperf.la @libcjson_LIBS@
- 
- if ENABLE_PROFILING
- # If the iperf-profiled-binary is enabled
---- a/src/iperf.h
-+++ b/src/iperf.h
-@@ -52,7 +52,7 @@
- 
- #include "timer.h"
- #include "queue.h"
--#include "cjson.h"
-+#include <cjson/cJSON.h>
- #include "iperf_time.h"
- #include "portable_endian.h"
- 
---- a/src/iperf_api.c
-+++ b/src/iperf_api.c
-@@ -79,7 +79,7 @@
- #endif /* HAVE_SCTP_H */
- #include "timer.h"
- 
--#include "cjson.h"
-+#include <cjson/cJSON.h>
- #include "units.h"
- #include "iperf_util.h"
- #include "iperf_locale.h"
---- a/src/iperf_tcp.c
-+++ b/src/iperf_tcp.c
-@@ -42,7 +42,7 @@
- #include "iperf_api.h"
- #include "iperf_tcp.h"
- #include "net.h"
--#include "cjson.h"
-+#include <cjson/cJSON.h>
- 
- #if defined(HAVE_FLOWLABEL)
- #include "flowlabel.h"
---- a/src/iperf_udp.c
-+++ b/src/iperf_udp.c
-@@ -45,7 +45,7 @@
- #include "iperf_udp.h"
- #include "timer.h"
- #include "net.h"
--#include "cjson.h"
-+#include <cjson/cJSON.h>
- 
- /* iperf_udp_recv
-  *
---- a/src/iperf_util.c
-+++ b/src/iperf_util.c
-@@ -46,7 +46,7 @@
- #include <errno.h>
- #include <fcntl.h>
- 
--#include "cjson.h"
-+#include <cjson/cJSON.h>
- #include "iperf.h"
- #include "iperf_api.h"
- 
---- a/src/iperf_util.h
-+++ b/src/iperf_util.h
-@@ -28,7 +28,7 @@
- #define __IPERF_UTIL_H
- 
- #include "iperf_config.h"
--#include "cjson.h"
-+#include <cjson/cJSON.h>
- #include <sys/select.h>
- #include <stddef.h>
- 
--- 
-2.45.2
-
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-2.2.1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-2.2.1.ebuild
new file mode 100644
index 00000000000..ea2912d4485
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-2.2.1.ebuild
@@ -0,0 +1,44 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit toolchain-funcs
+
+DESCRIPTION="Tool to measure IP bandwidth using UDP or TCP"
+HOMEPAGE="https://sourceforge.net/projects/iperf2/"
+
+if [[ ${PV} == *9999* ]] ; then
+	EGIT_REPO_URI="https://git.code.sf.net/p/iperf2/code"
+	inherit git-r3
+else
+	SRC_URI="https://downloads.sourceforge.net/iperf2/${P}.tar.gz"
+
+	KEYWORDS="~amd64 ~arm ~hppa ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos"
+fi
+
+LICENSE="HPND"
+SLOT="2"
+IUSE="debug"
+# Fails w/ connection refused to just-spawned daemon
+RESTRICT="test"
+
+src_configure() {
+	local myeconfargs=(
+		$(use_enable debug debuginfo)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	emake AR="$(tc-getAR)"
+}
+
+src_install() {
+	default
+
+	dodoc doc/*
+	newinitd "${FILESDIR}"/${PN}.initd-r1 ${PN}
+	newconfd "${FILESDIR}"/${PN}.confd ${PN}
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-2.9999.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-2.9999.ebuild
index cd4130c2772..ea2912d4485 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-2.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-2.9999.ebuild
@@ -1,25 +1,34 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
-inherit git-r3 toolchain-funcs
+inherit toolchain-funcs
 
 DESCRIPTION="Tool to measure IP bandwidth using UDP or TCP"
 HOMEPAGE="https://sourceforge.net/projects/iperf2/"
-EGIT_REPO_URI="https://git.code.sf.net/p/iperf2/code"
+
+if [[ ${PV} == *9999* ]] ; then
+	EGIT_REPO_URI="https://git.code.sf.net/p/iperf2/code"
+	inherit git-r3
+else
+	SRC_URI="https://downloads.sourceforge.net/iperf2/${P}.tar.gz"
+
+	KEYWORDS="~amd64 ~arm ~hppa ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos"
+fi
 
 LICENSE="HPND"
 SLOT="2"
-IUSE="ipv6 threads debug"
-
-DOCS=( INSTALL README )
+IUSE="debug"
+# Fails w/ connection refused to just-spawned daemon
+RESTRICT="test"
 
 src_configure() {
-	econf \
-		$(use_enable debug debuginfo) \
-		$(use_enable ipv6) \
-		$(use_enable threads)
+	local myeconfargs=(
+		$(use_enable debug debuginfo)
+	)
+
+	econf "${myeconfargs[@]}"
 }
 
 src_compile() {
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.17.1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.19.1.ebuild
similarity index 62%
rename from sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.17.1.ebuild
rename to sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.19.1.ebuild
index 25afe469008..fa59959a784 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.17.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.19.1.ebuild
@@ -1,17 +1,17 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
 inherit autotools systemd
 
-DESCRIPTION="A TCP, UDP, and SCTP network bandwidth measurement tool"
-HOMEPAGE="https://github.com/esnet/iperf"
-SRC_URI="https://github.com/esnet/iperf/releases/download/${PV}/${P}.tar.gz"
+DESCRIPTION="TCP, UDP, and SCTP network bandwidth measurement tool"
+HOMEPAGE="https://software.es.net/iperf/ https://github.com/esnet/iperf"
+SRC_URI="https://github.com/esnet/${PN}/archive/refs/tags/${PV}.tar.gz -> ${P}.tar.gz"
 
 LICENSE="BSD"
 SLOT="3"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~mips ppc ppc64 ~riscv sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
 IUSE="sctp"
 
 DEPEND="
@@ -26,8 +26,7 @@ DOCS=( README.md RELNOTES.md )
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-3.10.1-drop-forced-debugging-symbols.patch
-	"${FILESDIR}"/${PN}-3.17.1-Unbundle-cJSON.patch
-	"${FILESDIR}"/${PN}-3.17.1-c23.patch
+	"${FILESDIR}"/${PN}-3.18-unbundle-cJSON.patch
 )
 
 src_prepare() {
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iperf/metadata.xml b/sdk_container/src/third_party/portage-stable/net-misc/iperf/metadata.xml
index e966dec4de3..6952d36b034 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/iperf/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iperf/metadata.xml
@@ -12,6 +12,6 @@
 	<upstream>
 		<remote-id type="cpe">cpe:/a:iperf_project:iperf</remote-id>
 		<remote-id type="github">esnet/iperf</remote-id>
-		<remote-id type="sourceforge">iperf</remote-id>
+		<remote-id type="sourceforge">iperf2</remote-id>
 	</upstream>
 </pkgmetadata>

From 98437f1ab0ef50d7cc32198ed247bd15efc1b5e1 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:14:40 +0000
Subject: [PATCH 082/122] net-misc/socat: Sync with Gentoo

It's from Gentoo commit 56678ceb5ded328095736447237ecf67f29acd69.
---
 .../portage-stable/net-misc/socat/socat-1.8.0.3.ebuild         | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sdk_container/src/third_party/portage-stable/net-misc/socat/socat-1.8.0.3.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/socat/socat-1.8.0.3.ebuild
index 9235016c1a1..62563483c8b 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/socat/socat-1.8.0.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/socat/socat-1.8.0.3.ebuild
@@ -15,6 +15,9 @@ LICENSE="GPL-2"
 SLOT="0"
 KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
 IUSE="ipv6 readline ssl tcpd"
+# bug #946404 (and many others), whack-a-mole with timeouts and friends
+# Try again in the future.
+RESTRICT="test"
 
 DEPEND="
 	ssl? ( >=dev-libs/openssl-3:= )

From 1dc759e3af1aebe7242c462222eaa8b1d63a6e8b Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:14:45 +0000
Subject: [PATCH 083/122] net-nds/rpcbind: Sync with Gentoo

It's from Gentoo commit e8f2e43e93d86fdb09553c0db8b8acb1e59b80b6.
---
 .../portage-stable/net-nds/rpcbind/Manifest   |  2 +-
 .../net-nds/rpcbind/rpcbind-1.2.7.ebuild      |  3 +-
 ...bind-1.2.6.ebuild => rpcbind-1.2.8.ebuild} | 30 +++++++++++--------
 .../net-nds/rpcbind/rpcbind-9999.ebuild       |  3 +-
 4 files changed, 22 insertions(+), 16 deletions(-)
 rename sdk_container/src/third_party/portage-stable/net-nds/rpcbind/{rpcbind-1.2.6.ebuild => rpcbind-1.2.8.ebuild} (76%)

diff --git a/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/Manifest b/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/Manifest
index 83b0903cfd3..f6ac967b64e 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/Manifest
@@ -1,2 +1,2 @@
-DIST rpcbind-1.2.6.tar.bz2 124590 BLAKE2B bb0e9f81e4747f8a732c9e25af561e79f2b6cd1c1955db586833871901b6da73f4b7ef32149a81b75daa81359b9c0554726670460b28857042dd66a2f861cac2 SHA512 fb89c61be4c533fe2e6057749d97079a2d1c9fac0d35d6be1a159a0edbf86092b3fc121f19fa920e75aac5ecdd3f59f5978e6401d5cad16cd438c977736206a7
 DIST rpcbind-1.2.7.tar.bz2 125792 BLAKE2B f1e79b304ce5fe06c1c256d3512d999daffca782d956440f612b8a957ad7ddb35356b47aa4f4105d5b24d820daab32ec3a0f4a3b8ac76bb7adf5c3ed22d2ef01 SHA512 ca1517bdab86221d13c645042cc31b25b4d2b574d63ebaa20da4f5392b611cf58811f267214293e953f504d364e5daaa5875eab7aa68a04b89e68fd5508e3926
+DIST rpcbind-1.2.8.tar.bz2 129079 BLAKE2B 70bef658aafc4b1b626a7e9ff312b34748e0142a0a93d058c28d6599545281464f27a5546abe287f0dd369e5264cb38940f85e5e6c128cb0e0f7aaa4b841ab77 SHA512 66f3955a67c4d0142ec635614ceafbc9bdbea985f2edaeec903f17efaf3c2e98f6483e8e6b7f1358cf8d2c1c877b281d153a3bf1b6748b6d259ae7ad1465ee71
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-1.2.7.ebuild b/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-1.2.7.ebuild
index ab1dff1e44c..dd695f57edd 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-1.2.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-1.2.7.ebuild
@@ -16,7 +16,8 @@ else
 	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 fi
 
-LICENSE="BSD"
+# GPL-2 for init script (bug #426104)
+LICENSE="BSD GPL-2"
 SLOT="0"
 IUSE="debug remotecalls selinux systemd tcpd warmstarts"
 REQUIRED_USE="systemd? ( warmstarts )"
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-1.2.6.ebuild b/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-1.2.8.ebuild
similarity index 76%
rename from sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-1.2.6.ebuild
rename to sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-1.2.8.ebuild
index 6429cb9bb47..a553446a231 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-1.2.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-1.2.8.ebuild
@@ -1,33 +1,37 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 inherit systemd
 
+DESCRIPTION="portmap replacement which supports RPC over various protocols"
+HOMEPAGE="https://sourceforge.net/projects/rpcbind/"
+
 if [[ ${PV} == "9999" ]] ; then
 	EGIT_REPO_URI="git://linux-nfs.org/~steved/rpcbind.git"
 	inherit autotools git-r3
 else
 	SRC_URI="https://downloads.sourceforge.net/${PN}/${P}.tar.bz2"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 fi
 
-DESCRIPTION="portmap replacement which supports RPC over various protocols"
-HOMEPAGE="https://sourceforge.net/projects/rpcbind/"
-
-LICENSE="BSD"
+# GPL-2 for init script (bug #426104)
+LICENSE="BSD GPL-2"
 SLOT="0"
 IUSE="debug remotecalls selinux systemd tcpd warmstarts"
 REQUIRED_USE="systemd? ( warmstarts )"
 
-DEPEND=">=net-libs/libtirpc-0.2.3:=
+DEPEND="
+	>=net-libs/libtirpc-0.2.3:=
 	systemd? ( sys-apps/systemd:= )
-	tcpd? ( sys-apps/tcp-wrappers )"
-RDEPEND="${DEPEND}
-	selinux? ( sec-policy/selinux-rpcbind )"
-BDEPEND="
-	virtual/pkgconfig"
+	tcpd? ( sys-apps/tcp-wrappers )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-rpcbind )
+"
+BDEPEND="virtual/pkgconfig"
 
 src_prepare() {
 	default
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-9999.ebuild b/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-9999.ebuild
index dae4c2ee6ab..a553446a231 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-9999.ebuild
@@ -16,7 +16,8 @@ else
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 fi
 
-LICENSE="BSD"
+# GPL-2 for init script (bug #426104)
+LICENSE="BSD GPL-2"
 SLOT="0"
 IUSE="debug remotecalls selinux systemd tcpd warmstarts"
 REQUIRED_USE="systemd? ( warmstarts )"

From 1791b378075ee613d921851b1d50b602fbd5f0f1 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:14:46 +0000
Subject: [PATCH 084/122] profiles: Sync with Gentoo

It's from Gentoo commit 05a0f4f99016c0395e734c51e4ff32ee92809695.
---
 .../profiles/arch/alpha/package.use.mask      |   8 +-
 .../profiles/arch/amd64/package.use.mask      |   4 +
 .../profiles/arch/amd64/use.mask              |   6 +
 .../profiles/arch/amd64/x32/package.mask      |   1 -
 .../profiles/arch/amd64/x32/package.use.mask  |   1 +
 .../profiles/arch/arm/23.0-armv7a_hf/use.mask |   3 +-
 .../profiles/arch/arm/23.0-armv7a_sf/use.mask |   3 +-
 .../profiles/arch/arm/armv7a/use.mask         |   3 +-
 .../profiles/arch/arm/package.use.mask        |  12 +-
 .../arch/arm64/big-endian/package.mask        |   9 -
 .../profiles/arch/arm64/package.use.mask      |  19 +-
 .../profiles/arch/arm64/use.mask              |  10 +-
 .../profiles/arch/base/package.use.mask       |   3 -
 .../profiles/arch/base/use.mask               |  19 +-
 .../profiles/arch/hppa/package.use.mask       |   7 +-
 .../profiles/arch/mips/package.use.mask       |   5 +
 .../profiles/arch/powerpc/package.use.mask    |   4 +
 .../arch/powerpc/package.use.stable.mask      |   7 -
 .../arch/powerpc/ppc32/package.use.mask       |  11 +-
 .../arch/powerpc/ppc64/package.use.mask       |  10 -
 .../powerpc/ppc64/package.use.stable.mask     |   5 -
 .../profiles/arch/powerpc/use.mask            |   1 +
 .../profiles/arch/riscv/package.use           |   4 +-
 .../profiles/arch/riscv/package.use.mask      |   4 +
 .../profiles/arch/sparc/package.use.mask      |   2 +-
 .../arch/sparc/package.use.stable.mask        |   1 +
 .../profiles/arch/x86/package.use.mask        |  14 +-
 .../portage-stable/profiles/arch/x86/use.mask |   6 +
 .../profiles/base/package.use.force           |  10 +-
 .../profiles/base/package.use.mask            |  54 +--
 .../linux/ppc/23.0/time64/desktop/eapi        |   1 +
 .../linux/ppc/23.0/time64/desktop/gnome/eapi  |   1 +
 .../ppc/23.0/time64/desktop/gnome/parent      |   2 +
 .../23.0/time64/desktop/gnome/systemd/eapi    |   1 +
 .../23.0/time64/desktop/gnome/systemd/parent  |   2 +
 .../linux/ppc/23.0/time64/desktop/parent      |   2 +
 .../default/linux/ppc/23.0/time64/eapi        |   1 +
 .../linux/ppc/23.0/time64/make.defaults       |   5 +
 .../default/linux/ppc/23.0/time64/parent      |   2 +
 .../ppc/23.0/time64/split-usr/desktop/eapi    |   1 +
 .../23.0/time64/split-usr/desktop/gnome/eapi  |   1 +
 .../time64/split-usr/desktop/gnome/parent     |   2 +
 .../ppc/23.0/time64/split-usr/desktop/parent  |   2 +
 .../linux/ppc/23.0/time64/split-usr/eapi      |   1 +
 .../linux/ppc/23.0/time64/split-usr/parent    |   2 +
 .../linux/ppc/23.0/time64/systemd/eapi        |   1 +
 .../linux/ppc/23.0/time64/systemd/parent      |   2 +
 .../default/linux/s390/23.0/time64/eapi       |   1 +
 .../linux/s390/23.0/time64/make.defaults      |   5 +
 .../default/linux/s390/23.0/time64/parent     |   2 +
 .../linux/s390/23.0/time64/split-usr/eapi     |   1 +
 .../linux/s390/23.0/time64/split-usr/parent   |   2 +
 .../linux/s390/23.0/time64/systemd/eapi       |   1 +
 .../linux/s390/23.0/time64/systemd/parent     |   2 +
 .../profiles/desc/cpu_flags_arm.desc          |   6 +-
 .../profiles/desc/cpu_flags_ppc.desc          |   3 +-
 .../features/big-endian/package.use.mask      |   1 +
 .../profiles/features/musl/package.mask       |  10 +-
 .../profiles/features/musl/package.use.mask   |   1 +
 .../profiles/features/wd40/package.mask       |   7 +
 .../profiles/features/wd40/package.use.mask   |   9 +
 .../profiles/package.deprecated               |   9 +
 .../portage-stable/profiles/package.mask      | 323 ++++++++++--------
 .../prefix/darwin/macos/arch/arm64/use.mask   |  14 +-
 .../profiles/prefix/linux/amd64/parent        |   2 +-
 .../profiles/prefix/linux/arm/parent          |   2 +-
 .../profiles/prefix/linux/arm64/parent        |   2 +-
 .../profiles/prefix/linux/ppc64/parent        |   2 +-
 .../profiles/prefix/linux/ppc64le/parent      |   2 +-
 .../profiles/prefix/linux/riscv/parent        |   2 +-
 .../profiles/prefix/linux/x86/parent          |   2 +-
 .../portage-stable/profiles/profiles.desc     |  13 +-
 .../portage-stable/profiles/updates/1Q-2024   |   1 -
 .../portage-stable/profiles/updates/3Q-2021   |   1 -
 .../portage-stable/profiles/updates/3Q-2025   |   1 +
 75 files changed, 422 insertions(+), 280 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/profiles/arch/arm64/big-endian/package.mask
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/eapi
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/eapi
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/parent
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/systemd/eapi
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/systemd/parent
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/parent
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/eapi
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/make.defaults
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/parent
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/eapi
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/gnome/eapi
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/gnome/parent
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/parent
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/eapi
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/parent
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/systemd/eapi
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/systemd/parent
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/eapi
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/make.defaults
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/parent
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/split-usr/eapi
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/split-usr/parent
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/systemd/eapi
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/systemd/parent
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2025

diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
index ec68d39a856..8850b3a4b83 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Ian Jordan <immoloism@gmail.com> (2025-07-28)
+# Needs app-text/ronn-ng, which is not keyworded here
+app-accessibility/espeakup man
+
 # Cristian Othón Martínez Vera <cfuga@cfuga.mx> (2025-07-15)
 # Needs gui-apps/grim, which is not keyworded here
 x11-misc/xscreensaver wayland
@@ -343,10 +347,6 @@ dev-util/ragel doc
 # Dependency not keyworded on this arch.
 app-text/enchant voikko
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2020-11-12)
-# media-sound/lash not keyworded, bug #736725
-media-sound/fluidsynth lash
-
 # Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> (2020-10-14)
 # app-i18n/fcitx:4 not keyworded.
 media-libs/libsdl2 fcitx
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
index c82d58878ff..0131842955f 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
@@ -17,6 +17,10 @@
 
 #--- END OF EXAMPLES ---
 
+# Andreas K. Hüttel <dilfridge@gentoo.org> (2025-08-06)
+# x86-64 supports sframe
+>=sys-libs/glibc-2.42 -sframe
+
 # Alfred Wingate <parona@protonmail.com> (2025-05-22)
 # Upstream supports amd64
 media-libs/svt-av1 -test
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask
index a67dc54b8d4..ede58b0fa8f 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask
@@ -163,6 +163,9 @@
 -cpu_flags_x86_3dnow
 -cpu_flags_x86_3dnowext
 -cpu_flags_x86_aes
+-cpu_flags_x86_amx_bf16
+-cpu_flags_x86_amx_int8
+-cpu_flags_x86_amx_tile
 -cpu_flags_x86_avx
 -cpu_flags_x86_avx2
 -cpu_flags_x86_avx512_4fmaps
@@ -182,6 +185,9 @@
 -cpu_flags_x86_avx512ifma
 -cpu_flags_x86_avx512pf
 -cpu_flags_x86_avx512vbmi
+-cpu_flags_x86_avx_vnni
+-cpu_flags_x86_bmi1
+-cpu_flags_x86_bmi2
 -cpu_flags_x86_avx512vl
 -cpu_flags_x86_f16c
 -cpu_flags_x86_fma3
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
index 19800aa16e8..93403e9f53d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
@@ -183,7 +183,6 @@ app-metrics/ceph_exporter
 # Michał Górny <mgorny@gentoo.org> (2018-04-15)
 # Broken multilib dependencies.
 net-im/mattermost-desktop-bin
-net-im/skypeforlinux
 net-im/slack
 
 # Pawel Hajdan jr <phajdan.jr@gentoo.org> (2012-10-07)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.use.mask
index 0428d5699af..0ea971ba87c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.use.mask
@@ -63,6 +63,7 @@ games-util/lgogdownloader gui
 kde-apps/kde-apps-meta pim
 kde-apps/kdenetwork-meta bittorrent
 kde-apps/kleopatra pim
+kde-apps/umbrello php
 kde-misc/kio-gdrive share
 kde-plasma/plasma-nm openconnect
 net-misc/seafile-client shibboleth
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/23.0-armv7a_hf/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/23.0-armv7a_hf/use.mask
index fb779ca1d2e..b1bb8d71e60 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/23.0-armv7a_hf/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/23.0-armv7a_hf/use.mask
@@ -1,4 +1,4 @@
-# Copyright 2011-2022 Gentoo Authors
+# Copyright 2011-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Unmask armv7 specific USE flags
@@ -9,6 +9,7 @@
 
 -cpu_flags_arm_edsp
 -cpu_flags_arm_neon
+-cpu_flags_arm_neon-fp16
 -cpu_flags_arm_thumb
 -cpu_flags_arm_thumb2
 -cpu_flags_arm_vfp
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/23.0-armv7a_sf/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/23.0-armv7a_sf/use.mask
index fb779ca1d2e..b1bb8d71e60 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/23.0-armv7a_sf/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/23.0-armv7a_sf/use.mask
@@ -1,4 +1,4 @@
-# Copyright 2011-2022 Gentoo Authors
+# Copyright 2011-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Unmask armv7 specific USE flags
@@ -9,6 +9,7 @@
 
 -cpu_flags_arm_edsp
 -cpu_flags_arm_neon
+-cpu_flags_arm_neon-fp16
 -cpu_flags_arm_thumb
 -cpu_flags_arm_thumb2
 -cpu_flags_arm_vfp
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/armv7a/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/armv7a/use.mask
index fb779ca1d2e..b1bb8d71e60 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/armv7a/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/armv7a/use.mask
@@ -1,4 +1,4 @@
-# Copyright 2011-2022 Gentoo Authors
+# Copyright 2011-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Unmask armv7 specific USE flags
@@ -9,6 +9,7 @@
 
 -cpu_flags_arm_edsp
 -cpu_flags_arm_neon
+-cpu_flags_arm_neon-fp16
 -cpu_flags_arm_thumb
 -cpu_flags_arm_thumb2
 -cpu_flags_arm_vfp
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
index 7e68b737ca2..1b28df7624d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Alfred Wingate <parona@protonmail.com> (2025-07-31)
+# mongodb not keyworded here
+sci-libs/gdal mongodb
+
 # Cristian Othón Martínez Vera <cfuga@cfuga.mx> (2025-07-15)
 # Needs gui-apps/grim, which is not keyworded here
 x11-misc/xscreensaver wayland
@@ -339,10 +343,6 @@ dev-ruby/capybara test
 # pre-built, no ARM support
 net-wireless/gr-osmosdr sdrplay
 
-# Markus Meier <maekke@gentoo.org> (2018-05-30)
-# unkeyworded deps for bug #621434
-net-analyzer/zmap mongo
-
 # Michał Górny <mgorny@gentoo.org> (2018-04-15)
 # Unkeyworded dep masks moved from default/linux.
 net-libs/gnutls test-full
@@ -395,10 +395,6 @@ dev-db/mariadb -jdbc
 # does not build on arm at all (upstream bug)
 dev-scheme/racket futures jit
 
-# Ian Whyman <thev00d00@gentoo.org> (2016-05-22)
-# RPI support on arm
-dev-libs/libcec -raspberry-pi
-
 # Thomas Deutschmann <whissi@gentoo.org> (2016-03-19)
 # Unkeyworded deps, bug #564274
 app-metrics/collectd collectd_plugins_ipmi
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/big-endian/package.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/big-endian/package.mask
deleted file mode 100644
index 0d2aaf8a10e..00000000000
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/big-endian/package.mask
+++ /dev/null
@@ -1,9 +0,0 @@
-# Copyright 2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# Andreas K. Hüttel <dilfridge@gentoo.org> (2025-03-31)
-# gcc-14 fails to build (no idea about gcc-15 but upstream says
-# 14/15 regression)
-# https://bugs.gentoo.org/948045
-# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=118891
->=sys-devel/gcc-14
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
index d06de452a00..b521ed34aa3 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
@@ -1,6 +1,16 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Andreas K. Hüttel <dilfridge@gentoo.org> (2025-08-06)
+# aarch64 supports sframe
+>=sys-libs/glibc-2.42 -sframe
+
+# Ionen Wolkens <ionen@gentoo.org> (2025-08-01)
+# dev-qt/qtlanguageserver:6 is keyworded here
+dev-qt/qtdeclarative:6 -qmlls
+dev-qt/qttools:6 -qmlls
+dev-python/pyside -tools
+
 # Alfred Wingate <parona@protonmail.com> (2025-06-10)
 # Upstream supports arm64
 media-libs/svt-av1 -test
@@ -275,11 +285,6 @@ dev-util/diffoscope pascal
 # media-plugins/zam-plugins not keyworded here
 media-sound/easyeffects zamaudio
 
-# Sam James <sam@gentoo.org> (2021-04-14)
-# Supports 64-bit NEON
-# Note: libpng-compat 1.5.30 does NOT seem to.
-media-libs/libpng -cpu_flags_arm_neon
-
 # Sam James <sam@gentoo.org> (2021-03-20)
 # Supports both 'neon32' and 'neon64'
 sys-libs/zlib-ng -cpu_flags_arm_neon
@@ -529,10 +534,6 @@ net-voip/mumble g15
 # media-libs/libemf fails with #error unknown CPU.
 media-gfx/pstoedit emf
 
-# Alexis Ballier <aballier@gentoo.org> (2017-07-10)
-# openvz-sources are likely too old for any proper arm64 usage
-app-emulation/libvirt openvz
-
 # Alexis Ballier <aballier@gentoo.org> (2017-06-21)
 # net-fs/openafs-kernel does not recognize arm64 properly
 # Need to check if this has a chance to work with in-kernel drivers
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/use.mask
index a1ec43a35f2..7636800a185 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/use.mask
@@ -69,14 +69,22 @@ cpu_flags_arm_neon
 -cpu_flags_arm_v8
 
 -cpu_flags_arm_aes
+-cpu_flags_arm_asimd
+-cpu_flags_arm_asimddp
+-cpu_flags_arm_asimdfhm
+-cpu_flags_arm_asimdhp
 -cpu_flags_arm_crc32
 -cpu_flags_arm_edsp
+-cpu_flags_arm_i8mm
 -cpu_flags_arm_sha1
 -cpu_flags_arm_sha2
+-cpu_flags_arm_sm4
+-cpu_flags_arm_sve
+-cpu_flags_arm_sve2
 -cpu_flags_arm_vfp
+-cpu_flags_arm_vfp-d32
 -cpu_flags_arm_vfpv3
 -cpu_flags_arm_vfpv4
--cpu_flags_arm_vfp-d32
 
 # Mart Raudsepp <leio@gentoo.org> (2018-02-13)
 # net-libs/libsmi not tested on arm64 yet
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
index 202d53f6252..4cbc9b5d1d6 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
@@ -231,9 +231,6 @@ app-laptop/pbbuttonsd macbook
 # www-servers/nginx requires keywording
 www-servers/nginx nginx_modules_http_security
 
-# media-libs/libxmp requires keywording
-media-sound/qmmp xmp
-
 # Kai-Chun Ning <kaichun.ning@gmail.com> (2022-05-23)
 # Need intel-hybrid-codec-driver, which only works on amd64
 media-libs/libva-intel-driver hybrid
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
index 011061d30b2..a29e04b877f 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
@@ -92,6 +92,9 @@ svga
 cpu_flags_x86_3dnow
 cpu_flags_x86_3dnowext
 cpu_flags_x86_aes
+cpu_flags_x86_amx_bf16
+cpu_flags_x86_amx_int8
+cpu_flags_x86_amx_tile
 cpu_flags_x86_avx
 cpu_flags_x86_avx2
 cpu_flags_x86_avx512_4fmaps
@@ -112,6 +115,9 @@ cpu_flags_x86_avx512ifma
 cpu_flags_x86_avx512pf
 cpu_flags_x86_avx512vbmi
 cpu_flags_x86_avx512vl
+cpu_flags_x86_avx_vnni
+cpu_flags_x86_bmi1
+cpu_flags_x86_bmi2
 cpu_flags_x86_f16c
 cpu_flags_x86_fma3
 cpu_flags_x86_fma4
@@ -137,6 +143,7 @@ cpu_flags_ppc_altivec
 cpu_flags_ppc_vsx
 cpu_flags_ppc_vsx2
 cpu_flags_ppc_vsx3
+cpu_flags_ppc_vsx4
 
 # mips arch specific USE flags
 loongson2f
@@ -157,20 +164,30 @@ cpu_flags_arm_v5
 cpu_flags_arm_v6
 cpu_flags_arm_v7
 cpu_flags_arm_v8
+
 cpu_flags_arm_aes
+cpu_flags_arm_asimd
+cpu_flags_arm_asimddp
+cpu_flags_arm_asimdfhm
+cpu_flags_arm_asimdhp
 cpu_flags_arm_crc32
 cpu_flags_arm_edsp
+cpu_flags_arm_i8mm
 cpu_flags_arm_iwmmxt
 cpu_flags_arm_iwmmxt2
 cpu_flags_arm_neon
+cpu_flags_arm_neon-fp16
 cpu_flags_arm_sha1
 cpu_flags_arm_sha2
+cpu_flags_arm_sm4
+cpu_flags_arm_sve
+cpu_flags_arm_sve2
 cpu_flags_arm_thumb
 cpu_flags_arm_thumb2
 cpu_flags_arm_vfp
+cpu_flags_arm_vfp-d32
 cpu_flags_arm_vfpv3
 cpu_flags_arm_vfpv4
-cpu_flags_arm_vfp-d32
 
 # nVidia XvMC requires nvidia-drivers/nvidia-legacy-drivers
 nvidia
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
index dcc76e12668..8fc528450a6 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
@@ -79,6 +79,7 @@ sys-apps/systemd bpf
 # Leonardo Hernández Hernández <leohdz172@proton.me> (2024-07-07)
 # media-libs/quirc and media-sound/liblc3 are not keyworded here
 media-video/ffmpeg quirc liblc3
+media-video/ffmpeg-compat quirc liblc3
 
 # Sam James <sam@gentoo.org> (2024-07-03)
 # kde-frameworks/kservice not keyworded here
@@ -287,7 +288,7 @@ sys-libs/libcap tools
 # Michał Górny <mgorny@gentoo.org> (2021-07-25)
 # PyQt5 and wxpython are not keyworded.
 dev-python/ipython qt5 qt6
-dev-python/matplotlib qt5 qt6 wxwidgets
+dev-python/matplotlib qt6 wxwidgets
 
 # Matt Turner <mattst88@gentoo.org> (2021-07-23)
 # gui-libs/gtk is not keyworded
@@ -320,10 +321,6 @@ sys-apps/groff uchardet
 # Dependency not keyworded on this arch.
 app-text/enchant voikko
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2020-11-12)
-# media-sound/lash not keyworded, bug #736725
-media-sound/fluidsynth lash
-
 # Joonas Niilola <juippis@gentoo.org> (2020-10-08)
 # Dependency not keyworded on this arch.
 dev-libs/efl avif lua_single_target_luajit physics
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask
index b03b65a4c9a..87e0fd0c181 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask
@@ -1,6 +1,11 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Pacho Ramos <pacho@gentoo.org> (2025-08-15)
+# dev-lang/spidermonkey:128 is not keyworded on mips, #941187
+app-crypt/libsecret test-rust
+dev-util/glade gjs
+
 # Andreas K. Hüttel <dilfridge@gentoo.org> (2025-07-18)
 # Not keyworded for mips
 app-alternatives/sh ksh
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
index 4c99f634460..694d7349f0c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Alfred Wingate <parona@protonmail.com> (2025-07-31)
+# mongodb not keyworded here
+sci-libs/gdal mongodb
+
 # Alfredo Tupone <tupone@gentoo.org> (2025-07-02)
 # sci-ml/pytorch is not keyworded here
 sci-ml/huggingface_hub test
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.stable.mask
index 68edf904aff..ae12620d946 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.stable.mask
@@ -59,12 +59,6 @@ x11-wm/mutter screencast
 # Non-stable dependency.  Used to be masked completely.
 media-sound/abcde replaygain
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2018-06-20)
-# dev-python/pyqt5 is not stable.
-dev-python/matplotlib qt5 qt6 test
-net-print/hplip qt5
-dev-python/pyudev qt5
-
 # David Seifert <soap@gentoo.org> (2017-09-23)
 # MPI does not have stable keywords on ppc/ppc64
 sci-libs/fftw mpi
@@ -84,7 +78,6 @@ media-plugins/frei0r-plugins facedetect
 
 # Michael Palimaka <kensington@gentoo.org> (2016-05-25)
 # Dependencies not stable
-app-arch/p7zip kde
 dev-vcs/subversion kwallet
 x11-misc/xscreensaver new-login
 
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
index 5b58a22601a..4bb5178356d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
@@ -1,15 +1,16 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-07-31)
+# dev-python/pyqt5, dev-python/pyqt6 are not stable.
+dev-python/matplotlib qt6 test
+net-print/hplip qt5
+
 # Hans de Graaff <graaff@gentoo.org> (2025-06-29)
 # Requires large parts of dev-ruby/rails to be keyworded.
 dev-ruby/globalid test
 dev-ruby/minitest-hooks test
 
-# Mike Gilbert <floppym@gentoo.org> (2025-06-18)
-# media-libs/libsdl3 is missing keywords.
->=net-misc/freerdp-3.16.0 sdl
-
 # Sam James <sam@gentoo.org> (2025-05-16)
 # gpio: dev-libs/libgpiod not keyworded here
 # modbus: dev-libs/libmodbus not keyworded here
@@ -137,7 +138,7 @@ llvm-core/clang extra
 # Nowa Ammerlaan <nowa@gentoo.org> (2022-09-23)
 # The corresponding Qt5 modules are not keyworded on ppc, and we don't want to
 # keyword them solely because of PyQt5 while there are no other in-tree users.
-dev-python/pyqt5 bluetooth location speech
+dev-python/pyqt5 speech
 
 # Arthur Zamarin <arthurzam@gentoo.org> (2022-08-15)
 # deps not keyworded
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
index ca9699a9db8..42cfb07e310 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
@@ -1,10 +1,6 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Mike Gilbert <floppym@gentoo.org> (2025-06-18)
-# media-libs/libsdl3 is missing keywords.
->=net-misc/freerdp-3.16.0 sdl
-
 # Sam James <sam@gentoo.org> (2025-06-05)
 # dev-util/spirv-llvm-translator not keyworded here
 dev-libs/pocl spirv
@@ -216,12 +212,6 @@ net-analyzer/snort open-appid
 # Incomplete support, bug #605878.
 net-vpn/tor seccomp
 
-# Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> (2016-08-01)
-# kde-frameworks/*:5 not keyworded.
-net-irc/kvirc kde
-app-arch/p7zip kde
-dev-vcs/subversion kwallet
-
 # Jeroen Roovers <jer@gentoo.org> (2015-12-26)
 # Mask until >sys-cluster/ceph-0.94 goes stable
 net-analyzer/rrdtool rados
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.stable.mask
index 17d3058453f..695f75e84f2 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.stable.mask
@@ -71,11 +71,6 @@ dev-ruby/kramdown unicode
 # app-emacs/flycheck is not marked stable here yet
 dev-util/pkgcheck emacs
 
-# Nowa Ammerlaan <nowa@gentoo.org> (2022-09-23)
-# The corresponding Qt5 modules are not stable keyworded on ppc64, and we don't want to
-# keyword them solely because of PyQt5 while there are no other in-tree users.
-dev-python/pyqt5 bluetooth
-
 # Sam James <sam@gentoo.org> (2022-03-07)
 # sys-cluster/torque not marked stable on ppc64
 sys-cluster/openmpi openmpi_rm_pbs
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/use.mask
index acb66e942c0..e09b4733468 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/use.mask
@@ -51,6 +51,7 @@ clang
 -cpu_flags_ppc_vsx
 -cpu_flags_ppc_vsx2
 -cpu_flags_ppc_vsx3
+-cpu_flags_ppc_vsx4
 
 # Incompatible Use Flags
 #
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use
index 4f00112df03..2b7ec57d310 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use
@@ -1,8 +1,10 @@
 # Copyright 2023-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Michael Orlitzky <mjo@gentoo.org> (2025-08-11)
 # Andrey Grozin <grozin@gentoo.org> (2025-05-15)
-# use ecl as the default lisp for maxima
+# use ecl as the default lisp for maxima and fricas
+sci-mathematics/fricas ecl
 sci-mathematics/maxima ecl
 
 # James Le Cuirot <chewi@gentoo.org> (2023-12-16)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
index 744b729ab8b..4f258d6fda5 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 2019-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Alfred Wingate <parona@protonmail.com> (2025-07-31)
+# mongodb not keyworded here
+sci-libs/gdal mongodb
+
 # Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-02)
 # Broken bundled Eigen, fails to compile. See bug #865191.
 sci-geosciences/grass pdal
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
index 0d59b7e535a..368765dfb68 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
@@ -7,7 +7,7 @@ x11-misc/xscreensaver wayland
 
 # Christopher Byrne <salah.coronya@gmail.com> (2025-06-13)
 # dev-ml/findlib is not keyworkded here
-sys-libs/libnbd test
+sys-libs/libnbd ocaml
 
 # Andreas Sturmlechner <asturm@gentoo.org> (2025-06-13)
 # dev-libs/libwacom is not keyworded here
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.stable.mask
index 464cc3cd4f8..43140d55923 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.stable.mask
@@ -4,6 +4,7 @@
 # Ionen Wolkens <ionen@gentoo.org> (2025-05-25)
 # media-sound/liblc3 is not stable here yet
 media-video/ffmpeg liblc3
+media-video/ffmpeg-compat liblc3
 
 # Ionen Wolkens <ionen@gentoo.org> (2025-03-12)
 # app-arch/snappy is not stable here yet
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
index 4f2f3d586de..0db40be5064 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
@@ -1,15 +1,19 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Alfred Wingate <parona@protonmail.com> (2025-07-31)
+# mongodb not keyworded here
+sci-libs/gdal mongodb
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-07-26)
+# kde-apps/kamoso not keyworded yet, bug #946343
+>=kde-apps/kdemultimedia-meta-25.04.2-r1 gstreamer
+
 # Robin H. Johnson <robbat2@gentoo.org> (2025-07-04)
 # Deeper test dependencies with Ruby 3.3 are no longer yet keyworded keyword;
 # manually tested instead; Test dependencies work with stable Ruby 3.2.
 dev-ruby/facter test
 
-# Mike Gilbert <floppym@gentoo.org> (2025-06-18)
-# media-libs/libsdl3 is missing keywords.
->=net-misc/freerdp-3.16.0 sdl
-
 # Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-02)
 # dev-python/nanobind is not keyworded here
 media-gfx/openvdb python
@@ -86,7 +90,6 @@ games-emulation/rmg -dynarec
 # We only want to support spirv-llvm-translator >= 17 on x86, which is a
 # dependency of mesa.
 >=media-libs/mesa-24.1 llvm_slot_15 llvm_slot_16
->=dev-util/intel_clc-24.1 llvm_slot_16
 
 # Michael Orlitzky <mjo@gentoo.org> (2024-07-09)
 # The opcache extension fails to build on hardened x86, but only
@@ -171,6 +174,7 @@ dev-python/qtpy test
 games-util/lgogdownloader gui
 kde-apps/kde-apps-meta pim
 kde-apps/kdenetwork-meta bittorrent
+kde-apps/umbrello php
 kde-plasma/plasma-nm openconnect
 net-misc/seafile-client shibboleth
 net-p2p/ktorrent rss
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/use.mask
index 31187d658b6..2bb8e0acfa8 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/use.mask
@@ -120,6 +120,9 @@ webengine
 -cpu_flags_x86_3dnow
 -cpu_flags_x86_3dnowext
 -cpu_flags_x86_aes
+-cpu_flags_x86_amx_bf16
+-cpu_flags_x86_amx_int8
+-cpu_flags_x86_amx_tile
 -cpu_flags_x86_avx
 -cpu_flags_x86_avx2
 -cpu_flags_x86_avx512_4fmaps
@@ -140,6 +143,9 @@ webengine
 -cpu_flags_x86_avx512pf
 -cpu_flags_x86_avx512vbmi
 -cpu_flags_x86_avx512vl
+-cpu_flags_x86_avx_vnni
+-cpu_flags_x86_bmi1
+-cpu_flags_x86_bmi2
 -cpu_flags_x86_f16c
 -cpu_flags_x86_fma3
 -cpu_flags_x86_fma4
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
index 2d1b08f7dde..7badc70693e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
@@ -41,7 +41,11 @@ app-emulation/qemu X
 
 # Ionen Wolkens <ionen@gentoo.org> (2025-04-21)
 # Currently fails to build without, and Valve would likely not be
-# interested in a bug. May leave forced depending on how this goes.
+# interested in a bug. Even if this gets fixed, not sure if want
+# to unforce because of this lack of upstream support outside
+# normal Steam+Proton usage with matching build options, we try
+# to only allow a configuration similar to upstream's to minimize
+# issues (but feel free to unforce at your own risks).
 app-emulation/wine-proton mingw
 
 # Sebastian Pipping <sping@gentoo.org> (2025-03-27)
@@ -78,6 +82,8 @@ llvm-runtimes/libcxxabi clang
 #    echo "dev-lang/rust:${slot} llvm_slot_${_RUST_LLVM_MAP[${slot}]}"
 #    echo "dev-lang/rust-bin:${slot} llvm_slot_${_RUST_LLVM_MAP[${slot}]}"
 # done
+dev-lang/rust:1.89.0 llvm_slot_20
+dev-lang/rust-bin:1.89.0 llvm_slot_20
 dev-lang/rust:1.88.0 llvm_slot_20
 dev-lang/rust-bin:1.88.0 llvm_slot_20
 dev-lang/rust:1.87.0 llvm_slot_20
@@ -112,8 +118,6 @@ dev-lang/rust:1.75.0 llvm_slot_17
 dev-lang/rust-bin:1.75.0 llvm_slot_17
 dev-lang/rust:1.74.1 llvm_slot_17
 dev-lang/rust-bin:1.74.1 llvm_slot_17
-dev-lang/rust:1.71.1 llvm_slot_16
-dev-lang/rust-bin:1.71.1 llvm_slot_16
 
 # Sam James <sam@gentoo.org> (2024-06-03)
 # Poor rendering performance otherwise (bug #931215).
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
index 585d19a988d..11212b68340 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
@@ -6,6 +6,23 @@
 
 # New entries go on top.
 
+# Alfred Wingate <parona@protonmail.com> (2025-08-12)
+# Marked Beta tier upstream. Tests don't work with it.
+dev-games/ogre vulkan
+
+# Andreas K. Hüttel <dilfridge@gentoo.org> (2025-08-06)
+# General mask, to be unmasked on arches where glibc supports this
+>=sys-libs/glibc-2.42 sframe
+
+# Ionen Wolkens <ionen@gentoo.org> (2025-08-02)
+# Fails to build, needs looking into but isn't currently needed
+# by anything and can leave it masked for now.
+>=media-libs/vips-8.17 vala
+
+# Alfred Wingate (2025-07-31)
+# Missing dependency
+sci-libs/gdal mongodb
+
 # Ivy <openrc@posteo.de> (2025-07-11)
 # app-editors/gnome-text-editor[spell] has been dropped upstream and
 # replaced with app-text/libspelling, but will likely be added back
@@ -13,10 +30,6 @@
 ~app-editors/gnome-text-editor-47.2 spell
 ~app-editors/gnome-text-editor-47.4 spell
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-06-27)
-# Prepare cleanup of kde-apps/cervisia
-kde-apps/kdesdk-meta cvs
-
 # Andreas Sturmlechner <asturm@gentoo.org> (2025-06-26)
 # >=kde-plasma/drkonqi-6.3.90 requires systemd, so specifically
 # unmasked only in targets/systemd.
@@ -31,20 +44,11 @@ media-libs/svt-av1 test
 # Doesn't work well at runtime.
 dev-games/ogre wayland
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-23)
-# media-sound/hydrogen[lash] build is broken, and dropped upstream in next
-# version. Bug #946125
-media-sound/hydrogen lash
-
 # Maciej Mrozowski <reavertm@gentoo.org> (2025-05-22)
 # Does not compile as of 2024.1.1, requires buildsystem fixes.
 dev-games/simgear gdal
 games-simulation/flightgear gdal
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-14)
-# dev-qt/qtwebchannel:5 is masked, last revdep was dev-python/pyqtwebengine
-dev-python/pyqt5 webchannel
-
 # Joonas Niilola <juippis@gentoo.org> (2025-05-14)
 # Experimental, no official upstream support.
 www-client/firefox jpegxl
@@ -70,7 +74,6 @@ dev-cpp/fbthrift io-uring
 # Andreas Sturmlechner <asturm@gentoo.org> (2025-04-21)
 # Prepare cleanup of dev-qt/qtwebengine:5
 app-i18n/fcitx-chinese-addons webengine
-app-office/libalkimia webengine
 
 # Matt Jolly <kangie@gentoo.org> (2025-04-16)
 # Older versions of freeciv build an incompatible client and
@@ -110,10 +113,6 @@ sci-libs/opencascade ffmpeg
 # Requires dev-python/recommonmark with Python 3.10
 <llvm-core/clang-18 doc
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-02-13)
-# Prepare cleanup of dev-qt/qtgamepad:5
-dev-qt/qt3d gamepad
-
 # Michał Górny <mgorny@gentoo.org> (2025-02-08)
 # Requires dev-cpp/cpp-httplib that has extremely unstable ABI.
 # Not worth the constant churn of having to rebuild LLVM again and again.
@@ -141,11 +140,6 @@ dev-build/meson test-full
 # Blocking cleanup of kde-apps/kdegraphics-mobipocket:5
 kde-frameworks/kfilemetadata:5 mobi
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-01-03)
-# Prepare cleanup of kde-apps/kaccounts-integration:6[qt5] and
-# kde-frameworks/bluez-qt:5
-kde-frameworks/purpose:5 bluetooth kaccounts
-
 # Michał Górny <mgorny@gentoo.org> (2024-12-31)
 # None of the sci-libs/symengine versions work with the modern versions
 # of dev-libs/boost in Gentoo.
@@ -489,10 +483,6 @@ app-misc/pax-utils seccomp
 # app-text/pandoc is not keyworded on most architectures
 net-libs/gssdp man
 
-# Sam James <sam@gentoo.org> (2022-11-19)
-# Needs long-EOL dev-lang/spidermonkey:60 (which also needs python:2.7).
-media-libs/coin javascript
-
 # Matt Turner <mattst88@gentoo.org> (2022-11-16)
 # gnome-music and gnome-photos have not been ported to libsoup:3.0, while
 # other non-slotted dependencies have been.
@@ -503,12 +493,6 @@ gnome-base/gnome-extra-apps tracker
 # which has not been ported to libsoup:3.0.
 >=app-misc/localsearch-3.4.0-r1 rss
 
-# Viorel Munteanu <ceamac.paragon@gmail.com> (2022-10-07)
-# Cannot test and fix pax-kernel related bugs on a current grsec kernel
-# Mask the flag for now
-# Bugs: #643466, #674872, #832161, #855722
-app-emulation/virtualbox pax-kernel
-
 # Sam James <sam@gentoo.org> (2022-10-02)
 # USE=compat / possibly allowing sys-libs/zlib needs to be figured out,
 # but packages want to use the actual zlib-ng library, so we need to
@@ -910,10 +894,6 @@ sys-libs/glibc vanilla
 # This is a security risk if not used carefully, bug #628596.
 net-analyzer/nrpe command-args
 
-# Michał Górny <mgorny@gentoo.org> (2017-08-04)
-# sys-kernel/openvz-sources is being treecleaned wrt bug #580516.
-app-emulation/libvirt openvz
-
 # Mike Gilbert <floppym@gentoo.org> (2017-07-09)
 # Matthias Dahl <matthias.dahl@binary-island.eu> (2017-07-05)
 # Both are not your typical garden-variety Linux programs and are
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/parent
new file mode 100644
index 00000000000..9e06c4505a7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../../targets/desktop/gnome
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/systemd/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/systemd/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/systemd/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/systemd/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/systemd/parent
new file mode 100644
index 00000000000..2122741fb81
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/systemd/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../../../targets/desktop/gnome/systemd
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/parent
new file mode 100644
index 00000000000..db8ce088c69
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../targets/desktop
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/make.defaults
new file mode 100644
index 00000000000..dba188dfd7d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/make.defaults
@@ -0,0 +1,5 @@
+# Copyright 2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+CHOST="powerpc-unknown-linux-gnut64"
+CHOST_ppc="${CHOST}"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/parent
new file mode 100644
index 00000000000..320c1b2c0e2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/parent
@@ -0,0 +1,2 @@
+..
+../../../../../features/time64
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/gnome/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/gnome/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/gnome/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/gnome/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/gnome/parent
new file mode 100644
index 00000000000..d5a56a13f69
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/gnome/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../../../targets/desktop/gnome
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/parent
new file mode 100644
index 00000000000..fae96e8d36b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../../targets/desktop
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/parent
new file mode 100644
index 00000000000..25281026829
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../features/split-usr
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/systemd/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/systemd/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/systemd/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/systemd/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/systemd/parent
new file mode 100644
index 00000000000..7e061533c15
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/systemd/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../targets/systemd
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/make.defaults
new file mode 100644
index 00000000000..0c2f07fa052
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/make.defaults
@@ -0,0 +1,5 @@
+# Copyright 2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+CHOST="s390-ibm-linux-gnut64"
+CHOST_s390="${CHOST}"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/parent
new file mode 100644
index 00000000000..320c1b2c0e2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/parent
@@ -0,0 +1,2 @@
+..
+../../../../../features/time64
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/split-usr/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/split-usr/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/split-usr/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/split-usr/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/split-usr/parent
new file mode 100644
index 00000000000..25281026829
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/split-usr/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../features/split-usr
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/systemd/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/systemd/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/systemd/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/systemd/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/systemd/parent
new file mode 100644
index 00000000000..7e061533c15
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/systemd/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../targets/systemd
diff --git a/sdk_container/src/third_party/portage-stable/profiles/desc/cpu_flags_arm.desc b/sdk_container/src/third_party/portage-stable/profiles/desc/cpu_flags_arm.desc
index ad687c48c6b..7cd649b8be4 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/desc/cpu_flags_arm.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/desc/cpu_flags_arm.desc
@@ -2,13 +2,17 @@
 # Distributed under the terms of the GNU General Public License v2
 
 aes - Use the AES cryptography instruction set
+asimd - Use the Advanced SIMD instructions (NEON with ARMv8 extensions)
 asimddp - Use the Advanced SIMD dot product instructions
+asimdfhm - Use the Advanced SIMD single- & half-precision multiply
+asimdhp - Use the Advanced SIMD half-precision & vector arithmetics
 crc32 - Use the CRC32 instruction set
 edsp - Use the enhanced DSP instructions (ARMv*E and ARMv6+)
 i8mm - Use the AArch64 Int8 matrix multiplication instructions
 iwmmxt - Use the iwMMXt instruction set
 iwmmxt2 - Use the iwMMXt2 instruction set
-neon - Use the NEON (ASIMD) instruction set
+neon - Use the NEON instruction set
+neon-fp16 - Use the NEON intruction set with half word loads / store support
 sha1 - Use the SHA-1 cryptography instruction set
 sha2 - Use the SHA-2 cryptography instruction set
 sm4 - Use the SM4 cryptography instruction set
diff --git a/sdk_container/src/third_party/portage-stable/profiles/desc/cpu_flags_ppc.desc b/sdk_container/src/third_party/portage-stable/profiles/desc/cpu_flags_ppc.desc
index 5d3aad787db..1b2f6d603d9 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/desc/cpu_flags_ppc.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/desc/cpu_flags_ppc.desc
@@ -1,7 +1,8 @@
-# Copyright 2020 Gentoo Authors
+# Copyright 2020-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 altivec - Use the AltiVec/VMX instruction set
 vsx - Use the Vector Scalar Extension instruction set (POWER7 and later)
 vsx2 - Use the Vector Scalar Extension v.2 instruction set (POWER8 and later)
 vsx3 - Use the Vector Scalar Extension v.3 instruction set (POWER9 and later)
+vsx4 - Use the Vector Scalar Extension v.4 instruction set (POWER10 and later)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.use.mask
index 213bbb46d54..a674e69b1e2 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.use.mask
@@ -56,6 +56,7 @@ gnome-base/gnome-control-center wayland
 sys-apps/xdg-desktop-portal-gnome wayland
 net-libs/webkit-gtk:6 wayland
 dev-libs/libportal wayland
+gnome-extra/tecla wayland
 
 # matoro <matoro_gentoo@matoro.tk> (2023-04-10)
 # media-libs/libldac casualties (#80238)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
index 33449386cd5..0e745d52990 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
@@ -1,6 +1,11 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# PPN-SD <nicolas.parlant@parhuet.fr> (2025-07-28)
+# Bundled pcap-thread, not ported to musl
+# bug #713498, https://github.com/DNS-OARC/pcap-thread/issues/128
+net-dns/dnscap
+
 # Ian Jordan <immoloism@gmail.com> (2025-07-13)
 # Binary is compiled against glibc
 net-misc/anydesk
@@ -9,10 +14,6 @@ net-misc/anydesk
 # Not ported to musl (bug #939569, https://github.com/oracle/dtrace-utils/issues/87)
 dev-debug/dtrace
 
-# PPN-SD <nicolas.parlant@parhuet.fr> (2025-07-07)
-# it requires termio.h (glibc)
-app-emulation/ski
-
 # NHOrus <jy6x2b32pie9@yahoo.com> (2025-03-13)
 # uses functions musl will not implement, bug #942215
 app-admin/sud
@@ -370,7 +371,6 @@ net-im/element-desktop-bin
 net-im/gitter-bin
 net-im/mattermost-desktop-bin
 net-im/rocketchat-desktop-bin
-net-im/skypeforlinux
 net-im/slack
 net-im/telegram-desktop-bin
 net-im/whatsapp-desktop-bin
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask
index c8fdc17aee3..86d4b99c8de 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask
@@ -71,6 +71,7 @@ dev-libs/mongo-c-driver test
 dev-php/pecl-mongodb test
 dev-python/pymongo test-full
 net-analyzer/zmap mongo
+sci-libs/gdal mongodb
 
 # Nowa Ammerlaan <nowa@gentoo.org> (2024-04-25)
 # No Level-Zero on musl
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
index 82fb617206a..bd92000d80f 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
@@ -1,6 +1,13 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Michał Górny <mgorny@gentoo.org> (2024-05-08)
+# Pure Python packages using dev-python/uv-build, and therefore
+# requiring Rust to install, and their dependencies.
+dev-python/gherkin-official
+dev-python/pytest-bdd
+dev-python/uv-build
+
 # Sebastian Pipping <sping@gentoo.org> (2025-06-20)
 # Requires masked packages (bug #958030)
 # (dev-python/keyring, dev-python/pydantic)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.use.mask
index 90cb5ca5f69..4b38b6d6509 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.use.mask
@@ -1,6 +1,14 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Michał Górny <mgorny@gentoo.org> (2025-08-05)
+# Native extensions are using Rust.
+dev-python/fastbencode native-extensions
+
+# Holger Hoffstätte <holger@applied-asynchrony.com> (2025-07-24)
+# dnsdist-2.0.0[yaml] needs Rust
+net-dns/dnsdist yaml
+
 # Sam James <sam@gentoo.org> (2025-02-21)
 # Needs Rust
 media-video/ffmpeg rav1e svg
@@ -74,6 +82,7 @@ sys-kernel/installkernel efistub
 dev-python/botocore test
 dev-python/ipython nbconvert test
 dev-python/sphinx-autodoc-typehints test
+>=sci-libs/gdal-3.11.3 python
 
 # Michał Górny <mgorny@gentoo.org> (2024-02-01)
 # Need dev-python/trio.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/package.deprecated b/sdk_container/src/third_party/portage-stable/profiles/package.deprecated
index 0fb1221970c..8ca453a308e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/package.deprecated
+++ b/sdk_container/src/third_party/portage-stable/profiles/package.deprecated
@@ -17,6 +17,15 @@
 
 #--- END OF EXAMPLES ---
 
+# Michał Górny <mgorny@gentoo.org> (2025-07-29)
+# dev-python/flaky and dev-python/pytest-rerunfailurse have conflicting
+# pytest fixtures, with the latter providing a more powerful fixture
+# (and the former breaking packages requiring it).  If your package
+# uses `@pytest.mark.flaky`, use pytest-rerunfailures instead.
+# If it uses `@flaky.flaky`, send a patch upstream to switch
+# to `@pytest.mark.flaky`.
+dev-python/flaky
+
 # Michał Górny <mgorny@gentoo.org> (2025-06-28)
 # versioningit does not provide any support for building via GitHub
 # archives, and has rejected the efforts to provide an envvar override
diff --git a/sdk_container/src/third_party/portage-stable/profiles/package.mask b/sdk_container/src/third_party/portage-stable/profiles/package.mask
index decbca6f435..7fe4a9199be 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/package.mask
@@ -36,6 +36,187 @@
 
 #--- END OF EXAMPLES ---
 
+# Eray Aslan <eras@gentoo.org> (2025-08-18)
+# Due to a critical bug, krb5-1.22 has been withdrawn, and krb5-1.21.3 is again
+# the latest supported release.  krb5-1.22.1 will be issued with a correction.
+=app-crypt/mit-krb5-1.22
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-08-17)
+# Dead upstream for > 10 years. Only a snapshot could save this from
+# cleanup in 2018 for Qt5, but not this time (for Qt6). Bug #958435.
+# Removal on 2025-09-16.
+media-sound/qtagger
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-08-17)
+# Unmaintained upstream with no prospect to port from Qt5 to Qt6.
+# Alternatives exist. Bug #961635. Removal on 2025-09-16.
+media-sound/coquillo
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-08-17)
+# Project was ported to Qt6 by upstream, but also ported to Qbs in doing
+# so. Needs a new maintainer to start with Qbs based package from scratch.
+# Bugs #931995, #955967. Removal on 2025-09-16.
+media-gfx/valentina
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-08-17)
+# 1.2.3 is almost 10 years old, upstream repository archived, Qt5- and
+# EAPI-7 based. Bugs #832577, #830262, #846416 and finally #961631.
+# Removal on 2025-09-16.
+dev-util/qstlink2
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-08-17)
+# Hopelessly outdated and unmaintained package in Gentoo, upstream still
+# Qt5- and EAPI-7 based, no revdeps. Bugs #729746, #729746
+# Removal on 2025-09-16.
+dev-util/sasm
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-08-17)
+# Last release over 5 years ago, Qt5-based, no upstream reaction to Qt6
+# porting PR for more than 1.5 years. Bug #955208. Removal on 2025-09-16.
+sci-electronics/NanoVNA-QT
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-08-17)
+# Archived and unmaintained upstream, Qt5-based, build broken for >1 year.
+# Bugs #932756, #952103. Removal on 2025-09-16.
+app-crypt/yubikey-manager-qt
+
+# Ionen Wolkens <ionen@gentoo.org> (2025-08-13)
+# While it fixes several issues and is meant to be a stable branch,
+# 580.x has too many regressions in its current state. One of the most
+# prominent one is GTK4 applications hanging on exit when vulkan
+# (default) is used on wayland for many users, some games are also
+# known to have problems with it among other things.
+#
+# Can browse NVIDIA's 580 feedback thread[1] to get an idea.
+#
+# Feel free to unmask if not affected.
+#
+# [1] https://forums.developer.nvidia.com/t/580-release-feedback-discussion/
+~x11-drivers/nvidia-drivers-580.65.06
+~x11-drivers/nvidia-drivers-580.76.05
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-08-10)
+# Outdated version packaged in Gentoo, pending version bump request for
+# over a year, depends on Qt5 but worse, Qt5Script, no signs of upstream
+# porting away from it, many unattended build error bugs.
+# Bugs #922311, #926229. Removal on 2025-09-14.
+media-gfx/opentoonz
+
+# Michał Górny <mgorny@gentoo.org> (2025-08-10)
+# Significant regression breaking dev-python/websockets.
+# Masking until upstream decides how to proceed.
+=dev-lang/python-3.13.6
+=dev-python/python-tests-3.13.6
+
+# Hans de Graaff <graaff@gentoo.org> (2025-08-08)
+# ruby-openid fails tests and is archived upstream. Last release 6 years
+# ago. rack-openid is the only reverse dependency.
+# Removal on 2025-09-08
+dev-ruby/rack-openid
+dev-ruby/ruby-openid
+
+# Volkmar W. Pogatzki <gentoo@pogatzki.net> (2025-08-07)
+# Unused java library, pinned to virtual/jdk:1.8.
+# Removal on 2025-09-07.
+dev-java/jide-oss
+
+# Michał Górny <mgorny@gentoo.org> (2025-08-05)
+# Accidental breaking change.  Yanked upstream.  Bug #961089.
+# Followed by another yanked breaking release.
+=dev-python/setuptools-scm-9.1.1
+=dev-python/setuptools-scm-9.0.3
+=dev-python/setuptools-scm-9.0.0
+
+# Alexey Sokolov <alexey+gentoo@asokolov.org> (2025-08-03)
+# Inactive upstream, stuck on Qt5. Suggested alternatives:
+# media-sound/strawberry, media-sound/amarok.
+# Removal on 2025-09-03. Bug #960012.
+media-sound/clementine
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-08-10)
+# media-libs/liblastfm and media-libs/libmygpo-qt destabilisation mask.
+# No more stable revdeps after media-sound/clementine removal.
+~media-libs/liblastfm-1.1.0_pre20190625
+~media-libs/libmygpo-qt-1.1.0
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-07-30)
+# Current package is 7 years old and upstream repository only gets the
+# occasional commit. Package is stuck with EAPI-7, Qt5, no Python 3.13
+# support. Bug #952654. Removal on 2025-08-29.
+sci-chemistry/molequeue
+
+# Hans de Graaff <graaff@gentoo.org> (2025-07-30)
+# Obsolete slot that is ruby33-only. Use the newer slot instead. Removal
+# on 2025-08-30.
+dev-ruby/tzinfo:1
+
+# Eli Schwartz <eschwartz@gentoo.org> (2025-07-28)
+# Unmaintained, out of date, last upstream release in 2018, last
+# packaged release 2015. Broken with modern system interfaces for
+# some time. Entire OpenVZ ecosystem is vaporware these days,
+# openvz-sources was last-rited in 2017 already.
+# Removal on 2025-08-27.  Bug #580516, #868252.
+sys-cluster/vzctl
+app-backup/vzdump
+app-misc/vzstats
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-07-28)
+# Current package is 4 years old and outdated compared to upstream, needs
+# a real maintainer: still EAPI-7, Qt5-based with unclear upstream status.
+# Many bugs: #955642, #957424, #957402, #903803, #841740
+# Removal on 2025-08-27.
+dev-debug/edb-debugger
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-07-28)
+# Current package is 4 years old and outdated compared to upstream.
+# Still Qt5-based with unclear upstream status. Needs real care.
+# Many bugs: #953380, #701988, #683464, #590002, #565034, #579396
+# Removal on 2025-08-27.
+app-office/texmacs
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-07-28)
+# Last release in 2015, last commit more than 2 years ago, still Qt5-based,
+# EAPI-7, no signs of work towards Qt6 upstream. Bug #960817
+# Removal on 2025-08-27.
+media-video/baka-mplayer
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-07-28)
+# Dead for many years, Qt5-based, EAPI-7. Anyone interested in its features
+# should look into qmp3gain instead (bug #949077) but it also needs porting
+# to Qt6. Removal on 2025-08-27.
+media-sound/qtgain
+
+# Hans de Graaff <graaff@gentoo.org> (2025-07-28)
+# Obsolete slots of cucumber components. These slots are no longer used
+# by dev-util/cucumber. Removal on 2025-08-28.
+dev-util/cucumber-gherkin:23
+dev-util/cucumber-gherkin:25
+dev-util/cucumber-messages:19
+dev-util/cucumber-messages:24
+
+# Bernard Cafarelli <voyageur@gentoo.org> (2025-07-27)
+# Current version in tree only supports python <=3.11
+# Needs major version bump, relevant dependencies, and tests fixes
+# Removal on 2025-08-26. Bug #952156.
+dev-python/aiocache
+dev-python/arsenic
+dev-python/browser-cookie3
+dev-python/tld
+dev-python/yaswfp
+net-analyzer/wapiti
+
+# Michał Górny <mgorny@gentoo.org> (2025-07-26)
+# Another pytest plugin causing random breakage.  Discontinued upstream,
+# last revdep stopped using it.
+# Removal on 2025-08-25.  Bug #960760.
+dev-python/noseofyeti
+
+# Michał Górny <mgorny@gentoo.org> (2025-07-22)
+# Provider for PyPy3.10 executable.  This branch is no longer maintained
+# upstream, and it is vulnerable.  Removal on 2025-08-05.
+dev-lang/pypy:3.10
+dev-python/pypy3_10-exe
+dev-python/pypy3_10-exe-bin
+
 # Matt Turner <mattst88@gentoo.org> (2025-07-20)
 # No reverse dependencies remaining.
 # Removal on 2025-08-19.
@@ -101,19 +282,6 @@ virtual/perl-Term-ReadLine
 virtual/perl-Unicode-Collate
 virtual/perl-Unicode-Normalize
 
-# Joonas Niilola <juippis@gentoo.org> (2025-07-01)
-# Python-3.13 enabled version of Spidermonkey. The test phase crashes
-# with 3.13 so I'm not fully convinced there won't be runtime issues
-# with rdeps (gjs, libpeas) but try it out and report back in
-# bug #952299.
-=dev-lang/spidermonkey-128.12.0-r1
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-06-29)
-# KF5-based package, unmaintained upstream, see also:
-# https://mail.kde.org/pipermail/release-team/2025-June/013683.html
-# Removal on 2025-07-29.
-kde-apps/cervisia
-
 # Michał Górny <mgorny@gentoo.org> (2025-06-29)
 # File collision against gnome-base/gnome-keyring[pam], which is
 # required via pambase.  Masked until the maintainer determines a good
@@ -125,100 +293,21 @@ kde-apps/cervisia
 # no longer be used on this architecture.
 =net-proxy/mitmproxy-9.0.1
 
-# Jay Faulkner <jayf@gentoo.org> (2025-06-26)
-# Discontinued by upstream in Sept 2023, running on a likely vulnerable
-# electron version. Bug #959128.
-net-irc/irccloud-desktop-bin
-
-# David Seifert <soap@gentoo.org> (2025-06-25)
-# Skype has been shut down on 2025-05-05, use the Teams progressive web
-# application with your Skype username as alternative.
-# Removal on 2025-07-25.  Bug #942322.
-net-im/skypeforlinux
-sec-policy/selinux-skype
-x11-plugins/pidgin-skypeweb
-
-# Michał Górny <mgorny@gentoo.org> (2025-06-25)
-# New problematic test dependencies.  No reverse dependencies.
-# Removal on 2025-07-25.  Bug #958987.
-dev-python/caldav
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-06-24)
-# Qt5 package without any revdeps. Removal on 2025-07-24. Bug #938823
-dev-libs/libdbusmenu-qt
-
-# Michał Górny <mgorny@gentoo.org> (2025-06-21)
-# Last commit in 2019.  Has an entry point conflict with
-# dev-python/pytest-tornasync.  No reverse dependencies left.
-# Removal on 2025-07-21.  Bug #958601.
-dev-python/pytest-tornado
-
-# Michał Górny <mgorny@gentoo.org> (2025-06-21)
-# No commits for two years.  Broken with Python 3.14
-# and with >=dev-python/pytest-asyncio-1.0.0.  No reverse dependencies.
-# Removal on 2025-07-21.  Bug #958592.
-dev-python/backoff
-
 # Sam James <sam@gentoo.org> (2025-06-12)
 # Breaks several applications (bug #957943)
 >=dev-python/pygobject-3.52
 >=net-im/gajim-2.3.0
 
-# Alexey Sokolov <alexey+gentoo@asokolov.org> (2025-06-09)
-# Dead upstream, fails to compile with gcc 15 and cmake 4.
-# Removal on 2025-07-12. Bugs #957271, #944255
-games-arcade/tuxanci
-
-# Alexey Sokolov <alexey+gentoo@asokolov.org> (2025-06-09)
-# Dead upstream, doesn't build with gcc 15, we're the only ones packaging it.
-# Removal on 2025-07-12. Bugs #944434, #943845, #906249, #680698.
-app-shells/esh
-
-# Alexey Sokolov <alexey+gentoo@asokolov.org> (2025-06-09)
-# Unmaintained upstream since 2008, doesn't build. x86-only.
-# Removal on 2025-07-12. Bugs #77471, #926465, #941191, #948965.
-games-fps/tenebrae
-
-# Alexey Sokolov <alexey+gentoo@asokolov.org> (2025-06-09)
-# Dead upstream, fails to compile.
-# Removal on 2025-07-12. Bugs #919185, #882585, #871018, #913572
-net-analyzer/cryptcat
-
-# Alexey Sokolov <alexey+gentoo@asokolov.org> (2025-06-09)
-# Deprecated and no longer maintained upstream. Open security
-# issues. Use media-gfx/fig2dev instead.
-# Removal on 2025-07-12. Bug #917279.
-media-gfx/transfig
-
 # Sam James <sam@gentoo.ogr> (2025-06-08)
 # Masked for testing (bug #957583).
 =sys-devel/gettext-0.25*
 =dev-libs/libintl-0.25*
 
-# Michał Górny <mgorny@gentoo.org> (2025-06-07)
-# Broken and dangerous.  Archived in 2022.  The last reverse dependency
-# stopped using it in 2023 (except for outdated ebuilds).
-# Removal on 2025-07-07.  Bug #957272, #806474.
-dev-python/pytest-tempdir
-
-# Arthur Zamarin <arthurzam@gentoo.org> (2025-06-07)
-# EAPI=7, maintainer-needed, fails to compile, upstream gone, not
-# packaged anywhere else.
-# Removal on 2025-07-07.  Bug #957444.
-dev-util/bin_replace_string
-
 # Michał Górny <mgorny@gentoo.org> (2025-06-07)
 # Destabilized due to unresolved test failures.  If you need this
 # package, please use the ~arch version.
 =dev-python/lmdb-1.5.1
 
-# Sam James <sam@gentoo.org> (2025-06-03)
-# Major changes to packaging as bindings are split out by upstream.
->=app-crypt/gpgme-2
->=dev-cpp/gpgmepp-2
->=dev-libs/qgpgme-2
-dev-python/gpgmepy
-
 # Sam James <sam@gentoo.org> (2025-06-03)
 # Fetching from GitHub seems broken with this:
 # > Connecting to github.com|20.26.156.215|:443... connected.
@@ -226,39 +315,10 @@ dev-python/gpgmepy
 # >  Unable to locally verify the issuer's authority.
 =app-misc/ca-certificates-20250419.3.112
 
-# Michael Orlitzky <mjo@gentoo.org> (2025-05-28)
-# I added this for SageMath, but in hindsight do not think anyone is
-# using it. It has code issues and upstream is not terribly interested
-# in fixing it. (They are active and helpful, just not in love with this
-# particular codebase.) Bug 940232. Removal after 30 days.
-dev-gap/cohomolo
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-27)
-# sci-electronics/gazebo depends on x11-libs/qwt:6[qt5] and Qt5, lots of
-# open bugs. Most packages perpetually stuck at EAPI-7 and several major
-# version bumps out of date. Bugs #937608, #947390; removal on 2025-06-26.
-sci-electronics/gazebo
-dev-libs/sdformat
-net-libs/ignition-msgs
-net-libs/ignition-transport
-sci-libs/ignition-common
-sci-libs/ignition-fuel-tools
-sci-libs/ignition-math
-dev-build/ignition-cmake
-dev-libs/console_bridge
-dev-libs/urdfdom
-dev-libs/urdfdom_headers
-
 # Sam James <sam@gentoo.org> (2025-05-26)
 # Breaks some reverse dependencies and is abandoned upstream (bug #956630).
 =dev-cpp/glog-0.7.1
 
-# Nowa Ammerlaan <nowa@gentoo.org> (2025-05-25)
-# Archived upstream and no longer builds with modern compilers.
-# Bugs #956601, #930253
-# Removal on 2025-06-24
-media-libs/oneVPL-cpu
-
 # Sam James <sam@gentoo.org> (2025-05-23)
 # Severe memory leak (bug #953874)
 =app-i18n/ibus-anthy-1.5.17
@@ -267,22 +327,6 @@ media-libs/oneVPL-cpu
 # Introduces REQUIRED_USE that needs more discussion (bug #956402)
 =media-gfx/gimp-3.0.2-r2
 
-# Ulrich Müller <ulm@gentoo.org> (2025-05-18)
-# Pretest versions, masked for testing.
-<app-editors/emacs-30.1.9999:30-vcs
-
-# Hans de Graaff <graaff@gentoo.org> (2025-05-18)
-# Obsolete slot depending on an old cucumber version. Use the newer slot
-# instead. Masked for removal on 2025-06-18.
-dev-util/cucumber-rails:2
-
-# David Seifert <soap@gentoo.org> (2025-05-17)
-# Historically split from dev-libs/icu, disabled by default upstream and not
-# recommended anymore. If need be, we can make it optional in icu itself.
-# Removal on 2025-06-16. Bug #956106.
-dev-libs/icu-layoutex
-dev-libs/icu-le-hb
-
 # Alfred Wingate <parona@protonmail.com> (2025-05-17)
 # Masked for testing
 dev-db/mysql:8.4
@@ -385,11 +429,6 @@ dev-libs/libxml2-compat
 =dev-lang/rust-bin-1.84.0
 =dev-lang/rust-bin-1.84.1
 
-# Michał Górny <mgorny@gentoo.org> (2025-02-08)
-# Suspicious subslot bump, causing humongous rebuilds.
-# https://bugs.gentoo.org/949414
-=dev-cpp/cpp-httplib-0.18.6
-
 # Andreas Sturmlechner <asturm@gentoo.org> (2025-01-23)
 # Qt5 tools without any revdeps. Removal on 2025-06-10.
 dev-qt/assistant
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/arch/arm64/use.mask b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/arch/arm64/use.mask
index 7658bb04d35..49cde2534d9 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/arch/arm64/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/arch/arm64/use.mask
@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Unmask the flag corresponding to the default ABI
@@ -13,12 +13,20 @@
 -cpu_flags_arm_v8
 
 -cpu_flags_arm_aes
+-cpu_flags_arm_asimd
+-cpu_flags_arm_asimddp
+-cpu_flags_arm_asimdfhm
+-cpu_flags_arm_asimdhp
 -cpu_flags_arm_crc32
--cpu_flags_arm_neon
 -cpu_flags_arm_edsp
+-cpu_flags_arm_i8mm
+-cpu_flags_arm_neon-fp16
 -cpu_flags_arm_sha1
 -cpu_flags_arm_sha2
+-cpu_flags_arm_sm4
+-cpu_flags_arm_sve
+-cpu_flags_arm_sve2
 -cpu_flags_arm_vfp
+-cpu_flags_arm_vfp-d32
 -cpu_flags_arm_vfpv3
 -cpu_flags_arm_vfpv4
--cpu_flags_arm_vfp-d32
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/amd64/parent b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/amd64/parent
index c8d63be093b..850509166e2 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/amd64/parent
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/amd64/parent
@@ -1,2 +1,2 @@
-../../../default/linux/amd64/17.1/no-multilib
+../../../default/linux/amd64/23.0/no-multilib
 ..
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/arm/parent b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/arm/parent
index 979515f54f0..5aa0c177ba9 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/arm/parent
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/arm/parent
@@ -1,2 +1,2 @@
-../../../default/linux/arm/17.0/armv7a
+../../../default/linux/arm/23.0/armv7a_hf
 ..
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/arm64/parent b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/arm64/parent
index 41057b56ddf..f1a986bae44 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/arm64/parent
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/arm64/parent
@@ -1,2 +1,2 @@
-../../../default/linux/arm64/17.0
+../../../default/linux/arm64/23.0
 ..
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/ppc64/parent b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/ppc64/parent
index 7c6ab7df6a7..9a86fb44629 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/ppc64/parent
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/ppc64/parent
@@ -1,2 +1,2 @@
-../../../default/linux/ppc64/17.0
+../../../default/linux/ppc64/23.0
 ..
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/ppc64le/parent b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/ppc64le/parent
index 3301fe4e640..9b729845c49 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/ppc64le/parent
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/ppc64le/parent
@@ -1,2 +1,2 @@
-../../../default/linux/ppc64le/17.0
+../../../default/linux/ppc64le/23.0
 ..
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/riscv/parent b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/riscv/parent
index d3b49d5628b..32c1fbbd836 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/riscv/parent
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/riscv/parent
@@ -1,2 +1,2 @@
-../../../default/linux/riscv/20.0/rv64gc/lp64d
+../../../default/linux/riscv/23.0/rv64/lp64d
 ..
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/x86/parent b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/x86/parent
index c1189513e91..215342880ae 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/x86/parent
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/x86/parent
@@ -1,2 +1,2 @@
-../../../default/linux/x86/17.0
+../../../default/linux/x86/23.0
 ..
diff --git a/sdk_container/src/third_party/portage-stable/profiles/profiles.desc b/sdk_container/src/third_party/portage-stable/profiles/profiles.desc
index b3320c3edb1..ca10765d049 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/profiles.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/profiles.desc
@@ -293,6 +293,14 @@ ppc		default/linux/ppc/23.0/systemd					stable
 ppc		default/linux/ppc/23.0/split-usr				stable
 ppc		default/linux/ppc/23.0/split-usr/desktop			stable
 ppc		default/linux/ppc/23.0/split-usr/desktop/gnome			stable
+ppc		default/linux/ppc/23.0/time64					exp
+ppc		default/linux/ppc/23.0/time64/desktop				exp
+ppc		default/linux/ppc/23.0/time64/desktop/gnome			exp
+ppc		default/linux/ppc/23.0/time64/desktop/gnome/systemd		exp
+ppc		default/linux/ppc/23.0/time64/systemd				exp
+ppc		default/linux/ppc/23.0/time64/split-usr				exp
+ppc		default/linux/ppc/23.0/time64/split-usr/desktop			exp
+ppc		default/linux/ppc/23.0/time64/split-usr/desktop/gnome		exp
 
 
 # PPC64 profiles
@@ -363,11 +371,14 @@ riscv		default/linux/riscv/23.0/rv32/split-usr/ilp32				exp
 # S390 Profiles
 # @MAINTAINER: s390@gentoo.org
 s390		default/linux/s390/23.0						stable
-s390		default/linux/s390/23.0/systemd					dev
+s390		default/linux/s390/23.0/systemd					stable
 s390		default/linux/s390/23.0/split-usr				dev
 s390		default/linux/s390/23.0/split-usr/s390x				stable
 s390		default/linux/s390/23.0/s390x					stable
 s390		default/linux/s390/23.0/s390x/systemd				stable
+s390		default/linux/s390/23.0/time64					stable
+s390		default/linux/s390/23.0/time64/systemd				stable
+s390		default/linux/s390/23.0/time64/split-usr			dev
 
 
 # SPARC Profiles
diff --git a/sdk_container/src/third_party/portage-stable/profiles/updates/1Q-2024 b/sdk_container/src/third_party/portage-stable/profiles/updates/1Q-2024
index c5838b85a20..a37950c33f1 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/updates/1Q-2024
+++ b/sdk_container/src/third_party/portage-stable/profiles/updates/1Q-2024
@@ -19,7 +19,6 @@ move dev-util/valgrind dev-debug/valgrind
 move dev-util/meson-format-array dev-build/meson-format-array
 move dev-util/meson dev-build/meson
 move dev-util/cmake-fedora dev-build/cmake-fedora
-move dev-util/ignition-cmake dev-build/ignition-cmake
 move dev-util/rocm-cmake dev-build/rocm-cmake
 move dev-util/tinycmmc dev-build/tinycmmc
 move dev-util/cmake dev-build/cmake
diff --git a/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2021 b/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2021
index b77aad7be61..ce7d08ccc9a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2021
+++ b/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2021
@@ -3,7 +3,6 @@ move media-sound/zam-plugins media-plugins/zam-plugins
 slotmove =dev-ruby/elasticsearch-transport-6.8.3 6 6.8.3
 move dev-python/cfn-python-lint dev-python/cfn-lint
 move dev-python/dbusmock dev-python/python-dbusmock
-move dev-python/python-backoff dev-python/backoff
 move dev-python/python-musicbrainz-ngs dev-python/musicbrainzngs
 move dev-python/python-podman dev-python/podman
 move dev-python/u-msgpack dev-python/u-msgpack-python
diff --git a/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2025 b/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2025
new file mode 100644
index 00000000000..a1ee241d7c8
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2025
@@ -0,0 +1 @@
+move dev-python/pixelmatch-py dev-python/pixelmatch

From b86c81d77f73bac8eeebb629fb2c97a67bdae503 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:14:51 +0000
Subject: [PATCH 085/122] sec-keys/openpgp-keys-gentoo-release: Sync with
 Gentoo

It's from Gentoo commit 70b7b916170442b284b8dff42b1bcef475e28362.
---
 .../openpgp-keys-gentoo-release/Manifest      |  1 +
 ...penpgp-keys-gentoo-release-20250806.ebuild | 53 +++++++++++++++++++
 2 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/openpgp-keys-gentoo-release-20250806.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/Manifest b/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/Manifest
index de1e262bd94..0514bb0f69a 100644
--- a/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/Manifest
@@ -1,2 +1,3 @@
 DIST gentoo-release-test-sigs-20190224.tar.gz 3235 BLAKE2B 924c69a62d5321716f536144f0607bd3ec4a65d76be492adc729864fd9bef82df0086541ae13034a83152ea0c8dc3cbd168be6cff111a3484128a22cbc8ef1d4 SHA512 f8cc2e84bedbdf14ace6abe4aacf8f0c9810c77ff6ae0fac301829d9d4d5cf0c128a76516c773ac993879215bcdb0aab097e1e7e747d8e1a7c4cfc815bd4d3e6
 DIST gentoo-release.asc.20240703.gz 18710 BLAKE2B 2436319e0fc05432ea08e7828a337551de0b37783c4376e3249ed132c29d394376fb2e5f36281299cb251473ecb2b2240f75e2b7bdefa02ff35cc1ca4250c515 SHA512 1e17dfb0c626044a50ffc410fc515ea64d9ed53c53c70c046a6ebaf59a8991885c1f7dadb3366334fa840b91882f825a0878988a43a43adec0f10b1a22b4f7ee
+DIST gentoo-release.asc.20250806.gz 18794 BLAKE2B f683266f64357ce869adb04c8efdee296fdfacd72e003d305eecfb91b89c56243e0e7f342f47ca7918f560f961b7f73d874d86018f483ae814f43f40efda7459 SHA512 71b8ef105d49218690d242df2517b1a078f7a8d353ba6d9621cb6690431a46d85a3e45e3a2f4e3b9050b344c3cb636e10a2cc42cbd813a2e926b0b42630cd1cb
diff --git a/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/openpgp-keys-gentoo-release-20250806.ebuild b/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/openpgp-keys-gentoo-release-20250806.ebuild
new file mode 100644
index 00000000000..608383e3ede
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/openpgp-keys-gentoo-release-20250806.ebuild
@@ -0,0 +1,53 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="OpenPGP keys used for Gentoo releases (snapshots, stages)"
+HOMEPAGE="https://www.gentoo.org/downloads/signatures/"
+SRC_URI="
+	https://dev.gentoo.org/~mgorny/dist/openpgp-keys/gentoo-release.asc.${PV}.gz
+	test? (
+		https://dev.gentoo.org/~mgorny/dist/openpgp-keys/gentoo-release-test-sigs-20190224.tar.gz
+	)
+"
+S=${WORKDIR}
+
+LICENSE="public-domain"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	test? ( app-crypt/gnupg )
+"
+
+# Keys included:
+# DCD05B71EAB94199527F44ACDB6B8C1F96D8BF6D
+# D99EAC7379A850BCE47DA5F29E6438C817072058
+# 13EBBDBEDE7A12775DFDB1BABB572E0E2D182910
+# EF9538C9E8E64311A52CDEDFA13D0EF1914E7A72
+
+src_test() {
+	local old_umask=$(umask)
+	umask 077
+
+	local -x GNUPGHOME=${T}/.gnupg
+	mkdir "${GNUPGHOME}" || die
+	einfo "Importing keys ..."
+	gpg --import "gentoo-release.asc.${PV}" || die "Key import failed"
+
+	local f
+	for f in gentoo-release-test-sigs*/*.asc; do
+		einfo "Testing ${f##*/} ..."
+		gpg -q --trust-model always --verify "${f}" || die "Verification failed on ${f}"
+	done
+
+	umask "${old_umask}"
+}
+
+src_install() {
+	insinto /usr/share/openpgp-keys
+	newins "gentoo-release.asc.${PV}" gentoo-release.asc
+}

From fffe9396e6e16af10f937f94139d3a3561ce0cc3 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:15:02 +0000
Subject: [PATCH 086/122] sys-apps/azure-vm-utils: Sync with Gentoo

It's from Gentoo commit fb96aa56bae675de3af6a15ce8005e84cde74658.
---
 .../portage-stable/sys-apps/azure-vm-utils/Manifest  |  2 +-
 .../azure-vm-utils/azure-vm-utils-0.6.0-r1.ebuild    |  2 +-
 ...s-0.5.2-r1.ebuild => azure-vm-utils-0.7.0.ebuild} | 12 +++++++++---
 3 files changed, 11 insertions(+), 5 deletions(-)
 rename sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/{azure-vm-utils-0.5.2-r1.ebuild => azure-vm-utils-0.7.0.ebuild} (70%)

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/Manifest
index 871bed4884e..6372a6c0da3 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/Manifest
@@ -1,2 +1,2 @@
-DIST azure-vm-utils-0.5.2.tar.gz 42079 BLAKE2B e5380af38f072b15adb5b25b3df77fea699e88cddc1dd2779a263d63ee795cf79f3df8127265aebbdb031f96dbcfa10e36be71ebca35998f9d7e860b74b753e0 SHA512 2df38df001ee08da68543a8597c485b8f2b4e50fcdbe93defb443a1905fbc87ed5c2ef7903b79d795733b78e37fa8584a4ce33082b7a4490a1c7c4a8e5d8fcac
 DIST azure-vm-utils-0.6.0.tar.gz 48676 BLAKE2B c58a68ffcfa25fdab554c501de30e859f38b949ad7da215b9cf59b5884688a52b7279af2aec0c4dfe80d5240e8baa7460bb8c3e0800235ba7e676a78ac2e90b0 SHA512 f54dc3c6ca45b50a063a9c774f94cec3dd01e910088dbcbbf1ce279dc0c4874aa0fe2b27c9596248c137f787e9be51190cacb0d5ab8ab0cdd4ba994f60b64ddc
+DIST azure-vm-utils-0.7.0.tar.gz 73642 BLAKE2B 053122ed238e36f4b424e3befb01ea19f8557087e5af1aec23034a93e9844efd127a25061fb6cdfb23ae40aab7795f1aa179ee1c8494cdc48f235c479145b4eb SHA512 21ad39efe5a70ce4a222d30cd5f303c671cc2621a466e2b43e27c77cc85303e1f45d4f361f548e0c030a1c8c954eb0309a45eba615a2e2d454c73ac112db4e5c
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/azure-vm-utils-0.6.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/azure-vm-utils-0.6.0-r1.ebuild
index 2dfd6b33b05..28226a69e82 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/azure-vm-utils-0.6.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/azure-vm-utils-0.6.0-r1.ebuild
@@ -10,7 +10,7 @@ HOMEPAGE="https://github.com/Azure/azure-vm-utils"
 SRC_URI="https://github.com/Azure/${PN}/archive/refs/tags/v${PV}/${P}.tar.gz"
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~amd64 ~arm64"
+KEYWORDS="amd64 arm64"
 IUSE="dracut test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/azure-vm-utils-0.5.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/azure-vm-utils-0.7.0.ebuild
similarity index 70%
rename from sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/azure-vm-utils-0.5.2-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/azure-vm-utils-0.7.0.ebuild
index 9b4676a2451..034217c310c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/azure-vm-utils-0.5.2-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/azure-vm-utils-0.7.0.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit cmake udev
+inherit cmake optfeature udev
 
 DESCRIPTION="Utilities and udev rules to support Linux on Azure"
 HOMEPAGE="https://github.com/Azure/azure-vm-utils"
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/Azure/${PN}/archive/refs/tags/v${PV}/${P}.tar.gz"
 LICENSE="MIT"
 SLOT="0"
 KEYWORDS="~amd64 ~arm64"
-IUSE="test"
+IUSE="dracut test"
 RESTRICT="!test? ( test )"
 
 CDEPEND="
@@ -23,6 +23,7 @@ DEPEND="
 "
 RDEPEND="
 	${CDEPEND}
+	dracut? ( sys-kernel/dracut )
 "
 BDEPEND="
 	virtual/pkgconfig
@@ -30,8 +31,12 @@ BDEPEND="
 
 src_configure() {
 	local mycmakeargs=(
-		-DUDEV_RULES_INSTALL_DIR="$(get_udevdir)/rules.d"
+		-DAZURE_EPHEMERAL_DISK_SETUP_CONF_INSTALL_DIR="${EPREFIX}/etc"
+		-DDRACUT=$(usex dracut dracut "")
 		-DENABLE_TESTS=$(usex test)
+		-DINITRAMFS_TOOLS=
+		-DUDEV_RULES_INSTALL_DIR="${EPREFIX}$(get_udevdir)/rules.d"
+		-DVERSION="v${PV}"
 	)
 	cmake_src_configure
 }
@@ -48,6 +53,7 @@ src_install() {
 
 pkg_postinst() {
 	udev_reload
+	optfeature "aggregating multiple NVMe devices into a RAID-0 array" sys-fs/mdadm
 }
 
 pkg_postrm() {

From 7e8c4007425181f4200d3d8faf0a9cd92cca05a6 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:15:11 +0000
Subject: [PATCH 087/122] sys-apps/file: Sync with Gentoo

It's from Gentoo commit 704d0fb0689c1dc690931187a0a66fdc540edbe1.
---
 .../sys-apps/file/file-5.46-r3.ebuild         | 192 ++++++++++++++++++
 ...ile-5.46-seccomp-glibc-2.42-followup.patch |  20 ++
 .../files/file-5.46-seccomp-glibc-2.42.patch  |  82 ++++++++
 .../file/files/file-5.46-seccomp-rseq.patch   |  50 +++++
 4 files changed, 344 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.46-r3.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.46-seccomp-glibc-2.42-followup.patch
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.46-seccomp-glibc-2.42.patch
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.46-seccomp-rseq.patch

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.46-r3.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.46-r3.ebuild
new file mode 100644
index 00000000000..4b9f8508c10
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.46-r3.ebuild
@@ -0,0 +1,192 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+DISTUTILS_OPTIONAL=1
+PYTHON_COMPAT=( python3_{11..14} )
+
+inherit distutils-r1 toolchain-funcs multilib-minimal
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/file/file"
+	inherit autotools git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/file.asc
+	inherit libtool verify-sig
+	SRC_URI="https://astron.com/pub/file/${P}.tar.gz"
+	SRC_URI+=" verify-sig? ( https://astron.com/pub/file/${P}.tar.gz.asc )"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-file )"
+fi
+
+DESCRIPTION="Identify a file's format by scanning binary data for patterns"
+HOMEPAGE="https://www.darwinsys.com/file/"
+
+LICENSE="BSD-2"
+SLOT="0"
+IUSE="bzip2 lzip lzma python seccomp static-libs zlib zstd"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+DEPEND="
+	bzip2? ( app-arch/bzip2[${MULTILIB_USEDEP}] )
+	lzip? ( app-arch/lzlib )
+	lzma? ( app-arch/xz-utils[${MULTILIB_USEDEP}] )
+	seccomp? ( >=sys-libs/libseccomp-2.5.4[${MULTILIB_USEDEP}] )
+	zlib? ( >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}] )
+	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
+"
+RDEPEND="
+	${DEPEND}
+	python? (
+		${PYTHON_DEPS}
+		!dev-python/python-magic
+	)
+	seccomp? ( >=sys-libs/libseccomp-2.5.4[${MULTILIB_USEDEP}] )
+"
+BDEPEND+="
+	python? (
+		${PYTHON_DEPS}
+		${DISTUTILS_DEPS}
+	)
+"
+
+# https://bugs.gentoo.org/898676
+QA_CONFIG_IMPL_DECL_SKIP=( makedev )
+
+PATCHES=(
+	"${FILESDIR}/file-5.43-seccomp-fstatat64-musl.patch" #789336, not upstream yet
+	"${FILESDIR}/file-5.45-seccomp-sandbox.patch"
+	"${FILESDIR}/file-5.46-zip.patch"
+	"${FILESDIR}/file-5.46-buffer-overflow.patch"
+	"${FILESDIR}/file-5.46-seccomp-rseq.patch"
+	"${FILESDIR}/file-5.46-seccomp-glibc-2.42.patch"
+	"${FILESDIR}/file-5.46-seccomp-glibc-2.42-followup.patch"
+)
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]] ; then
+		eautoreconf
+	else
+		elibtoolize
+	fi
+
+	# Don't let python README kill main README, bug #60043
+	mv python/README.md python/README.python.md || die
+
+	# bug #662090
+	sed -i 's@README.md@README.python.md@' python/setup.py || die
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		--enable-fsect-man5
+		$(use_enable bzip2 bzlib)
+		$(multilib_native_use_enable lzip lzlib)
+		$(use_enable lzma xzlib)
+		$(use_enable seccomp libseccomp)
+		$(use_enable static-libs static)
+		$(use_enable zlib)
+		$(use_enable zstd zstdlib)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+build_src_configure() {
+	local myeconfargs=(
+		--disable-shared
+		--disable-libseccomp
+		--disable-bzlib
+		--disable-xzlib
+		--disable-zlib
+	)
+
+	econf_build "${myeconfargs[@]}"
+}
+
+need_build_file() {
+	# When cross-compiling, we need to build up our own file
+	# because people often don't keep matching host/target
+	# file versions, bug #362941
+	tc-is-cross-compiler && ! has_version -b "~${CATEGORY}/${P}"
+}
+
+src_configure() {
+	local ECONF_SOURCE="${S}"
+
+	if need_build_file ; then
+		mkdir -p "${WORKDIR}"/build || die
+		cd "${WORKDIR}"/build || die
+		build_src_configure
+	fi
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_compile() {
+	if multilib_is_native_abi ; then
+		emake
+	else
+		# bug #586444
+		emake -C src magic.h
+		emake -C src libmagic.la
+	fi
+}
+
+src_compile() {
+	if need_build_file ; then
+		# bug #586444
+		emake -C "${WORKDIR}"/build/src magic.h
+		emake -C "${WORKDIR}"/build/src file
+		local -x PATH="${WORKDIR}/build/src:${PATH}"
+	fi
+
+	multilib-minimal_src_compile
+
+	if use python ; then
+		cd python || die
+		distutils-r1_src_compile
+	fi
+}
+
+src_test() {
+	multilib-minimal_src_test
+
+	if use python ; then
+		cd python || die
+		distutils-r1_src_test
+	fi
+}
+
+python_test() {
+	eunittest
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi ; then
+		default
+	else
+		emake -C src install-{nodist_includeHEADERS,libLTLIBRARIES} DESTDIR="${D}"
+	fi
+}
+
+multilib_src_install_all() {
+	dodoc ChangeLog MAINT # README
+
+	# Required for `file -C`
+	insinto /usr/share/misc/magic
+	doins -r magic/Magdir/*
+
+	if use python ; then
+		cd python || die
+		distutils-r1_src_install
+	fi
+
+	find "${ED}" -type f -name "*.la" -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.46-seccomp-glibc-2.42-followup.patch b/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.46-seccomp-glibc-2.42-followup.patch
new file mode 100644
index 00000000000..0be2effabe3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.46-seccomp-glibc-2.42-followup.patch
@@ -0,0 +1,20 @@
+There's no need for the __linux__ check, as seccomp is Linux-only. Avoid
+including <termios.h> which will clash with <sys/ioctl.h>.
+--- a/src/seccomp.c
++++ b/src/seccomp.c
+@@ -34,14 +34,7 @@ FILE_RCSID("@(#)$File: seccomp.c,v 1.31 2025/03/20 14:57:41 christos Exp $")
+ #include <seccomp.h> /* libseccomp */
+ #include <sys/prctl.h> /* prctl */
+ #include <sys/socket.h>
+-#ifdef __powerpc64__
+-// See: https://sourceware.org/bugzilla/show_bug.cgi?id=32806
+-# include <asm/termbits.h>
+-#elif defined __linux__
+-# include <linux/termios.h>
+-#else
+-# include <termios.h>
+-#endif
++#include <asm/termbits.h>
+ #include <sys/ioctl.h>
+ #include <fcntl.h>
+ #include <stdlib.h>
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.46-seccomp-glibc-2.42.patch b/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.46-seccomp-glibc-2.42.patch
new file mode 100644
index 00000000000..47ae4d4074e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.46-seccomp-glibc-2.42.patch
@@ -0,0 +1,82 @@
+https://bugs.astron.com/view.php?id=678
+Two patches:
+1) https://github.com/file/file/commit/f49e4b1a393c0378e43b65c36765676c98d018c4
+2) From the bug
+
+From f49e4b1a393c0378e43b65c36765676c98d018c4 Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Thu, 20 Mar 2025 14:57:41 +0000
+Subject: [PATCH] Fix termios handling on linux/ppc (Dr. Werner Fink)
+
+---
+ src/seccomp.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/src/seccomp.c b/src/seccomp.c
+index 9e00034ad..f05c30f9f 100644
+--- a/src/seccomp.c
++++ b/src/seccomp.c
+@@ -27,15 +27,20 @@
+ #include "file.h"
+ 
+ #ifndef	lint
+-FILE_RCSID("@(#)$File: seccomp.c,v 1.30 2024/11/28 14:04:24 christos Exp $")
++FILE_RCSID("@(#)$File: seccomp.c,v 1.31 2025/03/20 14:57:41 christos Exp $")
+ #endif	/* lint */
+ 
+ #if HAVE_LIBSECCOMP
+ #include <seccomp.h> /* libseccomp */
+ #include <sys/prctl.h> /* prctl */
+-#include <sys/ioctl.h>
+ #include <sys/socket.h>
+-#include <termios.h>
++#ifdef __powerpc64__
++// See: https://sourceware.org/bugzilla/show_bug.cgi?id=32806
++# include <asm/termbits.h>
++#else
++# include <termios.h>
++#endif
++#include <sys/ioctl.h>
+ #include <fcntl.h>
+ #include <stdlib.h>
+ #include <errno.h>
+
+
+From 7b23bd3f87069fcebc9173c8d1637c2a2e1a12d1 Mon Sep 17 00:00:00 2001
+From: Tobias Stoeckmann <tobias@stoeckmann.org>
+Date: Wed, 6 Aug 2025 23:11:10 +0200
+Subject: [PATCH] Extend seccomp for glibc and  physical terminals
+
+New glibc implementations might also use TCGETS2 instead of TCGETS.
+This happens on current Arch Linux systems. Allow TCGETS2 in seccomp
+sandbox as well.
+---
+ src/seccomp.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/seccomp.c b/src/seccomp.c
+index f05c30f9..dddb821c 100644
+--- a/src/seccomp.c
++++ b/src/seccomp.c
+@@ -37,6 +37,8 @@ FILE_RCSID("@(#)$File: seccomp.c,v 1.31 2025/03/20 14:57:41 christos Exp $")
+ #ifdef __powerpc64__
+ // See: https://sourceware.org/bugzilla/show_bug.cgi?id=32806
+ # include <asm/termbits.h>
++#elif defined __linux__
++# include <linux/termios.h>
+ #else
+ # include <termios.h>
+ #endif
+@@ -121,6 +123,10 @@ enable_sandbox(void)
+ #ifdef TCGETS
+ 	// glibc may call ioctl TCGETS on stdout on physical terminal
+ 	ALLOW_IOCTL_RULE(TCGETS);
++#endif
++#ifdef TCGETS2
++	// glibc may call ioctl TCGETS2 on stdout on physical terminal
++	ALLOW_IOCTL_RULE(TCGETS2);
+ #endif
+ 	ALLOW_RULE(lseek);
+  	ALLOW_RULE(_llseek);
+-- 
+2.50.1
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.46-seccomp-rseq.patch b/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.46-seccomp-rseq.patch
new file mode 100644
index 00000000000..a0b124f4881
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.46-seccomp-rseq.patch
@@ -0,0 +1,50 @@
+https://github.com/file/file/commit/339bdef41536d63ffacd2e48082d195a1e3617b9
+
+From 339bdef41536d63ffacd2e48082d195a1e3617b9 Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Thu, 28 Nov 2024 14:04:24 +0000
+Subject: [PATCH] Sort, add rseq (Cristian Rodriguez)
+
+---
+ src/seccomp.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/src/seccomp.c b/src/seccomp.c
+index ce8243300..9e00034ad 100644
+--- a/src/seccomp.c
++++ b/src/seccomp.c
+@@ -27,7 +27,7 @@
+ #include "file.h"
+ 
+ #ifndef	lint
+-FILE_RCSID("@(#)$File: seccomp.c,v 1.29 2024/09/29 16:49:25 christos Exp $")
++FILE_RCSID("@(#)$File: seccomp.c,v 1.30 2024/11/28 14:04:24 christos Exp $")
+ #endif	/* lint */
+ 
+ #if HAVE_LIBSECCOMP
+@@ -103,6 +103,8 @@ enable_sandbox(void)
+ #ifdef __NR_getdents64
+ 	ALLOW_RULE(getdents64);
+ #endif
++	ALLOW_RULE(getpid);	// Used by glibc in file_pipe2file()
++	ALLOW_RULE(getrandom);	// Used by glibc in file_pipe2file()
+ #ifdef FIONREAD
+ 	// called in src/compress.c under sread
+ 	ALLOW_IOCTL_RULE(FIONREAD);
+@@ -136,6 +138,7 @@ enable_sandbox(void)
+ #ifdef __NR_readlinkat
+ 	ALLOW_RULE(readlinkat);
+ #endif
++	ALLOW_RULE(rseq);	// Used by glibc to randomize malloc
+ 	ALLOW_RULE(rt_sigaction);
+ 	ALLOW_RULE(rt_sigprocmask);
+ 	ALLOW_RULE(rt_sigreturn);
+@@ -145,8 +148,6 @@ enable_sandbox(void)
+ 	ALLOW_RULE(stat64);
+ 	ALLOW_RULE(sysinfo);
+ 	ALLOW_RULE(umask);	// Used in file_pipe2file()
+-	ALLOW_RULE(getpid);	// Used by glibc in file_pipe2file()
+-	ALLOW_RULE(getrandom);	// Used by glibc in file_pipe2file()
+ 	ALLOW_RULE(unlink);
+ 	ALLOW_RULE(utimes);
+ 	ALLOW_RULE(write);

From 810f8f22000fde3575fa62eaf4ab98076779c2c4 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:15:13 +0000
Subject: [PATCH 088/122] sys-apps/gawk: Sync with Gentoo

It's from Gentoo commit 9334555714016b028ea851c4671ec03556f48c68.
---
 .../portage-stable/sys-apps/gawk/Manifest     |   2 -
 .../sys-apps/gawk/gawk-5.3.1.ebuild           | 111 ------------------
 .../sys-apps/gawk/gawk-5.3.2.ebuild           |   9 +-
 3 files changed, 5 insertions(+), 117 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.1.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/Manifest
index 2221c8ff940..44e97499a9a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/Manifest
@@ -1,4 +1,2 @@
-DIST gawk-5.3.1.tar.xz 3510032 BLAKE2B be9132324344c0b052e954e004a942ff7c6b14b86b73cda491d7a33485f60341be4d8da1a06d1d7a27445b9b39a528bcce3eee9c2a3f8756de21bdc57a33f54d SHA512 c6b4c50ce565e6355ca162955072471e37541c51855c0011e834243a7390db8811344b0c974335844770e408e1f63d72d0d81459a081c392e0245c726019eaff
-DIST gawk-5.3.1.tar.xz.sig 488 BLAKE2B 2abafbb965912a194d047bed3ac1ef33a2b44dce0bc4b1a83a6ca3e2ecf676da0ad8333bb3817f0f32c7d67ab8662dc6086c9e1d6f2185a93d786390197fc643 SHA512 3e13b1bd598b7d4c715c802dcc9db298aeab12721620692f9dd76d3941fdfd87381f660c93be5cc04b6cd7378a6464b9033c93419dfcb514dcc33da8d0d9f502
 DIST gawk-5.3.2.tar.xz 3749260 BLAKE2B 8536777bb45c63d737ef08b3f1b98285cb29ec54400e35b2139c2bc66b464e3ec4950274614d95d94dc7eae18c57333b7c30a44d993855258155fc82b749042a SHA512 2268150fa35ae049a6ff3d0d0fa110db10477014c25f50e2ab4e3ee5fd60133369d2a994f59db4eb718020a0af5c4003ae7278c63e7fffa72f431ff4a1429e48
 DIST gawk-5.3.2.tar.xz.sig 488 BLAKE2B ea843fce8ca2b93a8006260e8022f3426daccc18b93bd75ef1fb18e391ce110a10682e75509d771ba9c419d1e22a584f66ff9a436512b76b039a85afed6c7596 SHA512 490f29271d06f374e25e13724f5944215734d0c6da465da5b2a723e83fa31a03c7a16e5c8853465561bc0676139588b1046c598554ccde4ae24563455ee28b65
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.1.ebuild
deleted file mode 100644
index 2d447605849..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.1.ebuild
+++ /dev/null
@@ -1,111 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-#GAWK_IS_BETA=yes
-
-DESCRIPTION="GNU awk pattern-matching language"
-HOMEPAGE="https://www.gnu.org/software/gawk/gawk.html"
-
-if [[ ${GAWK_IS_BETA} == yes || ${PV} == *_beta* ]] ; then
-	if [[ ${PV} == *_beta* ]] ; then
-		# Beta versioning is sometimes for the release prior, e.g.
-		# 5.2.1_beta is labelled upstream as 5.2.0b.
-		MY_PV=${PV/_beta/b}
-		MY_PV=$(ver_cut 1-2 ${MY_PV}).$(($(ver_cut 3 ${MY_PV}) - 1))$(ver_cut 4- ${MY_PV})
-		MY_P=${PN}-${MY_PV}
-
-		S="${WORKDIR}"/${MY_P}
-	else
-		MY_P=${P}
-	fi
-
-	SRC_URI="https://www.skeeve.com/gawk/${MY_P}.tar.gz"
-else
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gawk.asc
-	inherit verify-sig flag-o-matic
-
-	SRC_URI="mirror://gnu/gawk/${P}.tar.xz"
-	SRC_URI+=" verify-sig? ( mirror://gnu/gawk/${P}.tar.xz.sig )"
-
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-LICENSE="GPL-3+"
-SLOT="0"
-# While tempting to enable mpfr by default as e.g. Fedora do, as of 5.2.x,
-# MPFR support is "on parole" and may be removed:
-# https://www.gnu.org/software/gawk/manual/html_node/MPFR-On-Parole.html.
-IUSE="mpfr pma nls readline"
-
-RDEPEND="
-	mpfr? (
-		dev-libs/gmp:=
-		dev-libs/mpfr:=
-	)
-	readline? ( sys-libs/readline:= )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	>=sys-apps/texinfo-7.1
-	>=sys-devel/bison-3.5.4
-	nls? ( sys-devel/gettext )
-"
-
-if [[ ${GAWK_IS_BETA} != yes ]] ; then
-	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-gawk )"
-fi
-
-src_prepare() {
-	default
-
-	use elibc_musl && append-cppflags -D__GNU_LIBRARY__
-
-	# Use symlinks rather than hardlinks, and disable version links
-	sed -i \
-		-e '/^LN =/s:=.*:= $(LN_S):' \
-		-e '/install-exec-hook:/s|$|\nfoo:|' \
-		Makefile.in doc/Makefile.in || die
-
-	# bug #413327
-	sed -i '/^pty1:$/s|$|\n_pty1:|' test/Makefile.in || die
-
-	# Fix standards conflict on Solaris
-	if [[ ${CHOST} == *-solaris* ]] ; then
-		sed -i \
-			-e '/\<_XOPEN_SOURCE\>/s/1$/600/' \
-			-e '/\<_XOPEN_SOURCE_EXTENDED\>/s/1//' \
-			extension/inplace.c || die
-	fi
-}
-
-src_configure() {
-	# README says gawk may not work properly if built with non-Bison.
-	# We already BDEPEND on Bison, so just unset YACC rather than
-	# guessing if we need to do yacc.bison or bison -y.
-	unset YACC
-
-	local myeconfargs=(
-		--cache-file="${S}"/config.cache
-		--libexec='$(libdir)/misc'
-		$(use_with mpfr)
-		$(use_enable nls)
-		$(use_enable pma)
-		$(use_with readline)
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_install() {
-	# Automatic dodocs barfs
-	rm -rf README_d || die
-
-	default
-
-	# Install headers
-	insinto /usr/include/awk
-	doins *.h
-	rm "${ED}"/usr/include/awk/config.h || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.2.ebuild
index 2d447605849..4a2e8ea7cbd 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.2.ebuild
@@ -34,10 +34,11 @@ fi
 
 LICENSE="GPL-3+"
 SLOT="0"
-# While tempting to enable mpfr by default as e.g. Fedora do, as of 5.2.x,
-# MPFR support is "on parole" and may be removed:
-# https://www.gnu.org/software/gawk/manual/html_node/MPFR-On-Parole.html.
-IUSE="mpfr pma nls readline"
+# The gawk docs claim MPFR support is "on parole" and may be removed,
+# https://www.gnu.org/software/gawk/manual/html_node/MPFR-On-Parole.html
+# however this is somewhat outdated information, see
+# https://public-inbox.org/libc-alpha/202412190851.4BJ8psq4404509@freefriends.org/
+IUSE="+mpfr pma nls readline"
 
 RDEPEND="
 	mpfr? (

From c96ee226724c251f0e0c094aeecad00b32dd39d9 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:15:13 +0000
Subject: [PATCH 089/122] sys-apps/gentoo-functions: Sync with Gentoo

It's from Gentoo commit 339e5b31efd923cde32a58d972e29191fbd0ebe7.
---
 .../portage-stable/sys-apps/gentoo-functions/Manifest           | 2 +-
 ...too-functions-1.7.2.ebuild => gentoo-functions-1.7.4.ebuild} | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
 rename sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/{gentoo-functions-1.7.2.ebuild => gentoo-functions-1.7.4.ebuild} (97%)

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/Manifest
index a141f6db445..55fca559657 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/Manifest
@@ -1,3 +1,3 @@
 DIST gentoo-functions-0.19.tar.bz2 12079 BLAKE2B be0a3a54d4dee1755866047b670a69cd6fec368239123c3f0c08180b79a33c20147bca0e35e568faef6877513551e731bdf0c181aeb0460f6574d2d708219373 SHA512 2674d3fe5724cc6d685ae58bf0ee33f4a1bdba2c5e5809cfb193fd0a710d4678c2d9392c2c62d2321cf455f524950266dc1629ab684fe46632d179e539d5a39e
-DIST gentoo-functions-1.7.2.tar.bz2 29059 BLAKE2B 2b3d13e6f5b553fd0fa7a0880677bd61c82c8815d3801a2d80e7632a97c36f81b41075109856f6248ad0eb2453b511066e63a110c97984e6427135ad19cdc234 SHA512 3839b04784576cc5c5824b24f967862ea421be051983d1ac587de7e21b0fbc4f403e0d4f707ee5cbcf466ec4a12d188da9413a81ca71993c957328ff225cb9af
 DIST gentoo-functions-1.7.3.tar.bz2 29623 BLAKE2B e37fcaf7ca70eda4507f8b539ad37c989a3a6d28d2a063aa1650f60f8cbb28b00103ffea0f1221fd4e8379d4066bca1fd5aeee30073eed6274cfaaaa277bee84 SHA512 4c5d5c9e8b93e366c5483e8777dfdc15afc6764110cc69f751bb5cc1e335dd70e0952017ea55f1be70fcd5120f07708b1601638c97132f53acde8b3f5a4afe34
+DIST gentoo-functions-1.7.4.tar.bz2 29565 BLAKE2B dd05aaee9c078ef6b623950c120b7e9aa7056a1e02248a098a9b33e69109fa5a642221a2209a55570590e8101f4ec82e727602dce543977670dd7d49f789429e SHA512 184809eb684465639bc2d404c421e33153ffcac3fe985123e5f5815863c427c9e4f6155713a2c0b69006a4afbefc114211f4a4216f49e726a198938d43fcd395
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/gentoo-functions-1.7.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/gentoo-functions-1.7.4.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/gentoo-functions-1.7.2.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/gentoo-functions-1.7.4.ebuild
index 320c82e6dfe..6517d7f22a6 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/gentoo-functions-1.7.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/gentoo-functions-1.7.4.ebuild
@@ -1,4 +1,4 @@
-# Copyright 2014-2024 Gentoo Authors
+# Copyright 2014-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8

From aaff9ae6db90748dcb607e8f1342d4b99d0b4a17 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:15:20 +0000
Subject: [PATCH 090/122] sys-apps/hwdata: Sync with Gentoo

It's from Gentoo commit c7cd6ca254cbf7fdcf6f1565e08da80f45088dae.
---
 .../portage-stable/sys-apps/hwdata/Manifest   |  1 +
 .../sys-apps/hwdata/hwdata-0.398.ebuild       | 28 +++++++++++++++++++
 2 files changed, 29 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-apps/hwdata/hwdata-0.398.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/Manifest
index 2492122caa8..0a7f1f21929 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/Manifest
@@ -1,3 +1,4 @@
 DIST hwdata-0.383.tar.gz 2430035 BLAKE2B 7f53f08fa6df5d4dd2eb5a92b419914a0fd04a74285d5af0d879fe9b30b768f24c526225b3d700201a53eccabee49ae84958bb6605bc0265483bdf1801dfbffc SHA512 9a11e0d8cc6788c6a54c87956afb19853f5214c1d2deb77cc7c6155687a9621b83d54533a8e475decad82aaad84581ee410d16b7db20e666f62a003a76a62618
 DIST hwdata-0.390.tar.gz 2473831 BLAKE2B 45a8d5468d82dd3b3f42e290183bdd1dbd2e23ec926f780a54b21484263b7d9ea789b10fd9d6f1b9e741d160823b4816e6b6a470e0930dbc830c7a820ae514de SHA512 c9cbe0e41001a0d61b164d6544e57d66be7b4230434d2c395d182f41f96e6c3831e443c933f5a29bd0a2fefabbfc232a9efa772d04b89972da5d4d2eb7882443
 DIST hwdata-0.391.tar.gz 2479872 BLAKE2B 478d60635f338770751bf4b437f33ba0666b4c3d70d9c726c8e124c44e6d6f5a96ba96b63ae64a151732ca7607676aaccefc7a61c89cee584696b699b3234019 SHA512 9b831a7546ac6ca457b92bf438ba84d6487980b15a304af78ba8738cc456e02a62b1d19a849573ed596c85a3fbbc88ca305e5e4c665f27e8d75454be41d708f0
+DIST hwdata-0.398.tar.gz 2531820 BLAKE2B 415cf2e0e1735c4b0a2186421e85186f20ae3b165a8224923ef24471b98f3f923484072702c2f0c21dffe98ad2144459e14f2829b77c110e2397141da2bde676 SHA512 ede23b1acf25444ed859d296ebd29cf630da3b07203ec49e536fda0726c3af04afcdcd4a45b142931036e9650780c29011e0c7e2f0fb23a8fdb9b48bcd2e0caa
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/hwdata-0.398.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/hwdata-0.398.ebuild
new file mode 100644
index 00000000000..145dcd2debb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/hwdata-0.398.ebuild
@@ -0,0 +1,28 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit edo
+
+DESCRIPTION="Hardware identification and configuration data"
+HOMEPAGE="https://github.com/vcrhonek/hwdata"
+SRC_URI="https://github.com/vcrhonek/hwdata/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+
+RESTRICT="test"
+
+src_configure() {
+	# configure is not compatible with econf
+	local conf=(
+		./configure
+		--prefix="${EPREFIX}/usr"
+		--libdir="${EPREFIX}/lib"
+		--datadir="${EPREFIX}/usr/share"
+	)
+
+	edo "${conf[@]}"
+}

From f5c317fc57008c8e44efb07a959c768771eb03ad Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:15:22 +0000
Subject: [PATCH 091/122] sys-apps/iproute2: Sync with Gentoo

It's from Gentoo commit f0197b6e4a28bca10b42ccd76afae3c5c11efe7b.
---
 .../portage-stable/sys-apps/iproute2/Manifest |   1 +
 .../sys-apps/iproute2/iproute2-6.16.0.ebuild  | 215 ++++++++++++++++++
 2 files changed, 216 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.16.0.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
index 15c6bdad484..c22d9354233 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
@@ -3,3 +3,4 @@ DIST iproute2-6.12.0.tar.xz 925392 BLAKE2B 95aee769662e21c8c6223d09ee0ec365fcdeb
 DIST iproute2-6.13.0.tar.xz 927416 BLAKE2B bbebc44d1a7e35c410869a2a5884df09698ea3950acd126e5736a938718d40e57d539ff88ecd7827cbdf2f9481c3d728fff3948a61c2ba3e1483c5b7a7616577 SHA512 2e392a8ddc3d7662c3a72bba1c845587df85b7afc6efabf7df0ec2830bb1d4b16cac5bfb7a43dc3ac73adf0ea3fe3670824674d4f32209c6d1aa638a7cb7cd6c
 DIST iproute2-6.14.0.tar.xz 929092 BLAKE2B 18bd180c608b657694f4713bf915d45006c97a7206a3260ac52149d4c976422e1949ada425d4989c5a7e327e3d8eb45ea990de25f3645bb1308ac2531bf834d2 SHA512 e79049bdca0e0381f0a93a40e4d597ce59fb509dabc6e8b04a510ff9953f091c67577d6faa62967bd197bf62ab6e56d928558270a1390621431acb237b77fa46
 DIST iproute2-6.15.0.tar.xz 930908 BLAKE2B 50247f293e194601bd138418e55e2dc63421d2a5da863973e9ff78f2c76ba051350523559f2b7b7983af05a827f292135353adbf6c857ea32b7071f69940f73f SHA512 1a438941cd939e1c8e32cfe8c40e6fd826c89185f1bb0c623eaad7380a66afd9fa9e0d7cdc5e5b193d2761b7dbdc78fd0811537eecc500be633730c32ff55ad4
+DIST iproute2-6.16.0.tar.xz 931124 BLAKE2B d1c66f4d63edd6fa2701c92dbc47f8c4388d6a660d541d528e3463e8e261fda64df4a7f8930f510718c71ee82438b5c4859f072eb08c8ff1e4d1d65223108005 SHA512 88930ea1a3a901594a69dc04e533bfd1de0f5b79f176dedb45f11f01035bd680edccc8e04e56d0922ee430580581c646473a3baa941254739878f7ab946f17df
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.16.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.16.0.ebuild
new file mode 100644
index 00000000000..dfc30230bd4
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.16.0.ebuild
@@ -0,0 +1,215 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit dot-a edo toolchain-funcs flag-o-matic
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
+	inherit git-r3
+else
+	SRC_URI="https://www.kernel.org/pub/linux/utils/net/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+DESCRIPTION="kernel routing and traffic control utilities"
+HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="atm berkdb bpf caps elf +iptables minimal nfs selinux"
+# Needs root
+RESTRICT="test"
+
+# We could make libmnl optional, but it's tiny, so eh
+RDEPEND="
+	!minimal? ( net-libs/libmnl:= )
+	atm? ( net-dialup/linux-atm )
+	berkdb? ( sys-libs/db:= )
+	bpf? ( >=dev-libs/libbpf-0.6:= )
+	caps? ( sys-libs/libcap )
+	elf? ( virtual/libelf:= )
+	iptables? ( >=net-firewall/iptables-1.4.20:= )
+	nfs? ( net-libs/libtirpc:= )
+	selinux? ( sys-libs/libselinux )
+"
+# We require newer linux-headers for ipset support (bug #549948) and some defines (bug #553876)
+DEPEND="
+	${RDEPEND}
+	>=sys-kernel/linux-headers-3.16
+"
+BDEPEND="
+	app-arch/xz-utils
+	>=sys-devel/bison-2.4
+	app-alternatives/lex
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-6.10.0-musl-2.patch # bug #926341
+	"${FILESDIR}"/${PN}-6.9.0-mtu.patch # bug #291907
+	"${FILESDIR}"/${PN}-6.8.0-configure-nomagic-nolibbsd.patch # bug #643722 & #911727
+	"${FILESDIR}"/${PN}-6.8.0-disable-libbsd-fallback.patch # bug #911727
+)
+
+src_prepare() {
+	default
+
+	# Fix version if necessary
+	local versionfile="include/version.h"
+	if [[ ${PV} != 9999 ]] && ! grep -Fq "${PV}" ${versionfile} ; then
+		einfo "Fixing version string"
+		sed -i "s@\"[[:digit:]\.]\+\"@\"${PV}\"@" \
+			${versionfile} || die
+	fi
+
+	# echo -n is not POSIX compliant
+	sed -i 's@echo -n@printf@' configure || die
+
+	sed -i \
+		-e '/^CC :\?=/d' \
+		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
+		-e "s|-O2|${CFLAGS} ${CPPFLAGS}|" \
+		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
+		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
+		Makefile || die
+
+	# Build against system headers
+	rm -r include/netinet || die #include/linux include/ip{,6}tables{,_common}.h include/libiptc
+	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
+
+	if use minimal ; then
+		sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile || die
+	fi
+}
+
+src_configure() {
+	tc-export AR CC PKG_CONFIG
+	lto-guarantee-fat
+
+	# This sure is ugly. Should probably move into toolchain-funcs at some point.
+	local setns
+	pushd "${T}" >/dev/null || die
+	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c || die
+	if ${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null ; then
+		setns=y
+	else
+		setns=n
+	fi
+
+	echo 'int main(){return 0;}' > test.c || die
+	if ! ${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null ; then
+		sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile || die
+	fi
+	popd >/dev/null || die
+
+	# build system does not pass CFLAGS to LDFLAGS, as is recommended by GCC upstream
+	# https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-flto
+	# https://bugs.gentoo.org/929233
+	append-ldflags ${CFLAGS}
+
+	# run "configure" script first which will create "config.mk"...
+	# Using econf breaks since 5.14.0 (a9c3d70d902a0473ee5c13336317006a52ce8242)
+	eval "local -a EXTRA_ECONF=(${EXTRA_ECONF})"
+	edo ./configure --libbpf_force $(usex bpf on off) "${EXTRA_ECONF[@]}"
+
+	# Remove the definitions made by configure and allow them to be overridden
+	# by USE flags below.
+	# We have to do the cheesy only-sed-if-disabled because otherwise
+	# the *_FLAGS etc stuff found by configure will be used but result
+	# in a broken build.
+	if ! use berkdb ; then
+		sed -i -e '/HAVE_BERKELEY_DB/d' config.mk || die
+	fi
+
+	if ! use caps ; then
+		sed -i -e '/HAVE_CAP/d' config.mk || die
+	fi
+
+	if use minimal ; then
+		sed -i -e '/HAVE_MNL/d' config.mk || die
+	fi
+
+	if ! use elf ; then
+		sed -i -e '/HAVE_ELF/d' config.mk || die
+	fi
+
+	if ! use nfs ; then
+		sed -i -e '/HAVE_RPC/d' config.mk || die
+	fi
+
+	if ! use selinux ; then
+		sed -i -e '/HAVE_SELINUX/d' config.mk || die
+	fi
+
+	# ...Now switch on/off requested features via USE flags
+	# this is only useful if the test did not set other things, per bug #643722
+	# Keep in sync with ifs above, or refactor to be unified.
+	cat <<-EOF >> config.mk
+	TC_CONFIG_ATM := $(usex atm y n)
+	TC_CONFIG_XT  := $(usex iptables y n)
+	TC_CONFIG_NO_XT := $(usex iptables n y)
+	# We've locked in recent enough kernel headers, bug #549948
+	TC_CONFIG_IPSET := y
+	HAVE_BERKELEY_DB := $(usex berkdb y n)
+	HAVE_CAP      := $(usex caps y n)
+	HAVE_MNL      := $(usex minimal n y)
+	HAVE_ELF      := $(usex elf y n)
+	HAVE_RPC      := $(usex nfs y n)
+	HAVE_SELINUX  := $(usex selinux y n)
+	IP_CONFIG_SETNS := ${setns}
+	# Use correct iptables dir, bug #144265, bug #293709
+	IPT_LIB_DIR   := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
+	EOF
+}
+
+src_compile() {
+	emake V=1 NETNS_RUN_DIR=/run/netns
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	if use minimal ; then
+		into /
+		dosbin tc/tc
+		dobin ip/ip
+		return 0
+	fi
+
+	emake \
+		DESTDIR="${D}" \
+		PREFIX="${EPREFIX}/usr" \
+		LIBDIR="${EPREFIX}"/$(get_libdir) \
+		SBINDIR="${EPREFIX}"/sbin \
+		CONFDIR="${EPREFIX}"/etc/iproute2 \
+		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
+		MANDIR="${EPREFIX}"/usr/share/man \
+		ARPDDIR="${EPREFIX}"/var/lib/arpd \
+		install
+
+	dodir /bin
+	mv "${ED}"/{s,}bin/ip || die # bug #330115
+	mv "${ED}"/{s,}bin/ss || die # bug #547264
+
+	dolib.a lib/libnetlink.a
+	insinto /usr/include
+	doins include/libnetlink.h
+
+	# Collides with net-analyzer/ifstat
+	# https://bugs.gentoo.org/868321
+	mv "${ED}"/sbin/ifstat{,-iproute2} || die
+
+	if use berkdb ; then
+		keepdir /var/lib/arpd
+		# bug #47482, arpd doesn't need to be in /sbin
+		dodir /usr/bin
+		mv "${ED}"/sbin/arpd "${ED}"/usr/bin/ || die
+	elif [[ -d "${ED}"/var/lib/arpd ]]; then
+		rmdir --ignore-fail-on-non-empty -p "${ED}"/var/lib/arpd || die
+	fi
+	strip-lto-bytecode
+}

From d0a2a0236ffabfa5916d2f92a82be4b536bf247e Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:15:27 +0000
Subject: [PATCH 092/122] sys-apps/kbd: Sync with Gentoo

It's from Gentoo commit 80214f2d729f7e6289e18549a07fb61369e988c5.
---
 .../third_party/portage-stable/sys-apps/kbd/kbd-2.8.0.ebuild    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-2.8.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-2.8.0.ebuild
index c35d98dba13..66d872639d9 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-2.8.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-2.8.0.ebuild
@@ -12,7 +12,7 @@ if [[ ${PV} == 9999 ]] ; then
 else
 	if [[ $(ver_cut 3) -lt 90 ]] ; then
 		SRC_URI="https://www.kernel.org/pub/linux/utils/kbd/${P}.tar.xz"
-		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86"
+		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
 	else
 		inherit autotools
 		SRC_URI="https://github.com/legionus/kbd/archive/v${PV}.tar.gz -> ${P}.tar.gz"

From de64f329bb29b65f3bde10a918ab99c5563c6faf Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:15:29 +0000
Subject: [PATCH 093/122] sys-apps/locale-gen: Sync with Gentoo

It's from Gentoo commit e51631aba1fcc12ab4266b4ca57afa12b5eee377.
---
 .../sys-apps/locale-gen/Manifest              |  3 +-
 ...e-gen-3.0.ebuild => locale-gen-3.2.ebuild} | 14 +++++---
 .../sys-apps/locale-gen/locale-gen-3.3.ebuild | 32 +++++++++++++++++++
 .../locale-gen/locale-gen-9999.ebuild         | 32 +++++++++++++++++++
 4 files changed, 76 insertions(+), 5 deletions(-)
 rename sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/{locale-gen-3.0.ebuild => locale-gen-3.2.ebuild} (61%)
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-3.3.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/Manifest
index 06ec41ec604..5137f663710 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/Manifest
@@ -1,2 +1,3 @@
 DIST locale-gen-2.23.tar.bz2 7664 BLAKE2B a529b62fbb840c9352f06e8f5c80fc764425a2619dc69cc820f550a026d391788d5e2cfeeb46a8b5b9716da63340b4fce57a5b523edd4196ee1219c1200cb752 SHA512 c1245caadb04403c535a836f19bc410d0f04b5c0e297ea5be9852e6d71e08e528071ae769d63d31a677dda8fdd618b4c4d581ed525cf8786b82d8f37636db754
-DIST locale-gen-3.0.tar.bz2 14810 BLAKE2B f88381ca53eff89016daddedcaf349d4584a991de384e08f0908b025e37df8ecc90ee0b2834e596c8330516bbabd2e17a6c460ce5190e939704ae683732cc456 SHA512 4bfc27a12b2f4822ce7fb8ac7881adc2d1c34f8722aa688c940caaed06225d99a1c81569871de3cac9980725ed9743508ade0f68b171062d607e71261951373a
+DIST locale-gen-3.2.tar.bz2 16340 BLAKE2B a0558a0f84da3ea6a66903a632f261fe9cf63e21ccb32411f827367699fefd3e2e627ee018c2720dce3901e3801089c3aca6a487f2f075a9b6831529b160a0e2 SHA512 76655947a1d28cbda5be75454a3cc38e75d2914ab987bd59359f70acc6e3a3f2961675280ee8a52ada4724fb6393f1d5b6712077a89ebd3511a49c43cf459adf
+DIST locale-gen-3.3.tar.bz2 19815 BLAKE2B be46b2bedfc876900998fb1a4af3c6e5b04a0005caf0590052bda3f46a532c93ead62d44a6d0b4d6d0ef4bc01df1c2916c9ffac8dd8322278b2f3d21da0aaeb1 SHA512 3f55c0fe2fc0c434dc26538366238463798fde7e9367f6dc1c824531b6bff326ad0e6f62d3b599a8c2b92a6b974fa8ef8c46e58acf80d50820cc1987c20da7cb
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-3.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-3.2.ebuild
similarity index 61%
rename from sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-3.0.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-3.2.ebuild
index b3a29ad9dff..45a38c7dfc2 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-3.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-3.2.ebuild
@@ -5,15 +5,21 @@ EAPI=8
 
 DESCRIPTION="Generate locales based upon the config file /etc/locale.gen"
 HOMEPAGE="https://gitweb.gentoo.org/proj/locale-gen.git/"
-SRC_URI="https://gitweb.gentoo.org/proj/locale-gen.git/snapshot/${P}.tar.bz2"
 
-LICENSE="GPL-2"
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/locale-gen.git"
+	inherit git-r3
+else
+	SRC_URI="https://gitweb.gentoo.org/proj/locale-gen.git/snapshot/${P}.tar.bz2"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
 
+LICENSE="GPL-2"
 SLOT="0"
-#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 
 RDEPEND="
-	dev-lang/perl
+	>=dev-lang/perl-5.36
 	!<sys-libs/glibc-2.37-r3
 "
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-3.3.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-3.3.ebuild
new file mode 100644
index 00000000000..45a38c7dfc2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-3.3.ebuild
@@ -0,0 +1,32 @@
+# Copyright 2023-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Generate locales based upon the config file /etc/locale.gen"
+HOMEPAGE="https://gitweb.gentoo.org/proj/locale-gen.git/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/locale-gen.git"
+	inherit git-r3
+else
+	SRC_URI="https://gitweb.gentoo.org/proj/locale-gen.git/snapshot/${P}.tar.bz2"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+
+RDEPEND="
+	>=dev-lang/perl-5.36
+	!<sys-libs/glibc-2.37-r3
+"
+
+src_install() {
+	dosbin locale-gen
+	doman *.[0-8]
+	insinto /etc
+	doins locale.gen
+	keepdir /usr/lib/locale
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-9999.ebuild
new file mode 100644
index 00000000000..45a38c7dfc2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-9999.ebuild
@@ -0,0 +1,32 @@
+# Copyright 2023-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Generate locales based upon the config file /etc/locale.gen"
+HOMEPAGE="https://gitweb.gentoo.org/proj/locale-gen.git/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/locale-gen.git"
+	inherit git-r3
+else
+	SRC_URI="https://gitweb.gentoo.org/proj/locale-gen.git/snapshot/${P}.tar.bz2"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+
+RDEPEND="
+	>=dev-lang/perl-5.36
+	!<sys-libs/glibc-2.37-r3
+"
+
+src_install() {
+	dosbin locale-gen
+	doman *.[0-8]
+	insinto /etc
+	doins locale.gen
+	keepdir /usr/lib/locale
+}

From 93be5fff8d788aab5025d6670a0e6e56fcb67025 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:15:41 +0000
Subject: [PATCH 094/122] sys-apps/nvme-cli: Sync with Gentoo

It's from Gentoo commit 7e0afd937e0608417323748d1b554783141aba7d.
---
 .../portage-stable/sys-apps/nvme-cli/Manifest |  1 +
 .../sys-apps/nvme-cli/nvme-cli-2.15.ebuild    | 49 +++++++++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/nvme-cli-2.15.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/Manifest
index 3d12c0ea2a7..3354110b994 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/Manifest
@@ -2,3 +2,4 @@ DIST nvme-cli-2.11.gh.tar.gz 1023249 BLAKE2B c60765aaf8343adb29b2b042223accdd1ac
 DIST nvme-cli-2.12.gh.tar.gz 1079884 BLAKE2B ad08ce7c477cebdbb68efd707de851e9b7187cc6bd4ce4980f9a6f33a02c65d0ae6702e4f38f135db22acadf10bc26b87064ac2c9e09c820837c47ca32b0f093 SHA512 569a60302e4ce71713906417f34a8922b4788d77220a01f2f11dd12fc787ac6590c00588353cbbba292640688995fcefee4ab28c274bedcc02a2e3439c258938
 DIST nvme-cli-2.13.gh.tar.gz 1122216 BLAKE2B 45b181607f22d332fcf9e8d14c0dfba5c5a49e7e95bcf479efaf8eae3a60222af10c2f6699aab2c53ec91ede6e3e262101bbde81248facf25d40c87c0b07fa22 SHA512 71ade7b97354bf70e4909d85265db157715c1afe52fba6d1e2aa614900a8059830e85029f71680884966476363e8846d6cfbc1dcfe57330c749775acc39df6e7
 DIST nvme-cli-2.14.gh.tar.gz 1142108 BLAKE2B 7d482f065de704d9da8c54ea435c3ca8e81f08f683a9679300d8d02fd9bec6ee2c068d77ddbd2e390bd1d761b8b4b4a70a790cc290127968800df361b7a767a7 SHA512 7f600ee719f06283e136427a0f9eb0b22412f7f4549c774768caff54150207ba87e2a431ea1569e5ed86a554aecd23c00c4e8c351aa0168a81807c86a0cb2edc
+DIST nvme-cli-2.15.gh.tar.gz 1182716 BLAKE2B 295ba5f56b8c4aeaafb65132b35e6198127ebad845e48d63f2d4dc185e1e668414880167cd0dc03d20dc47cdb889d20b74b709e0573fe12b609f60a17fd50681 SHA512 6f4c9fe52883df5424ba28d8b66b00e61f4b6f7226d7385f026c1d3b8aeb473bdf637102d9cf7e049349c4f7e61eccbb33f7400cc09056f74be03a80b7d51c0d
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/nvme-cli-2.15.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/nvme-cli-2.15.ebuild
new file mode 100644
index 00000000000..32a67a7fe19
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/nvme-cli-2.15.ebuild
@@ -0,0 +1,49 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit meson systemd udev
+
+DESCRIPTION="NVM-Express user space tooling for Linux"
+HOMEPAGE="https://github.com/linux-nvme/nvme-cli"
+SRC_URI="https://github.com/linux-nvme/nvme-cli/archive/v${PV}.tar.gz -> ${P}.gh.tar.gz"
+
+LICENSE="GPL-2 GPL-2+"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv ~sparc ~x86"
+IUSE="+json pdc"
+
+RDEPEND="
+	>=sys-libs/libnvme-1.15:=[json?]
+	json? ( dev-libs/json-c:= )
+	sys-libs/zlib:=
+"
+DEPEND="
+	${RDEPEND}
+	virtual/os-headers
+"
+BDEPEND="
+	virtual/pkgconfig
+"
+
+src_configure() {
+	local emesonargs=(
+		-Dversion-tag="${PV}"
+		-Ddocs=all
+		-Dhtmldir="${EPREFIX}/usr/share/doc/${PF}/html"
+		-Dsystemddir="$(systemd_get_systemunitdir)"
+		-Dudevrulesdir="${EPREFIX}$(get_udevdir)/rules.d"
+		$(meson_feature json json-c)
+		$(meson_use pdc pdc-enabled)
+	)
+	meson_src_configure
+}
+
+pkg_postinst() {
+	udev_reload
+}
+
+pkg_postrm() {
+	udev_reload
+}

From 7011c132a3aba4aedd7430e303fda781afe12b6a Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:15:42 +0000
Subject: [PATCH 095/122] sys-apps/pciutils: Sync with Gentoo

It's from Gentoo commit e86abf97c54886e586295a38f2fdc57def9ea4a5.
---
 .../portage-stable/sys-apps/pciutils/pciutils-3.14.0.ebuild     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pciutils/pciutils-3.14.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/pciutils/pciutils-3.14.0.ebuild
index 5b30fe56f12..641d09839f0 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/pciutils/pciutils-3.14.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pciutils/pciutils-3.14.0.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://mj.ucw.cz/download/linux/pci/${P}.tar.gz"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
 IUSE="dns +kmod static-libs +udev zlib"
 REQUIRED_USE="static-libs? ( !udev )"
 

From 3481470db2499d2331d05b713aa64936c5872553 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:15:43 +0000
Subject: [PATCH 096/122] sys-apps/pv: Sync with Gentoo

It's from Gentoo commit bd7c8da068c8c4907216b4cefd676fa40fbd3f59.
---
 .../portage-stable/sys-apps/pv/Manifest       |  2 +
 .../sys-apps/pv/pv-1.9.34.ebuild              | 59 +++++++++++++++++++
 .../portage-stable/sys-apps/pv/pv-9999.ebuild |  8 +--
 3 files changed, 65 insertions(+), 4 deletions(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-1.9.34.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pv/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/pv/Manifest
index fb28b3ac9d3..a8fbec75a3b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/pv/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pv/Manifest
@@ -1,2 +1,4 @@
 DIST pv-1.9.31.tar.gz 417551 BLAKE2B 6018abe674834f45312faa5ce07b49e11258e29fffc11d88ce73f50ae58c47e94defa3d5d819099a6909610e7423d9e42a8ce939fa39fe476cdbf35e89aa0112 SHA512 63cdc6223cde4f3f0daf47b5808a3f72a9cfaf2c05751e971a99d9dd3df2f36430958213c023931f428c87341a5f6c1f3772f30ca992123ea4c2a2e48000ff1d
 DIST pv-1.9.31.tar.gz.asc 691 BLAKE2B 7b5b998341db887b14c56fc080d87cb4abb186b4df2c8def638822889a734436fe0c4c132396415bbc0dcb0754f76d0456bb667533ef7ed92ed0c09a62522e8b SHA512 549a3bb3f4f404b3a6e407663ba335e3d4e14303185654771c974335ed5e7ac46dbba71bbf4f26e640217829e58a0da8d6fa139b02f426b60ab074ec97084374
+DIST pv-1.9.34.tar.gz 416551 BLAKE2B aa2d56408a96de9b472a3ef5215a270c3c993543dc72b980948ffd2f6f6181bf69beaf911df284ea934c43d5053ada57a35e3dc43de08a184dca89fa75e945e5 SHA512 c590e376d33f49d8bb0d4463a54bb8c5a8dd25737f2d413f83c53c64cf6cb6d5ad977ff907fb6a8d8004ee371d35de08d3a5fb312b07a6c7237565e0bc55a104
+DIST pv-1.9.34.tar.gz.asc 691 BLAKE2B 0bb824f3f8352ab3c32d9df273780039eb81b8bf40f4f90cede5a121cccdd5370a1769da0bfe09735b80a59a75bb4ac3cbd5008bc0fa99c40077cae2dd64cf14 SHA512 8f0b7989b3e8d00b5147fa5ad37e3823b99edd9586210f73fcf553b95c7d2114843ff1c7445ac757689c1eca4cc5920fb86417733fba722bc287c66885e98a33
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-1.9.34.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-1.9.34.ebuild
new file mode 100644
index 00000000000..b66bc7a457d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-1.9.34.ebuild
@@ -0,0 +1,59 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/pv.asc
+inherit linux-info toolchain-funcs verify-sig
+
+DESCRIPTION="Pipe Viewer: a tool for monitoring the progress of data through a pipe"
+HOMEPAGE="https://ivarch.com/p/pv https://codeberg.org/ivarch/pv"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://codeberg.org/a-j-wood/pv"
+	inherit autotools git-r3
+else
+	SRC_URI="
+		https://ivarch.com/s/${P}.tar.gz
+		verify-sig? ( https://ivarch.com/s/${P}.tar.gz.txt -> ${P}.tar.gz.asc )
+	"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+IUSE="debug ncurses nls"
+
+RDEPEND="ncurses? ( sys-libs/ncurses:= )"
+DEPEND="${RDEPEND}"
+BDEPEND="verify-sig? ( sec-keys/openpgp-keys-pv )"
+
+pkg_setup() {
+	if use kernel_linux; then
+		CONFIG_CHECK="~SYSVIPC"
+		ERROR_SYSVIPC="You will need to enable CONFIG_SYSVIPC in your kernel to use the --remote option."
+		linux-info_pkg_setup
+	fi
+}
+
+src_prepare() {
+	default
+
+	[[ ${PV} == 9999 ]] && eautoreconf
+}
+
+src_configure() {
+	tc-export AR
+
+	econf \
+		$(use_enable debug debugging) \
+		$(use_with ncurses) \
+		$(use_enable nls)
+}
+
+src_test() {
+	# Valgrind is unreliable within sandbox
+	local -x SKIP_VALGRIND_TESTS=1
+	emake -Onone check
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-9999.ebuild
index f1565df2a2b..b66bc7a457d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-9999.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -7,15 +7,15 @@ VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/pv.asc
 inherit linux-info toolchain-funcs verify-sig
 
 DESCRIPTION="Pipe Viewer: a tool for monitoring the progress of data through a pipe"
-HOMEPAGE="https://www.ivarch.com/programs/pv.shtml https://codeberg.org/a-j-wood/pv"
+HOMEPAGE="https://ivarch.com/p/pv https://codeberg.org/ivarch/pv"
 
 if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://codeberg.org/a-j-wood/pv"
 	inherit autotools git-r3
 else
 	SRC_URI="
-		https://www.ivarch.com/programs/sources/${P}.tar.gz
-		verify-sig? ( https://www.ivarch.com/programs/sources/${P}.tar.gz.txt -> ${P}.tar.gz.asc )
+		https://ivarch.com/s/${P}.tar.gz
+		verify-sig? ( https://ivarch.com/s/${P}.tar.gz.txt -> ${P}.tar.gz.asc )
 	"
 
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"

From f4d1b8084ed0ca648b624898d5496c7e8ed0aa56 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:15:49 +0000
Subject: [PATCH 097/122] sys-apps/util-linux: Sync with Gentoo

It's from Gentoo commit ddb25922124a4e0b58e2a6b1b96b25b9aaf1657b.
---
 ...til-linux-2.41.1.ebuild => util-linux-2.41.1-r1.ebuild} | 6 ++++++
 .../sys-apps/util-linux/util-linux-9999.ebuild             | 7 ++++++-
 2 files changed, 12 insertions(+), 1 deletion(-)
 rename sdk_container/src/third_party/portage-stable/sys-apps/util-linux/{util-linux-2.41.1.ebuild => util-linux-2.41.1-r1.ebuild} (98%)

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.41.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.41.1-r1.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.41.1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.41.1-r1.ebuild
index 364132e10a2..96bcf9e9b25 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.41.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.41.1-r1.ebuild
@@ -353,6 +353,12 @@ multilib_src_configure() {
 
 src_configure() {
 	append-lfs-flags
+
+	# Workaround for bug #961040 (gcc PR120006)
+	if tc-is-gcc && [[ $(gcc-major-version) == 15 && $(gcc-minor-version) -lt 2 ]] ; then
+		append-flags -fno-ipa-pta
+	fi
+
 	multilib-minimal_src_configure
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-9999.ebuild
index 90bee97edbb..32de7e0bb19 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-9999.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 PYTHON_COMPAT=( python3_{11..14} )
 TMPFILES_OPTIONAL=1
 
-inherit pam python-r1 meson-multilib tmpfiles toolchain-funcs
+inherit flag-o-matic pam python-r1 meson-multilib tmpfiles toolchain-funcs
 
 MY_PV="${PV/_/-}"
 MY_P="${PN}-${MY_PV}"
@@ -128,6 +128,11 @@ src_unpack() {
 src_prepare() {
 	default
 
+	# Workaround for bug #961040 (gcc PR120006)
+	if tc-is-gcc && [[ $(gcc-major-version) == 15 && $(gcc-minor-version) -lt 2 ]] ; then
+		append-flags -fno-ipa-pta
+	fi
+
 	if use test ; then
 		# Known-failing tests
 		local known_failing_tests=(

From 5c169186425e194ee1cdace9c3122cec1b9f184d Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:15:52 +0000
Subject: [PATCH 098/122] sys-auth/polkit: Sync with Gentoo

It's from Gentoo commit 2401539f678c19c00582b8b06be672dca7723973.
---
 .../sys-auth/polkit/polkit-126-r2.ebuild      | 157 ++++++++++++++++++
 1 file changed, 157 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-auth/polkit/polkit-126-r2.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-auth/polkit/polkit-126-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-auth/polkit/polkit-126-r2.ebuild
new file mode 100644
index 00000000000..42ba546bf4a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-auth/polkit/polkit-126-r2.ebuild
@@ -0,0 +1,157 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{11..13} )
+inherit meson pam pax-utils python-any-r1 systemd tmpfiles xdg-utils
+
+DESCRIPTION="Policy framework for controlling privileges for system-wide services"
+HOMEPAGE="https://www.freedesktop.org/wiki/Software/polkit https://github.com/polkit-org/polkit"
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/polkit-org/polkit"
+	inherit git-r3
+elif [[ ${PV} == *_p* ]] ; then
+	# Upstream don't make releases very often. Test snapshots throughly
+	# and review commits, but don't shy away if there's useful stuff there
+	# we want.
+	MY_COMMIT=""
+	SRC_URI="https://github.com/polkit-org/polkit/archive/${MY_COMMIT}.tar.gz -> ${P}.tar.gz"
+
+	S="${WORKDIR}"/${PN}-${MY_COMMIT}
+else
+	SRC_URI="https://github.com/polkit-org/polkit/archive/refs/tags/${PV}.tar.gz -> ${P}.tar.gz"
+fi
+
+LICENSE="LGPL-2"
+SLOT="0"
+if [[ ${PV} != 9999 ]] ; then
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+fi
+IUSE="examples gtk +introspection kde pam nls selinux systemd test"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	acct-user/polkitd
+	app-text/docbook-xml-dtd:4.1.2
+	app-text/docbook-xsl-stylesheets
+	>=dev-libs/glib-2.32
+	dev-libs/gobject-introspection-common
+	dev-libs/libxslt
+	dev-util/glib-utils
+	virtual/pkgconfig
+	introspection? ( >=dev-libs/gobject-introspection-0.6.2 )
+	nls? ( sys-devel/gettext )
+	test? (
+		$(python_gen_any_dep '
+			dev-python/dbus-python[${PYTHON_USEDEP}]
+			dev-python/python-dbusmock[${PYTHON_USEDEP}]
+		')
+	)
+"
+DEPEND="
+	>=dev-libs/glib-2.32:2
+	dev-libs/expat
+	dev-lang/duktape:=
+	pam? (
+		sys-auth/pambase
+		sys-libs/pam
+	)
+	!pam? ( virtual/libcrypt:= )
+	systemd? ( sys-apps/systemd:0=[policykit] )
+	!systemd? ( sys-auth/elogind )
+"
+RDEPEND="
+	${DEPEND}
+	acct-user/polkitd
+	selinux? ( sec-policy/selinux-policykit )
+"
+PDEPEND="
+	gtk? ( || (
+		>=gnome-extra/polkit-gnome-0.105
+		>=lxde-base/lxsession-0.5.2
+	) )
+	kde? ( kde-plasma/polkit-kde-agent )
+"
+
+DOCS=( docs/TODO HACKING.md NEWS.md README.md )
+
+QA_MULTILIB_PATHS="
+	usr/lib/polkit-1/polkit-agent-helper-1
+	usr/lib/polkit-1/polkitd
+"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-elogind.patch
+)
+
+python_check_deps() {
+	python_has_version "dev-python/dbus-python[${PYTHON_USEDEP}]" &&
+	python_has_version "dev-python/python-dbusmock[${PYTHON_USEDEP}]"
+}
+
+pkg_setup() {
+	use test && python-any-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	# bug #401513
+	sed -i -e 's|unix-group:@PRIVILEGED_GROUP@|unix-user:@PRIVILEGED_GROUP@|' src/polkitbackend/*-default.rules.in || die
+}
+
+src_configure() {
+	xdg_environment_reset
+
+	local emesonargs=(
+		--localstatedir="${EPREFIX}"/var
+		-Dauthfw="$(usex pam pam shadow)"
+		-Dexamples=false
+		-Dgtk_doc=false
+		-Dman=true
+		-Dos_type=gentoo
+		-Dpam_module_dir=$(getpam_mod_dir)
+		-Dprivileged_group=0
+		-Dsession_tracking="$(usex systemd logind elogind)"
+		-Dsystemdsystemunitdir="$(systemd_get_systemunitdir)"
+		-Dlibs-only=false
+		$(meson_use introspection)
+		$(meson_use nls gettext)
+		$(meson_use test tests)
+	)
+	meson_src_configure
+}
+
+src_compile() {
+	meson_src_compile
+
+	# Required for polkitd on hardened/PaX due to spidermonkey's JIT
+	pax-mark mr src/polkitbackend/.libs/polkitd test/polkitbackend/.libs/polkitbackendjsauthoritytest
+}
+
+src_install() {
+	meson_src_install
+
+	# acct-user/polkitd installs its own (albeit with a different filename)
+	rm -rf "${ED}"/usr/lib/sysusers.d || die
+
+	if use examples ; then
+		docinto examples
+		dodoc src/examples/{*.c,*.policy*}
+	fi
+
+	if [[ ${EUID} == 0 ]]; then
+		diropts -m 0700 -o polkitd
+	fi
+	keepdir /etc/polkit-1/rules.d
+}
+
+pkg_postinst() {
+	tmpfiles_process polkit-tmpfiles.conf
+
+	if [[ ${EUID} == 0 ]]; then
+		chmod 0700 "${EROOT}"/{etc,usr/share}/polkit-1/rules.d
+		chown polkitd "${EROOT}"/{etc,usr/share}/polkit-1/rules.d
+	fi
+}

From 35702eb36a6c7cec75f658d46dfe6400d6d3c48c Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:16:00 +0000
Subject: [PATCH 099/122] sys-devel/binutils: Sync with Gentoo

It's from Gentoo commit 90de36e5befb1b66d6c5b4a2420620b873aa3f65.
---
 .../sys-devel/binutils/Manifest               |   3 +-
 .../binutils/binutils-2.43.9999.ebuild        | 571 ------------------
 ...2.44-r3.ebuild => binutils-2.44-r4.ebuild} |  11 +-
 .../binutils/binutils-2.44.9999.ebuild        |  10 +-
 ...44-r1.ebuild => binutils-2.45.9999.ebuild} |  65 +-
 ...ls-2.44-r2.ebuild => binutils-2.45.ebuild} |  65 +-
 .../sys-devel/binutils/binutils-9999.ebuild   |   4 +-
 .../files/binutils-2.44-strip-static.patch    | 155 -----
 8 files changed, 140 insertions(+), 744 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.43.9999.ebuild
 rename sdk_container/src/third_party/portage-stable/sys-devel/binutils/{binutils-2.44-r3.ebuild => binutils-2.44-r4.ebuild} (97%)
 rename sdk_container/src/third_party/portage-stable/sys-devel/binutils/{binutils-2.44-r1.ebuild => binutils-2.45.9999.ebuild} (90%)
 rename sdk_container/src/third_party/portage-stable/sys-devel/binutils/{binutils-2.44-r2.ebuild => binutils-2.45.ebuild} (90%)
 delete mode 100644 sdk_container/src/third_party/portage-stable/sys-devel/binutils/files/binutils-2.44-strip-static.patch

diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest
index bae05b1ad2e..e578b46ab1e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest
@@ -22,6 +22,7 @@ DIST binutils-2.42-patches-6.tar.xz 50664 BLAKE2B f13b65a761cfba80caf2e4740c6383
 DIST binutils-2.42.tar.xz 27567160 BLAKE2B e67a5c028fba70e70088fd11b38ec8c9c4ed5a019badefda25abeb6275997b16f0891e7ff3424c4b82bbfae92e8992669826920dd53df61cd48469d8f7cd5bd1 SHA512 155f3ba14cd220102f4f29a4f1e5cfee3c48aa03b74603460d05afb73c70d6657a9d87eee6eb88bf13203fe6f31177a5c9addc04384e956e7da8069c8ecd20a6
 DIST binutils-2.43-patches-3.tar.xz 62692 BLAKE2B a189a01a6a99c4fdff124cf90ecc18f874812c17fc735376c855469c487b6a71489ad5c2f86c518d2e029cc83d65757144ff9abddbe7ec3fc06e22f9501c62f4 SHA512 99a30e18fdfd7bdce85bb903f8d61837cfbb639ead8a680ff1a85ad1d615b658e696bdf196c4a002d029f952d34aa441e09e861b22f5400c65f07cce5934cd8f
 DIST binutils-2.43.tar.xz 28175768 BLAKE2B 28b0a04a28273b76eab2d00e00160be889f155f77f5a9d8759ef8dce505c97e97641bf7ec70b92b731b520570a02b06e04e8215b068fcb1bb2573e9ef24732d9 SHA512 93e063163e54d6a6ee2bd48dc754270bf757a3635b49a702ed6b310e929e94063958512d191e66beaf44275f7ea60865dbde138b624626739679fcc306b133bb
-DIST binutils-2.44-patches-1.tar.xz 9156 BLAKE2B c72a7d0ffdb852f8de9c18e187b5768085b3a070744a4fadef508ab0e865d3a3967ec12a0ee7a325b6b689f39e5243aacd9d3f73ceb723d53592ec6ca640161b SHA512 053de98536e92837d0a08fac26bb0f057431747fe6e82f8b9ac54dd9aed65d8de379d653c0e8a8cd31267b9769825a420db5f40957f8c4eb54a7e4a9d76fadb8
 DIST binutils-2.44-patches-4.tar.xz 83612 BLAKE2B caa71849dbbfe1181072c84985c786284f5111bbaa638a44e828c6cc4c19e005793d045dc116c772cf7ffed4898f6f6c935d04f94a76c26e59fb3c4f5adf03d1 SHA512 4dd8e6c36a0423ab29a1f4b227c90a05eb61cab380c809a2f49bba27e84d621e6a5eefe4ec510a7c1c60ba93720f92159ac477c02f9e720e1bbcd6aaf6097d26
 DIST binutils-2.44.tar.xz 27285788 BLAKE2B 0eb031ace9fb5a7047b81b5a05b1760f7d332c8ed67f98899f153a45f181b83e661a484551af05c0a9b2adc422da84619103c7b1f3c9fad5327872832b5446aa SHA512 b85d3bbc0e334cf67a96219d3c7c65fbf3e832b2c98a7417bf131f3645a0307057ec81cd2b29ff2563cec53e3d42f73e2c60cc5708e80d4a730efdcc6ae14ad7
+DIST binutils-2.45-patches-1.tar.xz 15588 BLAKE2B b88c62a6483807dfb24c97c534aadc1f930ea2d6cd8ad86734c40458a0e3ac4d149c0ee47c6ba541c462ce0e619dfaa5328c3dd5ffbd94511c487956866c7a38 SHA512 05c890a71d465539b3d066c2fd92930e4d6c9003147395a4c2cb9cc514f412fa392892e2c3b8887493a56b00453ac383612d0cac42e4cacce983e65886537149
+DIST binutils-2.45.tar.xz 27868232 BLAKE2B 1ce72346b1f531c89feb86b407e2c649151b506ffbd1a02d413411d36f7ede98fa9a1adf75dd941c01df5fe7e6bf151828b269eeb7c278315ca8004bff22eb7f SHA512 c7b10a7466d9fd398d7a0b3f2a43318432668d714f2ec70069a31bdc93c86d28e0fe83792195727167743707fbae45337c0873a0786416db53bbf22860c16ce7
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.43.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.43.9999.ebuild
deleted file mode 100644
index aba22e72ca2..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.43.9999.ebuild
+++ /dev/null
@@ -1,571 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit libtool flag-o-matic gnuconfig strip-linguas toolchain-funcs
-
-DESCRIPTION="Tools necessary to build programs"
-HOMEPAGE="https://sourceware.org/binutils/"
-
-LICENSE="GPL-3+"
-IUSE="cet debuginfod doc gold gprofng hardened multitarget +nls pgo +plugins static-libs test vanilla zstd"
-
-# Variables that can be set here  (ignored for live ebuilds)
-# PATCH_VER          - the patchset version
-#                      Default: empty, no patching
-# PATCH_BINUTILS_VER - the binutils version in the patchset name
-#                    - Default: PV
-# PATCH_DEV          - Use download URI https://dev.gentoo.org/~{PATCH_DEV}/distfiles/...
-#                      for the patchsets
-
-PATCH_VER=1
-PATCH_DEV=dilfridge
-
-if [[ ${PV} == 9999 ]]; then
-	inherit git-r3
-	SLOT=${PV}
-elif [[ ${PV} == *9999 ]]; then
-	inherit git-r3
-	SLOT=$(ver_cut 1-2)
-else
-	PATCH_BINUTILS_VER=${PATCH_BINUTILS_VER:-${PV}}
-	PATCH_DEV=${PATCH_DEV:-dilfridge}
-	SRC_URI="mirror://gnu/binutils/binutils-${PV}.tar.xz https://sourceware.org/pub/binutils/releases/binutils-${PV}.tar.xz https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PV}.tar.xz"
-	[[ -z ${PATCH_VER} ]] || SRC_URI="${SRC_URI}
-		https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
-	SLOT=$(ver_cut 1-2)
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-fi
-
-#
-# The cross-compile logic
-#
-export CTARGET=${CTARGET:-${CHOST}}
-if [[ ${CTARGET} == ${CHOST} ]] ; then
-	if [[ ${CATEGORY} == cross-* ]] ; then
-		export CTARGET=${CATEGORY#cross-}
-	fi
-fi
-is_cross() { [[ ${CHOST} != ${CTARGET} ]] ; }
-
-#
-# The dependencies
-#
-RDEPEND="
-	>=sys-devel/binutils-config-3
-	sys-libs/zlib
-	debuginfod? (
-		dev-libs/elfutils[debuginfod(-)]
-	)
-	zstd? ( app-arch/zstd:= )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	doc? ( sys-apps/texinfo )
-	pgo? (
-		dev-util/dejagnu
-		app-alternatives/bc
-	)
-	test? (
-		dev-util/dejagnu
-		app-alternatives/bc
-	)
-	nls? ( sys-devel/gettext )
-	zstd? ( virtual/pkgconfig )
-	app-alternatives/lex
-	app-alternatives/yacc
-"
-
-RESTRICT="!test? ( test )"
-
-MY_BUILDDIR=${WORKDIR}/build
-
-src_unpack() {
-	if [[ ${PV} == *9999 ]] ; then
-		EGIT_REPO_URI="
-			https://anongit.gentoo.org/git/proj/toolchain/binutils-patches.git
-			https://github.com/gentoo/binutils-patches
-		"
-		EGIT_CHECKOUT_DIR=${WORKDIR}/patches-git
-		git-r3_src_unpack
-		mv patches-git/9999 patch || die
-
-		if [[ ${PV} != 9999 ]] ; then
-			EGIT_BRANCH=binutils-$(ver_cut 1)_$(ver_cut 2)-branch
-		fi
-		EGIT_REPO_URI="
-			https://sourceware.org/git/binutils-gdb.git
-			https://git.sr.ht/~sourceware/binutils-gdb
-			https://gitlab.com/x86-binutils/binutils-gdb.git
-		"
-		S=${WORKDIR}/binutils
-		EGIT_CHECKOUT_DIR=${S}
-		git-r3_src_unpack
-	else
-		unpack ${P/-hppa64/}.tar.xz
-
-		cd "${WORKDIR}" || die
-		unpack binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz
-
-		# _p patch versions are Gentoo specific tarballs ...
-		local dir=${P%_p?}
-		dir=${dir/-hppa64/}
-
-		S=${WORKDIR}/${dir}
-	fi
-
-	cd "${WORKDIR}" || die
-	mkdir -p "${MY_BUILDDIR}" || die
-}
-
-src_prepare() {
-	local patchsetname
-	if [[ ${PV} == 9999 ]] ; then
-		patchsetname="from git master"
-	elif [[ ${PV} == *9999 ]] ; then
-		patchsetname="from git branch ${EGIT_BRANCH}"
-	else
-		patchsetname="${PATCH_BINUTILS_VER}-${PATCH_VER}"
-	fi
-
-	if [[ -n ${PATCH_VER} ]] || [[ ${PV} == *9999 ]] ; then
-		if ! use vanilla; then
-			einfo "Applying binutils patchset ${patchsetname}"
-			eapply "${WORKDIR}/patch"
-			einfo "Done."
-
-			# This is applied conditionally for now just out of caution.
-			# It should be okay on non-prefix systems though. See bug #892549.
-			if is_cross || use prefix; then
-				eapply "${FILESDIR}"/binutils-2.40-linker-search-path.patch \
-					   "${FILESDIR}"/binutils-2.41-linker-prefix.patch
-			fi
-		fi
-	fi
-
-	# Make sure our explicit libdir paths don't get clobbered, bug #562460
-	sed -i \
-		-e 's:@bfdlibdir@:@libdir@:g' \
-		-e 's:@bfdincludedir@:@includedir@:g' \
-		{bfd,opcodes}/Makefile.in || die
-
-	# Apply things from PATCHES and user dirs
-	default
-
-	# Run misc portage update scripts
-	gnuconfig_update
-	elibtoolize --portage --no-uclibc
-}
-
-toolchain-binutils_bugurl() {
-	printf "https://bugs.gentoo.org/"
-}
-toolchain-binutils_pkgversion() {
-	printf "Gentoo ${PV}"
-	[[ -n ${PATCH_VER} ]] && printf " p${PATCH_VER}"
-}
-
-src_configure() {
-	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
-	# Avoid really confusing logs from subconfigure spam, makes logs far
-	# more legible.
-	MAKEOPTS="--output-sync=line ${MAKEOPTS}"
-
-	# Setup some paths
-	LIBPATH=/usr/$(get_libdir)/binutils/${CTARGET}/${PV}
-	INCPATH=${LIBPATH}/include
-	DATAPATH=/usr/share/binutils-data/${CTARGET}/${PV}
-	if is_cross ; then
-		TOOLPATH=/usr/${CHOST}/${CTARGET}
-	else
-		TOOLPATH=/usr/${CTARGET}
-	fi
-	BINPATH=${TOOLPATH}/binutils-bin/${PV}
-
-	# Make sure we filter $LINGUAS so that only ones that
-	# actually work make it through, bug #42033
-	strip-linguas -u */po
-
-	# Keep things sane
-	strip-flags
-	use cet && filter-flags -mindirect-branch -mindirect-branch=*
-	use elibc_musl && append-ldflags -Wl,-z,stack-size=2097152
-
-	# https://sourceware.org/PR32372
-	append-cflags $(test-flags-CC -std=gnu17)
-
-	local x
-	echo
-	for x in CATEGORY CBUILD CHOST CTARGET CFLAGS LDFLAGS ; do
-		einfo "$(printf '%10s' ${x}:) ${!x}"
-	done
-	echo
-
-	cd "${MY_BUILDDIR}" || die
-	local myconf=()
-
-	if use plugins ; then
-		myconf+=( --enable-plugins )
-	fi
-	# enable gold (installed as ld.gold) and ld's plugin architecture
-	if use gold ; then
-		myconf+=( --enable-gold )
-	fi
-
-	if use nls ; then
-		myconf+=( --without-included-gettext )
-	else
-		myconf+=( --disable-nls )
-	fi
-
-	myconf+=( --with-system-zlib )
-
-	# For bi-arch systems, enable a 64bit bfd. This matches the bi-arch
-	# logic in toolchain.eclass. bug #446946
-	#
-	# We used to do it for everyone, but it's slow on 32bit arches. bug #438522
-	case $(tc-arch) in
-		ppc|sparc|x86) myconf+=( --enable-64-bit-bfd ) ;;
-	esac
-
-	use multitarget && myconf+=( --enable-targets=all --enable-64-bit-bfd )
-
-	[[ -n ${CBUILD} ]] && myconf+=( --build=${CBUILD} )
-
-	is_cross && myconf+=(
-		--with-sysroot="${EPREFIX}"/usr/${CTARGET}
-		--enable-poison-system-directories
-	)
-
-	myconf+=( --enable-secureplt )
-
-	# mips can't do hash-style=gnu ...
-	if [[ $(tc-arch) != mips ]] ; then
-		myconf+=( --enable-default-hash-style=gnu )
-	fi
-
-	myconf+=(
-		--prefix="${EPREFIX}"/usr
-		--host=${CHOST}
-		--target=${CTARGET}
-		--datadir="${EPREFIX}"${DATAPATH}
-		--datarootdir="${EPREFIX}"${DATAPATH}
-		--infodir="${EPREFIX}"${DATAPATH}/info
-		--mandir="${EPREFIX}"${DATAPATH}/man
-		--bindir="${EPREFIX}"${BINPATH}
-		--libdir="${EPREFIX}"${LIBPATH}
-		--libexecdir="${EPREFIX}"${LIBPATH}
-		--includedir="${EPREFIX}"${INCPATH}
-		# portage's econf() does not detect presence of --d-d-t
-		# because it greps only top-level ./configure. But not
-		# libiberty's or bfd's configure.
-		--disable-dependency-tracking
-		--disable-silent-rules
-		--enable-obsolete
-		--enable-shared
-		--enable-threads
-		--enable-relro
-		--enable-install-libiberty
-		--enable-textrel-check=$(usex hardened error warning)
-		# Things to think about
-		#--enable-deterministic-archives
-		--enable-new-dtags
-		--disable-jansson
-		--disable-werror
-		--with-bugurl="$(toolchain-binutils_bugurl)"
-		--with-pkgversion="$(toolchain-binutils_pkgversion)"
-		$(use_enable static-libs static)
-		$(use_with zstd)
-
-		# Disable modules that are in a combined binutils/gdb tree, bug #490566
-		--disable-{gdb,gdbserver,libbacktrace,libdecnumber,readline,sim}
-		# Strip out broken static link flags: https://gcc.gnu.org/PR56750
-		--without-stage1-ldflags
-		# Change SONAME to avoid conflict across {native,cross}/binutils, binutils-libs. bug #666100
-		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)
-
-		$(use_with debuginfod)
-
-		# Avoid automagic dev-libs/msgpack dep, bug #865875
-		--without-msgpack
-
-		# Allow user to opt into CET for host libraries.
-		# Ideally we would like automagic-or-disabled here.
-		# But the check does not quite work on i686: bug #760926.
-		$(use_enable cet)
-
-		# We can enable this by default in future, but it's brand new
-		# in 2.39 with several bugs:
-		# - Doesn't build on musl (https://sourceware.org/bugzilla/show_bug.cgi?id=29477)
-		# - No man pages (https://sourceware.org/bugzilla/show_bug.cgi?id=29521)
-		# - Broken at runtime without Java (https://sourceware.org/bugzilla/show_bug.cgi?id=29479)
-		# - binutils-config (and this ebuild?) needs adaptation first (https://bugs.gentoo.org/865113)
-		$(use_enable gprofng)
-
-		# Enables colored disassembly by default (equivalent to passing
-		# --disassembler-color=terminal to all objdump invocations).
-		--enable-colored-disassembly
-	)
-
-	case ${CTARGET} in
-		x86_64-*|aarch64*|arm64*|i[3456]*)
-			# These hardening options are available from 2.39+ but
-			# they unconditionally enable the behaviour even on arches
-			# where e.g. execstacks can't be avoided.
-			# See https://sourceware.org/bugzilla/show_bug.cgi?id=29592.
-			#
-			# TODO: Get the logic for this fixed upstream so it doesn't
-			# create impossible broken combinations on some arches, like mips.
-			#
-			# TODO: Get the logic for this fixed upstream so --disable-* works
-			# as expected.
-			myconf+=(
-				--enable-warn-execstack=yes
-				--enable-warn-rwx-segments=yes
-			)
-
-			if use hardened ; then
-				myconf+=(
-					# TODO: breaks glibc test suite
-					#--enable-error-execstack=yes
-					#--enable-error-rwx-segments=yes
-					--enable-default-execstack=no
-				)
-			fi
-			;;
-		*)
-			;;
-	esac
-
-	if use elibc_musl ; then
-		# Override our earlier setting for musl, as textrels don't
-		# work there at all. See bug #707660.
-		myconf+=(
-			--enable-textrel-check=error
-		)
-	fi
-
-	if use test || { use pgo && tc-is-lto ; } ; then
-		# -Wa,* needs to be consistent everywhere or lto-wrapper will complain
-		filter-flags '-Wa,*'
-	fi
-
-	if ! is_cross ; then
-		myconf+=( $(use_enable pgo pgo-build $(tc-is-lto && echo "lto" || echo "yes")) )
-
-		if use pgo ; then
-			# We let configure handle it for us because it has to run
-			# the testsuite later on for profiling, and LTO isn't compatible
-			# with the testsuite.
-			filter-lto
-
-			export BUILD_CFLAGS="${CFLAGS}"
-		fi
-	fi
-
-	ECONF_SOURCE="${S}" econf "${myconf[@]}"
-
-	# Prevent makeinfo from running if doc is unset.
-	if ! use doc ; then
-		sed -i \
-			-e '/^MAKEINFO/s:=.*:= true:' \
-			Makefile || die
-	fi
-}
-
-src_compile() {
-	cd "${MY_BUILDDIR}" || die
-
-	# see Note [tooldir hack for ldscripts]
-	# see linker prefix patch
-	emake \
-		tooldir="${EPREFIX}${TOOLPATH}" \
-		gentoo_prefix=$(usex prefix-guest "${EPREFIX}"/usr /usr) \
-		all
-
-	# only build info pages if the user wants them
-	if use doc ; then
-		emake info
-	fi
-
-	# we nuke the manpages when we're left with junk
-	# (like when we bootstrap, no perl -> no manpages)
-	find . -name '*.1' -a -size 0 -delete
-}
-
-src_test() {
-	cd "${MY_BUILDDIR}" || die
-
-	(
-		# Tests don't expect LTO
-		filter-lto
-
-		# lto-wrapper warnings which confuse tests
-		filter-flags '-Wa,*'
-
-		# bug #637066
-		filter-flags -Wall -Wreturn-type
-
-		emake -k check \
-			CFLAGS_FOR_TARGET="${CFLAGS_FOR_TARGET:-${CFLAGS}}" \
-			CXXFLAGS_FOR_TARGET="${CXXFLAGS_FOR_TARGET:-${CXXFLAGS}}" \
-			LDFLAGS_FOR_TARGET="${LDFLAGS_FOR_TARGET:-${LDFLAGS}}" \
-			CFLAGS="${CFLAGS}" \
-			CXXFLAGS="${CXXFLAGS}" \
-			LDFLAGS="${LDFLAGS}"
-	)
-}
-
-src_install() {
-	local x d
-
-	cd "${MY_BUILDDIR}" || die
-
-	# see Note [tooldir hack for ldscripts]
-	emake DESTDIR="${D}" tooldir="${EPREFIX}${LIBPATH}" install
-	rm -rf "${ED}"/${LIBPATH}/bin || die
-	use static-libs || find "${ED}" -name '*.la' -delete
-
-	# Newer versions of binutils get fancy with ${LIBPATH}, bug #171905
-	cd "${ED}"/${LIBPATH} || die
-	for d in ../* ; do
-		[[ ${d} == ../${PV} ]] && continue
-		mv ${d}/* . || die
-		rmdir ${d} || die
-	done
-
-	# Now we collect everything intp the proper SLOT-ed dirs
-	# When something is built to cross-compile, it installs into
-	# /usr/$CHOST/ by default ... we have to 'fix' that :)
-	if is_cross ; then
-		cd "${ED}"/${BINPATH} || die
-		for x in * ; do
-			mv ${x} ${x/${CTARGET}-} || die
-		done
-
-		if [[ -d ${ED}/usr/${CHOST}/${CTARGET} ]] ; then
-			mv "${ED}"/usr/${CHOST}/${CTARGET}/include "${ED}"/${INCPATH}
-			mv "${ED}"/usr/${CHOST}/${CTARGET}/lib/* "${ED}"/${LIBPATH}/
-			rm -r "${ED}"/usr/${CHOST}/{include,lib}
-		fi
-	fi
-
-	insinto ${INCPATH}
-	local libiberty_headers=(
-		# Not all the libiberty headers.  See libiberty/Makefile.in:install_to_libdir.
-		demangle.h
-		dyn-string.h
-		fibheap.h
-		hashtab.h
-		libiberty.h
-		objalloc.h
-		splay-tree.h
-	)
-	doins "${libiberty_headers[@]/#/${S}/include/}"
-	if [[ -d ${ED}/${LIBPATH}/lib ]] ; then
-		mv "${ED}"/${LIBPATH}/lib/* "${ED}"/${LIBPATH}/ || die
-		rm -r "${ED}"/${LIBPATH}/lib || die
-	fi
-
-	# Generate an env.d entry for this binutils
-	insinto /etc/env.d/binutils
-	cat <<-EOF > "${T}"/env.d
-		TARGET="${CTARGET}"
-		VER="${PV}"
-		LIBPATH="${EPREFIX}${LIBPATH}"
-	EOF
-	newins "${T}"/env.d ${CTARGET}-${PV}
-
-	# Handle documentation
-	if ! is_cross ; then
-		cd "${S}" || die
-		dodoc README
-
-		docinto bfd
-		dodoc bfd/ChangeLog* bfd/README bfd/PORTING bfd/TODO
-
-		docinto binutils
-		dodoc binutils/ChangeLog binutils/NEWS binutils/README
-
-		docinto gas
-		dodoc gas/ChangeLog* gas/CONTRIBUTORS gas/NEWS gas/README*
-
-		docinto gprof
-		dodoc gprof/ChangeLog* gprof/TEST gprof/TODO gprof/bbconv.pl
-
-		docinto ld
-		dodoc ld/ChangeLog* ld/README ld/NEWS ld/TODO
-
-		docinto libiberty
-		dodoc libiberty/ChangeLog* libiberty/README
-
-		docinto opcodes
-		dodoc opcodes/ChangeLog*
-	fi
-
-	# Remove shared info pages
-	rm -f "${ED}"/${DATAPATH}/info/{dir,configure.info,standards.info}
-
-	docompress "${DATAPATH}"/{info,man}
-
-	# Trim all empty dirs
-	find "${ED}" -depth -type d -exec rmdir {} + 2>/dev/null
-}
-
-pkg_postinst() {
-	# Make sure this ${CTARGET} has a binutils version selected
-	[[ -e ${EROOT}/etc/env.d/binutils/config-${CTARGET} ]] && return 0
-	binutils-config ${CTARGET}-${PV} || eerror binutils-config returned an error
-}
-
-pkg_postrm() {
-	local current_profile=$(binutils-config -c ${CTARGET})
-
-	# If no other versions exist, then uninstall for this
-	# target ... otherwise, switch to the newest version
-	# Note: only do this if this version is unmerged.  We
-	#       rerun binutils-config if this is a remerge, as
-	#       we want the mtimes on the symlinks updated (if
-	#       it is the same as the current selected profile)
-	if [[ ! -e ${EPREFIX}${BINPATH}/ld ]] && [[ ${current_profile} == ${CTARGET}-${PV} ]] ; then
-		local choice=$(binutils-config -l | grep ${CTARGET} | awk '{print $2}')
-		choice=${choice//$'\n'/ }
-		choice=${choice/* }
-		if [[ -z ${choice} ]] ; then
-			binutils-config -u ${CTARGET} || eerror binutils-config returned an error
-		else
-			binutils-config ${choice} || eerror binutils-config returned an error
-		fi
-	elif [[ $(CHOST=${CTARGET} binutils-config -c) == ${CTARGET}-${PV} ]] ; then
-		binutils-config ${CTARGET}-${PV} || eerror binutils-config returned an error
-	fi
-}
-
-# Note [slotting support]
-# -----------------------
-# Gentoo's layout for binutils files is non-standard as Gentoo
-# supports slotted installation for binutils. Many tools
-# still expect binutils to reside in known locations.
-# binutils-config package restores symlinks into known locations,
-# like:
-#    /usr/bin/${CTARGET}-<tool>
-#    /usr/bin/${CHOST}/${CTARGET}/lib/ldscrips
-#    /usr/include/
-#
-# Note [tooldir hack for ldscripts]
-# ---------------------------------
-# Build system does not allow ./configure to tweak every location
-# we need for slotting binutils hence all the shuffling in
-# src_install(). This note is about SCRIPTDIR define handling.
-#
-# SCRIPTDIR defines 'ldscripts/' directory location. SCRIPTDIR value
-# is set at build-time in ld/Makefile.am as: 'scriptdir = $(tooldir)/lib'
-# and hardcoded as -DSCRIPTDIR='"$(scriptdir)"' at compile time.
-# Thus we can't just move files around after compilation finished.
-#
-# Our goal is the following:
-# - at build-time set scriptdir to point to symlinked location:
-#   ${TOOLPATH}: /usr/${CHOST} (or /usr/${CHOST}/${CTARGET} for cross-case)
-# - at install-time set scriptdir to point to slotted location:
-#   ${LIBPATH}: /usr/$(get_libdir)/binutils/${CTARGET}/${PV}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r3.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r4.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r3.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r4.ebuild
index 18bb5a30165..48921bcceb4 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r4.ebuild
@@ -134,13 +134,16 @@ src_prepare() {
 
 	if [[ -n ${PATCH_VER} ]] || [[ ${PV} == *9999 ]] ; then
 		if ! use vanilla; then
+			# We backported a patch in 2.44 but it needed a few
+			# followups. Better to just handle it in 2.45 instead.
+			rm "${WORKDIR}/patch/0007-strip-Add-GCC-LTO-IR-support.patch" \
+				"${WORKDIR}/patch/0008-ld-testsuite-Use-plug_opt-for-plugin-option.patch" \
+				"${WORKDIR}/patch/0009-binutils-Don-t-complain-plugin-with-all-LTO-sections.patch" || die
+
 			einfo "Applying binutils patchset ${patchsetname}"
 			eapply "${WORKDIR}/patch"
 			einfo "Done."
 
-			# This is a fix on top of a patch we backported to 2.44
-			eapply "${FILESDIR}"/${P}-strip-static.patch
-
 			# This is applied conditionally for now just out of caution.
 			# It should be okay on non-prefix systems though. See bug #892549.
 			if is_cross || use prefix; then
@@ -195,6 +198,8 @@ src_configure() {
 
 	# Keep things sane
 	strip-flags
+	# Adds a property which confuses tests (PR33267)
+	filter-flags '-mno-direct-extern-access'
 	use cet && filter-flags -mindirect-branch -mindirect-branch=*
 	use elibc_musl && append-ldflags -Wl,-z,stack-size=2097152
 	lto-guarantee-fat
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44.9999.ebuild
index ec413eb353d..e21b286bb05 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44.9999.ebuild
@@ -19,7 +19,7 @@ IUSE="cet debuginfod doc gprofng hardened multitarget +nls pgo +plugins static-l
 # PATCH_DEV          - Use download URI https://dev.gentoo.org/~{PATCH_DEV}/distfiles/...
 #                      for the patchsets
 
-PATCH_VER=1
+PATCH_VER=4
 PATCH_DEV=dilfridge
 
 if [[ ${PV} == 9999 ]]; then
@@ -134,6 +134,12 @@ src_prepare() {
 
 	if [[ -n ${PATCH_VER} ]] || [[ ${PV} == *9999 ]] ; then
 		if ! use vanilla; then
+			# We backported a patch in 2.44 but it needed a few
+			# followups. Better to just handle it in 2.45 instead.
+			rm "${WORKDIR}/patch/0007-strip-Add-GCC-LTO-IR-support.patch" \
+				"${WORKDIR}/patch/0008-ld-testsuite-Use-plug_opt-for-plugin-option.patch" \
+				"${WORKDIR}/patch/0009-binutils-Don-t-complain-plugin-with-all-LTO-sections.patch" || die
+
 			einfo "Applying binutils patchset ${patchsetname}"
 			eapply "${WORKDIR}/patch"
 			einfo "Done."
@@ -192,6 +198,8 @@ src_configure() {
 
 	# Keep things sane
 	strip-flags
+	# Adds a property which confuses tests (PR33267)
+	filter-flags '-mno-direct-extern-access'
 	use cet && filter-flags -mindirect-branch -mindirect-branch=*
 	use elibc_musl && append-ldflags -Wl,-z,stack-size=2097152
 	lto-guarantee-fat
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.45.9999.ebuild
similarity index 90%
rename from sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.45.9999.ebuild
index 2203fe5beec..43d4bbfea9b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.45.9999.ebuild
@@ -35,7 +35,7 @@ else
 	[[ -z ${PATCH_VER} ]] || SRC_URI="${SRC_URI}
 		https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
 	SLOT=$(ver_cut 1-2)
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 fi
 
 #
@@ -142,7 +142,7 @@ src_prepare() {
 			# It should be okay on non-prefix systems though. See bug #892549.
 			if is_cross || use prefix; then
 				eapply "${FILESDIR}"/binutils-2.40-linker-search-path.patch \
-					   "${FILESDIR}"/binutils-2.41-linker-prefix.patch
+					   "${FILESDIR}"/binutils-2.43-linker-prefix.patch
 			fi
 		fi
 	fi
@@ -192,6 +192,8 @@ src_configure() {
 
 	# Keep things sane
 	strip-flags
+	# Adds a property which confuses tests (PR33267)
+	filter-flags '-mno-direct-extern-access'
 	use cet && filter-flags -mindirect-branch -mindirect-branch=*
 	use elibc_musl && append-ldflags -Wl,-z,stack-size=2097152
 	lto-guarantee-fat
@@ -295,9 +297,9 @@ src_configure() {
 
 		# We can enable this by default in future, but it's brand new
 		# in 2.39 with several bugs:
-		# - Doesn't build on musl (https://sourceware.org/bugzilla/show_bug.cgi?id=29477)
-		# - No man pages (https://sourceware.org/bugzilla/show_bug.cgi?id=29521)
-		# - Broken at runtime without Java (https://sourceware.org/bugzilla/show_bug.cgi?id=29479)
+		# - Doesn't build on musl (https://sourceware.org/PR29477)
+		# - No man pages (https://sourceware.org/PR29521)
+		# - Broken at runtime without Java (https://sourceware.org/PR29479)
 		# - binutils-config (and this ebuild?) needs adaptation first (https://bugs.gentoo.org/865113)
 		$(use_enable gprofng)
 
@@ -311,7 +313,7 @@ src_configure() {
 			# These hardening options are available from 2.39+ but
 			# they unconditionally enable the behaviour even on arches
 			# where e.g. execstacks can't be avoided.
-			# See https://sourceware.org/bugzilla/show_bug.cgi?id=29592.
+			# See https://sourceware.org/PR29592.
 			#
 			# TODO: Get the logic for this fixed upstream so it doesn't
 			# create impossible broken combinations on some arches, like mips.
@@ -526,6 +528,57 @@ src_install() {
 	find "${ED}" -depth -type d -exec rmdir {} + 2>/dev/null
 }
 
+# Simple test to make sure our new binutils isn't completely broken.
+# Skip if this binutils is a cross compiler.
+#
+# If coreutils is built with USE=multicall, some of these files
+# will just be wrapper scripts, not actual ELFs we can test.
+binutils_sanity_check() {
+	pushd "${T}" >/dev/null
+
+	einfo "Last-minute run tests with binutils in ${ED}${BINPATH} ..."
+
+	cat <<-EOF > "${T}"/number.c
+	int get_magic_number() {
+		return 42;
+	}
+	EOF
+
+	cat <<-EOF > "${T}"/test.c
+	#include <stdio.h>
+	int get_magic_number();
+
+	int main() {
+		printf("Hello Gentoo! Your magic number is: %d\n", get_magic_number());
+	}
+	EOF
+
+	local -x LD_LIBRARY_PATH="${ED}${LIBPATH}${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}"
+
+	local opt opt2
+	# TODO: test multilib variants?
+	for opt in '' '-O2' ; do
+		for opt2 in '-static' '-static-pie' '-fno-PIE -no-pie' ; do
+			$(tc-getCC) ${opt} ${opt2} -B"${ED}${BINPATH}" "${T}"/number.c "${T}"/test.c -o "${T}"/test
+			if "${T}"/test | grep -q "Hello Gentoo! Your magic number is: 42" ; then
+				:;
+			else
+				die "Test with '${opt} ${opt2}' failed! Aborting to avoid broken binutils!"
+			fi
+		done
+	done
+
+	popd >/dev/null
+}
+
+pkg_preinst() {
+	[[ -n ${ROOT} ]] && return 0
+	[[ -d ${ED}${BINPATH} ]] || return 0
+	[[ -n ${BOOTSTRAP_RAP} ]] || return 0
+	is_cross && return 0
+	binutils_sanity_check
+}
+
 pkg_postinst() {
 	# Make sure this ${CTARGET} has a binutils version selected
 	[[ -e ${EROOT}/etc/env.d/binutils/config-${CTARGET} ]] && return 0
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.45.ebuild
similarity index 90%
rename from sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r2.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.45.ebuild
index dda92e423ed..a92897aab95 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.45.ebuild
@@ -19,7 +19,7 @@ IUSE="cet debuginfod doc gprofng hardened multitarget +nls pgo +plugins static-l
 # PATCH_DEV          - Use download URI https://dev.gentoo.org/~{PATCH_DEV}/distfiles/...
 #                      for the patchsets
 
-PATCH_VER=4
+PATCH_VER=1
 PATCH_DEV=dilfridge
 
 if [[ ${PV} == 9999 ]]; then
@@ -142,7 +142,7 @@ src_prepare() {
 			# It should be okay on non-prefix systems though. See bug #892549.
 			if is_cross || use prefix; then
 				eapply "${FILESDIR}"/binutils-2.40-linker-search-path.patch \
-					   "${FILESDIR}"/binutils-2.41-linker-prefix.patch
+					   "${FILESDIR}"/binutils-2.43-linker-prefix.patch
 			fi
 		fi
 	fi
@@ -192,6 +192,8 @@ src_configure() {
 
 	# Keep things sane
 	strip-flags
+	# Adds a property which confuses tests (PR33267)
+	filter-flags '-mno-direct-extern-access'
 	use cet && filter-flags -mindirect-branch -mindirect-branch=*
 	use elibc_musl && append-ldflags -Wl,-z,stack-size=2097152
 	lto-guarantee-fat
@@ -295,9 +297,9 @@ src_configure() {
 
 		# We can enable this by default in future, but it's brand new
 		# in 2.39 with several bugs:
-		# - Doesn't build on musl (https://sourceware.org/bugzilla/show_bug.cgi?id=29477)
-		# - No man pages (https://sourceware.org/bugzilla/show_bug.cgi?id=29521)
-		# - Broken at runtime without Java (https://sourceware.org/bugzilla/show_bug.cgi?id=29479)
+		# - Doesn't build on musl (https://sourceware.org/PR29477)
+		# - No man pages (https://sourceware.org/PR29521)
+		# - Broken at runtime without Java (https://sourceware.org/PR29479)
 		# - binutils-config (and this ebuild?) needs adaptation first (https://bugs.gentoo.org/865113)
 		$(use_enable gprofng)
 
@@ -311,7 +313,7 @@ src_configure() {
 			# These hardening options are available from 2.39+ but
 			# they unconditionally enable the behaviour even on arches
 			# where e.g. execstacks can't be avoided.
-			# See https://sourceware.org/bugzilla/show_bug.cgi?id=29592.
+			# See https://sourceware.org/PR29592.
 			#
 			# TODO: Get the logic for this fixed upstream so it doesn't
 			# create impossible broken combinations on some arches, like mips.
@@ -526,6 +528,57 @@ src_install() {
 	find "${ED}" -depth -type d -exec rmdir {} + 2>/dev/null
 }
 
+# Simple test to make sure our new binutils isn't completely broken.
+# Skip if this binutils is a cross compiler.
+#
+# If coreutils is built with USE=multicall, some of these files
+# will just be wrapper scripts, not actual ELFs we can test.
+binutils_sanity_check() {
+	pushd "${T}" >/dev/null
+
+	einfo "Last-minute run tests with binutils in ${ED}${BINPATH} ..."
+
+	cat <<-EOF > "${T}"/number.c
+	int get_magic_number() {
+		return 42;
+	}
+	EOF
+
+	cat <<-EOF > "${T}"/test.c
+	#include <stdio.h>
+	int get_magic_number();
+
+	int main() {
+		printf("Hello Gentoo! Your magic number is: %d\n", get_magic_number());
+	}
+	EOF
+
+	local -x LD_LIBRARY_PATH="${ED}${LIBPATH}${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}"
+
+	local opt opt2
+	# TODO: test multilib variants?
+	for opt in '' '-O2' ; do
+		for opt2 in '-static' '-static-pie' '-fno-PIE -no-pie' ; do
+			$(tc-getCC) ${opt} ${opt2} -B"${ED}${BINPATH}" "${T}"/number.c "${T}"/test.c -o "${T}"/test
+			if "${T}"/test | grep -q "Hello Gentoo! Your magic number is: 42" ; then
+				:;
+			else
+				die "Test with '${opt} ${opt2}' failed! Aborting to avoid broken binutils!"
+			fi
+		done
+	done
+
+	popd >/dev/null
+}
+
+pkg_preinst() {
+	[[ -n ${ROOT} ]] && return 0
+	[[ -d ${ED}${BINPATH} ]] || return 0
+	[[ -n ${BOOTSTRAP_RAP} ]] || return 0
+	is_cross && return 0
+	binutils_sanity_check
+}
+
 pkg_postinst() {
 	# Make sure this ${CTARGET} has a binutils version selected
 	[[ -e ${EROOT}/etc/env.d/binutils/config-${CTARGET} ]] && return 0
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
index 97ab5db61c0..43d4bbfea9b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
@@ -141,7 +141,7 @@ src_prepare() {
 			# This is applied conditionally for now just out of caution.
 			# It should be okay on non-prefix systems though. See bug #892549.
 			if is_cross || use prefix; then
-				eapply "${FILESDIR}"/binutils-2.43-linker-search-path.patch \
+				eapply "${FILESDIR}"/binutils-2.40-linker-search-path.patch \
 					   "${FILESDIR}"/binutils-2.43-linker-prefix.patch
 			fi
 		fi
@@ -192,6 +192,8 @@ src_configure() {
 
 	# Keep things sane
 	strip-flags
+	# Adds a property which confuses tests (PR33267)
+	filter-flags '-mno-direct-extern-access'
 	use cet && filter-flags -mindirect-branch -mindirect-branch=*
 	use elibc_musl && append-ldflags -Wl,-z,stack-size=2097152
 	lto-guarantee-fat
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/files/binutils-2.44-strip-static.patch b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/files/binutils-2.44-strip-static.patch
deleted file mode 100644
index 2e94e96545f..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/files/binutils-2.44-strip-static.patch
+++ /dev/null
@@ -1,155 +0,0 @@
-https://bugs.gentoo.org/957882
-https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=eee822a66066a17529d7af544b1be767517a6c72
-
-From eee822a66066a17529d7af544b1be767517a6c72 Mon Sep 17 00:00:00 2001
-From: "H.J. Lu" <hjl.tools@gmail.com>
-Date: Fri, 13 Jun 2025 08:20:49 +0800
-Subject: [PATCH] objcopy: Correctly check archive element for LTO IR
-
-commit 717a38e9a02109fcbcb18bb2ec3aa251e2ad0a0d
-Author: H.J. Lu <hjl.tools@gmail.com>
-Date:   Sun May 4 05:12:46 2025 +0800
-
-    strip: Add GCC LTO IR support
-
-added:
-
-@@ -3744,6 +3768,12 @@ copy_archive (bfd *ibfd, bfd *obfd, const char
-*output_target,
-     goto cleanup_and_exit;
-   }
-
-+#if BFD_SUPPORTS_PLUGINS
-+      /* Copy LTO IR file as unknown object.  */
-+      if (bfd_plugin_target_p (ibfd->xvec))
-                                ^^^^ A typo, should be this_element.
-+  ok_object = false;
-+      else
-+#endif
-       if (ok_object)
-   {
-     ok = copy_object (this_element, output_element, input_arch);
-
-to check if the archive element is a LTO IR file.  "ibfd" is the archive
-BFD.  "this_element" should be used to check for LTO IR in the archive
-element.  Fix it by replacing "ibfd" with "this_element".
-
-	PR binutils/33078
-	* objcopy.c (copy_archive): Correctly check archive element for
-	LTO IR.
-	* testsuite/binutils-all/objcopy.exp (strip_test_archive): New.
-	Run strip_test_archive.
-
-Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
----
- binutils/objcopy.c                          |  2 +-
- binutils/testsuite/binutils-all/objcopy.exp | 81 +++++++++++++++++++++
- 2 files changed, 82 insertions(+), 1 deletion(-)
-
-diff --git a/binutils/objcopy.c b/binutils/objcopy.c
-index a973789b1d5..366e1079d82 100644
---- a/binutils/objcopy.c
-+++ b/binutils/objcopy.c
-@@ -3770,7 +3770,7 @@ copy_archive (bfd *ibfd, bfd *obfd, const char *output_target,
- 
- #if BFD_SUPPORTS_PLUGINS
-       /* Copy LTO IR file as unknown object.  */
--      if (bfd_plugin_target_p (ibfd->xvec))
-+      if (bfd_plugin_target_p (this_element->xvec))
- 	ok_object = false;
-       else
- #endif
-diff --git a/binutils/testsuite/binutils-all/objcopy.exp b/binutils/testsuite/binutils-all/objcopy.exp
-index cf94570642c..6aa6d2d9fe7 100644
---- a/binutils/testsuite/binutils-all/objcopy.exp
-+++ b/binutils/testsuite/binutils-all/objcopy.exp
-@@ -661,6 +661,87 @@ proc strip_test_with_saving_a_symbol { } {
- 
- strip_test_with_saving_a_symbol
- 
-+# Test stripping an archive.
-+
-+proc strip_test_archive { } {
-+    global AR
-+    global CC
-+    global STRIP
-+    global srcdir
-+    global subdir
-+
-+    set test "strip -g on archive"
-+
-+    if { [target_compile $srcdir/$subdir/testprog.c tmpdir/testprog.o object debug] != "" } {
-+	untested $test
-+	return
-+    }
-+
-+    set stripobjfile tmpdir/striptestprog.o
-+    set stripobjarchive testprog.o
-+    if [is_remote host] {
-+	set archive libstrip.a
-+	set objfile [remote_download host tmpdir/testprog.o]
-+	remote_file host delete $archive
-+	remote_file host delete $stripobjfile
-+	remote_file host delete $stripobjarchive
-+    } else {
-+	set archive tmpdir/libstrip.a
-+	set objfile tmpdir/testprog.o
-+	remote_file build delete $stripobjfile
-+	remote_file build delete $stripobjarchive
-+    }
-+
-+    remote_file build delete tmpdir/libstrip.a
-+
-+    set exec_output [binutils_run $STRIP "-g -o $stripobjfile $objfile"]
-+    set exec_output [prune_warnings $exec_output]
-+    if ![string equal "" $exec_output] {
-+	fail $test
-+	return
-+    }
-+
-+    set exec_output [binutils_run $AR "rc $archive ${objfile}"]
-+    set exec_output [prune_warnings $exec_output]
-+    if ![string equal "" $exec_output] {
-+	fail $test
-+	return
-+    }
-+
-+    set exec_output [binutils_run $STRIP "-g $archive"]
-+    set exec_output [prune_warnings $exec_output]
-+    if ![string equal "" $exec_output] {
-+	fail $test
-+	return
-+    }
-+
-+    set exec_output [binutils_run $AR "x $archive"]
-+    set exec_output [prune_warnings $exec_output]
-+    if ![string equal "" $exec_output] {
-+	fail $test
-+	return
-+    }
-+
-+    if [is_remote host] {
-+	set stripobjfile [remote_download host $stripobjfile]
-+	set stripobjarchive [remote_download host $stripobjarchive]
-+    }
-+
-+    send_log "cmp $stripobjarchive $stripobjfile\n"
-+    verbose "cmp $stripobjarchive $stripobjfile"
-+    set status [remote_exec build cmp "$stripobjarchive $stripobjfile"]
-+    set exec_output [lindex $status 1]
-+    set exec_output [prune_warnings $exec_output]
-+
-+    if [string equal "" $exec_output] then {
-+	pass $test
-+    } else {
-+	fail $test
-+    }
-+}
-+
-+strip_test_archive
-+
- # Build a final executable.
- 
- set exe [exeext]
--- 
-2.43.5

From c54ef47ed2864a799da6cec3df1ffeea585e01ac Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:16:03 +0000
Subject: [PATCH 100/122] sys-devel/crossdev: Sync with Gentoo

It's from Gentoo commit 7d0fb1a5ef02c02ec06d9dad0d6fc31d69aa2595.
---
 .../portage-stable/sys-devel/crossdev/crossdev-20250622.ebuild  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250622.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250622.ebuild
index 5494e3601b7..450f5772eaa 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250622.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250622.ebuild
@@ -13,7 +13,7 @@ if [[ ${PV} == "99999999" ]] ; then
 	"
 else
 	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
 fi
 
 DESCRIPTION="Gentoo Cross-toolchain generator"

From a3d8480a46205e1e2e399cd0291b291e401db943 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:16:03 +0000
Subject: [PATCH 101/122] sys-devel/gcc: Sync with Gentoo

It's from Gentoo commit 13a68f631d18c682d6acc3dd82ae00b1fd4e8855.
---
 .../portage-stable/sys-devel/gcc/Manifest     |  46 +++--
 ...gcc-16.0.0_p20250706-PR120358-qt-pta.patch |  47 -----
 ...0_p20250706-PR120949-clang-algorithm.patch | 166 ------------------
 .../sys-devel/gcc/gcc-10.5.0.ebuild           |   2 +-
 .../sys-devel/gcc/gcc-11.5.0.ebuild           |   2 +-
 .../sys-devel/gcc/gcc-12.4.1_p20250704.ebuild |  69 --------
 .../sys-devel/gcc/gcc-12.5.0.ebuild           |   2 +-
 .../sys-devel/gcc/gcc-13.4.1_p20250703.ebuild |  69 --------
 ...710.ebuild => gcc-13.4.1_p20250807.ebuild} |   4 +-
 ...717.ebuild => gcc-13.4.1_p20250814.ebuild} |   2 +-
 ...704.ebuild => gcc-14.3.1_p20250801.ebuild} |   4 +-
 ...711.ebuild => gcc-14.3.1_p20250808.ebuild} |   2 +-
 ...718.ebuild => gcc-14.3.1_p20250815.ebuild} |   2 +-
 .../sys-devel/gcc/gcc-15.1.0.ebuild           |  56 ------
 ..._p20250705-r1.ebuild => gcc-15.2.0.ebuild} |   2 +-
 ...712.ebuild => gcc-15.2.1_p20250809.ebuild} |   2 +-
 ...719.ebuild => gcc-15.2.1_p20250816.ebuild} |   2 +-
 ...-15.1.9999.ebuild => gcc-15.3.9999.ebuild} |   0
 ...713.ebuild => gcc-16.0.0_p20250803.ebuild} |   2 +-
 ...720.ebuild => gcc-16.0.0_p20250810.ebuild} |   2 +-
 ...-r1.ebuild => gcc-16.0.0_p20250817.ebuild} |   4 +-
 .../sys-devel/gcc/gcc-8.5.0-r2.ebuild         |   2 +-
 .../sys-devel/gcc/gcc-9.5.0.ebuild            |   2 +-
 .../portage-stable/sys-devel/gcc/metadata.xml |  10 +-
 24 files changed, 48 insertions(+), 453 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-16.0.0_p20250706-PR120358-qt-pta.patch
 delete mode 100644 sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-16.0.0_p20250706-PR120949-clang-algorithm.patch
 delete mode 100644 sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250704.ebuild
 delete mode 100644 sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250703.ebuild
 rename sdk_container/src/third_party/portage-stable/sys-devel/gcc/{gcc-13.4.1_p20250710.ebuild => gcc-13.4.1_p20250807.ebuild} (93%)
 rename sdk_container/src/third_party/portage-stable/sys-devel/gcc/{gcc-13.4.1_p20250717.ebuild => gcc-13.4.1_p20250814.ebuild} (99%)
 rename sdk_container/src/third_party/portage-stable/sys-devel/gcc/{gcc-14.3.1_p20250704.ebuild => gcc-14.3.1_p20250801.ebuild} (93%)
 rename sdk_container/src/third_party/portage-stable/sys-devel/gcc/{gcc-14.3.1_p20250711.ebuild => gcc-14.3.1_p20250808.ebuild} (99%)
 rename sdk_container/src/third_party/portage-stable/sys-devel/gcc/{gcc-14.3.1_p20250718.ebuild => gcc-14.3.1_p20250815.ebuild} (99%)
 delete mode 100644 sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.0.ebuild
 rename sdk_container/src/third_party/portage-stable/sys-devel/gcc/{gcc-15.1.1_p20250705-r1.ebuild => gcc-15.2.0.ebuild} (99%)
 rename sdk_container/src/third_party/portage-stable/sys-devel/gcc/{gcc-15.1.1_p20250712.ebuild => gcc-15.2.1_p20250809.ebuild} (99%)
 rename sdk_container/src/third_party/portage-stable/sys-devel/gcc/{gcc-15.1.1_p20250719.ebuild => gcc-15.2.1_p20250816.ebuild} (99%)
 rename sdk_container/src/third_party/portage-stable/sys-devel/gcc/{gcc-15.1.9999.ebuild => gcc-15.3.9999.ebuild} (100%)
 rename sdk_container/src/third_party/portage-stable/sys-devel/gcc/{gcc-16.0.0_p20250713.ebuild => gcc-16.0.0_p20250803.ebuild} (99%)
 rename sdk_container/src/third_party/portage-stable/sys-devel/gcc/{gcc-16.0.0_p20250720.ebuild => gcc-16.0.0_p20250810.ebuild} (99%)
 rename sdk_container/src/third_party/portage-stable/sys-devel/gcc/{gcc-16.0.0_p20250706-r1.ebuild => gcc-16.0.0_p20250817.ebuild} (92%)

diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
index 1b3e248ea39..506d67ced27 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
@@ -1,51 +1,47 @@
 DIST gcc-10.5.0-musl-patches-2.tar.xz 3452 BLAKE2B 5387e516d07d81477b3f39b8b3bd986bf861d32cd25dc5481c97bd3620d00c918c5661e86857f66dbf28a655401a53e43417f638c443e44cbfdbf5e950caac4d SHA512 86f2ce31cc4fc4fb5a6043fb527bf822d895e1a6220652024f78a1cbd5a962edb6be8dc5f43c32053e075f39bb2350ea8f14e7d57e0473dd2933a7b44676bde5
-DIST gcc-10.5.0-patches-6.tar.xz 18208 BLAKE2B 4cac3340108fb378c76ad62b728429f3c97f348d178744e7536575f3576ca8aa682b878b7df3b1c162dccae64a3cb56c66d8d60eae323e1ece2de4278084fdbd SHA512 9d6c84325fbc118cee01347468ce729c278e5b026b16da945fe54050726e26f86a46ee7b71a01a47cf927b70bfcce459c49a6bc4fb93dcfaa047c76d4c5bc5bc
+DIST gcc-10.5.0-patches-7.tar.xz 19600 BLAKE2B b3b168b76ca320f3d2469cff4521554264c45b5bc8e1e1509c53d5ac890233ca6c6a1da8c769d5ef387b524bad905cace4f05d6cd5a13d20a792b425710f0a68 SHA512 96eea70a487ef5648956aea136b0fa82bd88bea1b3ccfcc9b5735da1036e3fe0b3663edb09bbae4c53ddd84466695c70f04a5f8609cb8317a5bc1e91f04add63
 DIST gcc-10.5.0.tar.xz 77846412 BLAKE2B 9b71761f4015649514677784443886e59733ac3845f7dfaa4343f46327d36c08c403c444b9e492b870ac0b3f2e3568f972b7700a0ef05a497fb4066079b3143b SHA512 d86dbc18b978771531f4039465e7eb7c19845bf607dc513c97abf8e45ffe1086a99d98f83dfb7b37204af22431574186de9d5ff80c8c3c3a98dbe3983195bffd
 DIST gcc-11.5.0-musl-patches-3.tar.xz 4232 BLAKE2B 414e1b7e42cf50012d2d2513fc70f1fd41771f28ee3061fd0ea34e8c5d9ba09f2dc7ccc56ab5cd9fe494ce7a1f57cebf3d208bedbe5f6053a08909267a3d9b9f SHA512 02889bb0b5a80dfd2cf48343598d38b4e4e8e179164697265baefb4acc1cadeac6a1e64d90cc0ef0b5473524cfcd36e6d94c0a15d91ea45d8fb6e3e41c7b4cd9
-DIST gcc-11.5.0-patches-1.tar.xz 13664 BLAKE2B 64fd9c2d074aca58ecd8c0035ccf2d2b84d83b93b46367f3e068a95651a094a07b9aad7635bb9c7d2e5ea20dc5957bc19217ca32cbd6cf6f0344f4a3d943a60a SHA512 55828751008575fe89760a224477ee9e5132c0780fbe232e0b80b16ecd9854f85ae54bdcd216ae04de67f3a8b417ee2aad4f8bf9d9df5318613d3efb55bd92df
+DIST gcc-11.5.0-patches-2.tar.xz 14372 BLAKE2B f8e032c9f016f636f20f014a8d6c70ea6fa8620fb6022351a44750c00288d78c6bfe565d19468f172ae7fc66c49eacf8448f028679fc36aaa6f63551faf47391 SHA512 c02c3c78896c4a700670240c6e2765c58abec20d6c2d9f7abfa10b17958193d69b9f81b48544923960de42b0ce9c0a71738574a2462c96589d1c821b0e49b7b5
 DIST gcc-11.5.0.tar.xz 82399864 BLAKE2B f4a61faad32aac9e9cb553c1a1a011df0a057f6e2cac92a13cc7e285d08191dd4a117f41a8faac2359c0e2a16f954c7fef354dda9df8c63bff1c5cefda82602c SHA512 88f17d5a5e69eeb53aaf0a9bc9daab1c4e501d145b388c5485ebeb2cc36178fbb2d3e49ebef4a8c007a05e88471a06b97cf9b08870478249f77fbfa3d4abd9a8
 DIST gcc-12-20250528.tar.xz 79942548 BLAKE2B 3c500796a34ccd863da451de4084cc90d404c9b8d41caccde11a840bc25cf949669ea9b4d4ae58899962aeb37e14ec947068238787a0019bbf22e62135a001ca SHA512 aa4e0583b308b8ada43c209edee54f97606683e1e7dad8e0250a6c77591e8cb2520258973822a91f3a45261a46a0b2e3783214ae6e004eed90cdf3a2faec479c
 DIST gcc-12.4.0-musl-patches-1.tar.xz 3068 BLAKE2B e5e39c24934072ea89e4467d0dc5196f3dadfb5ffba0c856d051648a2fbf57d434a57e95227cdf2b8cea45f0f5555aec2bc372d2f6cb0b69efd87831d248d364 SHA512 b9db204845a25be043d76cae826d42eebeeb4f9be7c3049af6fe7601a552bedfd24731156a6a36b4b5e2e2af656a589a5c556d2b0b3ded33ba290a773ee87c62
 DIST gcc-12.4.0-musl-patches-3.tar.xz 3480 BLAKE2B ef230799427c10455b33e36fab1d8df4bb20d0964ca2ba05e0caaefae044ad57473eaa0bfdd499fb0eebde7f870abd9c94b04bd1234a2f4c01fe329dab25ffdb SHA512 b10c061aa135c568e404d23e3f7f14a28bb7d14cd9a5d6a60b13b93a53d7f1d4180c027326754adf3ef1aafb87758371d276435b324c41eac64440619d32922a
 DIST gcc-12.4.0-patches-3.tar.xz 14140 BLAKE2B cc73805b2c1f9f6a8d96b2a31d79ce0034ebc3ef1976e78e8ec4f2649c33cef48acee943773de5e03b891128f37e4d72c07d7f4c0bd6d473e484a4b6a9df9f25 SHA512 a93c6bc7d2bd1d7b80bfc6b16c042ac6d3cb6e15cada16041baa48b8023d857b4a1557f4620c46646136daece6566655523010366411aa9fad671398efb03b6f
-DIST gcc-12.5.0-RC-20250704.tar.xz 86030356 BLAKE2B 640429aac8340ca738ec84bc4eee24c1d2087927c81b7152c2a40fc083dd427ddcb7a639302ab851b5bdb4ac2edf22929bfd9c405ae1a3bc8bffdd7a2d50f415 SHA512 8b14e76acb5ccb20dd0d3480244e866e87dcf7fd92528679956e3b84470cc0e9c5e21f2f39139272a4a43a88536a4a07496a127cfb41cefd92195812c3aae858
+DIST gcc-12.4.0-patches-4.tar.xz 15648 BLAKE2B eec4a40233d396ef4d22901cd06b75a78800531e0c6f3d7d765b0b4ba0bbcf7d966112cfc73289245f209a931432c9d7c276c636c8c19ae79cfbf9b6d4a8fa17 SHA512 fb5d5a0433480dca0752e50448f9d2608c8df8579d9963a31bab15379e14cbc1ff2fcd37da8601b536b219f7b6b4f0364bc2cc8de07cbf468e81aae12910f862
 DIST gcc-12.5.0.tar.xz 85897368 BLAKE2B df2f87b407c5572d3590e9868a7597b98bc913669054e517fb2eb9ed82f635df6735a5cab0eab30ebec694e39e552806d837233f0ffe02aa90f5d8b61352c34f SHA512 c76020e4c844b53485502cb8a4e295221c9d37487d66c9f4559031fb14c85de20602e6387310005386cb0ef25e55067d2cfef141423bb445f3b77e7456a23533
 DIST gcc-13-20241220.tar.xz 84504500 BLAKE2B 60d6dcdcafa36399a0c0de7fef3a4eb4ca8e0b6780cd31c9eace2965c53115205bf64e8247b833a4375c1e3ad2d94820b5bdc97a4689be95d8ab55a676afa689 SHA512 10fe009dc3b8872b24350e4fb999f71b848bd5a03e48e8292f76e6eca3dbdef8383a3b13b813aada983ebdbe3ecab1642961b3210cd1e0063a86655a44493017
-DIST gcc-13-20250703.tar.xz 84586348 BLAKE2B 767826f6d4ab9ee1e2b7558ff7e32f5bf409e07283b7a103d42324f0df002a54d3e23066119fd85a30c0abc45bd108c8b63dfadf573b221fe9c3557f4998ec42 SHA512 518aaaec32bb381c4827f1984a87cd057980e0453aaa4b6083102548ec2d7fd9904c7b3a7b2e97bee4f771d46b9a79dc9b49eac5c9074f237d5779b5eaa59c85
-DIST gcc-13-20250710.tar.xz 84582400 BLAKE2B a5979c99d12f17b01dafde95a21490b74392e8fc17f12dddcb77ad883cb93928ef05a459303ed2ef2942fced560722d49ac657f34dee35546c8bfaa8a1e9c9e4 SHA512 0b831bed87e81edf95fab0905ed9209fcfd165881063ed43110a0be23696f6d3bc3199cc6ebfc60d3fe97ff6475512e7b1eb177d7e4949c39971cc69e4a14a2b
-DIST gcc-13-20250717.tar.xz 84570152 BLAKE2B 2f1c1602deaf34262a890d8eb65ae014be8c62bb2c088140a059b8ea0b0d1349a4d38d71babb319a4491215d8a485f8b2c0ada5f2b85b4f5c0c0b87f63907cc3 SHA512 a0fb8e81509889ce14add8656aafd4ce507ca1a201508cb189ddacca1840f91abc7c04fcf97ad2c64b4c98bc42543acc5693c351c502c8d35bcb7374601d527b
+DIST gcc-13-20250807.tar.xz 84575936 BLAKE2B cac8022c6c6d31fa1d741589b9a7c7fd60eb5fb9b44921b1be8beec1bed5846f769ecbdbd7950ed4de23de69c553b22944038edd92f0e76dc24154720a21f015 SHA512 2d5b59e2e18c02d49d8adadb3c62a45700016828a3dd170c276bfccebb6d15e05cf494fa523447a38e04e6b963c35467c8fb6a699da7cd39bb319f639cd9bf56
+DIST gcc-13-20250814.tar.xz 84576520 BLAKE2B d07de84e4b3b14f2a4dae355610ece06fce1cf2cd81cf26adc611b8c20732fb9aa2d3722b58172701adc00a7c0f5a9245991e387d8536857ea8407edab7ede04 SHA512 be51f594f953e422814c8680a64ca03656d4258b96d7129ef5d63a9bf9936ee2cee2736e4bb3592d8a9c573189e7cacdc29e1afc4bf3fe2565416027463ec6c7
 DIST gcc-13.2.0-musl-patches-2.tar.xz 5292 BLAKE2B c057d6574d03c05854edaa9f3fd40e9149662b04f3ac7a7db3eb078d73a7b535726d1bf52e5b12736dedb2f9898ad731f2e48a6421fcfbf7b90f929dee072fcb SHA512 a691da0c87c443a5e9d23731f4005f27871c5b12bc9102873ffa24d374aa7b9fbd187c4f5635d23fa9ffb17e351e76173c2d3fdf40646e355c4cb314b538de69
 DIST gcc-13.2.0-patches-3.tar.xz 30956 BLAKE2B 29ce043b46645640ca1e983397af3e158588ad87575f0bc59451ea4a7dd5e3bb5b190ed031de6a22cd790d423ba111e95d222187dd09985dceb12db9f0a2d907 SHA512 4ffecae7be320124ad0c4e71e39e142b7aa8db0e70b5f486f491d7a33ea31efc6464c6abeea77df02a8bd5cf81f08225d625c8af5c27f9afa32c0d7d989f7a3c
 DIST gcc-13.2.0.tar.xz 87858592 BLAKE2B 0034b29d3d6cc05821f0c4253ce077805943aff7b370729dd203bda57d89c107edd657eeddc2fb1e69ea15c7b0323b961f46516c7f4af89a3ccf7fea84701be2 SHA512 d99e4826a70db04504467e349e9fbaedaa5870766cda7c5cab50cdebedc4be755ebca5b789e1232a34a20be1a0b60097de9280efe47bdb71c73251e30b0862a2
 DIST gcc-13.3.0-musl-patches-2.tar.xz 5176 BLAKE2B ab84c6f29cabb72d2f0cf477e6e8aa4450ffdee7fae59b0e66cbdd8c82b3046306b4aa3d5412d3fdb21362547f2f42e5acecc08c08f8acabf68b983898e8267c SHA512 01c92db81e7f757446516fd5544e134b4a7d6379af2d471efa50112fe38a7fb7dc3389b0a580f7f0fa418267e903824ddd8421772e6dc8f39b80c274bcc1d37e
 DIST gcc-13.3.0-patches-2.tar.xz 44440 BLAKE2B ebde73f6c3cd1a5fdc5bbce36414a59dda0925cba9d422d3689fc9c14fece44ee2391982a674411aa99bf47ffd49200f3ce51cc908beb8298adfff78e709a84c SHA512 eb56e0d7e69b5c3cca21f4cbff21c1204cf64ede7e66d689f45cf5ff37de8a59f24eb1f4b30d9c4222fd4126654fe4ffc146851f504761014995553c1202e8fd
 DIST gcc-13.3.0-patches-5.tar.xz 52820 BLAKE2B 73759dc576aab9e5f66dc7f9a1e8eb1b79a98bdb85bfdac9d611baa82c85a5f433d5031876c6e0ee2f02dd1d874da1661b0dd0f05906b118502f17bfaf16eb1a SHA512 4e6b626a562657f2d928324b412d5033464c09d283ad3a2ebfebbb5245bffb09c2532318325c4c16f4206df5cede6758fe1031c55e64dfb9b9ea08ef2c1e90af
+DIST gcc-13.3.0-patches-8.tar.xz 57472 BLAKE2B 85976f7313340ce7a2cd9e7fa67e6d69ca377741d435d113148d2b9083ce99ea720ecd0658149300c16a67ef368fcc8893756b86fcce31ba7ca899d509cbb2c9 SHA512 fd70e1309e4c8d321a81be1a228358db00369d1bd3e5d1fc6405c408b95494230cf70004cf1702e8c1e594f028aa35ffa67059f8f91a32699c69ff0de105e06a
 DIST gcc-13.4.0.tar.xz 88530720 BLAKE2B abbba220652d6e84c59554e754207be91d1250d7751c09163e3166a9da8c7eb4d538785697bb3aea65a8a433e8b82f9a969cf09bb0ecc5aa4a27c964f0acd7e8 SHA512 9b4b83ecf51ef355b868608b8d257b2fa435c06d2719cb86657a7c2c2a0828ff4ce04e9bac1055bbcad8ed5b4da524cafaef654785e23a50233d95d89201e35f
-DIST gcc-14-20250704.tar.xz 88301340 BLAKE2B db43d299aec1e402703db5c63a296065cdfdc94065ac3609c16e6594e80aae08e23448ef2405ade23c3d5fd38d2b79851b243807744f5b4f37eab71a0f526718 SHA512 7362674f80be46aa524a99b04a7d8130f02459a5d7bed430fe0dbf4d8ee3affe397c0689ba4d2ea60ad099788518da0ba1cba5bd54ddeb7b23d96137e6552f68
-DIST gcc-14-20250711.tar.xz 88322532 BLAKE2B 4d1b4a750125787d673d18ba3ce702c33f4c7b6836185c8942a4528ab7030ccc69c914b64bdead1d9c3baea857a806e490245d06c0ea5e06726de37681fa26ef SHA512 74ee2eafb543d1e9b77397d499939e3846a253ebc8015596bdf79e98038598751f21df21f8f1f675a90c3ebb844142f43ca2255cf0a0d3d2d1c51bc1cbb40062
-DIST gcc-14-20250718.tar.xz 88311396 BLAKE2B 7be5f5d27eb7311d496cee780ae40c18957a96b6301cbfa6c93d89687d9baba24a393acc86554252d655f7c1c2516fe37593db5b5bdc4cf9f65b5f6f8a21659a SHA512 2371880b7ceaf56ff8bd0819ea09017b5852d80f7496f81b1554d052114a945cc484d32026830fedccc27f6f60a9f8a521d756ca0b5884a8aca88b47c520726a
+DIST gcc-14-20250801.tar.xz 88323948 BLAKE2B 1d47af7340faeed133a1d55bed8a788e4a7e0d12741d80a4345053fae1e95aa57ba4a24361c130080539242e5e5a7f2076827fdd3f2be383ad8d739443c3c885 SHA512 4034c9cfc0eb64239fc2149709d2d9d5055cd11ee5ea2284c61ed3d230f812bc1d8899ead339940b579610b65e1939eaf8ec05a2e26a50cb2c2c5a802a3437ff
+DIST gcc-14-20250808.tar.xz 88335256 BLAKE2B 9d4a88792c4d37748fbd93c059bf88bf654c4507bcd75497c573b0792dd24ebff752f3fd7b529abcbbbbfa42d87b090f20121fd12da79c2619b616d9edc3525c SHA512 6a484676df0e3c87b418014608c34caa68bfbbd3d32f0d6a261f326344d9d34ef210b5799ac26aa7a7a8308b28e6a91b2fc4d99add31bb9f20c3d8eae461ac07
+DIST gcc-14-20250815.tar.xz 88321100 BLAKE2B 579957ae47142c4468ca19ad6c469c40df0a236fe6d53a8962f47a34b23f0bcc35466b4c78d373ea90a3d79c3e4c3dc2a8f69cd2a9587b6a001385d0882d85f0 SHA512 a523d6c51eafdc0d66ced7167a9e34522ace446103bce0bdbc8fa6e58bb0266156ae6cc5ffd0e8b03e32acd379d63c1580fe3948076fdf62b0a3d1924e17cb9e
 DIST gcc-14.1.0-musl-patches-1.tar.xz 3600 BLAKE2B 4cd920b7ca1f122cae806707564d8e45bfd48e78c88788a12a301f6068b5a5f335d8885e67479ac536c66aeaa81f2ecb7240ae56e9fc821a7246ab66b453711f SHA512 61c48d90a55dfc2129d96aee69d939d6a89f6407f69f7bd12c1a619f28989f471fd219d731958f8e62b0fd650c32300f0ad8dc06d5df23d9fc8c1a77fe210c25
 DIST gcc-14.2.0-patches-8.tar.xz 14540 BLAKE2B 09f66035343d4cab694b8ab382170f8e2d546ddffedf3477f26edbd6a798ddf94294f569c2661729d40088d590bc17a4eb651710d8d9f66f33703734a1a82b67 SHA512 7a9a2724ef8db3c57b033d90751192969c16e5eaa8f4777b7f16470222ff3a18771b461bd89feaad701e7f0d573b883b487981588129933c732fb76117728b86
 DIST gcc-14.3.0-musl-patches-1.tar.xz 3468 BLAKE2B c576bc2b2c2ce742395ff32451a6a0737bc35ba02109f39249c449840e9cfda6ae709293b04e17ba85c9edc529114f7d77fe55f2ef559020af391c90885df054 SHA512 8b964188ac5cea5fe5ada35871268d836c4d4805affa8a06e43cc32c9a2c5386bf5eff2971ba311678eaa08885854aeda627dd15d292e67154c7691ce6fce49c
-DIST gcc-14.3.0-patches-1.tar.xz 14436 BLAKE2B a4679f87c67d4347a40e86a94f8a754e462a21761bb27494ccfce1d6bdd3a45bbeea64abed86a3ea1a116eab9a4d6e4faac9cba44fa0080e545a2a804e4921e7 SHA512 7d50eb5903f726b6a4f3179e88538583c0ad3ea32f9c49c0ef8ede0dbb2f3146e27ca7dd2d969a28e24550932843df6721bb465f0fcb26ba02def11c6136eaac
+DIST gcc-14.3.0-patches-4.tar.xz 28116 BLAKE2B 5804f10b40befad1cb9eab4e536377c08aed8c54d3de27f188ae2d52fa7c082a529ad9cb64f9574087afe74e64138c9fc918d653bd2c1d062b8b68d5c7ab640d SHA512 75ee4895efea0131107cf664a0f9fd10f38da0d0f93704e1920778e07f1a860d872a97e1e528f8e1ab754cca25948bb09c444b80cc04f5ae3a516336290bb99c
 DIST gcc-14.3.0.tar.xz 95212220 BLAKE2B 11c0e549b2e9b4bbbe4cd64782032d2ec783b3db8d4aa538ebd0a0c9760d8e521c32007891a608b081bc6dd353d4eb23030c5e2b9fe9a20c4894a8455dde47b6 SHA512 cb4e3259640721bbd275c723fe4df53d12f9b1673afb3db274c22c6aa457865dccf2d6ea20b4fd4c591f6152e6d4b87516c402015900f06ce9d43af66d3b7a93
-DIST gcc-15-20250705.tar.xz 92140172 BLAKE2B ac66bdda7beccab8b5b5565852e7f9743ba6f1cdeaa8ca7d15b14369251a0b592f92714c8c12e05df7d52d296a15843fe3301906e7e3c3574483be1e5485ffce SHA512 4a7304ed4ada55f5d37c191627de9f62e86c0a374987a3cdf43695ef436ab3eeeb7a143e5a11c3e5cac01c8c23c035f126d0c0a10dfd7686c8ec537dde61b9eb
-DIST gcc-15-20250712.tar.xz 92149428 BLAKE2B 106c53ed9bf68db9a637b4b59f1d7a7f4660f34eeaeb4839b7de005aef1ded893e9c62500a08d904402fa1c42d3ef2b1768a57717449984c752c2c4f939722c1 SHA512 122246196599b2ba4597a69ef733e2b36ed2a8fa757ed35eb9147e1ab3e62ec3fa5c8251aa0c4d5ba46cc9e44b7bc4072518bbd61820ba6df1acd9ab3d56c0fe
-DIST gcc-15-20250719.tar.xz 92169656 BLAKE2B 3b1e5ece557dee26830e080ab4add846b451da80b2d697c67aab93dbd168f83b56e2063b7ca74e4c2999cfd642ea5010a09f8bd1f37e93e2da17b5f5b0eff94d SHA512 a5e0082e492502385565479201bca3e9f5138a55d83540bff8b84a94d958c4d2afce474328656ee7d55fad910c04523c0068efe92382e68a327a65f6e641b88a
+DIST gcc-15-20250809.tar.xz 92336288 BLAKE2B 7b744d92a4ec23083c96e2a6e77df4e7f655e1d9ed55ebc5748c10177351f770ae7df5d78dd828173fd8498cf889de18d99cb7335a0bf38e008a4863cbc1cc70 SHA512 849cb5d2c8c0612f69c90f1662654028ebc0ceab738d707c4ef963063d7de7dd37fb70bd1a7a3275401105a604cbbdebfe0ee5855b8d3881dbd457002eadb38a
+DIST gcc-15-20250816.tar.xz 92325240 BLAKE2B a4f5bc9b6294dff8e11b89b5d23ee3bfcee945b238a36c5c20efebf36385be609fdf986877c8c710077a44ec6e775102ccc52bf8e50b6e74b7bbd017df993a03 SHA512 882b80ce2d1890b29d105e08a7af5af6d8cf1a5a9ea59c75860b05f45b5d8271a8584c951708356f53a2808010f47c39beeb74d7ef72c3f590ea8dfe0987c45e
 DIST gcc-15.1.0-musl-patches-1.tar.xz 3036 BLAKE2B f7e8b794feb3c30252dd3e35b990c8a134d337e285a2778ad5575b04667cf01040bf4187252151cd57097cd6d440851843156c9631736f4f065ca8b7ce2f0678 SHA512 4d3f1660d89484f63ad6c238884415673cdfdabb8833cce2fe114193b52f11b3518b034881024527f6553de93936d15ed707d4d2b1e8221908a08ec67810464b
-DIST gcc-15.1.0-patches-1.tar.xz 18628 BLAKE2B ee5fc9d6a06374ccc8d85cd1e269514fde8fed9b1810867a199ac747c09fc166e11e54ba531d42ee2ffbab3ca80277f9ad3c873fbaa3530ff60e5f2bc25c41ba SHA512 72992f0698f632c98abd6d8c7a7a38a109b2f064775a0c5029e44dc29cd88ae061cddd603d47eabced5af5f8571e0b73c9778080873c69dd4dc4766c60339b28
-DIST gcc-15.1.0-patches-2.tar.xz 19340 BLAKE2B ea8be3f2a79cfbc69583dd7b96590ebfb74a3ccb90a5f36700c66369c44b349d69f5e9903d83e1db1807dcbe77e6fd46221964c52fd0a594e6853c6e01d638f0 SHA512 954ddca48ebe44e1e93bf938b493d347592a4a0cb255a980a893cf5ff5378c6ac333389f0fcdff6fa4cefbd40212f0a32c64cdefc9e9874df44a2db904fdc5f6
-DIST gcc-15.1.0-patches-3.tar.xz 18664 BLAKE2B 8b6c04bb011122a8a748e8c6de59d5d4998bc02cc02667a48b3d7754721bf59d22bb3e31ab07c7ab26ece2f2ad3d7bcd319c84d58d0361ae6621bed6bebc53a0 SHA512 3c6d79449f44f9229ef0b5994933fdaece97eb78dd6c6497d6277ea34e5f02af7ce60902c452d0ce9db8d560e73703e7f32becf35a822dd6ac46496711969287
-DIST gcc-15.1.0.tar.xz 98268344 BLAKE2B a902ce99db4e93615879e435bcd0b96d5a16ea0af42598ca0e6d12913b2ce3651a98574c3264b2717b848e6b5a823b403ccca0adde463938d5b41aa3f1da0d34 SHA512 ddd35ca6c653dffa88f7c7ef9ee4cd806e156e0f3b30f4d63e75a8363361285cd566ee73127734cde6a934611de815bee3e32e24bfd2e0ab9f7ff35c929821c1
-DIST gcc-16-20250706.tar.xz 94122820 BLAKE2B ec48e2eef32aa2dfebff8264b943f344f8e06d6f2175ba75850a14d5019060800cfc94984ea7649483661c62818210259a22d0e33e60bfb32db02d372ce6b12a SHA512 a194f808ce19b66dc0786b62e23bc75e29e3d79779b2176c0f7e8bda564d937e2f0e83fb2337d3b8b5230bb22d1a053b371276418fd537d7ccc9e5242496037c
-DIST gcc-16-20250713.tar.xz 94187924 BLAKE2B 72381c90481e854f90358f98be3d3face062bbb9627c0a8810e8d8c325974abaa651396d20e249f6133b6fbae09bac2c521349809532160ecf9a545c422e9a62 SHA512 a76965f94b59eb931215ed763df44dc1e91683711b704b5b375ecddfda8c23c0d33b932788580de430040ccf58b3db193ebbe0a0ef6dd23391b15edebd043dc1
-DIST gcc-16-20250720.tar.xz 94259592 BLAKE2B bbfb90cd4ce556fdfde1bd80eb1255b57ef986b6c545d8a54a18e4868f5d25a299b0d39267d364b5ca267613d50bbcd432f507948db5a970cfd3d019eb3c3712 SHA512 91548580191b645a9b322bc1559d20ca81e70361b8ac2e5a4abf09fc03681c169c5846a22f149b9ff035301ff2ed1999d883a85c080a5e4319d1754657df0a72
+DIST gcc-15.1.0-patches-5.tar.xz 17476 BLAKE2B 82d08ac11358d9199989a5ee5a9327a6beab07ac309ae024125f0c1bf9a120ed0799bc15730b099aa631166735151bbd5385aa0fdc68958b3e97ee0379764036 SHA512 e218ba883a6be70a4b0a8e987b2b2e165ebc9bf9c295b15399710ed295ca4ea86372b18c3a87e227ef287642c6edbda0d0f9e769ab6c5bbd5975c2d8597deb90
+DIST gcc-15.2.0.tar.xz 101056276 BLAKE2B e270320978ca690e6e8f5ef06414dc13caf561f16403a3783c76fbf3dcee57e755a2d5bba922bf7fcae0bb6120443755d819b003791ae823d54589dd799804de SHA512 89047a2e07bd9da265b507b516ed3635adb17491c7f4f67cf090f0bd5b3fc7f2ee6e4cc4008beef7ca884b6b71dffe2bb652b21f01a702e17b468cca2d10b2de
+DIST gcc-16-20250803.tar.xz 95270732 BLAKE2B e63ada078704b0ff2a2646ed725db61d89aa3f27808cfe4ac0bacd86d9c08904a71b72e669b8b714b00db28196f6c6e1bf1aabef6459800f9fbc4d709356b6f1 SHA512 c5e74c95db89a38abc74711beb7ce14c8305962c4f98bae107b313ffec43de5e69853fb0f1f3b9ebbf75ee18e6ac6aea3c6f075e8aa509ef94ea7467a0f73cb4
+DIST gcc-16-20250810.tar.xz 95341000 BLAKE2B 6ccc5cac9a3c396c2b96658325186adf7866712af7c51732a515f400414570e1e4bb01c10dd509c5d38521f98abc1f257cf95ab68327e04d847b49f186253ef0 SHA512 ec037341f7e3b4c22bc0269cf99b779daddb3fb288969651d508e691d8360baed39939ceeb707c4b4cd094283aef446cbb538213c64ff08f15581682f4a65139
+DIST gcc-16-20250817.tar.xz 95454224 BLAKE2B bee169637249ecf98f68e31d66b48601bfbe4ab6f41c1ed068cefc7ced54462513ebabe2b064a93f62f617fe7cea398b10a03e0fef08307b6dd8ae7aaea3de52 SHA512 d5c519e1e0e3a4d3e2102633ce26bdb435eb62eb50c96559662f4523c2d8cee04f38e907a48f1aa780b63e1c7f7712485675a950d1a34b9d5959184c247e7d7d
 DIST gcc-16.0.0-musl-patches-1.tar.xz 3040 BLAKE2B 18b16357699780eb470cf44a10710281955140103198e0bd55b75e1efe3dbec233689edb11e1b9a62f782f3d97293af4906c18c2c41613b422eda085ee819467 SHA512 5ba580c7c7bb9e62935a5162d44d357cc31185a113acff7498ed7b1ac43fd0a35de7c3de0c87f02fe0be46b5e55b49bb35d1f5cd470058d21a9ea4096a37e13d
-DIST gcc-16.0.0-patches-5.tar.xz 23960 BLAKE2B 216e4d2b669043f2bd50fa69099388475b81129a9c96884f5ee1846dedd926e5243217d361ad840537c503e3af429d4930dbda92becbd4575fd6d5f4e3b3f47e SHA512 7aa48f5b979ee8feaa722d718d94497f7ae2d51b1793f7f7717befd7d8c5f379557e03d8af14c33b4483e64ad2e702ae6ae34a127a082abeb7e65acaa4999a3f
-DIST gcc-16.0.0-patches-6.tar.xz 22984 BLAKE2B 8766217760bf6397c5d929866e52f26b3b1c3004095ed6e35ed79196d6bac64635a90a68f677c8536748d7169116d6db50b7b851bd6ba8d7a25110127c86b933 SHA512 763394ee2aa3d3038a6dbbc8b30441b674f1d309a3a5ae3e33bdc850b26b4d579e44254d9fcd0f69f0f98aaa375b89c10524626c79a25df91f07f1f8959d68bb
-DIST gcc-16.0.0-patches-7.tar.xz 18380 BLAKE2B d537c65169e1dd7f68efa06875eb8b1558309a850dfab2ed175f36a62adbeb246eda019c39ff853af2826c7699c9e994c755bfb2ce744e5db9e106568c220bda SHA512 f66838ee282ef41ddc4199e9209688321804fb07c90359b161f7a608e98c1e4c02b03ab5f5d2a5827dab438f2a4bfee4d384e9b63067b7c52cd15678bd936df3
-DIST gcc-8.5.0-patches-4.tar.xz 18616 BLAKE2B 7594cbaea5daecf1a0b3d526c06aeba0a84c6da66aee2e105a51fda6be8d30a37ccc3814281b284a4582d892a1d556bca063551584edfc2525bed8ea5b6888e7 SHA512 1aa5742c361186637e7855f06feb1a4547e7d4d5de6e51f3d049e0ef3c19e2eff179465f52781739f59422035b7f8e4c0efa3844849f920f3c96acfdc37ca6a6
+DIST gcc-16.0.0-patches-10.tar.xz 22444 BLAKE2B 7f2c0e610f4190ea4a1852278ff1f4cbd22505dcb44e645a2fde80c96bf16e3ab58728ec5fee82aa9fb51a5fbdf8d70de182f75b1e3b0d1d42838344d317e5c6 SHA512 893590e59ab85acf6419941e5801b0d2f96e5ddcd793157489e774b8e0b5dc088b537be96f3a1d16066b8a5bb7a76aed062833a05b934a52376a1783f444a9c6
+DIST gcc-16.0.0-patches-9.tar.xz 18504 BLAKE2B b51c4547a12c04db2f37f26cf5c9cf1d6fa003fe4dde657c179e13e4b0e52b8e847efbaf139b1a418687259321dc350c98f01ba17501a1330f0dc3b68516b3f8 SHA512 67e4fadca36d0562586aac4c86673c918072642c7e7589c7b47643f35336bcc3e2adaea40b332cddd24821d1d1876c6a902763827dbb62e8d9b08161c3dbe49a
+DIST gcc-8.5.0-patches-5.tar.xz 20188 BLAKE2B 45b29161105edc6344bb48f5bdf17e1aad6e8d9edb4d9434816425996c1b12c10f1303963776adad9db866d845f864d80d198a30e35ee6c204ca3659cf7a1401 SHA512 f22ab5d8e3116e2e896a5dcbbf5cef67dc5090182af364ef64fc22d2b28c029da5ed39f126f446721e388e7b6848239d01f5fc0346e49b96d5c04068b557f8f8
 DIST gcc-8.5.0.tar.xz 63841008 BLAKE2B aa81a1a730fd7371360f6abed6ba78b5843fd18c58d5de5687acc320741b9e430e85df3535a1ef7a26051409be8d2f0945f503e5968480d919103123a99d4b12 SHA512 92f599680e6b7fbce88bcdda810f468777d541e5fddfbb287f7977d51093de2a5178bd0e6a08dfe37090ea10a0508a43ccd00220041abbbec33f1179bfc174d8
-DIST gcc-9.5.0-patches-2.tar.xz 14324 BLAKE2B 1d3bf3e673108ad2fcdcb86daefb4603d1c9f6aa815e34d1591054d466b76d6f50cce124ab4760528c4951ea16eb00888a3e6485417f81ebf250548732df4a8e SHA512 a6d6f650aaf0bd193a17ac279649f0544a282cea295824384c59341c3000eac4b574b60e00dd427585d928f9768166abf85168b47772132790ad98854acacbbf
+DIST gcc-9.5.0-patches-3.tar.xz 17888 BLAKE2B f2be05f32f4ecca41ebf4f402bf8fb3c11a36a8b7bd912ee9fe6baea980929774b629e12df7afb3405f1f5d044766a437b3eca5433f4af6c757f4a9dbb2e77eb SHA512 d31bb1964cdb2376572e4981b22c7ffa6fa695259c27af5d0d12aebc334cd1122c2f75739033f25f1e672300adeab2b3772622cb16099d002f3f8c5a8fe694f9
 DIST gcc-9.5.0.tar.xz 72462752 BLAKE2B 69e39314ee6bb46e3be491ba9c3cbc4914cb716f732c6d3f2b14d9382750b40c4f14b5d3051225b81f936ef8297b0ba8cb5439512e961dae5815d3bee2b0bfdb SHA512 cdd144ce4f747e051480410afc8506c90a57cb45da89071ddae377b1453bca3014422455ade9fe4563ebe51f4b6348cbc0c61905a9b8801cd597d51ad0ec62b3
 DIST gcc-validate-failures-a447cd6dee206facb66720bdacf0c765a8b09f33.py 27537 BLAKE2B 96c7474de0bc50ab890a91551412398c979396c43aa237a4b6d8baa98ce7fda2cc9f5a755a03fd9d055d885ee2fb40ba29644a0649c24398361ce75a20fae634 SHA512 409434953351cf1f2287f1e4a4fbde5b28a27add35ddd284080acec71b33cb4ec5e1c07f41a79fac060bd6f1eedd198812495141923e410ded907429fe515f83
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-16.0.0_p20250706-PR120358-qt-pta.patch b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-16.0.0_p20250706-PR120358-qt-pta.patch
deleted file mode 100644
index 1a9c9747c4c..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-16.0.0_p20250706-PR120358-qt-pta.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-https://bugs.gentoo.org/956308
-https://gcc.gnu.org/PR120358
-https://gcc.gnu.org/cgit/gcc/commit/?id=aa5ae523e84a97bf3a582ea0fa73d959afa9b9c7
-
-From aa5ae523e84a97bf3a582ea0fa73d959afa9b9c7 Mon Sep 17 00:00:00 2001
-Message-ID: <aa5ae523e84a97bf3a582ea0fa73d959afa9b9c7.1751999489.git.sam@gentoo.org>
-From: Richard Biener <rguenther@suse.de>
-Date: Mon, 7 Jul 2025 15:13:38 +0200
-Subject: [PATCH] tree-optimization/120358 - bogus PTA with structure access
-
-When we compute the constraint for something like
-MEM[(const struct QStringView &)&tok2 + 32] we go and compute
-what (const struct QStringView &)&tok2 + 32 points to and then
-add subvariables to its dereference that possibly fall in the
-range of the access according to the original refs size.  In
-doing that we disregarded that the subvariable the starting
-address points to might not be aligned to it and thus the
-access might start at any point within that variable.  The following
-conservatively adjusts the pruning of adjacent sub-variables to
-honor this.
-
-	PR tree-optimization/120358
-	* tree-ssa-structalias.cc (get_constraint_for_1): Adjust
-	pruning of sub-variables according to the imprecise
-	known start offset.
----
- gcc/tree-ssa-structalias.cc | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/gcc/tree-ssa-structalias.cc b/gcc/tree-ssa-structalias.cc
-index deca44ae0bf3..0215243d5be9 100644
---- a/gcc/tree-ssa-structalias.cc
-+++ b/gcc/tree-ssa-structalias.cc
-@@ -3690,7 +3690,10 @@ get_constraint_for_1 (tree t, vec<ce_s> *results, bool address_p,
- 		    size = -1;
- 		  for (; curr; curr = vi_next (curr))
- 		    {
--		      if (curr->offset - vi->offset < size)
-+		      /* The start of the access might happen anywhere
-+			 within vi, so conservatively assume it was
-+			 at its end.  */
-+		      if (curr->offset - (vi->offset + vi->size - 1) < size)
- 			{
- 			  cs.var = curr->id;
- 			  results->safe_push (cs);
--- 
-2.50.0
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-16.0.0_p20250706-PR120949-clang-algorithm.patch b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-16.0.0_p20250706-PR120949-clang-algorithm.patch
deleted file mode 100644
index 4d1ee50d801..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-16.0.0_p20250706-PR120949-clang-algorithm.patch
+++ /dev/null
@@ -1,166 +0,0 @@
-https://gcc.gnu.org/PR120949
-https://bugs.gentoo.org/959695
-https://bugs.gentoo.org/959697
-https://bugs.gentoo.org/959700
-https://bugs.gentoo.org/959704
-
-From ed912b1ee5ad0f241f968d5fd1a54a7e9e0e20dd Mon Sep 17 00:00:00 2001
-Message-ID: <ed912b1ee5ad0f241f968d5fd1a54a7e9e0e20dd.1751999555.git.sam@gentoo.org>
-From: Jonathan Wakely <jwakely@redhat.com>
-Date: Fri, 4 Jul 2025 21:19:52 +0100
-Subject: [PATCH] libstdc++: Fix attribute order on __normal_iterator friends
- [PR120949]
-
-In r16-1911-g6596f5ab746533 I claimed to have reordered some attributes
-for compatibility with Clang, but it looks like I got the Clang
-restriction backwards and put them all in the wrong order. Clang trunk
-accepts either order (probably since the llvm/llvm-project#133107 fix)
-but released versions still require a particular order.
-
-There were also some cases where the attributes were after the friend
-keyword, which Clang trunk still rejects.
-
-libstdc++-v3/ChangeLog:
-
-	PR libstdc++/120949
-	* include/bits/stl_iterator.h (__normal_iterator): Fix order of
-	always_inline and nodiscard attributes for Clang compatibility.
----
- libstdc++-v3/include/bits/stl_iterator.h | 30 +++++++++++++-----------
- 1 file changed, 16 insertions(+), 14 deletions(-)
-
-diff --git a/libstdc++-v3/include/bits/stl_iterator.h b/libstdc++-v3/include/bits/stl_iterator.h
-index a7188f46f6db..75e794f6c020 100644
---- a/libstdc++-v3/include/bits/stl_iterator.h
-+++ b/libstdc++-v3/include/bits/stl_iterator.h
-@@ -1211,7 +1211,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
- #else
-        // Forward iterator requirements
-       template<typename _Iter>
--	__attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+	_GLIBCXX_NODISCARD __attribute__((__always_inline__))
- 	friend
- 	_GLIBCXX_CONSTEXPR
- 	bool
-@@ -1220,7 +1220,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
- 	_GLIBCXX_NOEXCEPT
- 	{ return __lhs.base() == __rhs.base(); }
- 
--      __attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+      _GLIBCXX_NODISCARD __attribute__((__always_inline__))
-       friend
-       _GLIBCXX_CONSTEXPR
-       bool
-@@ -1229,7 +1229,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
-       { return __lhs.base() == __rhs.base(); }
- 
-       template<typename _Iter>
--	__attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+	_GLIBCXX_NODISCARD __attribute__((__always_inline__))
- 	friend
- 	_GLIBCXX_CONSTEXPR
- 	bool
-@@ -1238,7 +1238,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
- 	_GLIBCXX_NOEXCEPT
- 	{ return __lhs.base() != __rhs.base(); }
- 
--      __attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+      _GLIBCXX_NODISCARD __attribute__((__always_inline__))
-       friend
-       _GLIBCXX_CONSTEXPR
-       bool
-@@ -1248,15 +1248,16 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
- 
-       // Random access iterator requirements
-       template<typename _Iter>
-+	_GLIBCXX_NODISCARD __attribute__((__always_inline__))
- 	friend
--	__attribute__((__always_inline__)) _GLIBCXX_NODISCARD _GLIBCXX_CONSTEXPR
-+	_GLIBCXX_CONSTEXPR
- 	inline bool
- 	operator<(const __normal_iterator& __lhs,
- 		  const __normal_iterator<_Iter, _Container>& __rhs)
- 	_GLIBCXX_NOEXCEPT
- 	{ return __lhs.base() < __rhs.base(); }
- 
--      __attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+      _GLIBCXX_NODISCARD __attribute__((__always_inline__))
-       friend
-       _GLIBCXX20_CONSTEXPR
-       bool
-@@ -1265,15 +1266,16 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
-       { return __lhs.base() < __rhs.base(); }
- 
-       template<typename _Iter>
-+	_GLIBCXX_NODISCARD __attribute__((__always_inline__))
- 	friend
--	__attribute__((__always_inline__)) _GLIBCXX_NODISCARD _GLIBCXX_CONSTEXPR
-+	_GLIBCXX_CONSTEXPR
- 	bool
- 	operator>(const __normal_iterator& __lhs,
- 		  const __normal_iterator<_Iter, _Container>& __rhs)
- 	_GLIBCXX_NOEXCEPT
- 	{ return __lhs.base() > __rhs.base(); }
- 
--      __attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+      _GLIBCXX_NODISCARD __attribute__((__always_inline__))
-       friend
-       _GLIBCXX_CONSTEXPR
-       bool
-@@ -1282,7 +1284,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
-       { return __lhs.base() > __rhs.base(); }
- 
-       template<typename _Iter>
--	__attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+	_GLIBCXX_NODISCARD __attribute__((__always_inline__))
- 	friend
- 	_GLIBCXX_CONSTEXPR
- 	bool
-@@ -1291,7 +1293,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
- 	_GLIBCXX_NOEXCEPT
- 	{ return __lhs.base() <= __rhs.base(); }
- 
--      __attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+      _GLIBCXX_NODISCARD __attribute__((__always_inline__))
-       friend
-       _GLIBCXX_CONSTEXPR
-       bool
-@@ -1300,7 +1302,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
-       { return __lhs.base() <= __rhs.base(); }
- 
-       template<typename _Iter>
--	__attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+	_GLIBCXX_NODISCARD __attribute__((__always_inline__))
- 	friend
- 	_GLIBCXX_CONSTEXPR
- 	bool
-@@ -1309,7 +1311,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
- 	_GLIBCXX_NOEXCEPT
- 	{ return __lhs.base() >= __rhs.base(); }
- 
--      __attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+      _GLIBCXX_NODISCARD __attribute__((__always_inline__))
-       friend
-       _GLIBCXX_CONSTEXPR
-       bool
-@@ -1341,7 +1343,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
- #endif
- 	{ return __lhs.base() - __rhs.base(); }
- 
--      __attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+      _GLIBCXX_NODISCARD __attribute__((__always_inline__))
-       friend
-       _GLIBCXX_CONSTEXPR
-       difference_type
-@@ -1349,7 +1351,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
- 	_GLIBCXX_NOEXCEPT
-       { return __lhs.base() - __rhs.base(); }
- 
--      __attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+      _GLIBCXX_NODISCARD __attribute__((__always_inline__))
-       friend
-       _GLIBCXX_CONSTEXPR
-       __normal_iterator
--- 
-2.50.0
-
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild
index 77bed7c34b1..a8c26a52401 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="10.5.0"
-PATCH_VER="6"
+PATCH_VER="7"
 MUSL_VER="2"
 MUSL_GCC_VER="10.5.0"
 PYTHON_COMPAT=( python3_{11..14} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild
index 8ba8ef1f813..ddd706aca5a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="11.5.0"
-PATCH_VER="1"
+PATCH_VER="2"
 MUSL_VER="3"
 MUSL_GCC_VER="11.5.0"
 PYTHON_COMPAT=( python3_{11..14} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250704.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250704.ebuild
deleted file mode 100644
index edd35da963e..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250704.ebuild
+++ /dev/null
@@ -1,69 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Maintenance notes and explanations of GCC handling are on the wiki:
-# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
-
-TOOLCHAIN_PATCH_DEV="sam"
-TOOLCHAIN_HAS_TESTS=1
-TOOLCHAIN_GCC_RC=1
-PATCH_GCC_VER="12.4.0"
-PATCH_VER="3"
-MUSL_VER="3"
-MUSL_GCC_VER="12.4.0"
-PYTHON_COMPAT=( python3_{11..14} )
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-	        MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.0.ebuild
index a635f1a21b3..2dede09b939 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.0.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="12.4.0"
-PATCH_VER="3"
+PATCH_VER="4"
 MUSL_VER="3"
 MUSL_GCC_VER="12.4.0"
 PYTHON_COMPAT=( python3_{11..14} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250703.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250703.ebuild
deleted file mode 100644
index 37101ec35c2..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250703.ebuild
+++ /dev/null
@@ -1,69 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Maintenance notes and explanations of GCC handling are on the wiki:
-# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
-
-TOOLCHAIN_PATCH_DEV="sam"
-TOOLCHAIN_HAS_TESTS=1
-PATCH_GCC_VER="13.3.0"
-MUSL_GCC_VER="13.3.0"
-PATCH_VER="5"
-MUSL_VER="2"
-PYTHON_COMPAT=( python3_{11..14} )
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250710.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250807.ebuild
similarity index 93%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250710.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250807.ebuild
index 37101ec35c2..eb284e6784d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250710.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250807.ebuild
@@ -10,7 +10,7 @@ TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="13.3.0"
 MUSL_GCC_VER="13.3.0"
-PATCH_VER="5"
+PATCH_VER="8"
 MUSL_VER="2"
 PYTHON_COMPAT=( python3_{11..14} )
 
@@ -42,7 +42,7 @@ if tc_is_live ; then
 	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	:;
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250717.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250814.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250717.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250814.ebuild
index 37101ec35c2..765f70e27b2 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250717.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250814.ebuild
@@ -10,7 +10,7 @@ TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="13.3.0"
 MUSL_GCC_VER="13.3.0"
-PATCH_VER="5"
+PATCH_VER="8"
 MUSL_VER="2"
 PYTHON_COMPAT=( python3_{11..14} )
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250704.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250801.ebuild
similarity index 93%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250704.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250801.ebuild
index 11a03187dca..141c5143b38 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250704.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250801.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="14.3.0"
-PATCH_VER="1"
+PATCH_VER="4"
 MUSL_VER="1"
 MUSL_GCC_VER="14.3.0"
 PYTHON_COMPAT=( python3_{11..14} )
@@ -30,7 +30,7 @@ if tc_is_live ; then
 	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 	# m68k doesnt build (ICE, bug 932733)
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	:;
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250711.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250808.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250711.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250808.ebuild
index 11a03187dca..0995b00e4ed 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250711.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250808.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="14.3.0"
-PATCH_VER="1"
+PATCH_VER="4"
 MUSL_VER="1"
 MUSL_GCC_VER="14.3.0"
 PYTHON_COMPAT=( python3_{11..14} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250718.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250815.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250718.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250815.ebuild
index 11a03187dca..0995b00e4ed 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250718.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250815.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="14.3.0"
-PATCH_VER="1"
+PATCH_VER="4"
 MUSL_VER="1"
 MUSL_GCC_VER="14.3.0"
 PYTHON_COMPAT=( python3_{11..14} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.0.ebuild
deleted file mode 100644
index 1564e047ccd..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.0.ebuild
+++ /dev/null
@@ -1,56 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Maintenance notes and explanations of GCC handling are on the wiki:
-# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
-
-TOOLCHAIN_PATCH_DEV="sam"
-TOOLCHAIN_HAS_TESTS=1
-PATCH_GCC_VER="15.1.0"
-PATCH_VER="1"
-MUSL_VER="1"
-MUSL_GCC_VER="15.1.0"
-PYTHON_COMPAT=( python3_{11..14} )
-
-if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=master
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250705-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.2.0.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250705-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.2.0.ebuild
index 8b60d2682ef..4a055e721ec 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250705-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.2.0.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="15.1.0"
-PATCH_VER="2"
+PATCH_VER="5"
 MUSL_VER="1"
 MUSL_GCC_VER="15.1.0"
 PYTHON_COMPAT=( python3_{11..14} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250712.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.2.1_p20250809.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250712.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.2.1_p20250809.ebuild
index c6f54a62069..89436290970 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250712.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.2.1_p20250809.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="15.1.0"
-PATCH_VER="3"
+PATCH_VER="5"
 MUSL_VER="1"
 MUSL_GCC_VER="15.1.0"
 PYTHON_COMPAT=( python3_{11..14} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250719.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.2.1_p20250816.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250719.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.2.1_p20250816.ebuild
index c6f54a62069..89436290970 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250719.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.2.1_p20250816.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="15.1.0"
-PATCH_VER="3"
+PATCH_VER="5"
 MUSL_VER="1"
 MUSL_GCC_VER="15.1.0"
 PYTHON_COMPAT=( python3_{11..14} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.3.9999.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.9999.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.3.9999.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250713.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250803.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250713.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250803.ebuild
index f8f087f67ea..1f65e7fb575 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250713.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250803.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="16.0.0"
-PATCH_VER="6"
+PATCH_VER="9"
 MUSL_VER="1"
 MUSL_GCC_VER="16.0.0"
 PYTHON_COMPAT=( python3_{11..14} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250720.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250810.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250720.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250810.ebuild
index b50da9e405f..1f65e7fb575 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250720.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250810.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="16.0.0"
-PATCH_VER="7"
+PATCH_VER="9"
 MUSL_VER="1"
 MUSL_GCC_VER="16.0.0"
 PYTHON_COMPAT=( python3_{11..14} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250706-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250817.ebuild
similarity index 92%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250706-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250817.ebuild
index 0d09ce71547..6a0231661c9 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250706-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250817.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="16.0.0"
-PATCH_VER="5"
+PATCH_VER="10"
 MUSL_VER="1"
 MUSL_GCC_VER="16.0.0"
 PYTHON_COMPAT=( python3_{11..14} )
@@ -52,7 +52,5 @@ src_prepare() {
 
 	toolchain_src_prepare
 	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
-	eapply "${FILESDIR}"/${P}-PR120358-qt-pta.patch
-	eapply "${FILESDIR}"/${P}-PR120949-clang-algorithm.patch
 	eapply_user
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r2.ebuild
index 55f5d05f73f..c106ad8f8ec 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r2.ebuild
@@ -9,7 +9,7 @@ EAPI="8"
 TOOLCHAIN_PATCH_SUFFIX="xz"
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
-PATCH_VER="4"
+PATCH_VER="5"
 PYTHON_COMPAT=( python3_{11..14} )
 
 inherit toolchain
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild
index 90cd6d31e3a..ac627099c96 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="9.5.0"
-PATCH_VER="2"
+PATCH_VER="3"
 PYTHON_COMPAT=( python3_{11..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/metadata.xml
index 142253a37e4..c2a4c832cf0 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/metadata.xml
@@ -110,7 +110,15 @@
 			to find runtime problems in applications.
 		</flag>
 		<flag name="ssp">Build packages with stack smashing protection on by default</flag>
-		<flag name="systemtap">enable systemtap static probe points</flag>
+		<flag name="systemtap">
+			Enable enhanced debugging hooks/interface via SystemTap static probe points
+			in libgcc and libstdc++.
+
+			Note that this isn't exclusive to SystemTap, despite the name. This provides
+			an interface which <pkg>dev-debug/gdb</pkg> optionally uses, see
+			https://sourceware.org/gdb/wiki/LinkerInterface and
+			https://sourceware.org/gdb/wiki/DistroAdvice#sys.2Fsdt.h_probes.
+		</flag>
 		<flag name="vtv">
 			Build support for virtual table verification (a C++ hardening feature).
 

From 32df67f01c9e9ee141bbb833b6218441bc624bdb Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:16:05 +0000
Subject: [PATCH 102/122] sys-devel/gnuconfig: Sync with Gentoo

It's from Gentoo commit 9c2ac27166873e185fccb4a15d5a54663e344e8f.
---
 .../sys-devel/gnuconfig/Manifest              |  1 +
 .../gnuconfig/gnuconfig-20250710.ebuild       | 49 +++++++++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20250710.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/Manifest
index 1f95d4cec96..88f60a9e2dc 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/Manifest
@@ -1 +1,2 @@
 DIST gnuconfig-20240728.tar.xz 82360 BLAKE2B 476cabe032305adc916dffa39f30f07ac8249449e79da06763f08af9b642399c5c08bd5cf6b7229d63ba36b55e0ca75692b5db058ae0aa75b6b6370f12209aba SHA512 a43067a6f2a7f8d055122aefef2b0d28314c16871455e9223b8429a428ec6b4383eefe8fb50ff00d7c4c39710c6fb9fa81c3c84f3e6f5f58cbd1cf475896135e
+DIST gnuconfig-20250710.tar.xz 83388 BLAKE2B 3ae8bbec15255cfba57fbc1598228f90ff9ad82da6e1e1687c6937e9f1aa6a5ca56becf787308135cbb87eedf3eee51b20a8733c165e06613a0f9acd5fdf9cb9 SHA512 21d370bb917b91c393aebf17ecb446c5b9a93d88b29e021b85d28813de979e86053ef7af770fef0713093461268a439a17b573ce0e507dac04d089c058f7887f
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20250710.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20250710.ebuild
new file mode 100644
index 00000000000..02e93cc2904
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20250710.ebuild
@@ -0,0 +1,49 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+if [[ ${PV} == 99999999 ]] ; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/r/config.git"
+
+	inherit git-r3
+else
+	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	S="${WORKDIR}"
+fi
+
+DESCRIPTION="Updated config.sub and config.guess file from GNU"
+HOMEPAGE="https://savannah.gnu.org/projects/config"
+
+LICENSE="GPL-3+-with-autoconf-exception"
+SLOT="0"
+
+maint_pkg_create() {
+	cd "${S}" || die
+
+	emake ChangeLog
+	local ver=$(gawk '{ gsub(/-/, "", $1); print $1; exit }' ChangeLog)
+	[[ ${#ver} != 8 ]] && die "invalid version '${ver}'"
+
+	local tar="${T}/gnuconfig-${ver}.tar.xz"
+	tar -Jcf "${tar}" ./* || die "creating tar failed"
+	einfo "Packaged tar now available:"
+	einfo "$(du -b "${tar}")"
+}
+
+src_unpack() {
+	if [[ ${PV} == 99999999 ]] ; then
+		git-r3_src_unpack
+		maint_pkg_create
+	else
+		unpack ${A}
+	fi
+}
+
+src_install() {
+	insinto /usr/share/${PN}
+	doins config.{sub,guess}
+	fperms +x /usr/share/${PN}/config.{sub,guess}
+	dodoc ChangeLog
+}

From 023b31cd2b9c47024b2acc9bc4cdc001b5fd6cae Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:16:05 +0000
Subject: [PATCH 103/122] sys-firmware/edk2-bin: Sync with Gentoo

It's from Gentoo commit f1ad17f8d49ec3cfe263ab94f9652e0a0af5d1b4.
---
 .../portage-stable/sys-firmware/edk2-bin/edk2-bin-202202.ebuild | 2 +-
 .../portage-stable/sys-firmware/edk2-bin/edk2-bin-202408.ebuild | 2 +-
 .../portage-stable/sys-firmware/edk2-bin/edk2-bin-202411.ebuild | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202202.ebuild b/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202202.ebuild
index 75ae882382d..22e25e29aa5 100644
--- a/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202202.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202202.ebuild
@@ -15,7 +15,7 @@ S="${WORKDIR}"
 # TODO: the binary 202105 package currently lacks the preseeded
 #       OVMF_VARS.secboot.fd file (that we typically get from fedora)
 
-LICENSE="BSD-2 MIT"
+LICENSE="BSD-2-with-patent MIT"
 SLOT="0"
 KEYWORDS="amd64 arm64 ~loong ~ppc ppc64 ~riscv x86"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202408.ebuild b/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202408.ebuild
index e2582a3f091..6e11f9cc811 100644
--- a/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202408.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202408.ebuild
@@ -12,7 +12,7 @@ DESCRIPTION="TianoCore EDK II UEFI firmware for virtual machines"
 HOMEPAGE="https://github.com/tianocore/edk2"
 SRC_URI=$(printf "https://dev.gentoo.org/~chewi/distfiles/${BINPKG}-%s.xpak\n" ${ARCHES})
 S="${WORKDIR}"
-LICENSE="BSD-2 MIT"
+LICENSE="BSD-2-with-patent MIT"
 SLOT="0"
 KEYWORDS="amd64 arm64 ~loong ~ppc ppc64 ~riscv x86"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202411.ebuild b/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202411.ebuild
index de2d5e2553a..636670d43c7 100644
--- a/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202411.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202411.ebuild
@@ -12,7 +12,7 @@ DESCRIPTION="TianoCore EDK II UEFI firmware for virtual machines"
 HOMEPAGE="https://github.com/tianocore/edk2"
 SRC_URI=$(printf "https://dev.gentoo.org/~chewi/distfiles/${BINPKG}-%s.xpak\n" ${ARCHES})
 S="${WORKDIR}"
-LICENSE="BSD-2 MIT"
+LICENSE="BSD-2-with-patent MIT"
 SLOT="0"
 KEYWORDS="amd64 arm64 ~loong ~ppc ppc64 ~riscv x86"
 

From 9ca7dd62b6ffe0a965d9c8a31bd135657d603f09 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:16:06 +0000
Subject: [PATCH 104/122] sys-firmware/intel-microcode: Sync with Gentoo

It's from Gentoo commit 33d5cfb6a34d7d04b914007e98f6fc65cca95b6c.
---
 .../portage-stable/sys-firmware/intel-microcode/Manifest      | 4 ++--
 ...41103.ebuild => intel-microcode-20250812_p20250813.ebuild} | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)
 rename sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/{intel-microcode-20241112_p20241103.ebuild => intel-microcode-20250812_p20250813.ebuild} (99%)

diff --git a/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/Manifest b/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/Manifest
index 3a5ada833fd..c7d3575f1cb 100644
--- a/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/Manifest
@@ -1,7 +1,7 @@
-DIST intel-microcode-collection-20241103.tar.xz 17703860 BLAKE2B dd2e88e4b06a54ad5f07b12a842eea0a66f2b8d5bf5fb311bd5d9d955faf6f08d1b025cdf5ba04a6b43b3fb153dca50c2fba1cb40454e9b195c7fe03563c8685 SHA512 f57fc0ba0deced6d852354556429afea0995f1864a73594e92c5900bbec3816ff8d960860f853c788ebeb3ae0f1a44ca3dc9ddc091bdc2753a2f181993eb601d
 DIST intel-microcode-collection-20250211.tar.xz 20347768 BLAKE2B 3d06117d036731654052ed82000b303f66b5f279f64c9c7e7d1027fc79f5a01b36808bcfd71d522d4903bb8c637cc9fd5ac4e33f7597b5e07cce6038870e88f0 SHA512 cd7bd7a7cbcf37fe7aea98d10ed1369fcd75fa3778ff85eec474fab8ef80fe5c26fea8f3a89918af58aa250f544d0950591a793669507c7c5f3f9702ef442424
 DIST intel-microcode-collection-20250513.tar.xz 19778084 BLAKE2B 163360f399def56e9b4d05d31f3d20cdfa416f4673351a5d66cb320e7751abb3bc6e983bfd7fec53ccda8feff242d9e5e896a1137454876ea9df1ba36232191d SHA512 fe06dbcf2880c3b8857973a13fa2f25bc7eb8943bfc82b39ea7b2446becd82ea7c574df91989a2b66f897092db08e51cca671bc2297df30f266890751f02a7ce
+DIST intel-microcode-collection-20250813.tar.xz 20200664 BLAKE2B a503f331b152db37a51e864f520a11795f6e1d3313cc23c7a3985f1c2b9c941654829a50e667aa8b2f7c76cb71f04a6205b1276717d880a20d63a8e21e1afe69 SHA512 323ebd24490146db77837bafbd07240e1712b45e642d2956a5f635e8d814920d20a2d5efef80cf4a50af849dde1c37e78954f2f32e81924a65be45229865cc13
 DIST intel-ucode-sig_0x406e3-rev_0xd6.bin 101376 BLAKE2B 66d55867954d69dda1425febd93bb8c89f7aa836d504f8b5fee127f8505bcf2246f4fcc55cc245bc5e532528d60cca2eee278de7ab5174dc2862db7982a2b36f SHA512 248066b521bf512b5d8e4a8c7e921464ce52169c954d6e4ca580d8c172cd789519e22b4cf56c212e452b4191741f0202019f7061d322c9433b5af9ce5413b567
-DIST microcode-20241112.tar.gz 12923653 BLAKE2B 223721ac561b137513653e1b10dc2afabcc4fc9e304f3fc71c252f1ada9554bf1df812c766831ec4b5f66f57f66c3e1cf563d7d24d17e553a4e26adc659f8d76 SHA512 de4ddb0a77e17a4a5b6789537cf71db9ab884c795ef5c77b17d3392fda0fbb4d860cc27bcdbd7512d9412d6f934e6771e889be262b20e77433e0f72d3b6cf1f0
 DIST microcode-20250211.tar.gz 11844354 BLAKE2B 628d4e1664639d688fded764add9a0e2df38c8aae7a63b0bf93430befcf9938f0b9bec535016bfb2d6ff0538fd09f8eec7b2d721f727406a0ec50c6f809ad698 SHA512 493216fb14097c7c9bda3117fbcae8ad4300fb8646918338119ef303000aad6f73ca04acc59c9a890b0b2b58e097798f673954f15e3142948267bbeeacc842cf
 DIST microcode-20250512.tar.gz 14985022 BLAKE2B 1a080ef059cfb50846460b53f245ba7c241a5d2126df9a9842641066341971d1e9889499349be29fd90cf55f80d2fe230052cb34e718cbbdb8894138a647f34c SHA512 7c22448eaec64a09562fc05da59e8b77bd828ff7a8c2973a012eb5e2cf92a6cfff6e770e379f5db4a8d633de610be6f02ddd033351505a2b8180e3982d63a49e
+DIST microcode-20250812.tar.gz 14986599 BLAKE2B f0ae5a98ac65506f9a6c9d2902f6d1e1b8355ab0ddcdb7173ea5517cad4e0474b4cbbdd3196bf66ebd226d347f94d959db8bcf62c5f06eef13c6f8b7f16b70da SHA512 5c21676d1c1783c937c78ca00b9f8d9a870bc7dfdde564bdf2ba277931223fa8d6a2f21d6a0e6249b4ba8ccc2e47d5b3cbf41cc5edc08360c909b3f1c7f2dec1
diff --git a/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20241112_p20241103.ebuild b/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20250812_p20250813.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20241112_p20241103.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20250812_p20250813.ebuild
index f99a41e15b4..24658c887cf 100644
--- a/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20241112_p20241103.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20250812_p20250813.ebuild
@@ -43,7 +43,7 @@ S="${WORKDIR}"
 
 LICENSE="intel-ucode"
 SLOT="0"
-KEYWORDS="-* amd64 x86"
+KEYWORDS="-* ~amd64 ~x86"
 IUSE="dist-kernel hostonly +initramfs +split-ucode vanilla"
 REQUIRED_USE="
 	|| ( initramfs split-ucode )

From 198dcf94f3823663be01334cd35f7803f6f79ef8 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:16:12 +0000
Subject: [PATCH 105/122] sys-fs/btrfs-progs: Sync with Gentoo

It's from Gentoo commit 5994be3d337b0b9d108d3d5ccf5dea76353e8bbe.
---
 .../sys-fs/btrfs-progs/Manifest               |   2 +
 .../btrfs-progs/btrfs-progs-6.16.ebuild       | 188 ++++++++++++++++++
 2 files changed, 190 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.16.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/Manifest b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/Manifest
index d06fe5b665d..6edf590452d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/Manifest
@@ -6,3 +6,5 @@ DIST btrfs-progs-v6.14.tar.sign 566 BLAKE2B ddb860fa18cb56e7b460949c54c097e11bd0
 DIST btrfs-progs-v6.14.tar.xz 2739548 BLAKE2B fae9bdbacc093ba260d7740001eef98f4ffb72c30631c789a34fbd5f34283cbdfb9f1e6b2f6112fb769b90892b47ea2bcc0bcdab37748b8d23e3588051620b2a SHA512 becb9e1a95ecd3e0421dd9a4a4fd0bf0e950d6586aa8cc757f97b04392a54a4fd4bcae164a61054087823e610297041b2b79b0c6e827cab8ad804d9877268ee4
 DIST btrfs-progs-v6.15.tar.sign 566 BLAKE2B 002bd309b3c5c0cebea7f2424c775ad369d358731223f0fee2646ed57b4b635cef4561e04eb7bd01321d8da13cea87410626d78433d0e6b44cc6229069553ab1 SHA512 e008df77f2791468ca02c5acf68df5904219646bc55c129db9b75aff3212893824bcfbb1fb5cdf404f1f366d05c7fd1566419a5fadc6057b484f408c0f37dfb8
 DIST btrfs-progs-v6.15.tar.xz 4933176 BLAKE2B 5e79b7606fb236bc21e5b2401f5d6b27ad0ffb1b8ceef3ed9c7042b384508b1e1cc2a3a451d94e5369fa1592d91da78264caabe74bf1d907ac8e513a86b6fed8 SHA512 415cf222ae6a219123cdac5f99d4b8346a9f9c57e9e5b109a5198c287d1a00273a3651ce7f38f330d9d81c5a6293cfb5fedcc34c2a03a8be925caa3546a50dad
+DIST btrfs-progs-v6.16.tar.sign 566 BLAKE2B 80e30440ac59c034fd4d9d9cec7a5ddd1fd9533e350066d3c92d276e97023ba12b83daa98bb87065ea93a3651a6b51d4195d3cb89f8dae43986674434dffab7e SHA512 21f134616f91e7cf2e863908ae9793c7561f24985ec879056d7dddf6ae3b0766ae83bd5205dc12633b215cae1cce177bb9b8c39c84909fbaf53624b44d3e2dc7
+DIST btrfs-progs-v6.16.tar.xz 4949180 BLAKE2B 375c60a93bc5b62d7c3a94d5ed108b81786b27f2beba27d85bcede94a892d84e71b1fe00a1574cc53066fe77bb37408b2b382db4a1664fefcc676c1c3efa1c60 SHA512 b7b89c9f6855f48a369bfcaf647b50cd41fbd6b11e9017a57eace36917c0daec14d93946121640728e0dfcda74941f28f9c31abf694313cb5134156a2c1907f7
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.16.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.16.ebuild
new file mode 100644
index 00000000000..45d288067d0
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.16.ebuild
@@ -0,0 +1,188 @@
+# Copyright 2008-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Please bump with dev-python/btrfsutil
+
+PYTHON_COMPAT=( python3_{11..14} )
+inherit bash-completion-r1 python-any-r1 udev
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://github.com/kdave/btrfs-progs.git"
+	EGIT_BRANCH="devel"
+	WANT_LIBTOOL="none"
+	inherit autotools git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/dsterba.asc
+	inherit verify-sig
+
+	MY_PV="v${PV/_/-}"
+	MY_P="${PN}-${MY_PV}"
+	SRC_URI="
+		https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/${PN}/${MY_P}.tar.xz
+		verify-sig? ( https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/${PN}/${MY_P}.tar.sign )
+	"
+	S="${WORKDIR}"/${PN}-${MY_PV}
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	fi
+fi
+
+DESCRIPTION="Btrfs filesystem utilities"
+HOMEPAGE="https://btrfs.readthedocs.io/en/latest/"
+
+LICENSE="GPL-2"
+SLOT="0/0" # libbtrfs soname
+IUSE="+convert +man experimental reiserfs static static-libs udev +zstd"
+# Could support it with just !systemd => eudev, see mdadm, but let's
+# see if someone asks for it first.
+REQUIRED_USE="static? ( !udev )"
+
+# Tries to mount repaired filesystems
+RESTRICT="test"
+
+RDEPEND="
+	dev-libs/lzo:2=
+	sys-apps/util-linux:=[static-libs(+)?]
+	sys-libs/zlib:=
+	convert? (
+		sys-fs/e2fsprogs:=
+		reiserfs? (
+			>=sys-fs/reiserfsprogs-3.6.27
+		)
+	)
+	udev? ( virtual/libudev:= )
+	zstd? ( app-arch/zstd:= )
+"
+DEPEND="
+	${RDEPEND}
+	>=sys-kernel/linux-headers-5.10
+	convert? ( sys-apps/acl )
+	static? (
+		dev-libs/lzo:2[static-libs(+)]
+		sys-apps/util-linux:0[static-libs(+)]
+		sys-libs/zlib:0[static-libs(+)]
+		convert? (
+			sys-fs/e2fsprogs[static-libs(+)]
+			reiserfs? (
+				>=sys-fs/reiserfsprogs-3.6.27[static-libs(+)]
+			)
+		)
+		zstd? ( app-arch/zstd[static-libs(+)] )
+	)
+"
+BDEPEND="
+	virtual/pkgconfig
+	man? (
+		$(python_gen_any_dep 'dev-python/sphinx[${PYTHON_USEDEP}]
+			dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]')
+	)
+"
+
+python_check_deps() {
+	python_has_version "dev-python/sphinx[${PYTHON_USEDEP}]" &&
+	python_has_version "dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]"
+}
+
+if [[ ${PV} == 9999 ]]; then
+	BDEPEND+=" sys-devel/gnuconfig"
+else
+	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-dsterba )"
+fi
+
+pkg_setup() {
+	: # Prevent python-any-r1_python_setup
+}
+
+if [[ ${PV} != 9999 ]]; then
+	src_unpack() {
+		# Upstream sign the decompressed .tar
+		if use verify-sig; then
+			einfo "Unpacking ${MY_P}.tar.xz ..."
+			verify-sig_verify_detached - "${DISTDIR}"/${MY_P}.tar.sign \
+				< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -xf -))
+			assert "Unpack failed"
+		else
+			default
+		fi
+	}
+fi
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]]; then
+		local AT_M4DIR=config
+		eautoreconf
+
+		local automakedir="$(autotools_run_tool --at-output automake --print-libdir)"
+		[[ -e ${automakedir} ]] || die "Could not locate automake directory"
+
+		ln -s "${automakedir}"/install-sh config/install-sh || die
+		ln -s "${BROOT}"/usr/share/gnuconfig/config.guess config/config.guess || die
+		ln -s "${BROOT}"/usr/share/gnuconfig/config.sub config/config.sub || die
+	fi
+}
+
+src_configure() {
+	local myeconfargs=(
+		--bindir="${EPREFIX}"/sbin
+
+		--enable-lzo
+		$(use_enable experimental)
+		--disable-python
+		$(use_enable convert)
+		$(use_enable man documentation)
+		$(use_enable elibc_glibc backtrace)
+		$(use_enable static-libs static)
+		$(use_enable udev libudev)
+		$(use_enable zstd)
+
+		# Could support libgcrypt, libsodium, libkcapi, openssl, botan
+		--with-crypto=builtin
+		--with-convert=ext2$(usev reiserfs ',reiserfs')
+	)
+
+	export EXTRA_PYTHON_CFLAGS="${CFLAGS}"
+	export EXTRA_PYTHON_LDFLAGS="${LDFLAGS}"
+
+	if use man; then
+		python_setup
+	fi
+
+	# bash as a temporary workaround for https://github.com/kdave/btrfs-progs/pull/721
+	CONFIG_SHELL="${BROOT}"/bin/bash econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	emake V=1 all $(usev static)
+}
+
+src_test() {
+	emake V=1 -j1 -C tests test
+}
+
+src_install() {
+	local makeargs=(
+		$(usev static install-static)
+	)
+
+	emake V=1 DESTDIR="${D}" install "${makeargs[@]}"
+
+	if use experimental; then
+		exeinto /sbin
+		doexe btrfs-corrupt-block
+	fi
+
+	newbashcomp btrfs-completion btrfs
+}
+
+pkg_postinst() {
+	udev_reload
+}
+
+pkg_postrm() {
+	udev_reload
+}

From 6e03431feed9bb2e66b8bbec59646219fba3192f Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:16:12 +0000
Subject: [PATCH 106/122] sys-fs/cryptsetup: Sync with Gentoo

It's from Gentoo commit 5f32dd115d864fc2c9874bf795840ed2f4739a68.
---
 .../portage-stable/sys-fs/cryptsetup/cryptsetup-2.8.0.ebuild    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.8.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.8.0.ebuild
index 817e5f8061d..e35551b2182 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.8.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.8.0.ebuild
@@ -14,7 +14,7 @@ S="${WORKDIR}"/${P/_/-}
 LICENSE="GPL-2+"
 SLOT="0/12" # libcryptsetup.so version
 if [[ ${PV} != *_rc* ]] ; then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
 fi
 
 CRYPTO_BACKENDS="gcrypt kernel nettle +openssl"

From cd68b5a0543d14dde8221d3c26b260f6aa1ee564 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:16:26 +0000
Subject: [PATCH 107/122] sys-fs/lxcfs: Sync with Gentoo

It's from Gentoo commit 6ab87e51140a3aceaf8ff02492313e67c1f5e5f6.
---
 .../portage-stable/sys-fs/lxcfs/Manifest      |  2 +
 .../sys-fs/lxcfs/lxcfs-6.0.5.ebuild           | 81 +++++++++++++++++++
 2 files changed, 83 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-fs/lxcfs/lxcfs-6.0.5.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/lxcfs/Manifest b/sdk_container/src/third_party/portage-stable/sys-fs/lxcfs/Manifest
index 4b49440980c..7700d65826c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/lxcfs/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/lxcfs/Manifest
@@ -2,3 +2,5 @@ DIST lxcfs-5.0.4.tar.gz 104249 BLAKE2B 83a7b861136c34da8a24dd525fd0767193f2bbd92
 DIST lxcfs-5.0.4.tar.gz.asc 833 BLAKE2B aff883d24b374b296ea3678670e5e82c723fd0e35cfd7fed555aabbd811a104becc0b741331b4aa4a5129c9fff4dc88c6a86e7d64a89fe86aea81718f5d432dd SHA512 56b639597dbaf3008fe030147ea37192bd465c467a79e11ce139bcaa6bca1625b4bb9c4eda6ea1877446769f0fad9b4c5a3513d4f4415b841db96d5da8325ddc
 DIST lxcfs-6.0.4.tar.gz 106751 BLAKE2B 4f05cb5e31ed1f313eeb42ac7cc9e68031011af363992e9d15266d7c831fb83078821a42181142cb58418dc87b6ae71ccd79559e0c77c19b5810cb2f5dde98ab SHA512 27e27dd14e3ab6d6f33b78f3316d1d15ccdb5af76fd3631770fe8ff4e1d1a3cc6d7a8009a604660fccc63e4fa5f1601c6505f66ab76c11dcfcddd3baf7ff173b
 DIST lxcfs-6.0.4.tar.gz.asc 833 BLAKE2B 71d552694273e6b3fbeaa4fd2a07ad783ca66824fa7fef69ba79a343b65e57295a702efe580c17e77c6fdb3f79364e98206a099ef3ac99b1d1238178cd343e20 SHA512 fecc002f39f841f3ffbfd7c543cdfed61b9276e962a75230b2962a36bbef04f5444481bb1409ba38ed8f619d0887313f1cc84389f64755d6168c017f68bbaeb2
+DIST lxcfs-6.0.5.tar.gz 106565 BLAKE2B 1a726165be6670c7da4cab3e401e81229ba34f0852885de7d96e3099715c67aa5f49b48f7cfead1659cce1d0b3e191b6206df0b214a2487cac35170ea0ba104e SHA512 729c75bca4da79af9c38c6a42dbebf876d861e0b2c4b825c46edc3a39d27bae1a6a4faeff000d8a1e1a887437184a0413f763512c789cf9ce3ddbaab02de4ece
+DIST lxcfs-6.0.5.tar.gz.asc 833 BLAKE2B 58a12c083bf4b1d5138aec172223eed1d79284c6d48cc7262f9e9dac479894f094d6a8f2051aee9352c99947a638bb891cd48690d194e3d4b4392231ff8ebaef SHA512 c50289168d1a6c970dcffe61dcf2ee5296420c91cd8638b0f285e53e07b0e0d3704a199c8eceee2d282b2906e430165e86315271a9bd9335a91252727c2c921c
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/lxcfs/lxcfs-6.0.5.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/lxcfs/lxcfs-6.0.5.ebuild
new file mode 100644
index 00000000000..bd783dafb34
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/lxcfs/lxcfs-6.0.5.ebuild
@@ -0,0 +1,81 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{11..14} )
+
+inherit cmake meson python-any-r1 systemd verify-sig
+
+DESCRIPTION="FUSE filesystem for LXC"
+HOMEPAGE="https://linuxcontainers.org/lxcfs/introduction/ https://github.com/lxc/lxcfs/"
+SRC_URI="https://linuxcontainers.org/downloads/lxcfs/${P}.tar.gz
+	verify-sig? ( https://linuxcontainers.org/downloads/lxcfs/${P}.tar.gz.asc )"
+
+LICENSE="Apache-2.0 LGPL-2+"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64 ~riscv ~x86"
+IUSE="doc test"
+
+DEPEND="sys-fs/fuse:3="
+RDEPEND="${DEPEND}"
+BDEPEND="${PYTHON_DEPS}
+	virtual/pkgconfig
+	$(python_gen_any_dep '
+		dev-python/jinja2[${PYTHON_USEDEP}]
+	')
+	doc? ( sys-apps/help2man )
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+# Needs some black magic to work inside container/chroot.
+RESTRICT="test"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+python_check_deps() {
+	python_has_version -b "dev-python/jinja2[${PYTHON_USEDEP}]"
+}
+
+pkg_setup() {
+	python-any-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	# Fix python shebangs for python-exec[-native-symlinks], #851480
+	local shebangs=($(grep -rl "#!/usr/bin/env python3" || die))
+	python_fix_shebang -q ${shebangs[*]}
+}
+
+src_configure() {
+	local emesonargs=(
+		--localstatedir "${EPREFIX}/var"
+
+		$(meson_use doc docs)
+		$(meson_use test tests)
+
+		-Dfuse-version=3
+		-Dinit-script=""
+		-Dwith-init-script=""
+	)
+
+	meson_src_configure
+}
+
+src_test() {
+	cd "${BUILD_DIR}"/tests || die "failed to change into tests/ directory."
+	./main.sh || die
+}
+
+src_install() {
+	meson_src_install
+
+	newconfd "${FILESDIR}"/lxcfs-5.0.2.confd lxcfs
+	newinitd "${FILESDIR}"/lxcfs-5.0.2.initd lxcfs
+
+	# Provide our own service file (copy of upstream) due to paths being different from upstream,
+	# #728470
+	# https://github.com/lxc/lxcfs/tree/main/config/init
+	systemd_newunit "${FILESDIR}"/lxcfs-5.0.2.service lxcfs.service
+}

From 1519464b0b24dcd676cfd2659676adffdb9407a7 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:16:31 +0000
Subject: [PATCH 108/122] sys-kernel/dracut: Sync with Gentoo

It's from Gentoo commit 6c69d6609da493658a2d60a4bcf9b4c03a1471cc.
---
 .../portage-stable/sys-kernel/dracut/Manifest |   2 +-
 ...dracut-107.ebuild => dracut-108-r3.ebuild} |  22 +-
 .../sys-kernel/dracut/dracut-9999.ebuild      |   9 +-
 .../dracut-108-acct-user-group-gentoo.patch   |  13 +
 .../dracut-108-disable-ukify-magic.patch      |  13 +
 .../files/dracut-108-elf-parsing-fixes.patch  | 332 ++++++++++++++++++
 ...acut-108-respect-objcopy-and-objdump.patch |  89 +++++
 7 files changed, 474 insertions(+), 6 deletions(-)
 rename sdk_container/src/third_party/portage-stable/sys-kernel/dracut/{dracut-107.ebuild => dracut-108-r3.ebuild} (91%)
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-acct-user-group-gentoo.patch
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-disable-ukify-magic.patch
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-elf-parsing-fixes.patch
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-respect-objcopy-and-objdump.patch

diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/Manifest b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/Manifest
index 41f1fa12637..36841d2bfa9 100644
--- a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/Manifest
@@ -1,4 +1,4 @@
 DIST dracut-060_pre20240104.tar.gz 499965 BLAKE2B 935e0e5da348426d69c6dab6b91078f126cadd9ffc6a32378e79cd93b1dbadff35899efc3786fc12bf5a6741843d3637b0c98cc71fe4a96a8caf053ae887bac3 SHA512 f7818265f082e9c05ebb81a91b67fb9b1d3bf8b2433b7e6ea9be6bee43d28cd1ee48577648e1d9b3729c17608b028d294c13bf5d4db4cc5a18e3b007eb2cd67e
 DIST dracut-103.tar.gz 567713 BLAKE2B 7781c0b7fc83a2c0c461f6398687e053226b489fb5405b3132b30d8e7a4f3cea2bb73aa0fe6e4c4b27187d6270ba623f403916ec38025a912930ae347a7e25ce SHA512 ba0dbefbcbecb09c44ce240664bc4f4ee25dfb8be7bc060028ae3b1ccf7d70410491c105e64fcef3d6f44d2794cb6162bcea9404125906be46bf3dff098e0277
 DIST dracut-106.tar.gz 527743 BLAKE2B 837621da329500b88b0c81a724990702a9f4e816a4818c26622b2bc5e3885c908f0bbba682a262f967d9a08a912cfd63a33270143560a30e3d067dc4217c5262 SHA512 ab17f9440129e2db7c2902115459309132ce7f7b29bbb3172002b7a8ea8ab54799d62d89fbf3f84581a5c14196f6754d33669b583b9d758ab4686a3443a3c4ad
-DIST dracut-107.tar.gz 536435 BLAKE2B 8ff85073853f874b31b659b73abfafe27bb0da59c8e77039bd1739d266dffe26616f6c96eceb2cb36319801d0fb3df53ea4153bf426f081e7e5b73c11522018b SHA512 3f8e79fbfd40c0d384e856cbabe9257c5cbafbb4a3fe4b56da27832c36844dbbf9c59f12155d165d9343bc7341eda2b90c215148eb46ae873c219fbc93992944
+DIST dracut-108.tar.gz 552724 BLAKE2B fa5efd4039be8d2d30564a0768d2dec8c3d72b3721391d3a02bde8445cd7a5766d4b119594ebbca86dbd59bd71b64353febaaa7e2257f02d0075333dc29e9047 SHA512 ed06844b65003c1f75373309dbdc10a3036958f413b05b608510142fa78bb34dd9fb1e622242b02b2e9e4063bfa916fd755f5131a77fb3249f77d3f08eca2283
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-107.ebuild b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-108-r3.ebuild
similarity index 91%
rename from sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-107.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-108-r3.ebuild
index 415b8f5798a..6dcb2c228b3 100644
--- a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-107.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-108-r3.ebuild
@@ -54,7 +54,10 @@ DEPEND="
 "
 
 BDEPEND="
-	app-text/asciidoc
+	|| (
+		dev-ruby/asciidoctor
+		app-text/asciidoc
+	)
 	app-text/docbook-xml-dtd:4.5
 	>=app-text/docbook-xsl-stylesheets-1.75.2
 	>=dev-libs/libxslt-1.1.26
@@ -99,9 +102,13 @@ QA_MULTILIB_PATHS="usr/lib/dracut/.*"
 PATCHES=(
 	"${FILESDIR}"/gentoo-ldconfig-paths-r1.patch
 	# Gentoo specific acct-user and acct-group conf adjustments
-	"${FILESDIR}"/${PN}-106-acct-user-group-gentoo.patch
-	# https://github.com/dracut-ng/dracut-ng/pull/1322
-	"${FILESDIR}"/${PN}-107-hostonly-regression-fix-1322.patch
+	"${FILESDIR}"/${PN}-108-acct-user-group-gentoo.patch
+	# https://github.com/dracut-ng/dracut-ng/pull/1447
+	"${FILESDIR}"/${PN}-108-respect-objcopy-and-objdump.patch
+	# https://github.com/dracut-ng/dracut-ng/pull/1538
+	"${FILESDIR}"/${PN}-108-elf-parsing-fixes.patch
+	# https://github.com/dracut-ng/dracut-ng/pull/1122#issuecomment-3192110686
+	"${FILESDIR}"/${PN}-108-disable-ukify-magic.patch
 )
 
 pkg_setup() {
@@ -117,6 +124,10 @@ src_configure() {
 		--disable-dracut-cpio
 	)
 
+	if ! has_version dev-ruby/asciidoctor; then
+		myconf+=( --disable-asciidoctor )
+	fi
+
 	# this emulates what the build system would be doing without us
 	append-cflags -D_FILE_OFFSET_BITS=64
 
@@ -167,6 +178,9 @@ src_install() {
 		exeinto /usr/lib/dracut
 		doexe "src/dracut-cpio/$(cargo_target_dir)/dracut-cpio"
 	fi
+
+	# Use our own from sys-kernel/installkernel[dracut]
+	rm -r "${ED}/usr/lib/kernel" || die
 }
 
 pkg_preinst() {
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-9999.ebuild
index 624115e9cc8..95c80b5dac1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-9999.ebuild
@@ -54,7 +54,10 @@ DEPEND="
 "
 
 BDEPEND="
-	app-text/asciidoc
+	|| (
+		dev-ruby/asciidoctor
+		app-text/asciidoc
+	)
 	app-text/docbook-xml-dtd:4.5
 	>=app-text/docbook-xsl-stylesheets-1.75.2
 	>=dev-libs/libxslt-1.1.26
@@ -115,6 +118,10 @@ src_configure() {
 		--disable-dracut-cpio
 	)
 
+	if ! has_version dev-ruby/asciidoctor; then
+		myconf+=( --disable-asciidoctor )
+	fi
+
 	# this emulates what the build system would be doing without us
 	append-cflags -D_FILE_OFFSET_BITS=64
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-acct-user-group-gentoo.patch b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-acct-user-group-gentoo.patch
new file mode 100644
index 00000000000..52c15205c63
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-acct-user-group-gentoo.patch
@@ -0,0 +1,13 @@
+diff --git a/modules.d/73tpm2-tss/module-setup.sh b/modules.d/73tpm2-tss/module-setup.sh
+index 4441f5528..4b5654d56 100755
+--- a/modules.d/73tpm2-tss/module-setup.sh
++++ b/modules.d/73tpm2-tss/module-setup.sh
+@@ -30,7 +30,7 @@ installkernel() {
+ 
+ # Install the required file(s) and directories for the module in the initramfs.
+ install() {
+-    inst_sysusers tpm2-tss.conf
++    inst_sysusers tss.conf
+ 
+     inst_multiple -o \
+         "$tmpfilesdir"/tpm2-tss-fapi.conf \
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-disable-ukify-magic.patch b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-disable-ukify-magic.patch
new file mode 100644
index 00000000000..05268206de0
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-disable-ukify-magic.patch
@@ -0,0 +1,13 @@
+diff --git a/dracut.sh b/dracut.sh
+index e6d2d9f25..792ab3d34 100755
+--- a/dracut.sh
++++ b/dracut.sh
+@@ -2732,7 +2732,7 @@ if [[ $uefi == yes ]]; then
+     cp "$uefi_stub" "$tmp_uefi_stub"
+     "${OBJCOPY:-objcopy}" --remove-section .sbat "$tmp_uefi_stub" &> /dev/null
+ 
+-    if command -v ukify &> /dev/null; then
++    if false; then
+         dinfo "*** Using ukify to create UKI ***"
+         if ukify build \
+             --linux "$kernel_image" \
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-elf-parsing-fixes.patch b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-elf-parsing-fixes.patch
new file mode 100644
index 00000000000..1beb9c13c0a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-elf-parsing-fixes.patch
@@ -0,0 +1,332 @@
+From 88e375f89c11c989737f6d00b0cfe6309f7447d7 Mon Sep 17 00:00:00 2001
+From: James Le Cuirot <jlecuirot@microsoft.com>
+Date: Fri, 8 Aug 2025 12:50:12 +0100
+Subject: [PATCH 1/3] fix(dracut-install): the -n short option for --dry-run
+
+I forgot to update the getopt call.
+
+Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
+--- a/src/install/dracut-install.c
++++ b/src/install/dracut-install.c
+@@ -1638,7 +1638,7 @@ static int parse_argv(int argc, char *argv[])
+                 {NULL, 0, NULL, 0}
+         };
+ 
+-        while ((c = getopt_long(argc, argv, "madfhlL:oD:Hr:Rp:P:s:S:N:v", options, NULL)) != -1) {
++        while ((c = getopt_long(argc, argv, "madfhlL:oD:Hr:Rp:P:s:S:N:vn", options, NULL)) != -1) {
+                 switch (c) {
+                 case ARG_VERSION:
+                         puts(PROGRAM_VERSION_STRING);
+-- 
+2.50.1
+
+
+From 06e95cc602d0c6df99f4a54b2ade7deb59343a40 Mon Sep 17 00:00:00 2001
+From: James Le Cuirot <jlecuirot@microsoft.com>
+Date: Fri, 8 Aug 2025 12:52:23 +0100
+Subject: [PATCH 2/3] fix(dracut-install): the RUNPATH expansion returning
+ empty strings
+
+The input was not initially copied into the result, so the result would
+start with a null pointer and be treated as an empty string. Expansion
+will not occur in most cases, leading to a straight copy of input being
+returned, so just do that in the first place.
+
+Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
+--- a/src/install/dracut-install.c
++++ b/src/install/dracut-install.c
+@@ -770,7 +770,7 @@ static char *search_via_ldconf(const char *conf_pattern, const char *soname, con
+    expands to the directory of the given src path. $LIB expands to lib if
+    match64 is NULL or lib64 otherwise. Returns a newly allocated string even if
+    no expansion was necessary. */
+-static char *expand_runpath(char *input, const char *src, const Elf64_Ehdr *match64)
++static char *expand_runpath(const char *input, const char *src, const Elf64_Ehdr *match64)
+ {
+         regex_t regex;
+         regmatch_t rmatch[3]; /* 0: full match, 1: without brackets, 2: with brackets */
+@@ -780,11 +780,15 @@ static char *expand_runpath(char *input, const char *src, const Elf64_Ehdr *matc
+                 return NULL;
+         }
+ 
+-        char *result = NULL, *current = input;
++        char *result = strdup(input);
++        if (!result)
++                goto oom;
++
++        const char *current = input;
+         int offset = 0;
+ 
+         while (regexec(&regex, current + offset, 3, rmatch, 0) == 0) {
+-                char *varname = NULL;
++                const char *varname = NULL;
+                 _cleanup_free_ char *varval = NULL;
+                 size_t varname_len, varval_len;
+ 
+@@ -823,7 +827,7 @@ static char *expand_runpath(char *input, const char *src, const Elf64_Ehdr *matc
+         }
+ 
+         regfree(&regex);
+-        return result ?: strdup(current);
++        return result;
+ 
+ oom:
+         log_error("Out of memory");
+-- 
+2.50.1
+
+
+From 9f2f306fa971ee00cee0ae307479bc8a8dbc5263 Mon Sep 17 00:00:00 2001
+From: James Le Cuirot <jlecuirot@microsoft.com>
+Date: Fri, 8 Aug 2025 13:18:07 +0100
+Subject: [PATCH 3/3] fix(dracut-install): the handling of absolute paths in
+ sonames
+
+If the soname is an absolute path, expand it like the RUNPATH, and
+return it (with the sysroot) without further checks like glibc and musl
+do.
+
+They also support relative paths, but we cannot feasibly support them.
+Such paths are relative to the current directory of the calling process
+at runtime, which we cannot know in this context.
+
+This was observed with Neovim.
+
+Bug: https://bugs.gentoo.org/961101
+Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
+--- a/src/install/dracut-install.c
++++ b/src/install/dracut-install.c
+@@ -894,6 +894,21 @@ oom:
+ static char *find_library(const char *soname, const char *src, size_t src_len, const Elf64_Ehdr *match64,
+                           const Elf32_Ehdr *match32)
+ {
++        /* If the soname is an absolute path, expand it like the RUNPATH, and
++           return it (with the sysroot) without further checks like glibc and
++           musl do. They also support relative paths, but we cannot feasibly
++           support them. Such paths are relative to the current directory of the
++           calling process at runtime, which we cannot know in this context. */
++        if (soname[0] == '/') {
++                _cleanup_free_ char *expanded = expand_runpath(soname, src, match64);
++                if (!expanded)
++                        return NULL;
++
++                char *sysroot_expanded = NULL;
++                _asprintf(&sysroot_expanded, "%s%s", sysrootdir ?: "", expanded);
++                return sysroot_expanded;
++        }
++
+         if (match64)
+                 FIND_LIBRARY_RUNPATH_FOR_BITS(64, match64);
+         else if (match32)
+-- 
+2.50.1
+
+
+From 7186fa47fee7060a70fa6698748c4f4793edadf8 Mon Sep 17 00:00:00 2001
+From: James Le Cuirot <jlecuirot@microsoft.com>
+Date: Mon, 11 Aug 2025 10:12:59 +0100
+Subject: [PATCH 4/6] fix(dracut-install): handling of multiple sonames in
+ dlopen JSON
+
+We should not try to install every library referenced in the soname
+array, only the first one present. The array is intended to be an
+ordered preference list.
+
+Closes: https://github.com/dracut-ng/dracut-ng/issues/1552
+Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
+--- a/src/install/dracut-install.c
++++ b/src/install/dracut-install.c
+@@ -951,9 +951,10 @@ static void resolve_deps_dlopen_parse_json(Hashmap *pdeps, Hashmap *deps, const
+         for (size_t entry_idx = 0; entry_idx < sd_json_variant_elements(dlopen_json); entry_idx++) {
+                 sd_json_variant *entry = sd_json_variant_by_index(dlopen_json, entry_idx);
+                 sd_json_variant *feature_json = sd_json_variant_by_key(entry, "feature");
++                const char *feature = NULL;
+ 
+                 if (feature_json && sd_json_variant_is_string(feature_json)) {
+-                        const char *feature = sd_json_variant_string(feature_json);
++                        feature = sd_json_variant_string(feature_json);
+                         const char *name = src_soname ?: basename(fullsrcpath);
+ 
+                         Iterator i;
+@@ -988,12 +989,15 @@ static void resolve_deps_dlopen_parse_json(Hashmap *pdeps, Hashmap *deps, const
+ 
+                         const char *soname = sd_json_variant_string(soname_json);
+                         if (hashmap_get(pdeps, soname))
+-                                continue;
++                                goto skip;
+ 
+                         char *library = find_library(soname, fullsrcpath, src_len, match64, match32);
+-                        if (!library || hashmap_put_strdup_key(deps, soname, library) < 0)
+-                                log_warning("WARNING: could not locate dlopen dependency %s requested by '%s'", soname, fullsrcpath);
++                        if (library && hashmap_put_strdup_key(deps, soname, library) == 0)
++                                goto skip;
+                 }
++
++                log_warning("WARNING: could not locate dlopen dependency for %s feature requested by '%s'", feature ?: "unnamed",
++                            fullsrcpath);
+ skip:
+         }
+ }
+-- 
+2.50.1
+
+
+From 5c69be7d20af599cc6dd94d451a16d8639139bce Mon Sep 17 00:00:00 2001
+From: James Le Cuirot <jlecuirot@microsoft.com>
+Date: Mon, 11 Aug 2025 10:51:51 +0100
+Subject: [PATCH 5/6] fix(dracut-install): cache resolve_deps calls for speed
+ and less noise
+
+The dlopen dependency failure warning was particularly noisy and likely
+to trigger. We were already caching the processed items in resolve_lazy,
+but resolve_deps recurses many times, so it was necessary to move the
+cache down a level. I didn't reuse "items" here because it would have
+clashed with its usage elsewhere.
+
+I had to think about whether the cache would function correctly with
+changing values of pdeps. If a dependency is not found on the first
+attempt, it does not prevent its consumer from being installed, so it
+does not matter that it might be found via a RUNPATH on a subsequent
+attempt.
+
+Closes: https://github.com/dracut-ng/dracut-ng/issues/1552
+Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
+--- a/src/install/dracut-install.c
++++ b/src/install/dracut-install.c
+@@ -93,6 +93,7 @@ static Hashmap *items_failed = NULL;
+ static Hashmap *modules_loaded = NULL;
+ static Hashmap *modules_suppliers = NULL;
+ static Hashmap *processed_suppliers = NULL;
++static Hashmap *processed_deps = NULL;
+ static Hashmap *modalias_to_kmod = NULL;
+ static Hashmap *add_dlopen_features = NULL;
+ static Hashmap *omit_dlopen_features = NULL;
+@@ -1132,13 +1133,21 @@ skip:
+    Both ELF binaries and scripts with shebangs are handled. */
+ static int resolve_deps(const char *src, Hashmap *pdeps)
+ {
+-        _cleanup_free_ char *fullsrcpath = NULL;
+-
+-        fullsrcpath = get_real_file(src, true);
++        char *fullsrcpath = get_real_file(src, true);
+         log_debug("resolve_deps('%s') -> get_real_file('%s', true) = '%s'", src, src, fullsrcpath);
+         if (!fullsrcpath)
+                 return 0;
+ 
++        switch (hashmap_put(processed_deps, fullsrcpath, fullsrcpath)) {
++        case -EEXIST:
++                free(fullsrcpath);
++                return 0;
++        case -ENOMEM:
++                log_error("Out of memory");
++                free(fullsrcpath);
++                return -ENOMEM;
++        }
++
+         _cleanup_close_ int fd = open(fullsrcpath, O_RDONLY | O_CLOEXEC);
+         if (fd < 0) {
+                 log_error("ERROR: cannot open '%s': %m", fullsrcpath);
+@@ -1838,27 +1847,10 @@ static int parse_argv(int argc, char *argv[])
+ static int resolve_lazy(int argc, char **argv)
+ {
+         int i;
+-        size_t destrootdirlen = strlen(destrootdir);
+         int ret = 0;
+-        char *item;
+         for (i = 0; i < argc; i++) {
+-                const char *src = argv[i];
+-                char *p = argv[i];
+-
+-                log_debug("resolve_deps('%s')", src);
+-
+-                if (strstr(src, destrootdir)) {
+-                        p = &argv[i][destrootdirlen];
+-                }
+-
+-                if (check_hashmap(items, p)) {
+-                        continue;
+-                }
+-
+-                item = strdup(p);
+-                hashmap_put(items, item, item);
+-
+-                ret += resolve_deps(src, NULL);
++                log_debug("resolve_deps('%s')", argv[i]);
++                ret += resolve_deps(argv[i], NULL);
+         }
+         return ret;
+ }
+@@ -3008,13 +3000,14 @@ int main(int argc, char **argv)
+         items = hashmap_new(string_hash_func, string_compare_func);
+         items_failed = hashmap_new(string_hash_func, string_compare_func);
+         processed_suppliers = hashmap_new(string_hash_func, string_compare_func);
++        processed_deps = hashmap_new(string_hash_func, string_compare_func);
+         modalias_to_kmod = hashmap_new(string_hash_func, string_compare_func);
+ 
+         dlopen_features[0] = add_dlopen_features = hashmap_new(string_hash_func, string_compare_func);
+         dlopen_features[1] = omit_dlopen_features = hashmap_new(string_hash_func, string_compare_func);
+ 
+         if (!items || !items_failed || !processed_suppliers || !modules_loaded ||
+-            !add_dlopen_features || !omit_dlopen_features) {
++            !processed_deps || !add_dlopen_features || !omit_dlopen_features) {
+                 log_error("Out of memory");
+                 r = EXIT_FAILURE;
+                 goto finish1;
+@@ -3093,6 +3086,9 @@ finish2:
+         while ((i = hashmap_steal_first(processed_suppliers)))
+                 item_free(i);
+ 
++        while ((i = hashmap_steal_first(processed_deps)))
++                item_free(i);
++
+         for (size_t j = 0; j < 2; j++) {
+                 char ***array;
+                 Iterator it;
+@@ -3118,6 +3114,7 @@ finish2:
+         hashmap_free(modules_loaded);
+         hashmap_free(modules_suppliers);
+         hashmap_free(processed_suppliers);
++        hashmap_free(processed_deps);
+         hashmap_free(modalias_to_kmod);
+ 
+         if (arg_mod_filter_path)
+-- 
+2.50.1
+
+
+From edb94a1b2c7d11a29eb055a28fa598e8fd317fe4 Mon Sep 17 00:00:00 2001
+From: James Le Cuirot <jlecuirot@microsoft.com>
+Date: Tue, 12 Aug 2025 10:15:58 +0100
+Subject: [PATCH 6/6] fix(dracut-install): broken calls to mmap with 0 length
+
+This results in an invalid argument error, so check for 0 length first.
+
+Fixes: https://bugs.gentoo.org/961340
+Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
+--- a/src/install/dracut-install.c
++++ b/src/install/dracut-install.c
+@@ -632,7 +632,11 @@ static char *check_lib_match(const char *dirname, const char *basename, const ch
+         if (fstat(fd, &sb) < 0)
+                 goto finish2;
+ 
+-        void *map = mmap(NULL, sb.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
++        size_t lib_len = sb.st_size;
++        if (lib_len == 0)
++                goto finish2;
++
++        void *map = mmap(NULL, lib_len, PROT_READ, MAP_PRIVATE, fd, 0);
+         if (map == MAP_FAILED)
+                 goto finish2;
+ 
+@@ -1161,6 +1165,9 @@ static int resolve_deps(const char *src, Hashmap *pdeps)
+         }
+ 
+         size_t src_len = sb.st_size;
++        if (src_len == 0)
++                return 0;
++
+         void *map = mmap(NULL, src_len, PROT_READ, MAP_PRIVATE, fd, 0);
+         if (map == MAP_FAILED) {
+                 log_error("ERROR: cannot mmap '%s': %m", fullsrcpath);
+-- 
+2.50.1
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-respect-objcopy-and-objdump.patch b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-respect-objcopy-and-objdump.patch
new file mode 100644
index 00000000000..5ab73d1a8e8
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-respect-objcopy-and-objdump.patch
@@ -0,0 +1,89 @@
+diff --git a/dracut-functions.sh b/dracut-functions.sh
+index 84a34fafd..617ccf91c 100755
+--- a/dracut-functions.sh
++++ b/dracut-functions.sh
+@@ -1042,7 +1042,7 @@ get_dev_module() {
+ pe_file_format() {
+     if [[ $# -eq 1 ]]; then
+         local magic
+-        magic=$(objdump -p "$1" \
++        magic=$("${OBJDUMP:-objdump}" -p "$1" \
+             | awk '{if ($1 == "Magic"){print $2}}')
+         # 010b (PE32), 020b (PE32+)
+         [[ $magic == "020b" || $magic == "010b" ]] && return 0
+@@ -1055,7 +1055,7 @@ pe_get_header_data() {
+     local data_header
+     [[ $# -ne "2" ]] && return 1
+     [[ $(pe_file_format "$1") -eq 1 ]] && return 1
+-    data_header=$(objdump -p "$1" \
++    data_header=$("${OBJDUMP:-objdump}" -p "$1" \
+         | awk -v data="$2" '{if ($1 == data){print $2}}')
+     echo "$data_header"
+ }
+diff --git a/dracut.sh b/dracut.sh
+index 45373efb7..b53d72924 100755
+--- a/dracut.sh
++++ b/dracut.sh
+@@ -1649,7 +1649,7 @@ if [[ ! $print_cmdline ]]; then
+     fi
+ 
+     if [[ $uefi == yes ]]; then
+-        if ! command -v objcopy &> /dev/null; then
++        if ! command -v "${OBJCOPY:-objcopy}" &> /dev/null; then
+             dfatal "Need 'objcopy' to create a UEFI executable"
+             exit 1
+         fi
+@@ -2638,7 +2638,7 @@ clean_sbat_string() {
+ get_sbat_string() {
+     local inp=$1
+     local out=$uefi_outdir/$2
+-    objcopy -O binary --only-section=.sbat "$inp" "$out"
++    "${OBJCOPY:-objcopy}" -O binary --only-section=.sbat "$inp" "$out"
+     clean_sbat_string "$out"
+ }
+ 
+@@ -2656,7 +2656,7 @@ if [[ $uefi == yes ]]; then
+         fi
+     fi
+ 
+-    offs=$(($(objdump -h "$uefi_stub" 2> /dev/null | awk 'NF==7 {size=$3;
++    offs=$(($("${OBJDUMP:-objdump}" -h "$uefi_stub" 2> /dev/null | awk 'NF==7 {size=$3;
+                 offset=$4} END {print "16#"size" + 16#"offset}')))
+     if [[ $offs -eq 0 ]]; then
+         dfatal "Failed to get the size of $uefi_stub to create UEFI image file"
+@@ -2719,7 +2719,7 @@ if [[ $uefi == yes ]]; then
+ 
+     tmp_uefi_stub=$uefi_outdir/elf.stub
+     cp "$uefi_stub" "$tmp_uefi_stub"
+-    objcopy --remove-section .sbat "$tmp_uefi_stub" &> /dev/null
++    "${OBJCOPY:-objcopy}" --remove-section .sbat "$tmp_uefi_stub" &> /dev/null
+ 
+     if command -v ukify &> /dev/null; then
+         dinfo "*** Using ukify to create UKI ***"
+@@ -2749,7 +2749,7 @@ if [[ $uefi == yes ]]; then
+             exit 1
+         fi
+     else
+-        if objcopy \
++        if "${OBJCOPY:-objcopy}" \
+             ${SOURCE_DATE_EPOCH:+--enable-deterministic-archives --preserve-dates} \
+             ${uefi_osrelease:+--add-section .osrel="$uefi_osrelease" --change-section-vma .osrel=$(printf 0x%x "$uefi_osrelease_offs")} \
+             ${uefi_cmdline:+--add-section .cmdline="$uefi_cmdline" --change-section-vma .cmdline=$(printf 0x%x "$uefi_cmdline_offs")} \
+diff --git a/lsinitrd.sh b/lsinitrd.sh
+index 86b2c5a67..fd0633dfa 100755
+--- a/lsinitrd.sh
++++ b/lsinitrd.sh
+@@ -358,11 +358,11 @@ unpack_files() {
+ 
+ read -r -N 2 bin < "$image"
+ if [ "$bin" = "MZ" ]; then
+-    command -v objcopy > /dev/null || {
++    command -v "${OBJCOPY:-objcopy}" > /dev/null || {
+         echo "Need 'objcopy' to unpack an UEFI executable."
+         exit 1
+     }
+-    objcopy \
++    "${OBJCOPY:-objcopy}" \
+         --dump-section .linux="$TMPDIR/vmlinuz" \
+         --dump-section .initrd="$TMPDIR/initrd.img" \
+         --dump-section .cmdline="$TMPDIR/cmdline.txt" \

From 1ee26bb8f26ab1f6b8693d0235ba83bdf3b47753 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:16:31 +0000
Subject: [PATCH 109/122] sys-kernel/linux-headers: Sync with Gentoo

It's from Gentoo commit b764b57f11046580ee843664a5669ad08dc2fbe2.
---
 .../sys-kernel/linux-headers/Manifest         |  2 +
 .../linux-headers/linux-headers-6.16.ebuild   | 51 +++++++++++++++++++
 2 files changed, 53 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/linux-headers-6.16.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/Manifest b/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/Manifest
index 1df682a4cf0..e2b75bd14e1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/Manifest
@@ -13,6 +13,7 @@ DIST gentoo-headers-6.12-1.tar.xz 1164 BLAKE2B 87b1f0e5bbc7e7a04dc05a12c8ac0e1a2
 DIST gentoo-headers-6.13-1.tar.xz 1164 BLAKE2B 92c2b223c597b1aa94be129932902253308ceb66a0f4b8f9d1a79582a241c5e50d75363c6ebfc8266141f5d576dacc42acb7f6c09fe2c374b98f70c2210f4a08 SHA512 6885e725f17e07e565512dfaeb248fba01822a8836e4d6a8d3f84436ffe9290df2d0450de282efb4a18af893111e4258f69a5c6581d1783aebaee999c7e6db02
 DIST gentoo-headers-6.14-1.tar.xz 1164 BLAKE2B 2c72d180953c450158690549fb2e852310bba07cb9e81646b841348eb9327d82b5a203760c7f5b50a1a82bcca21968926a085024b36ac75f077a2fc957fa0e51 SHA512 962b7670c563f886bddbd04b49652d3a6af282a162c00a27f5ec95ca2c6a55227cfbf2819b8b754a53fd54d5106a5ea72da8f34411cfc16c7fe2cf4b700d670a
 DIST gentoo-headers-6.15-1.tar.xz 1168 BLAKE2B 2a48bece7181e24ebaf4c206823406fbeca44b13757b7dd1f63c1c3d4585e3d808e71bb503fda3b8461fb4b8eaa39ea6fcff7cebc1b97734afdeb9ed87293246 SHA512 3aee6d4327ab8414d35cda0a826b1d0068807525d12041e2c49141986ab8835f135418a9736640d8836581af90fa8fdf4c15c54eee1f0b18ae86413e3eb81d34
+DIST gentoo-headers-6.16-1.tar.xz 1168 BLAKE2B 01e016fd7fbe35c03e9be3df8c0bc4f4d885ae783dcec0631957c9f8d4cc4e294afc0fee6eda7a16526f10503aaed333685b18f3266025170ed28fe51b7ef3ae SHA512 1460a2c1a8589059e2df61c8cdd4da5ddada08d0889485cd3daf688f0274780bc0be46c9691df9039c77919c364cc85f08a0db899d014bdf4b79d9f853876791
 DIST gentoo-headers-6.6-1.tar.xz 1172 BLAKE2B 626bb33b42f48bceca2ba6a0a9c0b043a8607bb391d3b541e98d2af42eacfabeda3a5a3d48b7bee1fd0a2a8ad0b6173bde49d3827ea087e501eb0e91d18c4ab7 SHA512 09bcda97d9d17ee3f66ee46d9c00b8ac4fba5b9662fa24e4e2754bd9e4e7b3f097e5f2d52281eeb7a671dfe303aabe15c8fd66f117fddf29fb094e28d8c603b3
 DIST gentoo-headers-6.8-1.tar.xz 1164 BLAKE2B 43283b61fc35057c7f703108d6e4aead901329106e4c297cdfc261e8f9cb1f2ec9370b7367432b9eabe9fcc4358da745170b1f4ec6079d373f50de1fde148778 SHA512 c43e18ce1b39a60e163c2e0f824b1402bcbda84f20b2ae38d53681ff517713c42fd876954fab0ab8044b66e28e32f9ee93fc61ecbbc9c2bb5a9932a0616e570c
 DIST gentoo-headers-6.9-1.tar.xz 1164 BLAKE2B fd385a2c39e9528f60dee582f153485842e76a8a9ad87fd8a11179b8ad2558df23e3c7fb7476f3f1011536e26da50f625a660d2a8ae01954300085f8b3f1bb01 SHA512 3fad4602e453a9aae24cc640ee6c70b06f221c78262f5befe794ca5eb48c352aff335715b5033760ca690bdef55e6a6acb5d3d2351bae885f3023098b5c6ecb1
@@ -31,6 +32,7 @@ DIST linux-6.12.tar.xz 147906904 BLAKE2B b2ec2fc69218cacabbbe49f78384a5d259ca581
 DIST linux-6.13.tar.xz 148523052 BLAKE2B 9f617ecb3f2393b57ba03c654fea62a7213f24c835989f333a1ef29492af551bfa7d9ad786d5ef1484854adc77c7c6af38fb09a72d994d305695f512c325e77f SHA512 1137e6440132b0958f89165440e99208f82b204e7245ae69dc9c808df97d13ce8f58136db92407e0e93394fa7f6283ec7a34597c6e92a5b6d9025e0960357957
 DIST linux-6.14.tar.xz 149408504 BLAKE2B 11835719804b406fe281ea1c276a84dc0cbaa808552ddcca9233d3eaeb1c001d0455c7205379b02de8e8db758c1bae6fe7ceb6697e63e3cf9ae7187dc7a9715e SHA512 71dcaa3772d8d9797c3ae30cae9c582b11a7047a3bbcb8dfd479a4dffb40ff0da74cf3d45175f50cc9992e338bcadd46c9c570f54054ca3bde6661768d3d22eb
 DIST linux-6.15.tar.xz 151168812 BLAKE2B 465596c6dc053ff3a3966302a906d3edb4f7ee1ef82f8c20b96360196d3414f5b1deeafa67b8340fcdecd3617280ba9b756d7073ad15c707865e256397b4af53 SHA512 d03788ffa8d8ae1b84ef1286bb44a08fc01432e509dfec6cccae5c5a5a47201d378aec2bcd21e6f0bbd1e625b26f47780c06ee9c1cef3775358f98b160923f30
+DIST linux-6.16.tar.xz 152620004 BLAKE2B 87bc4da7e89cc8265aebffea7ec6c09f711be24fee87cb1c03a264c03fd5a538d66aa806640835aa5103926e612cdfbc52d7c861d7f7065f1a8bb11d893b0921 SHA512 55a00f89ad6db6db2e26ff5dc5cfc96bbf6654e5bd5d17d2a3b944a47640367e54139716d230923187bebc6cb7756edc9511a620fb8abc6f32c50a658a734784
 DIST linux-6.6.tar.xz 140064536 BLAKE2B 5f02fd8696d42f7ec8c5fbadec8e7270bdcfcb1f9844a6c4db3e1fd461c93ce1ccda650ca72dceb4890ebcbbf768ba8fba0bce91efc49fbd2c307b04e95665f2 SHA512 458b2c34d46206f9b4ccbac54cc57aeca1eaecaf831bc441e59701bac6eadffc17f6ce24af6eadd0454964e843186539ac0d63295ad2cc32d112b60360c39a35
 DIST linux-6.8.tar.xz 142502100 BLAKE2B c6f17f816cea16e629f63e9379b98888713f57b2c5173306926471f139a9d612a0c74e119341f8075390e55e203d787d9edeb4ad5a064b18870f6f0f7ffaafb2 SHA512 5c4eb4aa1d3f7d1ea01c0f7ddeadacdece6e144fd4bdfc16b2b925d3e10dc04de3a6db69320b79a96c3560052616f001d2c09e7a1bb4f7b731e2380a7ecce068
 DIST linux-6.9.tar.xz 144034416 BLAKE2B 4cf86c3cfe6e6534745d42dfaeca59b17ea1168c4e8b615c80e6d8aac735f11283cd85fa992b440b5d4452917e94b9f08397a64af0be5894e3df23c68892377e SHA512 fed3b4cd1fbfb4d94618587c1934273d2ecc8b6e42a3d586ff8a5f24980be930f2ef803aa2923ca3bfa5e4e619f967f3af315368f24fa76f610b10443624a579
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/linux-headers-6.16.ebuild b/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/linux-headers-6.16.ebuild
new file mode 100644
index 00000000000..2296d0506c4
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/linux-headers-6.16.ebuild
@@ -0,0 +1,51 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+ETYPE="headers"
+H_SUPPORTEDARCH="alpha amd64 arc arm arm64 csky hexagon hppa loong m68k microblaze mips nios2 openrisc ppc ppc64 riscv s390 sh sparc x86 xtensa"
+inherit kernel-2
+detect_version
+
+PATCH_PV=${PV} # to ease testing new versions against not existing patches
+PATCH_VER="1"
+PATCH_DEV="sam"
+SRC_URI="
+	${KERNEL_URI}
+	${PATCH_VER:+https://dev.gentoo.org/~${PATCH_DEV}/distfiles/sys-kernel/linux-headers/gentoo-headers-${PATCH_PV}-${PATCH_VER}.tar.xz}
+"
+S="${WORKDIR}/linux-${PV}"
+
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+
+BDEPEND="
+	app-arch/xz-utils
+	dev-lang/perl
+"
+
+src_unpack() {
+	# Avoid kernel-2_src_unpack
+	default
+}
+
+src_prepare() {
+	local PATCHES=()
+	[[ -n ${PATCH_VER} ]] && PATCHES+=( "${WORKDIR}"/${PATCH_PV} )
+
+	# TODO: May need forward porting to newer versions
+	use elibc_musl && PATCHES+=(
+		"${FILESDIR}"/${PN}-5.15-remove-inclusion-sysinfo.h.patch
+	)
+
+	# Avoid kernel-2_src_prepare
+	default
+}
+
+src_install() {
+	kernel-2_src_install
+
+	find "${ED}" \( -name '.install' -o -name '*.cmd' \) -delete || die
+	# Delete empty directories
+	find "${ED}" -empty -type d -delete || die
+}

From 29ed6376d4dbc2f598a9148230756fc1e1d13b37 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:16:31 +0000
Subject: [PATCH 110/122] sys-libs/binutils-libs: Sync with Gentoo

It's from Gentoo commit 41ac22ad581efdd9a431ff98a6fe63355938a654.
---
 .../sys-libs/binutils-libs/Manifest           |   3 +-
 .../binutils-libs/binutils-libs-2.44.ebuild   | 225 ------------------
 ...44-r1.ebuild => binutils-libs-2.45.ebuild} |  36 ++-
 3 files changed, 34 insertions(+), 230 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44.ebuild
 rename sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/{binutils-libs-2.44-r1.ebuild => binutils-libs-2.45.ebuild} (86%)

diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/Manifest
index d28c78db2d1..9adc46f37f6 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/Manifest
@@ -18,6 +18,7 @@ DIST binutils-2.42-patches-6.tar.xz 50664 BLAKE2B f13b65a761cfba80caf2e4740c6383
 DIST binutils-2.42.tar.xz 27567160 BLAKE2B e67a5c028fba70e70088fd11b38ec8c9c4ed5a019badefda25abeb6275997b16f0891e7ff3424c4b82bbfae92e8992669826920dd53df61cd48469d8f7cd5bd1 SHA512 155f3ba14cd220102f4f29a4f1e5cfee3c48aa03b74603460d05afb73c70d6657a9d87eee6eb88bf13203fe6f31177a5c9addc04384e956e7da8069c8ecd20a6
 DIST binutils-2.43-patches-3.tar.xz 62692 BLAKE2B a189a01a6a99c4fdff124cf90ecc18f874812c17fc735376c855469c487b6a71489ad5c2f86c518d2e029cc83d65757144ff9abddbe7ec3fc06e22f9501c62f4 SHA512 99a30e18fdfd7bdce85bb903f8d61837cfbb639ead8a680ff1a85ad1d615b658e696bdf196c4a002d029f952d34aa441e09e861b22f5400c65f07cce5934cd8f
 DIST binutils-2.43.tar.xz 28175768 BLAKE2B 28b0a04a28273b76eab2d00e00160be889f155f77f5a9d8759ef8dce505c97e97641bf7ec70b92b731b520570a02b06e04e8215b068fcb1bb2573e9ef24732d9 SHA512 93e063163e54d6a6ee2bd48dc754270bf757a3635b49a702ed6b310e929e94063958512d191e66beaf44275f7ea60865dbde138b624626739679fcc306b133bb
-DIST binutils-2.44-patches-1.tar.xz 9156 BLAKE2B c72a7d0ffdb852f8de9c18e187b5768085b3a070744a4fadef508ab0e865d3a3967ec12a0ee7a325b6b689f39e5243aacd9d3f73ceb723d53592ec6ca640161b SHA512 053de98536e92837d0a08fac26bb0f057431747fe6e82f8b9ac54dd9aed65d8de379d653c0e8a8cd31267b9769825a420db5f40957f8c4eb54a7e4a9d76fadb8
 DIST binutils-2.44-patches-4.tar.xz 83612 BLAKE2B caa71849dbbfe1181072c84985c786284f5111bbaa638a44e828c6cc4c19e005793d045dc116c772cf7ffed4898f6f6c935d04f94a76c26e59fb3c4f5adf03d1 SHA512 4dd8e6c36a0423ab29a1f4b227c90a05eb61cab380c809a2f49bba27e84d621e6a5eefe4ec510a7c1c60ba93720f92159ac477c02f9e720e1bbcd6aaf6097d26
 DIST binutils-2.44.tar.xz 27285788 BLAKE2B 0eb031ace9fb5a7047b81b5a05b1760f7d332c8ed67f98899f153a45f181b83e661a484551af05c0a9b2adc422da84619103c7b1f3c9fad5327872832b5446aa SHA512 b85d3bbc0e334cf67a96219d3c7c65fbf3e832b2c98a7417bf131f3645a0307057ec81cd2b29ff2563cec53e3d42f73e2c60cc5708e80d4a730efdcc6ae14ad7
+DIST binutils-2.45-patches-1.tar.xz 15588 BLAKE2B b88c62a6483807dfb24c97c534aadc1f930ea2d6cd8ad86734c40458a0e3ac4d149c0ee47c6ba541c462ce0e619dfaa5328c3dd5ffbd94511c487956866c7a38 SHA512 05c890a71d465539b3d066c2fd92930e4d6c9003147395a4c2cb9cc514f412fa392892e2c3b8887493a56b00453ac383612d0cac42e4cacce983e65886537149
+DIST binutils-2.45.tar.xz 27868232 BLAKE2B 1ce72346b1f531c89feb86b407e2c649151b506ffbd1a02d413411d36f7ede98fa9a1adf75dd941c01df5fe7e6bf151828b269eeb7c278315ca8004bff22eb7f SHA512 c7b10a7466d9fd398d7a0b3f2a43318432668d714f2ec70069a31bdc93c86d28e0fe83792195727167743707fbae45337c0873a0786416db53bbf22860c16ce7
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44.ebuild
deleted file mode 100644
index 3265100b04c..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44.ebuild
+++ /dev/null
@@ -1,225 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit flag-o-matic libtool toolchain-funcs multilib-minimal
-
-DESCRIPTION="Core binutils libraries (libbfd, libopcodes, libiberty) for external packages"
-HOMEPAGE="https://sourceware.org/binutils/"
-
-LICENSE="|| ( GPL-3 LGPL-3 )"
-IUSE="64-bit-bfd cet multitarget nls static-libs test"
-
-# Variables that can be set here  (ignored for live ebuilds)
-# PATCH_VER          - the patchset version
-#                      Default: empty, no patching
-# PATCH_BINUTILS_VER - the binutils version in the patchset name
-#                    - Default: PV
-# PATCH_DEV          - Use download URI https://dev.gentoo.org/~{PATCH_DEV}/distfiles/...
-#                      for the patchsets
-
-PATCH_VER=1
-PATCH_DEV=dilfridge
-
-MY_PN=binutils
-MY_P=${MY_PN}-${PV}
-
-if [[ ${PV} == 9999 ]]; then
-	inherit git-r3
-	SLOT="0/${PV}"
-elif [[ ${PV} == *9999 ]]; then
-	inherit git-r3
-	SLOT="0/$(ver_cut 1-2)"
-else
-	PATCH_BINUTILS_VER=${PATCH_BINUTILS_VER:-${PV}}
-	PATCH_DEV=${PATCH_DEV:-dilfridge}
-	SRC_URI="mirror://gnu/binutils/${MY_P}.tar.xz
-	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${MY_P}.tar.xz
-	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${MY_PN}-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
-	SLOT="0/${PV}"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
-fi
-
-BDEPEND="
-	nls? ( sys-devel/gettext )
-	test? ( dev-util/dejagnu )
-"
-DEPEND="sys-libs/zlib[${MULTILIB_USEDEP}]"
-# Need a newer binutils-config that'll reset include/lib symlinks for us.
-RDEPEND="${DEPEND}
-	>=sys-devel/binutils-config-5
-"
-
-RESTRICT="!test? ( test )"
-
-MY_BUILDDIR=${WORKDIR}/build
-
-MULTILIB_WRAPPED_HEADERS=(
-	/usr/include/bfd.h
-)
-
-src_unpack() {
-	if [[ ${PV} == *9999 ]] ; then
-		EGIT_REPO_URI="
-			https://anongit.gentoo.org/git/proj/toolchain/binutils-patches.git
-			https://github.com/gentoo/binutils-patches
-		"
-		EGIT_CHECKOUT_DIR=${WORKDIR}/patches-git
-		git-r3_src_unpack
-		mv patches-git/9999 patch || die
-
-		if [[ ${PV} != 9999 ]] ; then
-			EGIT_BRANCH=binutils-$(ver_cut 1)_$(ver_cut 2)-branch
-		fi
-		EGIT_REPO_URI="
-			https://sourceware.org/git/binutils-gdb.git
-			https://git.sr.ht/~sourceware/binutils-gdb
-			https://gitlab.com/x86-binutils/binutils-gdb.git
-		"
-		S=${WORKDIR}/binutils
-		EGIT_CHECKOUT_DIR=${S}
-		git-r3_src_unpack
-	else
-		unpack ${MY_P}.tar.xz
-
-		cd "${WORKDIR}" || die
-		unpack binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz
-
-		# _p patch versions are Gentoo specific tarballs ...
-		local dir=${MY_P}
-		dir=${dir/-hppa64/}
-
-		S=${WORKDIR}/${dir}
-	fi
-
-	cd "${WORKDIR}" || die
-	mkdir -p "${MY_BUILDDIR}" || die
-}
-
-src_prepare() {
-	if [[ -n ${PATCH_VER} ]] ; then
-		einfo "Applying binutils-${PATCH_BINUTILS_VER} patchset ${PATCH_VER}"
-		eapply "${WORKDIR}/patch"/*.patch
-	fi
-
-	# Fix cross-compile relinking issue, bug #626402
-	elibtoolize
-
-	if [[ ${CHOST} == *-darwin* ]] ; then
-		# somehow libtool/configure is messed up and (custom patch at
-		# upstream?) and misdetects (basically assumes) nm can be called
-		# with -B arg -- can't run eautoreconf (fails), so patch up
-		# manually, this would break any target that needs -B to nm
-		sed -i -e 's/lt_cv_path_NM="$tmp_nm -B"/lt_cv_path_NM="$tmp_nm"/' \
-			libctf/configure || die
-	fi
-
-	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
-	# Avoid really confusing logs from subconfigure spam, makes logs far
-	# more legible.
-	export MAKEOPTS="--output-sync=line ${MAKEOPTS}"
-
-	default
-}
-
-pkgversion() {
-	printf "Gentoo ${PVR}"
-	[[ -n ${PATCHVER} ]] && printf " p${PATCHVER}"
-}
-
-multilib_src_configure() {
-	# bug #814326
-	filter-lto
-
-	local myconf=(
-		# portage's econf() does not detect presence of --d-d-t
-		# because it greps only top-level ./configure. But not
-		# libiberty's or bfd's configure.
-		--disable-dependency-tracking
-		--disable-silent-rules
-		--enable-obsolete
-		--enable-shared
-		--enable-threads
-		# Newer versions (>=2.24) make this an explicit option. #497268
-		--enable-install-libiberty
-		--disable-werror
-		--with-bugurl="https://bugs.gentoo.org/"
-		--with-pkgversion="$(pkgversion)"
-		$(use_enable static-libs static)
-		# The binutils eclass enables this flag for all bi-arch builds,
-		# but other tools often don't care about that support.  Put it
-		# beyond a flag if people really want it, but otherwise leave
-		# it disabled as it can slow things down on 32bit arches. #438522
-		$(use_enable 64-bit-bfd)
-		# This only disables building in the zlib subdir.
-		# For binutils itself, it'll use the system version. #591516
-		--without-zlib
-		--with-system-zlib
-		# We only care about the libs, so disable programs. #528088
-		--disable-{binutils,etc,ld,gas,gprof,gprofng}
-		# Disable modules that are in a combined binutils/gdb tree. #490566
-		--disable-{gdb,gdbserver,libbacktrace,libdecnumber,readline,sim}
-		# Strip out broken static link flags.
-		# https://gcc.gnu.org/PR56750
-		--without-stage1-ldflags
-		# We pull in all USE-flags that change ABI in an incompatible
-		# way. #666100
-		# USE=multitarget change size of global arrays
-		# USE=64-bit-bfd changes data structures of exported API
-		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)-$(usex 64-bit-bfd 64 def)
-
-		# avoid automagic dependency on (currently prefix) systems
-		# systems with debuginfod library, bug #754753
-		--without-debuginfod
-
-		# Revisit if it's useful, we do have binutils[zstd] though
-		--without-zstd
-
-		# Allow user to opt into CET for host libraries.
-		# Ideally we would like automagic-or-disabled here.
-		# But the check does not quite work on i686: bug #760926.
-		$(use_enable cet)
-	)
-
-	# mips can't do hash-style=gnu ...
-	if [[ $(tc-arch) != mips ]] ; then
-		myconf+=( --enable-default-hash-style=gnu )
-	fi
-
-	use multitarget && myconf+=( --enable-targets=all --enable-64-bit-bfd )
-
-	use nls \
-		&& myconf+=( --without-included-gettext ) \
-		|| myconf+=( --disable-nls )
-
-	if [[ ${CHOST} == *-darwin* ]] && use nls ; then
-		# fix underlinking in opcodes
-		sed -i -e 's/@SHARED_LDFLAGS@/@SHARED_LDFLAGS@ -lintl/' \
-			"${S}"/opcodes/Makefile.in || die
-	fi
-
-	ECONF_SOURCE="${S}" econf "${myconf[@]}"
-
-	# Prevent makeinfo from running as we don't build docs here.
-	# bug #622652
-	sed -i \
-		-e '/^MAKEINFO/s:=.*:= true:' \
-		Makefile || die
-}
-
-multilib_src_install() {
-	emake DESTDIR="${D}" install
-
-	# Provided by dev-debug/gdb instead
-	if [[ ${PV} != 9999 ]] ; then
-		rm "${ED}"/usr/share/info/sframe-spec.info || die
-	fi
-
-	# Provide libiberty.h directly.
-	dosym libiberty/libiberty.h /usr/include/libiberty.h
-}
-
-multilib_src_install_all() {
-	use static-libs || find "${ED}"/usr -name '*.la' -delete
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.45.ebuild
similarity index 86%
rename from sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.45.ebuild
index 6d25065050a..5c677ffd910 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.45.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit dot-a libtool toolchain-funcs multilib-minimal
+inherit dot-a flag-o-matic libtool toolchain-funcs multilib-minimal
 
 DESCRIPTION="Core binutils libraries (libbfd, libopcodes, libiberty) for external packages"
 HOMEPAGE="https://sourceware.org/binutils/"
@@ -208,9 +208,37 @@ multilib_src_configure() {
 }
 
 multilib_src_test() {
-	# Without this, the default `src_test` check for the 'check' target
-	# with `-n` may fail with parallel make and silently skip tests (bug #955595)
-	emake check
+	(
+		# Tests don't expect LTO
+		filter-lto
+
+		# If we have e.g. -mfpmath=sse -march=pentium4 in CFLAGS,
+		# we'll get lto1 warnings for some tests which cause
+		# spurious failures because -mfpmath isn't passed at
+		# link-time. Filter accordingly.
+		#
+		# Alternatively, we could pass C{C,XX}_FOR_TARGET with
+		# some (ideally not all, surely would break some tests)
+		# stuffed in.
+		filter-flags '-mfpmath=*'
+
+		# lto-wrapper warnings which confuse tests
+		filter-flags '-Wa,*'
+
+		# bug #637066
+		filter-flags -Wall -Wreturn-type
+
+		# Note that we need 'check' explicitly if ever cleaning this
+		# up: the default `src_test` check for the 'check' target
+		# with `-n` may fail with parallel make and silently skip tests (bug #955595)
+		emake -k check \
+			CFLAGS_FOR_TARGET="${CFLAGS_FOR_TARGET:-${CFLAGS}}" \
+			CXXFLAGS_FOR_TARGET="${CXXFLAGS_FOR_TARGET:-${CXXFLAGS}}" \
+			LDFLAGS_FOR_TARGET="${LDFLAGS_FOR_TARGET:-${LDFLAGS}}" \
+			CFLAGS="${CFLAGS}" \
+			CXXFLAGS="${CXXFLAGS}" \
+			LDFLAGS="${LDFLAGS}"
+	)
 }
 
 multilib_src_install() {

From 74a7d56a2a8e58ff1dda0ba8bd8a2843c714e141 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:16:34 +0000
Subject: [PATCH 111/122] sys-libs/gdbm: Sync with Gentoo

It's from Gentoo commit d9904eedca75aef09bdc6036414ef81644f75505.
---
 .../portage-stable/sys-libs/gdbm/Manifest     |  2 +
 .../sys-libs/gdbm/gdbm-1.24.ebuild            |  2 +-
 .../sys-libs/gdbm/gdbm-1.25.ebuild            |  2 +-
 .../sys-libs/gdbm/gdbm-1.26.ebuild            | 64 +++++++++++++++++++
 4 files changed, 68 insertions(+), 2 deletions(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.26.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/Manifest
index 166446d0756..741bae376ae 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/Manifest
@@ -2,3 +2,5 @@ DIST gdbm-1.24.tar.gz 1195931 BLAKE2B 79f49adbb455c2e1b91f3450037b71165fa8de8265
 DIST gdbm-1.24.tar.gz.sig 95 BLAKE2B 3a66c2a256d9601db57df20feb5d72d1e94d23b7a92e3099f121549c8aa2c57b05a3021d88f97291819378462a68664af958de4c9de65887d2cca6642d172bc3 SHA512 a54595e0fd23724f5e30c2ff1b9656dbb6da3b448f4ab6a2579a523c11bae53e47d3843327a1e4499b312ab947ac73b5a9aa6e78fe5e932c55a1be0cdab4e63d
 DIST gdbm-1.25.tar.gz 1224180 BLAKE2B 6abf5f77823dda7ebcaa775d58f7a311c8f73c7521fe223398b5cb4b4831ad177cfd87fd42f2b24ca2fc5984af7d51abcc5e509ceb6aab2746a52aecb550654b SHA512 1785598665d7323eed052a55708903c6abaeafcfb66a9ceb69293f57c3fdbf49cd8a821ef23715a40bf7030d0067d1340d12279ed07afe040f912e53078e47f5
 DIST gdbm-1.25.tar.gz.sig 566 BLAKE2B 7740ca7be87eb3f33ff2fd330e35dd900786d9d6a589d466202a121e0e943d3037a75daf584f0b8c99cf10ffac388b1de732c19e43af62bb8da969980c7f65b7 SHA512 0abf5198f0e5ca9678d7741181724389be2289263d2a91c07a979c03f976e7cc494f39a5fbc4d8dbb8acacba463accf28ba0eba4907f1bfe2bac0ab2f4f5eede
+DIST gdbm-1.26.tar.gz 1226591 BLAKE2B 9423ea16ee3e8f1ce57ea32371f49919e2a3819a206a61ce927676a08a71a6a495d3949714bff7be789dfce75bf0ab0ac76f07ec673b71a84ae32bd8cd483781 SHA512 44aafe254f0950a8f5215d8f1337674f07b19f2a375f6eb19a7e39690028c80c3774b705c2b76b470ae74042b21f2ca77d02f6f57aa2ee50296db801220a3352
+DIST gdbm-1.26.tar.gz.sig 566 BLAKE2B b15fdc78010a9fc020d9aad5c92394d00ebce846ac0468fee90701b19295f51df4ccbb22e7af4bde75b0e2b52e46c96dd511c6f3552d2151a828422033d1bc26 SHA512 ba126e81a660c6658bdb5aac65c12546cf4d7721da88f3767808c9c94e4082cf48eaf9655b502898603af22a52032d9cba40f94db4170e4f5878e7a2b8ec9922
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.24.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.24.ebuild
index ef4eb0f7602..e56d75019b5 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.24.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.24.ebuild
@@ -13,7 +13,7 @@ SRC_URI="
 	verify-sig? ( mirror://gnu/gdbm/${P}.tar.gz.sig )
 "
 
-LICENSE="GPL-3"
+LICENSE="GPL-3+ GPL-2+ FDL-1.3+"
 SLOT="0/6" # libgdbm.so version
 KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="+berkdb nls +readline static-libs test"
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.25.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.25.ebuild
index 618e0844b4c..80091df0d8b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.25.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.25.ebuild
@@ -13,7 +13,7 @@ SRC_URI="
 	verify-sig? ( mirror://gnu/gdbm/${P}.tar.gz.sig )
 "
 
-LICENSE="GPL-3"
+LICENSE="GPL-3+ GPL-2+ FDL-1.3+"
 SLOT="0/6" # libgdbm.so version
 KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="+berkdb nls +readline static-libs test"
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.26.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.26.ebuild
new file mode 100644
index 00000000000..70110857093
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.26.ebuild
@@ -0,0 +1,64 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gdbm.asc
+inherit libtool multilib-minimal multiprocessing verify-sig
+
+DESCRIPTION="Standard GNU database libraries"
+HOMEPAGE="https://www.gnu.org/software/gdbm/"
+SRC_URI="
+	mirror://gnu/gdbm/${P}.tar.gz
+	verify-sig? ( mirror://gnu/gdbm/${P}.tar.gz.sig )
+"
+
+LICENSE="GPL-3+ GPL-2+ FDL-1.3+"
+SLOT="0/6" # libgdbm.so version
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="+berkdb nls +readline static-libs test"
+RESTRICT="!test? ( test )"
+
+DEPEND="readline? ( sys-libs/readline:=[${MULTILIB_USEDEP}] )"
+RDEPEND="${DEPEND}"
+BDEPEND="
+	test? ( dev-util/dejagnu )
+	verify-sig? ( >=sec-keys/openpgp-keys-gdbm-20250323 )
+"
+
+src_prepare() {
+	default
+
+	# gdbm ships with very old libtool files, regen to avoid
+	# errors when cross-compiling.
+	elibtoolize
+}
+
+multilib_src_configure() {
+	# gdbm doesn't appear to use either of these libraries
+	export ac_cv_lib_dbm_main=no ac_cv_lib_ndbm_main=no
+
+	local myeconfargs=(
+		--includedir="${EPREFIX}"/usr/include/gdbm
+		$(use_enable berkdb libgdbm-compat)
+		$(use_enable nls)
+		$(use_enable static-libs static)
+		$(use_with readline)
+	)
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_test() {
+	emake -Onone check TESTSUITEFLAGS="--jobs=$(get_makeopts_jobs)"
+}
+
+multilib_src_install_all() {
+	einstalldocs
+
+	if ! use static-libs ; then
+		find "${ED}" -name '*.la' -delete || die
+	fi
+
+	mv "${ED}"/usr/include/gdbm/gdbm.h "${ED}"/usr/include/ || die
+}

From d1a193059295b7317c323c35a859e9d5eb8bded9 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:16:34 +0000
Subject: [PATCH 112/122] sys-libs/glibc: Sync with Gentoo

It's from Gentoo commit 0438de13b4185b56111f444a4f67a33c05ec6b72.
---
 .../portage-stable/sys-libs/glibc/Manifest    |    4 +-
 .../sys-libs/glibc/glibc-2.19-r3.ebuild       |   40 +-
 .../sys-libs/glibc/glibc-2.31-r7.ebuild       |   44 +-
 .../sys-libs/glibc/glibc-2.32-r8.ebuild       |   44 +-
 .../sys-libs/glibc/glibc-2.33-r14.ebuild      |   44 +-
 .../sys-libs/glibc/glibc-2.34-r14.ebuild      |   44 +-
 .../sys-libs/glibc/glibc-2.35-r11.ebuild      |   44 +-
 .../sys-libs/glibc/glibc-2.36-r8.ebuild       |   44 +-
 .../sys-libs/glibc/glibc-2.37-r10.ebuild      |   56 +-
 .../sys-libs/glibc/glibc-2.38-r13.ebuild      |   56 +-
 .../sys-libs/glibc/glibc-2.39-r11.ebuild      |   56 +-
 .../sys-libs/glibc/glibc-2.40-r11.ebuild      |   56 +-
 ...bc-2.41-r4.ebuild => glibc-2.41-r5.ebuild} |   66 +-
 .../sys-libs/glibc/glibc-2.42.ebuild          | 1776 +++++++++++++++++
 .../sys-libs/glibc/glibc-9999.ebuild          |   75 +-
 .../sys-libs/glibc/metadata.xml               |    9 +-
 16 files changed, 2147 insertions(+), 311 deletions(-)
 rename sdk_container/src/third_party/portage-stable/sys-libs/glibc/{glibc-2.41-r4.ebuild => glibc-2.41-r5.ebuild} (97%)
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.42.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/Manifest
index fd9bfed0dfd..0c18ac20b2c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/Manifest
@@ -25,8 +25,10 @@ DIST glibc-2.39-patches-11.tar.xz 192784 BLAKE2B fef42e0bd2a3341f41cac56dc878dcc
 DIST glibc-2.39.tar.xz 18520988 BLAKE2B 9d98459a2d58401e07c081e0d841935b23998da75a7eb5a7ebd23a1f9ebab99dee623fe166397c1b6c926960c570f62dbca5cb3b5ce84a918adff6b7a15e16bb SHA512 818f58172a52815b4338ea9f2a69ecaa3335492b9f8f64cbf8afb24c0d737982341968ecd79631cae3d3074ab0ae4bc6056fc4ba3ffe790849dc374835cd57e2
 DIST glibc-2.40-patches-11.tar.xz 227044 BLAKE2B 2a8c799a88596f3fc28bc45fc206f231f628ff83aae242d69e216b65983def35d3aaab282287f1d77cb9d37d10bb71c483815ea83dfb2e47670a4cfcfbd1d92f SHA512 e984e4842951c24cf079e9a6f88771ede0709949402dd9f734cbfdf21ff40ca3d7380c0b9cc0c0d89943b6481adf8c7db2ab4b0ffe57e2e1fa514d925f0db395
 DIST glibc-2.40.tar.xz 18752204 BLAKE2B 8593cab5b2549b77159b6866fbb40b917e491fd5bc0814f7f85b6529166d78d4583436450c479b86cdfe468304fc4d2a9ba8294230a55dbc4c15e89c3ab6c000 SHA512 33caf91dbfddde6480b7cdf7a68b36aff8c522bfee56160af26af297f1b768668edb08bc4e1a7ff61c64721e3c1d49c347a5dd01c5edd3b914ee6479c8b27885
-DIST glibc-2.41-patches-6.tar.xz 83980 BLAKE2B ca689782db9f78751d5b5004ee9bf7bd6daf4cf071bb25507e53e4408fdd0331a9f4c82bbe7579e38540fc4d416bd858f76e5655f4e8a87048067fbc5e3c7a17 SHA512 bce972f5e036712e178d0adc97bef17b83a5c5cc3139d689bfc2847bc5e8126ee01250ce41033bc78919a7638965740d54eb431b240a9a32460c433335da968f
+DIST glibc-2.41-patches-7.tar.xz 96232 BLAKE2B 0d4d22eb467370e9e902278b223545c5a225c990a87b4c2f39db48677301d126d7e69ea2823822ced5c472a9abdf7679c6c0ede88b87e50123a7ac146a98249e SHA512 00fc6f83a28dfae8f17ed50ba19f322d267f3f6d80e5545c317694ce1e2e0e4ebfb922b4fa1d7c854d035a457e968bf8281ccedca8e5347e380fa54b6755aedd
 DIST glibc-2.41.tar.xz 19344868 BLAKE2B 4da62f489ba7a95bb069c2cfea8cf78e4d37e3a5f7e1736239670ba1dca12b69aa77bd00ced078c27d91b1e622c58cbd70258161a9d18c5b3bcc95863b8d744d SHA512 894a3e5a796bc13df30c26a5bfbe4d60b5dbdaac54e7763432235124b547070c7dda88c50584536870cab79183d8cad73a3ac6ed09bfe54fa8482aad07253169
+DIST glibc-2.42-patches-2.tar.xz 25856 BLAKE2B 26a5a3bdc7985c2193533e883445acac29ea695df30d72b6d9409aa9ec94d39a086eb6c41eb9adfc39e0de78f7ae84e0fa64a955f9866de262179ee40ce4a6b5 SHA512 1526613855b9ca65002c6853f88d77990a1fe9e6f4cc01aca51d67fc4592ed985da8c74a661d304eb8a27c6afc8592da259fe40fa08a824942a9b700942086e6
+DIST glibc-2.42.tar.xz 19930508 BLAKE2B 6ffabfe7942034a5a4fb5097679cb47bc3431eb2a3864af07cea0cb6aa5db63fbaf6f026b3c9299e00268058a6762eb21e92499f012d552ed87d65c7ffbd0bbe SHA512 73a617db8e0f0958c0575f7a1c5a35b72b7e070b6cbdd02a9bb134995ca7ca0909f1e50d7362c53d2572d72f1879bb201a61d5275bac16136895d9a34ef0c068
 DIST glibc-systemd-20210729.tar.gz 1480 BLAKE2B 37722c7579df782d890e44dbab99c3de52ab466eb9de80d82405e9bb5620bf39ffc8c5f466a435bdb86ef6d36dd7019c0736573916bda6c67d02a2581e0ec979 SHA512 efd75af58b50522c28cdac7abd1fc56555bc1bb042512c90d8340c1ec09c5791b3872a305bf83723252bbde5855b75d958c041083457765c4cfd170732d09238
 DIST glibc-systemd-20210814.tar.gz 1469 BLAKE2B 10fa7bcb46d4fdce9c0ab353cbd30871e9b09a347a13a9c9a3b5777f931aa3c826c158d2e49532c604d4a834f2fab4089b67495fb88d0398945dc50d45ad9ef1 SHA512 5346a9ea459a1e6ccf665389f2a294de1e16f1e3e05cdf07e3dd99ed0e4f6f8b52cc333d4bff3c75ac90ab6ce70cd4ab2b3e126f920ce7979abd6dda56315efc
 DIST locale-gen-2.00.tar.gz 7738 BLAKE2B cde6de5ba3400aea24d0d5f1b79471f89f09fb747c8e371e38316c7ada92f967e0865f573f23cb353d82419c234724143c0aeca9eb70eb945dfc581cc7491eb1 SHA512 b609fddb9ec5e567c008841fef3390eddb5d6e7699a8271b3b8c0ade1b44b0ac2e5d1daa8b9acabf3432e3b88110b538a96f209b1ad0f9e988b7efce66606dff
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.19-r3.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.19-r3.ebuild
index 7d492b72364..275cfa3d70e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.19-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.19-r3.ebuild
@@ -1036,16 +1036,30 @@ src_test() {
 }
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local locale_list="${root%/}/etc/locale.gen"
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	local prefix=$1 user_config config
+	local -a localegen_args
+
+	config="${prefix}/usr/share/i18n/SUPPORTED"
+	user_config="${prefix}/etc/locale.gen"
+
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		# For USE=compile-locales, all locales should be built.
+		mkdir -p -- "${prefix}/usr/lib/locale" || die
+	elif locale-gen --list --config "${user_config}" | read -r; then
+		config=${user_config}
 	fi
 
-	locale-gen --jobs $(makeopts_jobs) --config "${locale_list}" \
-		--destdir "${root}"
+	localegen_args=( --config "${config}" --destdir "${prefix}" )
+
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
+	fi
+
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1219,7 +1233,9 @@ glibc_do_src_install() {
 
 	# Generate all locales if this is a native build as locale generation
 	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen "${ED}"
+		if ! run_locale_gen "${ED}"; then
+			die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 	fi
 }
 
@@ -1311,8 +1327,10 @@ pkg_postinst() {
 		"${EROOT}"/usr/sbin/iconvconfig --prefix="${ROOT}/"
 	fi
 
-	if ! is_crosscompile && [[ -n ${ROOT} ]] ; then
-		use compile-locales || run_locale_gen "${EROOT}/"
+	if ! is_crosscompile && [[ -z ${ROOT} ]] ; then
+		if ! use compile-locales && ! run_locale_gen "${EROOT}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 	fi
 
 	# Check for sanity of /etc/nsswitch.conf, take 2
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.31-r7.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.31-r7.ebuild
index 7df8f581644..8ec824d2fdc 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.31-r7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.31-r7.ebuild
@@ -1174,30 +1174,30 @@ src_test() {
 }
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
-	fi
+	config="${prefix}/usr/share/i18n/SUPPORTED"
+	user_config="${prefix}/etc/locale.gen"
 
-	local locale_list="${root}/etc/locale.gen"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		# For USE=compile-locales, all locales should be built.
+		mkdir -p -- "${prefix}/usr/lib/locale" || die
+	elif locale-gen --list --config "${user_config}" | read -r; then
+		config=${user_config}
+	fi
 
-	pushd "${ED}"/$(get_libdir) >/dev/null
+	localegen_args=( --config "${config}" --destdir "${prefix}" )
 
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root}/usr/share/i18n/SUPPORTED"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs $(makeopts_jobs) --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1392,7 +1392,9 @@ glibc_do_src_install() {
 
 	# Generate all locales if this is a native build as locale generation
 	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+		if ! run_locale_gen "${ED%/}"; then
+			die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 		sed -e 's:COMPILED_LOCALES="":COMPILED_LOCALES="1":' -i "${ED}"/usr/sbin/locale-gen || die
 	fi
 }
@@ -1491,7 +1493,9 @@ pkg_postinst() {
 	fi
 
 	if ! is_crosscompile && [[ -z ${ROOT} ]] ; then
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT%/}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 	fi
 
 	# Check for sanity of /etc/nsswitch.conf, take 2
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.32-r8.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.32-r8.ebuild
index 656ad5161a2..c44f933c4c8 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.32-r8.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.32-r8.ebuild
@@ -1203,30 +1203,30 @@ src_test() {
 }
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
-	fi
+	config="${prefix}/usr/share/i18n/SUPPORTED"
+	user_config="${prefix}/etc/locale.gen"
 
-	local locale_list="${root}/etc/locale.gen"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		# For USE=compile-locales, all locales should be built.
+		mkdir -p -- "${prefix}/usr/lib/locale" || die
+	elif locale-gen --list --config "${user_config}" | read -r; then
+		config=${user_config}
+	fi
 
-	pushd "${ED}"/$(get_libdir) >/dev/null
+	localegen_args=( --config "${config}" --destdir "${prefix}" )
 
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root}/usr/share/i18n/SUPPORTED"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs $(makeopts_jobs) --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1404,7 +1404,9 @@ glibc_do_src_install() {
 
 	# Generate all locales if this is a native build as locale generation
 	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+		if ! run_locale_gen "${ED%/}"; then
+			die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 		sed -e 's:COMPILED_LOCALES="":COMPILED_LOCALES="1":' -i "${ED}"/usr/sbin/locale-gen || die
 	fi
 }
@@ -1509,7 +1511,9 @@ pkg_postinst() {
 	fi
 
 	if ! is_crosscompile && [[ -z ${ROOT} ]] ; then
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT%/}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 	fi
 
 	# Check for sanity of /etc/nsswitch.conf, take 2
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.33-r14.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.33-r14.ebuild
index 5e23df0069e..19294871446 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.33-r14.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.33-r14.ebuild
@@ -1225,30 +1225,30 @@ src_test() {
 }
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
-	fi
+	config="${prefix}/usr/share/i18n/SUPPORTED"
+	user_config="${prefix}/etc/locale.gen"
 
-	local locale_list="${root%/}/etc/locale.gen"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		# For USE=compile-locales, all locales should be built.
+		mkdir -p -- "${prefix}/usr/lib/locale" || die
+	elif locale-gen --list --config "${user_config}" | read -r; then
+		config=${user_config}
+	fi
 
-	pushd "${ED}"/$(get_libdir) >/dev/null
+	localegen_args=( --config "${config}" --destdir "${prefix}" )
 
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs $(makeopts_jobs) --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1453,7 +1453,9 @@ glibc_do_src_install() {
 
 	# Generate all locales if this is a native build as locale generation
 	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+		if ! run_locale_gen "${ED%/}"; then
+			die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 		sed -e 's:COMPILED_LOCALES="":COMPILED_LOCALES="1":' -i "${ED}"/usr/sbin/locale-gen || die
 	fi
 }
@@ -1574,7 +1576,9 @@ pkg_postinst() {
 	fi
 
 	if ! is_crosscompile && [[ -z ${ROOT} ]] ; then
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT%/}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 	fi
 
 	upgrade_warning
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.34-r14.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.34-r14.ebuild
index e23b9ae35e9..93da806cc97 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.34-r14.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.34-r14.ebuild
@@ -1246,30 +1246,30 @@ src_test() {
 }
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
-	fi
+	config="${prefix}/usr/share/i18n/SUPPORTED"
+	user_config="${prefix}/etc/locale.gen"
 
-	local locale_list="${root%/}/etc/locale.gen"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		# For USE=compile-locales, all locales should be built.
+		mkdir -p -- "${prefix}/usr/lib/locale" || die
+	elif locale-gen --list --config "${user_config}" | read -r; then
+		config=${user_config}
+	fi
 
-	pushd "${ED}"/$(get_libdir) >/dev/null
+	localegen_args=( --config "${config}" --destdir "${prefix}" )
 
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs $(makeopts_jobs) --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1474,7 +1474,9 @@ glibc_do_src_install() {
 
 	# Generate all locales if this is a native build as locale generation
 	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+		if ! run_locale_gen "${ED%/}"; then
+			die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 		sed -e 's:COMPILED_LOCALES="":COMPILED_LOCALES="1":' -i "${ED}"/usr/sbin/locale-gen || die
 	fi
 }
@@ -1595,7 +1597,9 @@ pkg_postinst() {
 	fi
 
 	if ! is_crosscompile && [[ -z ${ROOT} ]] ; then
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT%/}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 	fi
 
 	upgrade_warning
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.35-r11.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.35-r11.ebuild
index 0c2aec0025e..b61d907c813 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.35-r11.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.35-r11.ebuild
@@ -1254,30 +1254,30 @@ src_test() {
 }
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
-	fi
+	config="${prefix}/usr/share/i18n/SUPPORTED"
+	user_config="${prefix}/etc/locale.gen"
 
-	local locale_list="${root%/}/etc/locale.gen"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		# For USE=compile-locales, all locales should be built.
+		mkdir -p -- "${prefix}/usr/lib/locale" || die
+	elif locale-gen --list --config "${user_config}" | read -r; then
+		config=${user_config}
+	fi
 
-	pushd "${ED}"/$(get_libdir) >/dev/null
+	localegen_args=( --config "${config}" --destdir "${prefix}" )
 
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs $(makeopts_jobs) --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1482,7 +1482,9 @@ glibc_do_src_install() {
 
 	# Generate all locales if this is a native build as locale generation
 	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+		if ! run_locale_gen "${ED%/}"; then
+			die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 		sed -e 's:COMPILED_LOCALES="":COMPILED_LOCALES="1":' -i "${ED}"/usr/sbin/locale-gen || die
 	fi
 }
@@ -1603,7 +1605,9 @@ pkg_postinst() {
 	fi
 
 	if ! is_crosscompile && [[ -z ${ROOT} ]] ; then
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT%/}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 	fi
 
 	upgrade_warning
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.36-r8.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.36-r8.ebuild
index cb6ddba38eb..5df7eb487f1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.36-r8.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.36-r8.ebuild
@@ -1284,30 +1284,30 @@ src_test() {
 }
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
-	fi
+	config="${prefix}/usr/share/i18n/SUPPORTED"
+	user_config="${prefix}/etc/locale.gen"
 
-	local locale_list="${root%/}/etc/locale.gen"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		# For USE=compile-locales, all locales should be built.
+		mkdir -p -- "${prefix}/usr/lib/locale" || die
+	elif locale-gen --list --config "${user_config}" | read -r; then
+		config=${user_config}
+	fi
 
-	pushd "${ED}"/$(get_libdir) >/dev/null
+	localegen_args=( --config "${config}" --destdir "${prefix}" )
 
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs $(makeopts_jobs) --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1523,7 +1523,9 @@ glibc_do_src_install() {
 
 	# Generate all locales if this is a native build as locale generation
 	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+		if ! run_locale_gen "${ED%/}"; then
+			die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 		sed -e 's:COMPILED_LOCALES="":COMPILED_LOCALES="1":' -i "${ED}"/usr/sbin/locale-gen || die
 	fi
 }
@@ -1644,7 +1646,9 @@ pkg_postinst() {
 	fi
 
 	if ! is_crosscompile && [[ -z ${ROOT} ]] ; then
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT%/}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 	fi
 
 	upgrade_warning
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.37-r10.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.37-r10.ebuild
index e323ee8ae32..14ea48d6eef 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.37-r10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.37-r10.ebuild
@@ -1295,38 +1295,36 @@ src_test() {
 # src_install
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a hasversion_opts localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		hasversion_opts=( -b )
 	fi
 
-	local locale_list="${root%/}/etc/locale.gen"
-
-	pushd "${ED}"/$(get_libdir) >/dev/null
-
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	if has_version "${hasversion_opts[@]}" '>=sys-apps/locale-gen-3'; then
+		localegen_args=( --prefix "${prefix}" )
+	else
+		config="${prefix}/usr/share/i18n/SUPPORTED"
+		user_config="${prefix}/etc/locale.gen"
+		if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+			# For USE=compile-locales, all locales should be built.
+			mkdir -p -- "${prefix}/usr/lib/locale" || die
+		elif locale-gen --list --config "${user_config}" | read -r; then
+			config=${user_config}
+		fi
+		localegen_args=( --config "${config}" --destdir "${prefix}" )
 	fi
 
-	# bug 736794: we need to be careful with the parallelization... the number of
-	# processors saved in the environment of a binary package may differ strongly
-	# from the number of processes available during postinst
-	local mygenjobs="$(makeopts_jobs)"
-	if [[ "${EMERGE_FROM}" == "binary" ]] ; then
-		mygenjobs="$(nproc)"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs "${mygenjobs}" --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1539,8 +1537,8 @@ glibc_do_src_install() {
 	rm -f "${ED}"/etc/localtime
 
 	# Generate all locales if this is a native build as locale generation
-	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+	if use compile-locales && ! is_crosscompile && ! run_locale_gen "${ED}"; then
+		die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
 	fi
 }
 
@@ -1663,7 +1661,9 @@ pkg_postinst() {
 	fi
 
 	if ! is_crosscompile && [[ -z ${ROOT} ]] ; then
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 	fi
 
 	upgrade_warning
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.38-r13.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.38-r13.ebuild
index 5bba661e9e9..4bee7a911ae 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.38-r13.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.38-r13.ebuild
@@ -1314,38 +1314,36 @@ src_test() {
 # src_install
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a hasversion_opts localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		hasversion_opts=( -b )
 	fi
 
-	local locale_list="${root%/}/etc/locale.gen"
-
-	pushd "${ED}"/$(get_libdir) >/dev/null
-
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	if has_version "${hasversion_opts[@]}" '>=sys-apps/locale-gen-3'; then
+		localegen_args=( --prefix "${prefix}" )
+	else
+		config="${prefix}/usr/share/i18n/SUPPORTED"
+		user_config="${prefix}/etc/locale.gen"
+		if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+			# For USE=compile-locales, all locales should be built.
+			mkdir -p -- "${prefix}/usr/lib/locale" || die
+		elif locale-gen --list --config "${user_config}" | read -r; then
+			config=${user_config}
+		fi
+		localegen_args=( --config "${config}" --destdir "${prefix}" )
 	fi
 
-	# bug 736794: we need to be careful with the parallelization... the number of
-	# processors saved in the environment of a binary package may differ strongly
-	# from the number of processes available during postinst
-	local mygenjobs="$(makeopts_jobs)"
-	if [[ "${EMERGE_FROM}" == "binary" ]] ; then
-		mygenjobs="$(nproc)"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs "${mygenjobs}" --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1558,8 +1556,8 @@ glibc_do_src_install() {
 	rm -f "${ED}"/etc/localtime
 
 	# Generate all locales if this is a native build as locale generation
-	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+	if use compile-locales && ! is_crosscompile && ! run_locale_gen "${ED}"; then
+		die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
 	fi
 }
 
@@ -1708,7 +1706,9 @@ pkg_postinst() {
 		# window for the affected programs.
 		use loong && glibc_refresh_ldconfig
 
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 	fi
 
 	upgrade_warning
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.39-r11.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.39-r11.ebuild
index 4b46bc6f4e3..b34df92b725 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.39-r11.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.39-r11.ebuild
@@ -1322,38 +1322,36 @@ src_test() {
 # src_install
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a hasversion_opts localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		hasversion_opts=( -b )
 	fi
 
-	local locale_list="${root%/}/etc/locale.gen"
-
-	pushd "${ED}"/$(get_libdir) >/dev/null
-
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	if has_version "${hasversion_opts[@]}" '>=sys-apps/locale-gen-3'; then
+		localegen_args=( --prefix "${prefix}" )
+	else
+		config="${prefix}/usr/share/i18n/SUPPORTED"
+		user_config="${prefix}/etc/locale.gen"
+		if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+			# For USE=compile-locales, all locales should be built.
+			mkdir -p -- "${prefix}/usr/lib/locale" || die
+		elif locale-gen --list --config "${user_config}" | read -r; then
+			config=${user_config}
+		fi
+		localegen_args=( --config "${config}" --destdir "${prefix}" )
 	fi
 
-	# bug 736794: we need to be careful with the parallelization... the number of
-	# processors saved in the environment of a binary package may differ strongly
-	# from the number of processes available during postinst
-	local mygenjobs="$(makeopts_jobs)"
-	if [[ "${EMERGE_FROM}" == "binary" ]] ; then
-		mygenjobs="$(nproc)"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs "${mygenjobs}" --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1568,8 +1566,8 @@ glibc_do_src_install() {
 	rm -f "${ED}"/etc/localtime
 
 	# Generate all locales if this is a native build as locale generation
-	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+	if use compile-locales && ! is_crosscompile && ! run_locale_gen "${ED}"; then
+		die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
 	fi
 }
 
@@ -1719,7 +1717,9 @@ pkg_postinst() {
 		# window for the affected programs.
 		use loong && glibc_refresh_ldconfig
 
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 	fi
 
 	upgrade_warning
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.40-r11.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.40-r11.ebuild
index 07f8c01de0e..3e94d2cd321 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.40-r11.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.40-r11.ebuild
@@ -1302,38 +1302,36 @@ src_test() {
 # src_install
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a hasversion_opts localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		hasversion_opts=( -b )
 	fi
 
-	local locale_list="${root%/}/etc/locale.gen"
-
-	pushd "${ED}"/$(get_libdir) >/dev/null
-
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	if has_version "${hasversion_opts[@]}" '>=sys-apps/locale-gen-3'; then
+		localegen_args=( --prefix "${prefix}" )
+	else
+		config="${prefix}/usr/share/i18n/SUPPORTED"
+		user_config="${prefix}/etc/locale.gen"
+		if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+			# For USE=compile-locales, all locales should be built.
+			mkdir -p -- "${prefix}/usr/lib/locale" || die
+		elif locale-gen --list --config "${user_config}" | read -r; then
+			config=${user_config}
+		fi
+		localegen_args=( --config "${config}" --destdir "${prefix}" )
 	fi
 
-	# bug 736794: we need to be careful with the parallelization... the number of
-	# processors saved in the environment of a binary package may differ strongly
-	# from the number of processes available during postinst
-	local mygenjobs="$(makeopts_jobs)"
-	if [[ "${EMERGE_FROM}" == "binary" ]] ; then
-		mygenjobs="$(nproc)"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs "${mygenjobs}" --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1548,8 +1546,8 @@ glibc_do_src_install() {
 	rm -f "${ED}"/etc/localtime
 
 	# Generate all locales if this is a native build as locale generation
-	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+	if use compile-locales && ! is_crosscompile && ! run_locale_gen "${ED}"; then
+		die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
 	fi
 }
 
@@ -1699,7 +1697,9 @@ pkg_postinst() {
 		# window for the affected programs.
 		use loong && glibc_refresh_ldconfig
 
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 
 		# If fixincludes was/is active for a particular GCC slot, we
 		# must refresh it. See bug #933282 and GCC's documentation:
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.41-r4.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.41-r5.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.41-r4.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.41-r5.ebuild
index 373c2958ca3..2c01722eb4f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.41-r4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.41-r5.ebuild
@@ -12,7 +12,7 @@ TMPFILES_OPTIONAL=1
 EMULTILIB_PKG="true"
 
 # Gentoo patchset (ignored for live ebuilds)
-PATCH_VER=6
+PATCH_VER=7
 PATCH_DEV=dilfridge
 
 # gcc mulitilib bootstrap files version
@@ -972,14 +972,14 @@ src_prepare() {
 		einfo "Done."
 	fi
 
-        case ${CTARGET} in
-                m68*-aligned-*)
+	case ${CTARGET} in
+		m68*-aligned-*)
 			einfo "Applying utmp format fix for m68k with -maligned-int"
 			eapply "${FILESDIR}/glibc-2.41-m68k-malign.patch"
 			;;
-                *)
+		*)
 			;;
-        esac
+	esac
 
 	default
 
@@ -1316,38 +1316,36 @@ src_test() {
 # src_install
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a hasversion_opts localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		hasversion_opts=( -b )
 	fi
 
-	local locale_list="${root%/}/etc/locale.gen"
-
-	pushd "${ED}"/$(get_libdir) >/dev/null
-
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	if has_version "${hasversion_opts[@]}" '>=sys-apps/locale-gen-3'; then
+		localegen_args=( --prefix "${prefix}" )
+	else
+		config="${prefix}/usr/share/i18n/SUPPORTED"
+		user_config="${prefix}/etc/locale.gen"
+		if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+			# For USE=compile-locales, all locales should be built.
+			mkdir -p -- "${prefix}/usr/lib/locale" || die
+		elif locale-gen --list --config "${user_config}" | read -r; then
+			config=${user_config}
+		fi
+		localegen_args=( --config "${config}" --destdir "${prefix}" )
 	fi
 
-	# bug 736794: we need to be careful with the parallelization... the number of
-	# processors saved in the environment of a binary package may differ strongly
-	# from the number of processes available during postinst
-	local mygenjobs="$(makeopts_jobs)"
-	if [[ "${EMERGE_FROM}" == "binary" ]] ; then
-		mygenjobs="$(nproc)"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs "${mygenjobs}" --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1562,8 +1560,8 @@ glibc_do_src_install() {
 	rm -f "${ED}"/etc/localtime
 
 	# Generate all locales if this is a native build as locale generation
-	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+	if use compile-locales && ! is_crosscompile && ! run_locale_gen "${ED}"; then
+		die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
 	fi
 }
 
@@ -1713,7 +1711,9 @@ pkg_postinst() {
 		# window for the affected programs.
 		use loong && glibc_refresh_ldconfig
 
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 
 		# If fixincludes was/is active for a particular GCC slot, we
 		# must refresh it. See bug #933282 and GCC's documentation:
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.42.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.42.ebuild
new file mode 100644
index 00000000000..703f08dd696
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.42.ebuild
@@ -0,0 +1,1776 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Bumping notes: https://wiki.gentoo.org/wiki/Project:Toolchain/sys-libs/glibc
+# Please read & adapt the page as necessary if obsolete.
+
+PYTHON_COMPAT=( python3_{10..13} )
+TMPFILES_OPTIONAL=1
+
+EMULTILIB_PKG="true"
+
+# Gentoo patchset (ignored for live ebuilds)
+PATCH_VER=2
+PATCH_DEV=dilfridge
+
+# gcc mulitilib bootstrap files version
+GCC_BOOTSTRAP_VER=20201208
+
+# systemd integration version
+GLIBC_SYSTEMD_VER=20210729
+
+# Minimum kernel version that glibc requires
+MIN_KERN_VER="3.2.0"
+
+# Minimum pax-utils version needed (which contains any new syscall changes for
+# its seccomp filter!). Please double check this!
+MIN_PAX_UTILS_VER="1.3.3"
+
+# Minimum systemd version needed (which contains any new syscall changes for
+# its seccomp filter!). Please double check this!
+MIN_SYSTEMD_VER="254.9-r1"
+
+inherit python-any-r1 prefix preserve-libs toolchain-funcs flag-o-matic gnuconfig \
+	multilib systemd multiprocessing tmpfiles eapi9-ver
+
+DESCRIPTION="GNU libc C library"
+HOMEPAGE="https://www.gnu.org/software/libc/"
+
+if [[ ${PV} == *9999 ]]; then
+	inherit git-r3
+else
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	SRC_URI="mirror://gnu/glibc/${P}.tar.xz"
+	SRC_URI+=" https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${P}-patches-${PATCH_VER}.tar.xz"
+fi
+
+SRC_URI+=" multilib-bootstrap? ( https://dev.gentoo.org/~dilfridge/distfiles/gcc-multilib-bootstrap-${GCC_BOOTSTRAP_VER}.tar.xz )"
+SRC_URI+=" systemd? ( https://gitweb.gentoo.org/proj/toolchain/glibc-systemd.git/snapshot/glibc-systemd-${GLIBC_SYSTEMD_VER}.tar.gz )"
+
+LICENSE="LGPL-2.1+ BSD HPND ISC inner-net rc PCRE"
+SLOT="2.2"
+IUSE="audit caps cet compile-locales custom-cflags doc gd hash-sysv-compat headers-only +multiarch multilib multilib-bootstrap nscd perl profile selinux sframe +ssp stack-realign +static-libs suid systemd systemtap test vanilla"
+
+# Here's how the cross-compile logic breaks down ...
+#  CTARGET - machine that will target the binaries
+#  CHOST   - machine that will host the binaries
+#  CBUILD  - machine that will build the binaries
+# If CTARGET != CHOST, it means you want a libc for cross-compiling.
+# If CHOST != CBUILD, it means you want to cross-compile the libc.
+#  CBUILD = CHOST = CTARGET    - native build/install
+#  CBUILD != (CHOST = CTARGET) - cross-compile a native build
+#  (CBUILD = CHOST) != CTARGET - libc for cross-compiler
+#  CBUILD != CHOST != CTARGET  - cross-compile a libc for a cross-compiler
+# For install paths:
+#  CHOST = CTARGET  - install into /
+#  CHOST != CTARGET - install into /usr/CTARGET/
+#
+export CBUILD=${CBUILD:-${CHOST}}
+export CTARGET=${CTARGET:-${CHOST}}
+if [[ ${CTARGET} == ${CHOST} ]] ; then
+	if [[ ${CATEGORY} == cross-* ]] ; then
+		export CTARGET=${CATEGORY#cross-}
+	fi
+fi
+
+# Note [Disable automatic stripping]
+# Disabling automatic stripping for a few reasons:
+# - portage's attempt to strip breaks non-native binaries at least on
+#   arm: bug #697428
+# - portage's attempt to strip libpthread.so.0 breaks gdb thread
+#   enumeration: bug #697910. This is quite subtle:
+#   * gdb uses glibc's libthread_db-1.0.so to enumerate threads.
+#   * libthread_db-1.0.so needs access to libpthread.so.0 local symbols
+#     via 'ps_pglobal_lookup' symbol defined in gdb.
+#   * 'ps_pglobal_lookup' uses '.symtab' section table to resolve all
+#     known symbols in 'libpthread.so.0'. Specifically 'nptl_version'
+#     (unexported) is used to sanity check compatibility before enabling
+#     debugging.
+#     Also see https://sourceware.org/gdb/wiki/FAQ#GDB_does_not_see_any_threads_besides_the_one_in_which_crash_occurred.3B_or_SIGTRAP_kills_my_program_when_I_set_a_breakpoint
+#   * normal 'strip' command trims '.symtab'
+#   Thus our main goal here is to prevent 'libpthread.so.0' from
+#   losing it's '.symtab' entries.
+# - similarly, valgrind requires knowledge about symbols in ld.so:
+#	bug #920753
+# As Gentoo's strip does not allow us to pass less aggressive stripping
+# options and does not check the machine target we strip selectively.
+
+# We need a new-enough binutils/gcc to match upstream baseline.
+# Also we need to make sure our binutils/gcc supports TLS,
+# and that gcc already contains the hardened patches.
+# Lastly, let's avoid some openssh nastiness, bug 708224, as
+# convenience to our users.
+
+IDEPEND="
+	!compile-locales? ( sys-apps/locale-gen )
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	>=app-misc/pax-utils-${MIN_PAX_UTILS_VER}
+	sys-devel/bison
+	compile-locales? ( sys-apps/locale-gen )
+	doc? (
+		dev-lang/perl
+		sys-apps/texinfo
+	)
+	sframe? ( >=sys-devel/binutils-2.45 )
+	test? (
+		dev-lang/perl
+		>=net-dns/libidn2-2.3.0
+		sys-apps/gawk[mpfr]
+	)
+"
+COMMON_DEPEND="
+	gd? ( media-libs/gd:2= )
+	nscd? ( selinux? (
+		audit? ( sys-process/audit )
+		caps? ( sys-libs/libcap )
+	) )
+	suid? ( caps? ( sys-libs/libcap ) )
+	selinux? ( sys-libs/libselinux )
+	systemtap? ( dev-debug/systemtap )
+"
+DEPEND="${COMMON_DEPEND}
+"
+RDEPEND="${COMMON_DEPEND}
+	!<app-misc/pax-utils-${MIN_PAX_UTILS_VER}
+	!<sys-apps/systemd-${MIN_SYSTEMD_VER}
+	perl? ( dev-lang/perl )
+"
+
+RESTRICT="!test? ( test )"
+
+if [[ ${CATEGORY} == cross-* ]] ; then
+	BDEPEND+=" !headers-only? (
+		>=${CATEGORY}/binutils-2.27
+		>=${CATEGORY}/gcc-6.2
+	)"
+	[[ ${CATEGORY} == *-linux* ]] && DEPEND+=" ${CATEGORY}/linux-headers"
+else
+	BDEPEND+="
+		>=sys-devel/binutils-2.27
+		>=sys-devel/gcc-6.2
+	"
+	DEPEND+=" virtual/os-headers "
+	RDEPEND+="
+		>=net-dns/libidn2-2.3.0
+		vanilla? ( !sys-libs/timezone-data )
+	"
+	PDEPEND+=" !vanilla? ( sys-libs/timezone-data )"
+fi
+
+# Ignore tests whitelisted below
+GENTOO_GLIBC_XFAIL_TESTS="${GENTOO_GLIBC_XFAIL_TESTS:-yes}"
+
+# The following tests fail due to the Gentoo build system and are thus
+# executed but ignored:
+XFAIL_TEST_LIST=(
+	# buggy test, assumes /dev/ and /dev/null on a single filesystem
+	# 'mount --bind /dev/null /chroot/dev/null' breaks it.
+	# https://sourceware.org/PR25909
+	tst-support_descriptors
+
+	# The following tests fail only inside portage
+	# https://bugs.gentoo.org/831267
+	tst-system
+	tst-strerror
+	tst-strsignal
+
+	# Fails with certain PORTAGE_NICENESS/PORTAGE_SCHEDULING_POLICY
+	tst-sched1
+	tst-sched_setattr
+
+	# Fails regularly, unreliable
+	tst-valgrind-smoke
+
+	# https://sourceware.org/bugzilla/show_bug.cgi?id=31877 (bug #927973)
+	tst-shstk-legacy-1g
+)
+
+XFAIL_NSPAWN_TEST_LIST=(
+	# These tests need to be adapted to handle EPERM/ENOSYS(?) properly
+	# upstream, as systemd-nspawn's default seccomp whitelist is too strict.
+	# https://sourceware.org/PR30603
+	test-errno-linux
+	tst-aarch64-pkey
+	tst-bz21269
+	tst-mlock2
+	tst-ntp_gettime
+	tst-ntp_gettime-time64
+	tst-ntp_gettimex
+	tst-ntp_gettimex-time64
+	tst-pkey
+	tst-process_mrelease
+	tst-adjtime
+	tst-adjtime-time64
+	tst-clock2
+	tst-clock2-time64
+
+	# These fail if --suppress-sync and/or low priority is set
+	tst-sync_file_range
+	test-errno
+)
+
+#
+# Small helper functions
+#
+
+dump_build_environment() {
+	einfo ==== glibc build environment ========================================================
+	local v
+	for v in ABI CBUILD CHOST CTARGET CBUILD_OPT CTARGET_OPT CC CXX CPP LD \
+		{AS,C,CPP,CXX,LD}FLAGS MAKEINFO NM AR AS STRIP RANLIB OBJCOPY \
+		STRINGS OBJDUMP READELF; do
+		einfo " $(printf '%15s' ${v}:)   ${!v}"
+	done
+	einfo =====================================================================================
+}
+
+is_crosscompile() {
+	[[ ${CHOST} != ${CTARGET} ]]
+}
+
+just_headers() {
+	is_crosscompile && use headers-only
+}
+
+alt_prefix() {
+	is_crosscompile && echo /usr/${CTARGET}
+}
+
+# This prefix is applicable to CHOST when building against this
+# glibc. It is baked into the library at configure time.
+host_eprefix() {
+	is_crosscompile || echo "${EPREFIX}"
+}
+
+# This prefix is applicable to CBUILD when building against this
+# glibc. It determines the destination path at install time.
+build_eprefix() {
+	is_crosscompile && echo "${EPREFIX}"
+}
+
+alt_headers() {
+	echo $(alt_prefix)/usr/include
+}
+alt_libdir() {
+	echo $(alt_prefix)/$(get_libdir)
+}
+alt_usrlibdir() {
+	echo $(alt_prefix)/usr/$(get_libdir)
+}
+
+builddir() {
+	echo "${WORKDIR}/build-${ABI}-${CTARGET}-$1"
+}
+
+do_compile_test() {
+	local ret save_cflags=${CFLAGS}
+	CFLAGS+=" $1"
+	shift
+
+	pushd "${T}" >/dev/null
+
+	rm -f glibc-test*
+	printf '%b' "$*" > glibc-test.c
+
+	# We assume CC is already set up.
+	nonfatal emake glibc-test
+	ret=$?
+
+	popd >/dev/null
+
+	CFLAGS=${save_cflags}
+	return ${ret}
+}
+
+do_run_test() {
+	local ret
+
+	if [[ ${MERGE_TYPE} == "binary" ]] ; then
+		# ignore build failures when installing a binary package #324685
+		do_compile_test "" "$@" 2>/dev/null || return 0
+	else
+		ebegin "Performing simple compile test for ABI=${ABI}"
+		if ! do_compile_test "" "$@" ; then
+			ewarn "Simple build failed ... assuming this is desired #324685"
+			eend 1
+			return 0
+		else
+			eend 0
+		fi
+	fi
+
+	pushd "${T}" >/dev/null
+
+	./glibc-test
+	ret=$?
+	rm -f glibc-test*
+
+	popd >/dev/null
+
+	return ${ret}
+}
+
+setup_target_flags() {
+	# This largely mucks with compiler flags.  None of which should matter
+	# when building up just the headers.
+	just_headers && return 0
+
+	case $(tc-arch) in
+		x86)
+			# -march needed for #185404 #199334
+			# TODO: When creating the first glibc cross-compile, this test will
+			# always fail as it does a full link which in turn requires glibc.
+			# Probably also applies when changing multilib profile settings (e.g.
+			# enabling x86 when the profile was amd64-only previously).
+			# We could change main to _start and pass -nostdlib here so that we
+			# only test the gcc code compilation.  Or we could do a compile and
+			# then look for the symbol via scanelf.
+			if ! do_compile_test "" 'void f(int i, void *p) {if (__sync_fetch_and_add(&i, 1)) f(i, p);}\nint main(){return 0;}\n'; then
+				local t=${CTARGET_OPT:-${CTARGET}}
+				t=${t%%-*}
+				filter-flags '-march=*'
+				export CFLAGS="-march=${t} ${CFLAGS}"
+				einfo "Auto adding -march=${t} to CFLAGS #185404"
+			fi
+			# For compatibility with older binaries at slight performance cost.
+			use stack-realign && export CFLAGS+=" -mstackrealign"
+		;;
+		amd64)
+			# -march needed for #185404 #199334
+			# TODO: See cross-compile issues listed above for x86.
+			if [[ ${ABI} == x86 ]]; then
+				if ! do_compile_test "${CFLAGS_x86}" 'void f(int i, void *p) {if (__sync_fetch_and_add(&i, 1)) f(i, p);}\nint main(){return 0;}\n'; then
+					local t=${CTARGET_OPT:-${CTARGET}}
+					t=${t%%-*}
+					# Normally the target is x86_64-xxx, so turn that into the -march that
+					# gcc actually accepts. #528708
+					[[ ${t} == "x86_64" ]] && t="x86-64"
+					filter-flags '-march=*'
+					# ugly, ugly, ugly.  ugly.
+					CFLAGS_x86=$(CFLAGS=${CFLAGS_x86} filter-flags '-march=*'; echo "${CFLAGS}")
+					export CFLAGS_x86="${CFLAGS_x86} -march=${t}"
+					einfo "Auto adding -march=${t} to CFLAGS_x86 #185404 (ABI=${ABI})"
+				fi
+				# For compatibility with older binaries at slight performance cost.
+				use stack-realign && export CFLAGS_x86+=" -mstackrealign"
+			fi
+		;;
+		mips)
+			# The mips abi cannot support the GNU style hashes. #233233
+			filter-ldflags -Wl,--hash-style=gnu -Wl,--hash-style=both
+		;;
+		ppc|ppc64)
+			# Many arch-specific implementations do not work on ppc with
+			# cache-block not equal to 128 bytes. This breaks memset:
+			#   https://sourceware.org/PR26522
+			#   https://bugs.gentoo.org/737996
+			# Use default -mcpu=. For ppc it means non-multiarch setup.
+			filter-flags '-mcpu=*'
+		;;
+		sparc)
+			# Both sparc and sparc64 can use -fcall-used-g6.  -g7 is bad, though.
+			filter-flags "-fcall-used-g7"
+			append-flags "-fcall-used-g6"
+
+			local cpu
+			case ${CTARGET} in
+			sparc64-*)
+				cpu="sparc64"
+				case $(get-flag mcpu) in
+				v9)
+					# We need to force at least v9a because the base build doesn't
+					# work with just v9.
+					# https://sourceware.org/bugzilla/show_bug.cgi?id=19477
+					append-flags "-Wa,-xarch=v9a"
+					;;
+				esac
+				;;
+			sparc-*)
+				case $(get-flag mcpu) in
+				v8|supersparc|hypersparc|leon|leon3)
+					cpu="sparcv8"
+					;;
+				*)
+					cpu="sparcv9"
+					;;
+				esac
+			;;
+			esac
+			[[ -n ${cpu} ]] && CTARGET_OPT="${cpu}-${CTARGET#*-}"
+		;;
+	esac
+}
+
+setup_flags() {
+	# Make sure host make.conf doesn't pollute us
+	if is_crosscompile || tc-is-cross-compiler ; then
+		CHOST=${CTARGET} strip-unsupported-flags
+	fi
+
+	# Store our CFLAGS because it's changed depending on which CTARGET
+	# we are building when pulling glibc on a multilib profile
+	CFLAGS_BASE=${CFLAGS_BASE-${CFLAGS}}
+	CFLAGS=${CFLAGS_BASE}
+	CXXFLAGS_BASE=${CXXFLAGS_BASE-${CXXFLAGS}}
+	CXXFLAGS=${CXXFLAGS_BASE}
+	ASFLAGS_BASE=${ASFLAGS_BASE-${ASFLAGS}}
+	ASFLAGS=${ASFLAGS_BASE}
+
+	# Allow users to explicitly avoid flag sanitization via
+	# USE=custom-cflags.
+	if ! use custom-cflags; then
+		# Over-zealous CFLAGS can often cause problems.  What may work for one
+		# person may not work for another.  To avoid a large influx of bugs
+		# relating to failed builds, we strip most CFLAGS out to ensure as few
+		# problems as possible.
+		strip-flags
+
+		# Allow -O2 and -O3, but nothing else for now.
+		# TODO: Test -Os, -Oz.
+		if ! is-flagq '-O@(2|3)' ; then
+			# Lock glibc at -O2. We want to be conservative here.
+			filter-flags '-O?'
+			append-flags -O2
+		fi
+	fi
+
+	strip-unsupported-flags
+	filter-lto
+	filter-flags -m32 -m64 '-mabi=*'
+
+	# glibc aborts if rpath is set by LDFLAGS
+	filter-ldflags '-Wl,-rpath=*'
+
+	# ld can't use -r & --relax at the same time, bug #788901
+	# https://sourceware.org/PR27837
+	filter-ldflags '-Wl,--relax'
+
+	# Flag added for cross-prefix, but causes ldconfig to segfault. Not needed
+	# anyway because glibc already handles this by itself.
+	filter-ldflags '-Wl,--dynamic-linker=*'
+
+	# Fails to link (bug #940709) in some cases but even if it manages to,
+	# subtle runtime breakage will occur because the linker scripts need
+	# adaptation. Mentioned in PR21557#c0.
+	filter-ldflags '-Wl,--gc-sections'
+
+	# some weird software relies on sysv hashes in glibc, bug 863863, bug 864100
+	# we have to do that here already so mips can filter it out again :P
+	if use hash-sysv-compat ; then
+		append-ldflags '-Wl,--hash-style=both'
+	fi
+
+	# #492892
+	filter-flags -frecord-gcc-switches
+
+	# #898098
+	filter-flags -fno-builtin
+
+	# #798774
+	filter-flags -fno-semantic-interposition
+
+	# #829583
+	filter-lfs-flags
+
+	unset CBUILD_OPT CTARGET_OPT
+	if use multilib ; then
+		CTARGET_OPT=$(get_abi_CTARGET)
+		[[ -z ${CTARGET_OPT} ]] && CTARGET_OPT=$(get_abi_CHOST)
+	fi
+
+	setup_target_flags
+
+	if [[ -n ${CTARGET_OPT} && ${CBUILD} == ${CHOST} ]] && ! is_crosscompile; then
+		CBUILD_OPT=${CTARGET_OPT}
+	fi
+
+	# glibc's headers disallow -O0 and fail at build time:
+	#  include/libc-symbols.h:75:3: #error "glibc cannot be compiled without optimization"
+	# https://sourceware.org/glibc/wiki/FAQ#Why_do_I_get:.60.23error_.22glibc_cannot_be_compiled_without_optimization.22.27.2C_when_trying_to_compile_GNU_libc_with_GNU_CC.3F
+	replace-flags -O0 -O1
+
+	# Similar issues as with SSP. Can't inject yourself that early.
+	filter-flags '-fsanitize=*'
+
+	# See end of bug #830454; we handle this via USE=cet
+	filter-flags '-fcf-protection=*'
+
+	# When bootstrapping, we may have a situation where
+	# CET-enabled gcc from seed is used to build CET-disabled
+	# glibc. As such, gcc implicitly enables CET if no
+	# -fcf-protection flag is passed. For a typical package it
+	# should not be a problem, but for glibc it matters as it is
+	# dealing with CET in ld.so. So if CET is supposed to be
+	# disabled for glibc, be explicit about it.
+	if ! use cet; then
+		case ${ABI}-${CTARGET} in
+			amd64-x86_64-*|x32-x86_64-*-*-gnux32)
+				append-flags '-fcf-protection=none'
+				;;
+			arm64-aarch64*)
+				append-flags '-mbranch-protection=none'
+				;;
+		esac
+	fi
+}
+
+use_multiarch() {
+	# Allow user to disable runtime arch detection in multilib.
+	use multiarch || return 1
+	# Make sure binutils is new enough to support indirect functions,
+	# #336792. This funky sed supports gold and bfd linkers.
+	local bver nver
+	bver=$($(tc-getLD ${CTARGET}) -v | sed -n -r '1{s:[^0-9]*::;s:^([0-9.]*).*:\1:;p}')
+	case $(tc-arch ${CTARGET}) in
+	amd64|x86) nver="2.20" ;;
+	arm)       nver="2.22" ;;
+	hppa)      nver="2.23" ;;
+	ppc|ppc64) nver="2.20" ;;
+	# ifunc support was added in 2.23, but glibc also needs
+	# machinemode which is in 2.24.
+	s390)      nver="2.24" ;;
+	sparc)     nver="2.21" ;;
+	*)         return 1 ;;
+	esac
+	ver_test ${bver} -ge ${nver}
+}
+
+# Setup toolchain variables that had historically been defined in the
+# profiles for these archs.
+setup_env() {
+	# silly users
+	unset LD_RUN_PATH
+	unset LD_ASSUME_KERNEL
+
+	if is_crosscompile || tc-is-cross-compiler ; then
+		multilib_env ${CTARGET_OPT:-${CTARGET}}
+
+		if ! use multilib ; then
+			MULTILIB_ABIS=${DEFAULT_ABI}
+		else
+			MULTILIB_ABIS=${MULTILIB_ABIS:-${DEFAULT_ABI}}
+		fi
+
+		# If the user has CFLAGS_<CTARGET> in their make.conf, use that,
+		# and fall back on CFLAGS.
+		local VAR=CFLAGS_${CTARGET//[-.]/_}
+		CFLAGS=${!VAR-${CFLAGS}}
+		einfo " $(printf '%15s' 'Manual CFLAGS:')   ${CFLAGS}"
+	fi
+
+	setup_flags
+
+	export ABI=${ABI:-${DEFAULT_ABI:-default}}
+
+	if just_headers ; then
+		# Avoid mixing host's CC and target's CFLAGS_${ABI}:
+		# At this bootstrap stage we have only binutils for
+		# target but not compiler yet.
+		einfo "Skip CC ABI injection. We can't use (cross-)compiler yet."
+		return 0
+	fi
+
+	# glibc does not work with non-bfd (for various reasons):
+	# * gold (bug #269274)
+	# * mold (bug #860900)
+	tc-ld-force-bfd
+
+	if use doc ; then
+		export MAKEINFO=makeinfo
+	else
+		export MAKEINFO=/dev/null
+	fi
+
+	# Reset CC and CXX to the value at start of emerge
+	export CC=${glibc__ORIG_CC:-${CC:-$(tc-getCC ${CTARGET})}}
+	export CXX=${glibc__ORIG_CXX:-${CXX:-$(tc-getCXX ${CTARGET})}}
+	export CPP=${glibc__ORIG_CPP:-${CPP:-$(tc-getCPP ${CTARGET})}}
+
+	# and make sure glibc__ORIG_CC and glibc__ORIG_CXX is defined now.
+	export glibc__ORIG_CC=${CC}
+	export glibc__ORIG_CXX=${CXX}
+	export glibc__ORIG_CPP=${CPP}
+
+	if tc-is-clang && ! use custom-cflags && ! is_crosscompile ; then
+		export glibc__force_gcc=yes
+		# once this is toggled on, it needs to stay on, since with CPP manipulated
+		# tc-is-clang does not work correctly anymore...
+	fi
+
+	if [[ ${glibc__force_gcc} == "yes" ]] ; then
+		# If we are running in an otherwise clang/llvm environment, we need to
+		# recover the proper gcc and binutils settings here, at least until glibc
+		# is finally building with clang. So let's override everything that is
+		# set in the clang profiles.
+		# Want to shoot yourself into the foot? Set USE=custom-cflags, that's always
+		# a good start into that direction.
+		# Also, if you're crosscompiling, let's assume you know what you are doing.
+		# Hopefully.
+		# Last, we need the settings of the *build* environment, not of the
+		# target environment...
+
+		local current_binutils_path=$(env CHOST="${CBUILD}" ROOT="${BROOT}" binutils-config -B "${CTARGET}")
+		local current_gcc_path=$(env ROOT="${BROOT}" gcc-config -B)
+		einfo "Overriding clang configuration, since it won't work here"
+
+		export CC="${current_gcc_path}/${CTARGET}-gcc"
+		export CPP="${current_gcc_path}/${CTARGET}-cpp"
+		export CXX="${current_gcc_path}/${CTARGET}-g++"
+		export LD="${current_binutils_path}/ld.bfd"
+		export AR="${current_binutils_path}/ar"
+		export AS="${current_binutils_path}/as"
+		export NM="${current_binutils_path}/nm"
+		export STRIP="${current_binutils_path}/strip"
+		export RANLIB="${current_binutils_path}/ranlib"
+		export OBJCOPY="${current_binutils_path}/objcopy"
+		export STRINGS="${current_binutils_path}/strings"
+		export OBJDUMP="${current_binutils_path}/objdump"
+		export READELF="${current_binutils_path}/readelf"
+		export ADDR2LINE="${current_binutils_path}/addr2line"
+
+		# do we need to also do flags munging here? yes! at least...
+		filter-flags '-fuse-ld=*'
+		filter-flags '-D_FORTIFY_SOURCE=*'
+
+	else
+
+		# this is the "normal" case
+
+		export CC="$(tc-getCC ${CTARGET})"
+		export CXX="$(tc-getCXX ${CTARGET})"
+		export CPP="$(tc-getCPP ${CTARGET})"
+
+		# Always use tuple-prefixed toolchain. For non-native ABI glibc's configure
+		# can't detect them automatically due to ${CHOST} mismatch and fallbacks
+		# to unprefixed tools. Similar to multilib.eclass:multilib_toolchain_setup().
+		export NM="$(tc-getNM ${CTARGET})"
+		export READELF="$(tc-getREADELF ${CTARGET})"
+
+	fi
+
+	# We need to export CFLAGS with abi information in them because glibc's
+	# configure script checks CFLAGS for some targets (like mips).  Keep
+	# around the original clean value to avoid appending multiple ABIs on
+	# top of each other. (Why does the comment talk about CFLAGS if the code
+	# acts on CC?)
+	export glibc__GLIBC_CC=${CC}
+	export glibc__GLIBC_CXX=${CXX}
+	export glibc__GLIBC_CPP=${CPP}
+
+	export glibc__abi_CFLAGS="$(get_abi_CFLAGS)"
+
+	# CFLAGS can contain ABI-specific flags like -mfpu=neon, see bug #657760
+	# To build .S (assembly) files with the same ABI-specific flags
+	# upstream currently recommends adding CFLAGS to CC/CXX:
+	#    https://sourceware.org/PR23273
+	# Note: Passing CFLAGS via CPPFLAGS overrides glibc's arch-specific CFLAGS
+	# and breaks multiarch support. See 659030#c3 for an example.
+	# The glibc configure script doesn't properly use LDFLAGS all the time.
+	export CC="${glibc__GLIBC_CC} ${glibc__abi_CFLAGS} ${CFLAGS} ${LDFLAGS}"
+
+	# Some of the tests are written in C++, so we need to force our multlib abis in, bug 623548
+	export CXX="${glibc__GLIBC_CXX} ${glibc__abi_CFLAGS} ${CFLAGS}"
+
+	export CPP="${glibc__GLIBC_CPP} ${glibc__abi_CFLAGS} ${CFLAGS}"
+
+	if is_crosscompile; then
+		# Assume worst-case bootstrap: glibc is built for the first time
+		# with ${CTARGET}-g++ not available yet. We avoid
+		# building auxiliary programs that require C++: bug #683074
+		# It should not affect final result.
+		export libc_cv_cxx_link_ok=no
+		# The line above has the same effect. We set CXX explicitly
+		# to make build logs less confusing.
+		export CXX=
+	fi
+}
+
+foreach_abi() {
+	setup_env
+
+	local ret=0
+	local abilist=""
+	if use multilib ; then
+		abilist=$(get_install_abis)
+	else
+		abilist=${DEFAULT_ABI}
+	fi
+	local -x ABI
+	for ABI in ${abilist:-default} ; do
+		setup_env
+		einfo "Running $1 for ABI ${ABI}"
+		$1
+		: $(( ret |= $? ))
+	done
+	return ${ret}
+}
+
+glibc_banner() {
+	local b="Gentoo ${PVR}"
+	[[ -n ${PATCH_VER} ]] && ! use vanilla && b+=" (patchset ${PATCH_VER})"
+	echo "${b}"
+}
+
+# The following Kernel version handling functions are mostly copied from portage
+# source. It's better not to use linux-info.eclass here since a) it adds too
+# much magic, see bug 326693 for some of the arguments, and b) some of the
+# functions are just not provided.
+
+g_get_running_KV() {
+	uname -r
+	return $?
+}
+
+g_KV_major() {
+	[[ -z $1 ]] && return 1
+	local KV=$@
+	echo "${KV%%.*}"
+}
+
+g_KV_minor() {
+	[[ -z $1 ]] && return 1
+	local KV=$@
+	KV=${KV#*.}
+	echo "${KV%%.*}"
+}
+
+g_KV_micro() {
+	[[ -z $1 ]] && return 1
+	local KV=$@
+	KV=${KV#*.*.}
+	echo "${KV%%[^[:digit:]]*}"
+}
+
+g_KV_to_int() {
+	[[ -z $1 ]] && return 1
+	local KV_MAJOR=$(g_KV_major "$1")
+	local KV_MINOR=$(g_KV_minor "$1")
+	local KV_MICRO=$(g_KV_micro "$1")
+	local KV_int=$(( KV_MAJOR * 65536 + KV_MINOR * 256 + KV_MICRO ))
+
+	# We make version 2.2.0 the minimum version we will handle as
+	# a sanity check ... if its less, we fail ...
+	if [[ ${KV_int} -ge 131584 ]] ; then
+		echo "${KV_int}"
+		return 0
+	fi
+	return 1
+}
+
+g_int_to_KV() {
+	local version=$1 major minor micro
+	major=$((version / 65536))
+	minor=$(((version % 65536) / 256))
+	micro=$((version % 256))
+	echo ${major}.${minor}.${micro}
+}
+
+get_kheader_version() {
+	printf '#include <linux/version.h>\nLINUX_VERSION_CODE\n' | \
+	$(tc-getCPP ${CTARGET}) -I "${ESYSROOT}$(alt_headers)" - | \
+	tail -n 1
+}
+
+# We collect all sanity checks here. Consistency is not guranteed between
+# pkg_ and src_ phases, so we call this function both in pkg_pretend and in
+# src_unpack.
+sanity_prechecks() {
+	# Prevent native builds from downgrading
+	if [[ ${MERGE_TYPE} != "buildonly" ]] && \
+	   [[ -z ${ROOT} ]] && \
+	   [[ ${CBUILD} == ${CHOST} ]] && \
+	   [[ ${CHOST} == ${CTARGET} ]] ; then
+
+		# The high rev # is to allow people to downgrade between -r#
+		# versions. We want to block 2.20->2.19, but 2.20-r3->2.20-r2
+		# should be fine. Hopefully we never actually use a r# this
+		# high.
+		if has_version ">${CATEGORY}/${P}-r10000" ; then
+			eerror "Sanity check to keep you from breaking your system:"
+			eerror " Downgrading glibc is not supported and a sure way to destruction."
+			[[ ${I_ALLOW_TO_BREAK_MY_SYSTEM} = yes ]] || die "Aborting to save your system."
+		fi
+
+		if ! do_run_test '#include <unistd.h>\n#include <sys/syscall.h>\nint main(){return syscall(1000)!=-1;}\n' ; then
+			eerror "Your old kernel is broken. You need to update it to a newer"
+			eerror "version as syscall(<bignum>) will break. See bug 279260."
+			die "Old and broken kernel."
+		fi
+	fi
+
+	if [[ ${CTARGET} == i386-* ]] ; then
+		eerror "i386 CHOSTs are no longer supported."
+		eerror "Chances are you don't actually want/need i386."
+		eerror "Please read https://www.gentoo.org/doc/en/change-chost.xml"
+		die "Please fix your CHOST"
+	fi
+
+	if [[ -e /proc/xen ]] && [[ $(tc-arch) == "x86" ]] && ! is-flag -mno-tls-direct-seg-refs ; then
+		ewarn "You are using Xen but don't have -mno-tls-direct-seg-refs in your CFLAGS."
+		ewarn "This will result in a 50% performance penalty when running with a 32bit"
+		ewarn "hypervisor, which is probably not what you want."
+	fi
+
+	# ABI-specific checks follow here. Hey, we have a lot more specific conditions that
+	# we test for...
+	if ! is_crosscompile ; then
+		if use amd64 && use multilib && [[ ${MERGE_TYPE} != "binary" ]] ; then
+			ebegin "Checking if the system can execute 32-bit binaries"
+			echo 'int main(){return 0;}' > "${T}/check-ia32-emulation.c"
+			local STAT
+			if ${CC-${CHOST}-gcc} ${CFLAGS_x86} "${T}/check-ia32-emulation.c" -o "${T}/check-ia32-emulation.elf32"; then
+				"${T}/check-ia32-emulation.elf32"
+				STAT=$?
+			else
+				# Don't fail here to allow single->multi ABI switch
+				# or recover from breakage like bug #646424
+				ewarn "Failed to compile the ABI test. Broken host glibc?"
+				STAT=0
+			fi
+			rm -f "${T}/check-ia32-emulation.elf32"
+			eend $STAT
+			if [[ $STAT -ne 0 ]]; then
+				eerror "Ensure that CONFIG_IA32_EMULATION is enabled in the kernel."
+				eerror "Seek support otherwise."
+				die "Unable to execute 32-bit binaries"
+			fi
+		fi
+
+	fi
+
+	# When we actually have to compile something...
+	if ! just_headers && [[ ${MERGE_TYPE} != "binary" ]] ; then
+		if [[ -d "${ESYSROOT}"/usr/lib/include ]] ; then
+			# bug #833620, bug #643302
+			eerror "Found ${ESYSROOT}/usr/lib/include directory!"
+			eerror "This is known to break glibc's build."
+			eerror "Please backup its contents then remove the directory."
+			die "Found directory (${ESYSROOT}/usr/lib/include) which will break build (bug #833620)!"
+		fi
+
+		if [[ ${CTARGET} == *-linux* ]] ; then
+			local run_kv build_kv want_kv
+
+			run_kv=$(g_get_running_KV)
+			build_kv=$(g_int_to_KV $(get_kheader_version))
+			want_kv=${MIN_KERN_VER}
+
+			if ! is_crosscompile && ! tc-is-cross-compiler ; then
+				# Building fails on an non-supporting kernel
+				ebegin "Checking running kernel version (${run_kv} >= ${want_kv})"
+				if ! [[ $(g_KV_to_int ${run_kv}) -ge $(g_KV_to_int ${want_kv}) ]] ; then
+					eend 1
+					echo
+					eerror "You need a kernel of at least ${want_kv}!"
+					die "Kernel version too low!"
+				fi
+				eend 0
+			fi
+
+			# Do not run this check for pkg_pretend, just pkg_setup and friends (if we ever get used there).
+			# It's plausible (seen it in the wild) that Portage will (correctly) schedule a linux-headers
+			# upgrade before glibc, but because pkg_pretend gets run before any packages are merged at all (not
+			# just glibc), the whole emerge gets aborted without a good reason. We probably don't
+			# need to run this check at all given we have a dependency on the right headers,
+			# but let's leave it as-is for now.
+			if [[ ${EBUILD_PHASE_FUNC} != pkg_pretend ]] ; then
+				ebegin "Checking linux-headers version (${build_kv} >= ${want_kv})"
+				if ! [[ $(g_KV_to_int ${build_kv}) -ge $(g_KV_to_int ${want_kv}) ]] ; then
+					eend 1
+					echo
+					eerror "You need linux-headers of at least ${want_kv}!"
+					die "linux-headers version too low!"
+				fi
+				eend 0
+			fi
+		fi
+	fi
+}
+
+upgrade_warning() {
+	is_crosscompile && return
+
+	if [[ ${MERGE_TYPE} != buildonly && -n ${REPLACING_VERSIONS} && -z ${ROOT} ]]; then
+		if ver_replacing -lt $(ver_cut 1-2 ${PV}); then
+			ewarn "After upgrading glibc, please restart all running processes."
+			ewarn "Be sure to include init (telinit u) or systemd (systemctl daemon-reexec)."
+			ewarn "Alternatively, reboot your system."
+			ewarn "(See bug #660556, bug #741116, bug #823756, etc)"
+		fi
+	fi
+}
+
+#
+# the phases
+#
+
+# pkg_pretend
+
+pkg_pretend() {
+	upgrade_warning
+}
+
+# pkg_setup
+
+pkg_setup() {
+	# see bug 682570
+	[[ -z ${BOOTSTRAP_RAP} ]] && python-any-r1_pkg_setup
+}
+
+# src_unpack
+
+src_unpack() {
+	setup_env
+
+	einfo "Checking general environment sanity."
+	sanity_prechecks
+
+	use multilib-bootstrap && unpack gcc-multilib-bootstrap-${GCC_BOOTSTRAP_VER}.tar.xz
+
+	if [[ ${PV} == *9999 ]] ; then
+		EGIT_REPO_URI="
+			https://anongit.gentoo.org/git/proj/toolchain/glibc-patches.git
+			https://github.com/gentoo/glibc-patches.git
+		"
+		EGIT_CHECKOUT_DIR=${WORKDIR}/patches-git
+		git-r3_src_unpack
+		mv patches-git/9999 patches || die
+		EGIT_REPO_URI="
+			https://sourceware.org/git/glibc.git
+			https://git.sr.ht/~sourceware/glibc
+			https://gitlab.com/x86-glibc/glibc.git
+		"
+		EGIT_CHECKOUT_DIR=${S}
+		[[ ${PV} == *.*.9999 ]] && EGIT_BRANCH=release/${PV%.*}/master
+		git-r3_src_unpack
+	else
+		unpack ${P}.tar.xz
+
+		cd "${WORKDIR}" || die
+		unpack ${P}-patches-${PATCH_VER}.tar.xz
+	fi
+
+	cd "${WORKDIR}" || die
+	use systemd && unpack glibc-systemd-${GLIBC_SYSTEMD_VER}.tar.gz
+}
+
+# src_prepare
+
+src_prepare() {
+	local patchsetname
+	if ! use vanilla ; then
+		if [[ ${PV} == 9999* ]] ; then
+			patchsetname="from git master"
+		else
+			patchsetname="${PV}-${PATCH_VER}"
+		fi
+		einfo "Applying Gentoo Glibc patchset ${patchsetname}"
+		eapply "${WORKDIR}"/patches
+		einfo "Done."
+	fi
+
+	case ${CTARGET} in
+		m68*-aligned-*)
+			einfo "Applying utmp format fix for m68k with -maligned-int"
+			eapply "${FILESDIR}/glibc-2.41-m68k-malign.patch"
+			;;
+		*)
+			;;
+	esac
+
+	default
+
+	gnuconfig_update
+
+	cd "${WORKDIR}" || die
+	find . -name configure -exec touch {} +
+
+	# Fix permissions on some of the scripts.
+	chmod u+x "${S}"/scripts/*.sh
+
+	cd "${S}" || die
+}
+
+# src_configure
+
+glibc_do_configure() {
+	dump_build_environment
+
+	local myconf=()
+
+	# Use '=strong' instead of '=all' to protect only functions
+	# worth protecting from stack smashes.
+	myconf+=( --enable-stack-protector=$(usex ssp strong no) )
+
+	# Keep a whitelist of targets supporting IFUNC. glibc's ./configure
+	# is not robust enough to detect proper support:
+	#    https://bugs.gentoo.org/641216
+	#    https://sourceware.org/PR22634#c0
+	case $(tc-arch ${CTARGET}) in
+		# Keep whitelist of targets where autodetection mostly works.
+		amd64|x86|sparc|ppc|ppc64|arm|arm64|s390|riscv|loong) ;;
+		# Blacklist everywhere else
+		*) myconf+=( libc_cv_ld_gnu_indirect_function=no ) ;;
+	esac
+
+	case ${ABI}-${CTARGET} in
+		amd64-x86_64-*|x32-x86_64-*-*-gnux32) myconf+=( $(use_enable cet) ) ;;
+		*) ;;
+	esac
+
+	case ${ABI}-${CTARGET} in
+		amd64-x86_64-*|arm64-aarch64-*) myconf+=( $(use_enable sframe) ) ;;
+		*) ;;
+	esac
+
+	[[ $(tc-is-softfloat) == "yes" ]] && myconf+=( --without-fp )
+
+	myconf+=( --enable-kernel=${MIN_KERN_VER} )
+
+	# Since SELinux support is only required for nscd, only enable it if:
+	# 1. USE selinux
+	# 2. only for the primary ABI on multilib systems
+	# 3. Not a crosscompile
+	if ! is_crosscompile && use selinux ; then
+		if use multilib ; then
+			if is_final_abi ; then
+				myconf+=( --with-selinux )
+			else
+				myconf+=( --without-selinux )
+			fi
+		else
+			myconf+=( --with-selinux )
+		fi
+	else
+		myconf+=( --without-selinux )
+	fi
+
+	# Force a few tests where we always know the answer but
+	# configure is incapable of finding it.
+	if is_crosscompile ; then
+		export \
+			libc_cv_c_cleanup=yes \
+			libc_cv_forced_unwind=yes
+	fi
+
+	myconf+=(
+		--disable-werror
+		--enable-bind-now
+		--enable-fortify-source
+		--build=${CBUILD_OPT:-${CBUILD}}
+		--host=${CTARGET_OPT:-${CTARGET}}
+		$(use_enable profile)
+		$(use_with gd)
+		--with-headers="${ESYSROOT}$(alt_headers)"
+		--prefix="$(host_eprefix)/usr"
+		--sysconfdir="$(host_eprefix)/etc"
+		--localstatedir="$(host_eprefix)/var"
+		--libdir='$(prefix)'/$(get_libdir)
+		--mandir='$(prefix)'/share/man
+		--infodir='$(prefix)'/share/info
+		--libexecdir='$(libdir)'/misc/glibc
+		--with-bugurl=https://bugs.gentoo.org/
+		--with-pkgversion="$(glibc_banner)"
+		$(use_multiarch || echo --disable-multi-arch)
+		$(use_enable systemtap)
+		$(use_enable nscd)
+
+		# /usr/bin/mtrace has a Perl shebang. Gentoo Prefix QA checks fail if
+		# Perl hasn't been installed inside the prefix yet and configure picks
+		# up a Perl from outside the prefix instead. configure will fail to
+		# execute Perl during configure if we're cross-compiling a prefix, but
+		# it will just disable mtrace in that case.
+		# Note: mtrace is needed by the test suite.
+		ac_cv_path_PERL="$(usex perl "${EPREFIX}"/usr/bin/perl $(usex test "${EPREFIX}"/usr/bin/perl $(usex doc "${EPREFIX}"/usr/bin/perl no)))"
+
+		# locale data is arch-independent
+		# https://bugs.gentoo.org/753740
+		libc_cv_complocaledir='${exec_prefix}/lib/locale'
+
+		# On aarch64 there is no way to override -mcpu=native, and if
+		# the current cpu does not support SVE configure fails.
+		# Let's boldly assume our toolchain can always build SVE instructions.
+		libc_cv_aarch64_sve_asm=yes
+
+		${EXTRA_ECONF}
+	)
+
+	# We rely on sys-libs/timezone-data for timezone tools normally.
+	myconf+=( $(use_enable vanilla timezone-tools) )
+
+	# These libs don't have configure flags.
+	ac_cv_lib_audit_audit_log_user_avc_message=$(usex audit || echo no)
+	ac_cv_lib_cap_cap_init=$(usex caps || echo no)
+
+	# There is no configure option for this and we need to export it
+	# since the glibc build will re-run configure on itself
+	export libc_cv_rootsbindir="$(host_eprefix)/sbin"
+	export libc_cv_slibdir="$(host_eprefix)/$(get_libdir)"
+
+	local builddir=$(builddir nptl)
+	mkdir -p "${builddir}"
+	cd "${builddir}"
+	set -- "${S}"/configure "${myconf[@]}"
+	echo "$@"
+	"$@" || die "failed to configure glibc"
+
+	# If we're trying to migrate between ABI sets, we need
+	# to lie and use a local copy of gcc.  Like if the system
+	# is built with MULTILIB_ABIS="amd64 x86" but we want to
+	# add x32 to it, gcc/glibc don't yet support x32.
+	#
+	if [[ -n ${GCC_BOOTSTRAP_VER} ]] && use multilib-bootstrap ; then
+		echo 'int main(void){}' > "${T}"/test.c || die
+		if ! $(tc-getCC ${CTARGET}) ${CFLAGS} ${LDFLAGS} "${T}"/test.c -Wl,-emain -lgcc 2>/dev/null ; then
+			sed -i -e '/^CC = /s:$: -B$(objdir)/../'"gcc-multilib-bootstrap-${GCC_BOOTSTRAP_VER}/${ABI}:" config.make || die
+		fi
+	fi
+}
+
+glibc_headers_configure() {
+	export ABI=default
+
+	local builddir=$(builddir "headers")
+	mkdir -p "${builddir}"
+	cd "${builddir}"
+
+	# if we don't have a compiler yet, we can't really test it now ...
+	# hopefully they don't affect header generation, so let's hope for
+	# the best here ...
+	local v vars=(
+		ac_cv_header_cpuid_h=yes
+		libc_cv_{386,390,alpha,arm,hppa,mips,{powerpc,sparc}{,32,64},sh,x86_64}_tls=yes
+		libc_cv_asm_cfi_directives=yes
+		libc_cv_broken_visibility_attribute=no
+		libc_cv_c_cleanup=yes
+		libc_cv_compiler_powerpc64le_binary128_ok=yes
+		libc_cv_forced_unwind=yes
+		libc_cv_gcc___thread=yes
+		libc_cv_mlong_double_128=yes
+		libc_cv_mlong_double_128ibm=yes
+		libc_cv_ppc_machine=yes
+		libc_cv_ppc_rel16=yes
+		libc_cv_predef_fortify_source=no
+		libc_cv_target_power8_ok=yes
+		libc_cv_visibility_attribute=yes
+		libc_cv_z_combreloc=yes
+		libc_cv_z_execstack=yes
+		libc_cv_z_initfirst=yes
+		libc_cv_z_nodelete=yes
+		libc_cv_z_nodlopen=yes
+		libc_cv_z_relro=yes
+		libc_mips_abi=${ABI}
+		libc_mips_float=$([[ $(tc-is-softfloat) == "yes" ]] && echo soft || echo hard)
+		# These libs don't have configure flags.
+		ac_cv_lib_audit_audit_log_user_avc_message=no
+		ac_cv_lib_cap_cap_init=no
+	)
+
+	einfo "Forcing cached settings:"
+	for v in "${vars[@]}" ; do
+		einfo " ${v}"
+		export ${v}
+	done
+
+	local headers_only_arch_CPPFLAGS=()
+
+	# Blow away some random CC settings that screw things up. #550192
+	if [[ -d ${S}/sysdeps/mips ]]; then
+		pushd "${S}"/sysdeps/mips >/dev/null
+		sed -i -e '/^CC +=/s:=.*:= -D_MIPS_SZPTR=32:' mips32/Makefile mips64/n32/Makefile || die
+		sed -i -e '/^CC +=/s:=.*:= -D_MIPS_SZPTR=64:' mips64/n64/Makefile || die
+
+		# Force the mips ABI to the default.  This is OK because the set of
+		# installed headers in this phase is the same between the 3 ABIs.
+		# If this ever changes, this hack will break, but that's unlikely
+		# as glibc discourages that behavior.
+		# https://crbug.com/647033
+		sed -i -e 's:abiflag=.*:abiflag=_ABIO32:' preconfigure || die
+
+		popd >/dev/null
+	fi
+
+	local myconf=()
+
+	case ${CTARGET} in
+	aarch64*)
+		# The configure checks fail during cross-build, so disable here
+		# for headers-only
+		myconf+=(
+			--disable-mathvec
+		) ;;
+	riscv*)
+		# RISC-V interrogates the compiler to determine which target to
+		# build.  If building the headers then we don't strictly need a
+		# RISC-V compiler, so the built-in definitions that are provided
+		# along with all RISC-V compiler might not exist.  This causes
+		# glibc's RISC-V preconfigure script to blow up.  Since we're just
+		# building the headers any value will actually work here, so just
+		# pick the standard one (rv64g/lp64d) to make the build scripts
+		# happy for now -- the headers are all the same anyway so it
+		# doesn't matter.
+		headers_only_arch_CPPFLAGS+=(
+			-D__riscv_xlen=64
+			-D__riscv_flen=64
+			-D__riscv_float_abi_double=1
+			-D__riscv_atomic=1
+		) ;;
+	esac
+
+	myconf+=(
+		--disable-sanity-checks
+		--enable-hacker-mode
+		--disable-werror
+		--enable-bind-now
+		--build=${CBUILD_OPT:-${CBUILD}}
+		--host=${CTARGET_OPT:-${CTARGET}}
+		--with-headers="${ESYSROOT}$(alt_headers)"
+		--prefix="$(host_eprefix)/usr"
+		${EXTRA_ECONF}
+	)
+
+	# Nothing is compiled here which would affect the headers for the target.
+	# So forcing CC/CFLAGS is sane.
+	local headers_only_CC=$(tc-getBUILD_CC)
+	local headers_only_CFLAGS="-O1 -pipe"
+	local headers_only_CPPFLAGS="-U_FORTIFY_SOURCE ${headers_only_arch_CPPFLAGS[*]}"
+	local headers_only_LDFLAGS=""
+	set -- "${S}"/configure "${myconf[@]}"
+	echo \
+		"CC=${headers_only_CC}" \
+		"CFLAGS=${headers_only_CFLAGS}" \
+		"CPPFLAGS=${headers_only_CPPFLAGS}" \
+		"LDFLAGS=${headers_only_LDFLAGS}" \
+		"$@"
+	CC=${headers_only_CC} \
+	CFLAGS=${headers_only_CFLAGS} \
+	CPPFLAGS=${headers_only_CPPFLAGS} \
+	LDFLAGS="" \
+	"$@" || die "failed to configure glibc"
+}
+
+do_src_configure() {
+	if just_headers ; then
+		glibc_headers_configure
+	else
+		glibc_do_configure nptl
+	fi
+}
+
+src_configure() {
+	foreach_abi do_src_configure
+}
+
+# src_compile
+
+do_src_compile() {
+	emake -C "$(builddir nptl)"
+}
+
+src_compile() {
+	if just_headers ; then
+		return
+	fi
+
+	foreach_abi do_src_compile
+}
+
+# src_test
+
+glibc_src_test() {
+	cd "$(builddir nptl)"
+
+	local myxfailparams=""
+	if [[ "${GENTOO_GLIBC_XFAIL_TESTS}" == "yes" ]] ; then
+		local virt=$(systemd-detect-virt 2>/dev/null)
+		if [[ ${virt} == systemd-nspawn ]] ; then
+			ewarn "Skipping extra tests because in systemd-nspawn container"
+			XFAIL_TEST_LIST+=( "${XFAIL_NSPAWN_TEST_LIST[@]}" )
+		fi
+		if [[ "$(nice)" == "19" ]] ; then
+			# Expects to be able to increase niceness, which it can't do if
+			# already at the highest nice value
+			XFAIL_TEST_LIST+=( "tst-nice" )
+		fi
+
+		for myt in ${XFAIL_TEST_LIST[@]} ; do
+			myxfailparams+="test-xfail-${myt}=yes "
+		done
+	fi
+
+	# sandbox does not understand unshare() and prevents
+	# writes to /proc/, which makes many tests fail
+
+	# we give the tests a bit more time to avoid spurious
+	# bug reports on slow arches
+
+	SANDBOX_ON=0 LD_PRELOAD= TIMEOUTFACTOR=16 nonfatal emake ${myxfailparams} check
+}
+
+src_test() {
+	if just_headers ; then
+		return
+	fi
+
+	# glibc_src_test uses nonfatal so that we can run tests for all ABIs
+	# and fail at the end instead.
+	foreach_abi glibc_src_test || die "tests failed"
+}
+
+# src_install
+
+run_locale_gen() {
+	local prefix=$1 user_config config
+	local -a hasversion_opts localegen_args
+
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		hasversion_opts=( -b )
+	fi
+
+	if has_version "${hasversion_opts[@]}" '>=sys-apps/locale-gen-3'; then
+		localegen_args=( --prefix "${prefix}" )
+	else
+		config="${prefix}/usr/share/i18n/SUPPORTED"
+		user_config="${prefix}/etc/locale.gen"
+		if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+			# For USE=compile-locales, all locales should be built.
+			mkdir -p -- "${prefix}/usr/lib/locale" || die
+		elif locale-gen --list --config "${user_config}" | read -r; then
+			config=${user_config}
+		fi
+		localegen_args=( --config "${config}" --destdir "${prefix}" )
+	fi
+
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
+	fi
+
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
+}
+
+glibc_do_src_install() {
+	local builddir=$(builddir nptl)
+	cd "${builddir}"
+
+	emake install_root="${D}/$(build_eprefix)$(alt_prefix)" install
+
+	# This version (2.26) provides some compatibility libraries for the NIS/NIS+ support
+	# which come without headers etc. Only needed for binary packages since the
+	# external net-libs/libnsl has increased soversion. Keep only versioned libraries.
+	find "${D}" -name "libnsl.a" -delete
+	find "${D}" -name "libnsl.so" -delete
+
+	# Normally upstream_pv is ${PV}. Live ebuilds are exception, there we need
+	# to infer upstream version:
+	# '#define VERSION "2.26.90"' -> '2.26.90'
+	local upstream_pv=$(sed -n -r 's/#define VERSION "(.*)"/\1/p' "${S}"/version.h)
+
+	# Avoid stripping binaries not targeted by ${CHOST}. Or else
+	# ${CHOST}-strip would break binaries build for ${CTARGET}.
+	is_crosscompile && dostrip -x /
+
+	# gdb thread introspection relies on local libpthreads symbols. stripping breaks it
+	# See Note [Disable automatic stripping]
+	dostrip -x $(alt_libdir)/libpthread-${upstream_pv}.so
+	# valgrind requires knowledge about ld.so symbols.
+	dostrip -x $(alt_libdir)/ld-*.so*
+
+	if [[ -e ${ED}/$(alt_usrlibdir)/libm-${upstream_pv}.a ]] ; then
+		# Move versioned .a file out of libdir to evade portage QA checks
+		# instead of using gen_usr_ldscript(). We fix ldscript as:
+		# "GROUP ( /usr/lib64/libm-<pv>.a ..." -> "GROUP ( /usr/lib64/glibc-<pv>/libm-<pv>.a ..."
+		sed -i "s@\(libm-${upstream_pv}.a\)@${P}/\1@" \
+			"${ED}"/$(alt_usrlibdir)/libm.a || die
+		dodir $(alt_usrlibdir)/${P}
+		mv "${ED}"/$(alt_usrlibdir)/libm-${upstream_pv}.a \
+			"${ED}"/$(alt_usrlibdir)/${P}/libm-${upstream_pv}.a || die
+	fi
+
+	# We configure toolchains for standalone prefix systems with a sysroot,
+	# which is prepended to paths in ld scripts, so strip the prefix from these.
+	# Before: GROUP ( /foo/lib64/libc.so.6 /foo/usr/lib64/libc_nonshared.a  AS_NEEDED ( /foo/lib64/ld-linux-x86-64.so.2 ) )
+	# After: GROUP ( /lib64/libc.so.6 /usr/lib64/libc_nonshared.a  AS_NEEDED ( /lib64/ld-linux-x86-64.so.2 ) )
+	if [[ -n $(host_eprefix) ]] ; then
+		local file
+		grep -lZIF "ld script" "${ED}/$(alt_usrlibdir)"/lib*.{a,so} 2>/dev/null | while read -rd '' file ; do
+			sed -i "s|$(host_eprefix)/|/|g" "${file}" || die
+		done
+	fi
+
+	# We'll take care of the cache ourselves
+	rm -f "${ED}"/etc/ld.so.cache
+
+	# Everything past this point just needs to be done once ...
+	is_final_abi || return 0
+
+	# Make sure the non-native interp can be found on multilib systems even
+	# if the main library set isn't installed into the right place.  Maybe
+	# we should query the active gcc for info instead of hardcoding it ?
+	local i ldso_abi ldso_name
+	local ldso_abi_list=(
+		# x86
+		amd64   /lib64/ld-linux-x86-64.so.2
+		x32     /libx32/ld-linux-x32.so.2
+		x86     /lib/ld-linux.so.2
+		# mips
+		o32     /lib/ld.so.1
+		n32     /lib32/ld.so.1
+		n64     /lib64/ld.so.1
+		# powerpc
+		ppc     /lib/ld.so.1
+		# riscv
+		ilp32d  /lib/ld-linux-riscv32-ilp32d.so.1
+		ilp32   /lib/ld-linux-riscv32-ilp32.so.1
+		lp64d   /lib/ld-linux-riscv64-lp64d.so.1
+		lp64    /lib/ld-linux-riscv64-lp64.so.1
+		# s390
+		s390    /lib/ld.so.1
+		s390x   /lib/ld64.so.1
+		# sparc
+		sparc32 /lib/ld-linux.so.2
+		sparc64 /lib64/ld-linux.so.2
+	)
+	case $(tc-endian) in
+	little)
+		ldso_abi_list+=(
+			# arm
+			arm64   /lib/ld-linux-aarch64.so.1
+			# ELFv2 (glibc does not support ELFv1 on LE)
+			ppc64   /lib64/ld64.so.2
+		)
+		;;
+	big)
+		ldso_abi_list+=(
+			# arm
+			arm64   /lib/ld-linux-aarch64_be.so.1
+			# ELFv1 (glibc does not support ELFv2 on BE)
+			ppc64   /lib64/ld64.so.1
+		)
+		;;
+	esac
+	if [[ ${SYMLINK_LIB} == "yes" ]] && [[ ! -e ${ED}/$(alt_prefix)/lib ]] ; then
+		dosym $(get_abi_LIBDIR ${DEFAULT_ABI}) $(alt_prefix)/lib
+	fi
+	for (( i = 0; i < ${#ldso_abi_list[@]}; i += 2 )) ; do
+		ldso_abi=${ldso_abi_list[i]}
+		has ${ldso_abi} $(get_install_abis) || continue
+
+		ldso_name="$(alt_prefix)${ldso_abi_list[i+1]}"
+		if [[ ! -L ${ED}/${ldso_name} && ! -e ${ED}/${ldso_name} ]] ; then
+			dosym ../$(get_abi_LIBDIR ${ldso_abi})/${ldso_name##*/} ${ldso_name}
+		fi
+	done
+
+	# In the LSB 5.0 definition, someone had the excellent idea to "standardize"
+	# the runtime loader name, see also https://xkcd.com/927/
+	# Normally, in Gentoo one should never come across executables that require this.
+	# However, binary commercial packages are known to adhere to weird practices.
+	# https://refspecs.linuxfoundation.org/LSB_5.0.0/LSB-Core-AMD64/LSB-Core-AMD64.html#BASELIB
+	local lsb_ldso_name native_ldso_name lsb_ldso_abi
+	local lsb_ldso_abi_list=(
+		# x86
+		amd64	ld-linux-x86-64.so.2	ld-lsb-x86-64.so.3
+	)
+	for (( i = 0; i < ${#lsb_ldso_abi_list[@]}; i += 3 )) ; do
+		lsb_ldso_abi=${lsb_ldso_abi_list[i]}
+		native_ldso_name=${lsb_ldso_abi_list[i+1]}
+		lsb_ldso_name=${lsb_ldso_abi_list[i+2]}
+		has ${lsb_ldso_abi} $(get_install_abis) || continue
+
+		if [[ ! -L ${ED}/$(get_abi_LIBDIR ${lsb_ldso_abi})/${lsb_ldso_name} && ! -e ${ED}/$(get_abi_LIBDIR ${lsb_ldso_abi})/${lsb_ldso_name} ]] ; then
+			dosym ${native_ldso_name} "$(alt_prefix)/$(get_abi_LIBDIR ${lsb_ldso_abi})/${lsb_ldso_name}"
+		fi
+	done
+
+	# With devpts under Linux mounted properly, we do not need the pt_chown
+	# binary to be setuid.  This is because the default owners/perms will be
+	# exactly what we want.
+	if ! use suid ; then
+		find "${ED}" -name pt_chown -exec chmod -s {} +
+	fi
+
+	#################################################################
+	# EVERYTHING AFTER THIS POINT IS FOR NATIVE GLIBC INSTALLS ONLY #
+	#################################################################
+
+	# Make sure we install some symlink hacks so that when we build
+	# a 2nd stage cross-compiler, gcc finds the target system
+	# headers correctly.  See gcc/doc/gccinstall.info
+	if is_crosscompile ; then
+		# We need to make sure that /lib and /usr/lib always exists.
+		# gcc likes to use relative paths to get to its multilibs like
+		# /usr/lib/../lib64/.  So while we don't install any files into
+		# /usr/lib/, we do need it to exist.
+		keepdir $(alt_prefix)/lib
+		keepdir $(alt_prefix)/usr/lib
+
+		dosym usr/include $(alt_prefix)/sys-include
+		return 0
+	fi
+
+	# Files for Debian-style locale updating
+	dodir /usr/share/i18n
+	sed \
+		-e "/^#/d" \
+		-e "/SUPPORTED-LOCALES=/d" \
+		-e "s: \\\\::g" -e "s:/: :g" \
+		"${S}"/localedata/SUPPORTED > "${ED}"/usr/share/i18n/SUPPORTED \
+		|| die "generating /usr/share/i18n/SUPPORTED failed"
+
+	cd "${S}" || die
+
+	# Install misc network config files
+	insinto /etc
+	doins posix/gai.conf
+
+	if use systemd ; then
+		doins "${WORKDIR}/glibc-systemd-${GLIBC_SYSTEMD_VER}/gentoo-config/nsswitch.conf"
+	else
+		doins nss/nsswitch.conf
+	fi
+
+	# Gentoo-specific
+	newins "${FILESDIR}"/host.conf-1 host.conf
+
+	if use nscd ; then
+		doins nscd/nscd.conf
+
+		newinitd "$(prefixify_ro "${FILESDIR}"/nscd-1)" nscd
+
+		local nscd_args=(
+			-e "s:@PIDFILE@:$(strings "${ED}"/usr/sbin/nscd | grep nscd.pid):"
+		)
+
+		sed -i "${nscd_args[@]}" "${ED}"/etc/init.d/nscd
+
+		use systemd && systemd_dounit nscd/nscd.service
+		newtmpfiles nscd/nscd.tmpfiles nscd.conf
+	fi
+
+	echo 'LDPATH="include ld.so.conf.d/*.conf"' > "${T}"/00glibc
+	doenvd "${T}"/00glibc
+
+	for d in BUGS ChangeLog CONFORMANCE FAQ NEWS NOTES PROJECTS README* ; do
+		[[ -s ${d} ]] && dodoc ${d}
+	done
+	dodoc -r ChangeLog.old
+
+	# Prevent overwriting of the /etc/localtime symlink.  We'll handle the
+	# creation of the "factory" symlink in pkg_postinst().
+	rm -f "${ED}"/etc/localtime
+
+	# Generate all locales if this is a native build as locale generation
+	if use compile-locales && ! is_crosscompile && ! run_locale_gen "${ED}"; then
+		die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+	fi
+}
+
+glibc_headers_install() {
+	local builddir=$(builddir "headers")
+	cd "${builddir}"
+	emake install_root="${D}/$(build_eprefix)$(alt_prefix)" install-headers
+
+	insinto $(alt_headers)/gnu
+	doins "${S}"/include/gnu/stubs.h
+
+	# Make sure we install the sys-include symlink so that when
+	# we build a 2nd stage cross-compiler, gcc finds the target
+	# system headers correctly.  See gcc/doc/gccinstall.info
+	dosym usr/include $(alt_prefix)/sys-include
+}
+
+src_install() {
+	if just_headers ; then
+		export ABI=default
+		glibc_headers_install
+		return
+	fi
+
+	foreach_abi glibc_do_src_install
+
+	if ! use static-libs ; then
+		einfo "Not installing static glibc libraries"
+		find "${ED}" -name "*.a" -and -not -name "*_nonshared.a" -delete
+	fi
+}
+
+# Simple test to make sure our new glibc isn't completely broken.
+# Make sure we don't test with statically built binaries since
+# they will fail.  Also, skip if this glibc is a cross compiler.
+#
+# If coreutils is built with USE=multicall, some of these files
+# will just be wrapper scripts, not actual ELFs we can test.
+glibc_sanity_check() {
+	cd / #228809
+
+	# We enter ${ED} so to avoid trouble if the path contains
+	# special characters; for instance if the path contains the
+	# colon character (:), then the linker will try to split it
+	# and look for the libraries in an unexpected place. This can
+	# lead to unsafe code execution if the generated prefix is
+	# within a world-writable directory.
+	# (e.g. /var/tmp/portage:${HOSTNAME})
+	pushd "${ED}"/$(get_libdir) >/dev/null
+
+	# first let's find the actual dynamic linker here
+	# symlinks may point to the wrong abi
+	local newldso=$(find . -maxdepth 1 -name 'ld*so.?' -type f -print -quit)
+
+	einfo Last-minute run tests with ${newldso} in /$(get_libdir) ...
+
+	local x striptest
+	for x in cal date env free ls true uname uptime ; do
+		x=$(type -p ${x})
+		[[ -z ${x} || ${x} != ${EPREFIX}/* ]] && continue
+		striptest=$(LC_ALL="C" file -L ${x} 2>/dev/null) || continue
+		case ${striptest} in
+		*"statically linked"*) continue;;
+		*"ASCII text"*) continue;;
+		esac
+		# We need to clear the locale settings as the upgrade might want
+		# incompatible locale data.  This test is not for verifying that.
+		LC_ALL=C \
+		${newldso} --library-path . ${x} > /dev/null \
+			|| die "simple run test (${x}) failed"
+	done
+
+	popd >/dev/null
+}
+
+pkg_preinst() {
+	# nothing to do if just installing headers
+	just_headers && return
+
+	einfo "Checking general environment sanity."
+	sanity_prechecks
+
+	# prepare /etc/ld.so.conf.d/ for files
+	mkdir -p "${EROOT}"/etc/ld.so.conf.d
+
+	# Default /etc/hosts.conf:multi to on for systems with small dbs.
+	if [[ $(wc -l < "${EROOT}"/etc/hosts) -lt 1000 ]] ; then
+		sed -i '/^multi off/s:off:on:' "${ED}"/etc/host.conf
+		einfo "Defaulting /etc/host.conf:multi to on"
+	fi
+
+	[[ -n ${ROOT} ]] && return 0
+	[[ -d ${ED}/$(get_libdir) ]] || return 0
+	[[ -z ${BOOTSTRAP_RAP} ]] && glibc_sanity_check
+
+	if [[ -L ${EROOT}/usr/lib/locale ]]; then
+		# Help portage migrate this to a directory
+		# https://bugs.gentoo.org/753740
+		rm "${EROOT}"/usr/lib/locale || die
+	fi
+
+	# Keep around libcrypt so that Perl doesn't break when merging libxcrypt
+	# (libxcrypt is the new provider for now of libcrypt.so.{1,2}).
+	# bug #802207
+	if has_version "${CATEGORY}/${PN}[crypt]" && ! has preserve-libs ${FEATURES}; then
+		PRESERVED_OLD_LIBCRYPT=1
+		cp -p "${EROOT}/$(get_libdir)/libcrypt$(get_libname 1)" \
+			"${T}/libcrypt$(get_libname 1)" || die
+	else
+		PRESERVED_OLD_LIBCRYPT=0
+	fi
+}
+
+glibc_refresh_ldconfig() {
+	if [[ ${MERGE_TYPE} == buildonly ]]; then
+		return
+	fi
+
+	# Version check could be added to avoid unnecessary work, but ldconfig
+	# should finish quickly enough to not matter.
+	ebegin "Refreshing ld.so.cache"
+	ldconfig -i
+	if ! eend $?; then
+		ewarn "Failed to refresh the ld.so.cache for you. Some programs may be broken"
+		ewarn "before you manually do so (ldconfig -i)."
+	fi
+}
+
+pkg_postinst() {
+	# nothing to do if just installing headers
+	just_headers && return
+
+	if ! tc-is-cross-compiler && [[ -x ${EROOT}/usr/sbin/iconvconfig ]] ; then
+		# Generate fastloading iconv module configuration file.
+		"${EROOT}"/usr/sbin/iconvconfig --prefix="${ROOT}/"
+	fi
+
+	if ! is_crosscompile && [[ -z ${ROOT} ]] ; then
+		# glibc-2.38+ on loong has ldconfig support added, but the ELF e_flags
+		# handling has changed as well, which means stale ldconfig auxiliary
+		# cache entries and failure to lookup libgcc_s / libstdc++ (breaking
+		# every C++ application) / libgomp etc., among other breakages.
+		#
+		# To fix this, simply refresh the ld.so.cache without using the
+		# auxiliary cache if we're natively installing on loong. This should
+		# be done relatively soon because we want to minimize the breakage
+		# window for the affected programs.
+		use loong && glibc_refresh_ldconfig
+
+		if ! use compile-locales && ! run_locale_gen "${EROOT}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
+
+		# If fixincludes was/is active for a particular GCC slot, we
+		# must refresh it. See bug #933282 and GCC's documentation:
+		# https://gcc.gnu.org/onlinedocs/gcc/Fixed-Headers.html
+		#
+		# TODO: Could this be done for cross? Some care would be needed
+		# to pass the right arguments.
+		while IFS= read -r -d $'\0' slot ; do
+			local mkheaders_path="${BROOT}"/usr/libexec/gcc/${CBUILD}/${slot##*/}/install-tools/mkheaders
+			local pthread_h="${BROOT}"/usr/lib/gcc/${CBUILD}/${slot##*/}/include-fixed/pthread.h
+			if [[ -x ${mkheaders_path} ]] ; then
+				ebegin "Refreshing fixincludes for ${CBUILD} with gcc-${slot##*/}"
+				${mkheaders_path} -v
+				eend $?
+			elif [[ -f ${pthread_h} ]] ; then
+				# fixincludes might have been enabled in the past for this
+				# GCC slot but not since we fixed toolchain.eclass to install
+				# mkheaders, so we need to manually delete pthread.h at least.
+				ebegin "Deleting stale fixincludes'd pthread.h for ${CBUILD} with gcc-${slot##*/}"
+				mv -v "${pthread_h}" "${pthread_h}.bak"
+				eend $?
+			fi
+		done < <(find "${BROOT}"/usr/libexec/gcc/${CBUILD}/ -mindepth 1 -maxdepth 1 -type d -print0)
+	fi
+
+	upgrade_warning
+
+	# Check for sanity of /etc/nsswitch.conf, take 2
+	if [[ -e ${EROOT}/etc/nsswitch.conf ]] && ! has_version sys-auth/libnss-nis ; then
+		local entry
+		for entry in passwd group shadow; do
+			if grep -E -q "^[ \t]*${entry}:.*nis" "${EROOT}"/etc/nsswitch.conf; then
+				ewarn ""
+				ewarn "Your ${EROOT}/etc/nsswitch.conf uses NIS. Support for that has been"
+				ewarn "removed from glibc and is now provided by the package"
+				ewarn "  sys-auth/libnss-nis"
+				ewarn "Install it now to keep your NIS setup working."
+				ewarn ""
+			fi
+		done
+	fi
+
+	if [[ ${PRESERVED_OLD_LIBCRYPT} -eq 1 ]] ; then
+		cp -p "${T}/libcrypt$(get_libname 1)" "${EROOT}/$(get_libdir)/libcrypt$(get_libname 1)" || die
+		preserve_old_lib_notify /$(get_libdir)/libcrypt$(get_libname 1)
+
+		elog "Please ignore a possible later error message about a file collision involving"
+		elog "${EROOT}/$(get_libdir)/libcrypt$(get_libname 1). We need to preserve this file for the moment to keep"
+		elog "the upgrade working, but it also needs to be overwritten when"
+		elog "sys-libs/libxcrypt is installed. See bug 802210 for more details."
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-9999.ebuild
index 2f7f58fcccd..0e65d86c790 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-9999.ebuild
@@ -38,7 +38,7 @@ inherit python-any-r1 prefix preserve-libs toolchain-funcs flag-o-matic gnuconfi
 DESCRIPTION="GNU libc C library"
 HOMEPAGE="https://www.gnu.org/software/libc/"
 
-if [[ ${PV} == 9999* ]]; then
+if [[ ${PV} == *9999 ]]; then
 	inherit git-r3
 else
 	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
@@ -51,7 +51,7 @@ SRC_URI+=" systemd? ( https://gitweb.gentoo.org/proj/toolchain/glibc-systemd.git
 
 LICENSE="LGPL-2.1+ BSD HPND ISC inner-net rc PCRE"
 SLOT="2.2"
-IUSE="audit caps cet compile-locales custom-cflags doc gd hash-sysv-compat headers-only +multiarch multilib multilib-bootstrap nscd perl profile selinux +ssp stack-realign +static-libs suid systemd systemtap test vanilla"
+IUSE="audit caps cet compile-locales custom-cflags doc gd hash-sysv-compat headers-only +multiarch multilib multilib-bootstrap nscd perl profile selinux sframe +ssp stack-realign +static-libs suid systemd systemtap test vanilla"
 
 # Here's how the cross-compile logic breaks down ...
 #  CTARGET - machine that will target the binaries
@@ -115,6 +115,7 @@ BDEPEND="
 		dev-lang/perl
 		sys-apps/texinfo
 	)
+	sframe? ( >=sys-devel/binutils-2.45 )
 	test? (
 		dev-lang/perl
 		>=net-dns/libidn2-2.3.0
@@ -930,7 +931,7 @@ src_unpack() {
 
 	use multilib-bootstrap && unpack gcc-multilib-bootstrap-${GCC_BOOTSTRAP_VER}.tar.xz
 
-	if [[ ${PV} == 9999* ]] ; then
+	if [[ ${PV} == *9999 ]] ; then
 		EGIT_REPO_URI="
 			https://anongit.gentoo.org/git/proj/toolchain/glibc-patches.git
 			https://github.com/gentoo/glibc-patches.git
@@ -944,12 +945,13 @@ src_unpack() {
 			https://gitlab.com/x86-glibc/glibc.git
 		"
 		EGIT_CHECKOUT_DIR=${S}
+		[[ ${PV} == *.*.9999 ]] && EGIT_BRANCH=release/${PV%.*}/master
 		git-r3_src_unpack
 	else
 		unpack ${P}.tar.xz
 
 		cd "${WORKDIR}" || die
-		unpack glibc-${PV}-patches-${PATCH_VER}.tar.xz
+		unpack ${P}-patches-${PATCH_VER}.tar.xz
 	fi
 
 	cd "${WORKDIR}" || die
@@ -1020,6 +1022,11 @@ glibc_do_configure() {
 		*) ;;
 	esac
 
+	case ${ABI}-${CTARGET} in
+		amd64-x86_64-*|arm64-aarch64-*) myconf+=( $(use_enable sframe) ) ;;
+		*) ;;
+	esac
+
 	[[ $(tc-is-softfloat) == "yes" ]] && myconf+=( --without-fp )
 
 	myconf+=( --enable-kernel=${MIN_KERN_VER} )
@@ -1301,7 +1308,7 @@ glibc_src_test() {
 	# we give the tests a bit more time to avoid spurious
 	# bug reports on slow arches
 
-	SANDBOX_ON=0 LD_PRELOAD= TIMEOUTFACTOR=16 emake ${myxfailparams} check
+	SANDBOX_ON=0 LD_PRELOAD= TIMEOUTFACTOR=16 nonfatal emake ${myxfailparams} check
 }
 
 src_test() {
@@ -1309,44 +1316,44 @@ src_test() {
 		return
 	fi
 
+	# glibc_src_test uses nonfatal so that we can run tests for all ABIs
+	# and fail at the end instead.
 	foreach_abi glibc_src_test || die "tests failed"
 }
 
 # src_install
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a hasversion_opts localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		hasversion_opts=( -b )
 	fi
 
-	local locale_list="${root%/}/etc/locale.gen"
-
-	pushd "${ED}"/$(get_libdir) >/dev/null
-
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	if has_version "${hasversion_opts[@]}" '>=sys-apps/locale-gen-3'; then
+		localegen_args=( --prefix "${prefix}" )
+	else
+		config="${prefix}/usr/share/i18n/SUPPORTED"
+		user_config="${prefix}/etc/locale.gen"
+		if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+			# For USE=compile-locales, all locales should be built.
+			mkdir -p -- "${prefix}/usr/lib/locale" || die
+		elif locale-gen --list --config "${user_config}" | read -r; then
+			config=${user_config}
+		fi
+		localegen_args=( --config "${config}" --destdir "${prefix}" )
 	fi
 
-	# bug 736794: we need to be careful with the parallelization... the number of
-	# processors saved in the environment of a binary package may differ strongly
-	# from the number of processes available during postinst
-	local mygenjobs="$(makeopts_jobs)"
-	if [[ "${EMERGE_FROM}" == "binary" ]] ; then
-		mygenjobs="$(nproc)"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs "${mygenjobs}" --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1561,8 +1568,8 @@ glibc_do_src_install() {
 	rm -f "${ED}"/etc/localtime
 
 	# Generate all locales if this is a native build as locale generation
-	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+	if use compile-locales && ! is_crosscompile && ! run_locale_gen "${ED}"; then
+		die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
 	fi
 }
 
@@ -1712,7 +1719,9 @@ pkg_postinst() {
 		# window for the affected programs.
 		use loong && glibc_refresh_ldconfig
 
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 
 		# If fixincludes was/is active for a particular GCC slot, we
 		# must refresh it. See bug #933282 and GCC's documentation:
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/metadata.xml
index 846d01d34e0..f4f01a67edd 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/metadata.xml
@@ -18,11 +18,18 @@
 		<flag name="multilib-bootstrap">Provide prebuilt libgcc.a and crt files if missing. Only needed for ABI switch.</flag>
 		<flag name="nscd">Build, and enable support for, the Name Service Cache Daemon</flag>
 		<flag name="perl">Install additional scripts written in Perl</flag>
+		<flag name="sframe">enable building with sframe backtrace support</flag>
 		<flag name="ssp">protect stack of glibc internals</flag>
 		<flag name="stack-realign">Realign the stack in the 32-bit build for compatibility with older binaries at some performance cost</flag>
 		<flag name="static-pie">Enable static PIE support (runtime files for -static-pie gcc option).</flag>
 		<flag name="suid">Make internal pt_chown helper setuid -- not needed if using Linux and have /dev/pts mounted with gid=5</flag>
-		<flag name="systemtap">enable systemtap static probe points</flag>
+		<flag name="systemtap">
+			Enable enhanced debugging hooks/interface via SystemTap static probe points.
+
+			Note that this isn't exclusive to SystemTap, despite the name. This provides
+			an interface which <pkg>dev-debug/gdb</pkg> optionally uses, see
+			https://sourceware.org/gdb/wiki/LinkerInterface.
+		</flag>
 	</use>
 	<upstream>
 		<remote-id type="cpe">cpe:/a:gnu:glibc</remote-id>

From ededa9b07b36b038d5acb27efd93bbbe8da7830d Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:16:35 +0000
Subject: [PATCH 113/122] sys-libs/libcap: Sync with Gentoo

It's from Gentoo commit 976f6b50303605158f8548b8cbf6fac4a658d820.
---
 .../portage-stable/sys-libs/libcap/libcap-2.71.ebuild    | 7 +++++--
 .../portage-stable/sys-libs/libcap/libcap-2.76.ebuild    | 7 +++++--
 .../portage-stable/sys-libs/libcap/libcap-9999.ebuild    | 9 ++++++---
 3 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.71.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.71.ebuild
index bdff2e8cbcc..b83ad80003d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.71.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.71.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit multilib-minimal toolchain-funcs pam
+inherit dot-a multilib-minimal toolchain-funcs pam
 
 if [[ ${PV} == *9999 ]]; then
 	inherit git-r3
@@ -59,6 +59,7 @@ run_emake() {
 }
 
 src_configure() {
+	use static-libs && lto-guarantee-fat
 	tc-export_build_env BUILD_CC
 	multilib-minimal_src_configure
 }
@@ -75,7 +76,9 @@ multilib_src_install() {
 	# no configure, needs explicit install line #444724#c3
 	run_emake DESTDIR="${D}" install
 
-	if ! use static-libs ; then
+	if use static-libs ; then
+		strip-lto-bytecode
+	else
 		rm "${ED}"/usr/$(get_libdir)/lib{cap,psx}.a || die
 	fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.76.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.76.ebuild
index bdff2e8cbcc..b83ad80003d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.76.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.76.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit multilib-minimal toolchain-funcs pam
+inherit dot-a multilib-minimal toolchain-funcs pam
 
 if [[ ${PV} == *9999 ]]; then
 	inherit git-r3
@@ -59,6 +59,7 @@ run_emake() {
 }
 
 src_configure() {
+	use static-libs && lto-guarantee-fat
 	tc-export_build_env BUILD_CC
 	multilib-minimal_src_configure
 }
@@ -75,7 +76,9 @@ multilib_src_install() {
 	# no configure, needs explicit install line #444724#c3
 	run_emake DESTDIR="${D}" install
 
-	if ! use static-libs ; then
+	if use static-libs ; then
+		strip-lto-bytecode
+	else
 		rm "${ED}"/usr/$(get_libdir)/lib{cap,psx}.a || die
 	fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-9999.ebuild
index b81da91b612..aeb560184a5 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-9999.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-inherit multilib-minimal toolchain-funcs pam
+inherit dot-a multilib-minimal toolchain-funcs pam
 
 if [[ ${PV} == *9999 ]]; then
 	inherit git-r3
@@ -59,6 +59,7 @@ run_emake() {
 }
 
 src_configure() {
+	use static-libs && lto-guarantee-fat
 	tc-export_build_env BUILD_CC
 	multilib-minimal_src_configure
 }
@@ -75,7 +76,9 @@ multilib_src_install() {
 	# no configure, needs explicit install line #444724#c3
 	run_emake DESTDIR="${D}" install
 
-	if ! use static-libs ; then
+	if use static-libs ; then
+		strip-lto-bytecode
+	else
 		rm "${ED}"/usr/$(get_libdir)/lib{cap,psx}.a || die
 	fi
 

From 48df562278d4d15c00a13070c80456bc4e027a9e Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:16:36 +0000
Subject: [PATCH 114/122] sys-libs/libnvme: Sync with Gentoo

It's from Gentoo commit 07a4407a5c4b0cb7b6221f1866819c2faa9561c6.
---
 .../portage-stable/sys-libs/libnvme/Manifest  |   1 +
 .../sys-libs/libnvme/libnvme-1.15.ebuild      | 103 ++++++++++++++++++
 2 files changed, 104 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.15.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/Manifest
index d66e68308c8..d4b518e2890 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/Manifest
@@ -2,3 +2,4 @@ DIST libnvme-1.11.1.gh.tar.gz 740327 BLAKE2B eb9a731ce4886e7a76170d4be916e850548
 DIST libnvme-1.12.gh.tar.gz 775030 BLAKE2B b6c9da012c39ec0b5ce671f498fd55b904ea9f0c34f8358eed166e08f9ef12c760707aa693a0123267cfb256812650f0afb5d017f4c8a940b61e18f9998d8b9e SHA512 6681f476c36d077d1481336ca66327cfed9b910e75309334a1eb1fa8ccfba7982d96c7b3ae5d587f306923247a716c5d70f4b71c26716e6be6020b470f9c1077
 DIST libnvme-1.13.gh.tar.gz 776674 BLAKE2B a0b9190a2350e28ccbe4bed69eb23140bf6863688c977a023333309cdcca8398d6c024197429454c003ebbc642d492f88737d27cea368345768cf181fad8ce8d SHA512 7c56cb4a531c77e7024126c3dde4ffe629944be93a3102b09bc7a16031bdd64dac5cb19834c586609c5e3c186f805532d739f960abc4ba22114f36c6bc710264
 DIST libnvme-1.14.gh.tar.gz 805970 BLAKE2B a7d4acd4f28d2bca223fc788962fc62ab31e2f60010bd05254c44e3c59a60e42ecfe25c6aea13ac99341695340084d3c3034d8a3f822df7c51551c839d41fe95 SHA512 96a1bbd6cea1e77381254e242e781b023416abfbf44c82a0aa6eb0b316b30316d32d0b91f441089a317cbae5b511f6b3eaab570624cbda2178f9dce4cb5dd288
+DIST libnvme-1.15.gh.tar.gz 811291 BLAKE2B 6b1f8f873eb173ac5e8593fed7825cd39a3fe501c5d51f23e8bf3ae4f403709d35a0d893e5f190cced73426bf6fa532f8c0a75f8f9c34834f6a1aa849be7673f SHA512 7357685b3f47eda445387965420e7885a326a6b60b3da5af4a8bb942d4f924534babbde3d4aae8468c8a2f0ee4971f2896fadc133f4c387d59f9f620ed2450aa
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.15.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.15.ebuild
new file mode 100644
index 00000000000..3558cff4039
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.15.ebuild
@@ -0,0 +1,103 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{11..14} )
+DISTUTILS_OPTIONAL=1
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=meson-python
+inherit distutils-r1 meson
+
+DESCRIPTION="C Library for NVM Express on Linux"
+HOMEPAGE="https://github.com/linux-nvme/libnvme"
+SRC_URI="https://github.com/linux-nvme/libnvme/archive/refs/tags/v${PV}.tar.gz -> ${P}.gh.tar.gz"
+
+LICENSE="LGPL-2.1+"
+SLOT="0/1"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+IUSE="dbus examples io-uring +json keyutils python ssl test"
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+	python? ( ${PYTHON_REQUIRED_USE} )
+"
+
+DEPEND="
+	json? ( dev-libs/json-c:= )
+	keyutils? ( sys-apps/keyutils:= )
+	dbus? ( sys-apps/dbus:= )
+	python? ( ${PYTHON_DEPS} )
+	ssl? ( >=dev-libs/openssl-1.1:= )
+	io-uring? ( sys-libs/liburing:= )
+"
+RDEPEND="
+	${DEPEND}
+"
+BDEPEND="
+	python? (
+		${DISTUTILS_DEPS}
+		dev-lang/swig
+		dev-python/meson-python[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests unittest
+
+src_prepare() {
+	default
+	use python && distutils-r1_src_prepare
+}
+
+src_configure() {
+	local emesonargs=(
+		-Dpython=disabled
+		$(meson_use test tests)
+		$(meson_use examples)
+		$(meson_feature json json-c)
+		$(meson_feature dbus libdbus)
+		$(meson_feature keyutils)
+		$(meson_feature ssl openssl)
+		$(meson_feature io-uring liburing)
+	)
+	meson_src_configure
+	use python && distutils-r1_src_configure
+}
+
+python_compile() {
+	local emesonargs=(
+		-Dpython=enabled
+	)
+	meson_src_configure --reconfigure
+	distutils-r1_python_compile
+}
+
+src_compile() {
+	meson_src_compile
+
+	use python && distutils-r1_src_compile
+}
+
+src_test() {
+	meson_src_test
+	use python && distutils-r1_src_test
+}
+
+python_test() {
+	local -A test_args=(
+		["test-nbft.py"]="--filename=${S}/libnvme/tests/NBFT"
+	)
+	pushd "${BUILD_DIR}" >/dev/null || die
+	local testfile
+	for testfile in "${S}"/libnvme/tests/*.py; do
+		PYTHONPATH="${BUILD_DIR}" "${EPYTHON}" "${testfile}" \
+			${test_args[${testfile##*/}]} \
+			|| die "test ${testfile##*/} failed with ${EPYTHON}"
+	done
+	popd >/dev/null || die
+}
+
+src_install() {
+	meson_src_install
+	use python && distutils-r1_src_install
+}

From a4cd9a4e422cbcaeb024b7897a74dff913eba2b5 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:16:41 +0000
Subject: [PATCH 115/122] sys-libs/ncurses: Sync with Gentoo

It's from Gentoo commit 0a11fe6ecbe79172f4def7e5715082db9205e0bd.
---
 .../portage-stable/sys-libs/ncurses/Manifest  | 160 +-----
 .../ncurses/files/ncurses-6.4-t64-1.patch     |  12 -
 .../ncurses/files/ncurses-6.4-t64-2.patch     |  12 -
 .../ncurses/ncurses-6.4_p20240414.ebuild      | 492 ------------------
 .../ncurses/ncurses-6.5_p20241109.ebuild      | 460 ----------------
 .../ncurses/ncurses-6.5_p20250125.ebuild      | 474 -----------------
 ...ebuild => ncurses-6.5_p20250531-r1.ebuild} |   6 +-
 ...08.ebuild => ncurses-6.5_p20250802.ebuild} |  31 +-
 8 files changed, 44 insertions(+), 1603 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/sys-libs/ncurses/files/ncurses-6.4-t64-1.patch
 delete mode 100644 sdk_container/src/third_party/portage-stable/sys-libs/ncurses/files/ncurses-6.4-t64-2.patch
 delete mode 100644 sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.4_p20240414.ebuild
 delete mode 100644 sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20241109.ebuild
 delete mode 100644 sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250125.ebuild
 rename sdk_container/src/third_party/portage-stable/sys-libs/ncurses/{ncurses-6.5_p20250531.ebuild => ncurses-6.5_p20250531-r1.ebuild} (99%)
 rename sdk_container/src/third_party/portage-stable/sys-libs/ncurses/{ncurses-6.5_p20250308.ebuild => ncurses-6.5_p20250802.ebuild} (97%)

diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/Manifest
index 84e1cb687ab..2d599afbef0 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/Manifest
@@ -1,144 +1,3 @@
-DIST ncurses-6.4-20230107.patch.gz 196232 BLAKE2B 8751142f825a4b79413986e45bc160d49cc9ccef23ae542c59a74435e251de82bdc8f450df14db0867b8679b5ecb81f0fb9abda662a82fb033a7eb5e079ee308 SHA512 970670d8eee50d44b8c7f29daf4c6a575beff3b4fafe12fff786cbd7ac03edeb1e7dae99c8064de99c166e9b3d7811f035ecf75c0eaffb382127cc9df5388d9b
-DIST ncurses-6.4-20230107.patch.gz.asc 729 BLAKE2B 483156747c88de46d131cf1f4e460972f95f689baaec0fb4c7c9966bec6e53d41285261761af17cbd8a9543108095587e598e3fe2fe21d76dc4fedde85a3eb0a SHA512 e14d0a27dae59e95f503bf1a569b0cc3115755043eb0cb4fa481e90bf24d097fae675e08c1247c0746fbb5c03c363dc88e6a60c0e9d6abb278df4e8d581749b1
-DIST ncurses-6.4-20230114.patch.gz 179019 BLAKE2B 8e7290f41133177275249c084c93a5fe6cb1dcd75e4deea0e44dbdd79774a364705bcd20b30b735996e19e861b5cde2216b5ce7c8d89066095d7c06ce38e5454 SHA512 202c02b09bf21d5c8341fc0e8a30a2c906f0e260a4d536f1332f978ebbe4d93250b832c6449a81ffdc9e030802f064237f39fd0f473e75e61cc77e15232c9a01
-DIST ncurses-6.4-20230114.patch.gz.asc 729 BLAKE2B dbb676160938bf5a65780a446bdffc8521410d216609d38817ea8977ea0f244dc221ec33a0475e05542fba4be7349f0948e9fa32be7fd439e57721b6a6e08fe3 SHA512 bfa1b6856fdf503aa17bac83ba0170009242ac950d46bb8789fb0e0f68c406fed364104565351df70ab58b12bbf8aedd4e587df3bd7ee69a6a0c287f67fd0c3b
-DIST ncurses-6.4-20230121.patch.gz 44888 BLAKE2B 355b2f283b978a2aadee0f4e1bc1694eb8d4ef559014d86b1ef05ab818a8852192b09976336ecd73f2610e87a8a3ccd4f799e6e0585ec4a2a8e85abbbae2f467 SHA512 7bee1b23afff48b5319a60f9e90cfd7593c0a107bcd5606da8e765b4d38904a6f732fe8077ecfac45ee2daceed301026ef3fb67435cae1d94ef5fec01440c100
-DIST ncurses-6.4-20230121.patch.gz.asc 729 BLAKE2B ddd69de4d17066b79ed9c99dfafcd051ebfb32cc31b5ea88fe013b991ca91e3bf4d00fbb36bd73b5d2ff0d4fdf33525b14bbe6ccb5216af5459e276e161a716b SHA512 f0a6eb2c81782c2d2da6d15b82a3167e4209887b868efe2e36708ffba93c987f358828d353a4b211f5fe6c1abce90b42e7d6dd2cb6ad322de78bbe2ceb04e1ad
-DIST ncurses-6.4-20230128.patch.gz 119721 BLAKE2B e91942151653415ba09e384c683a2d13854c6a751fbb4b60ee74245e71207f98d7a89b000e93cc3555f302dba2c5ca55d8313cab2197dc4074251044ef7b4eae SHA512 fffc86e953213ddc9bbe5c6a51bd60725ef75655452d03a53a38bfd5ca318d4801bb9ae4244e7e14ca8c77a9aa6fba298f45a01ae26a964cfc3300268f87c479
-DIST ncurses-6.4-20230128.patch.gz.asc 729 BLAKE2B 0faa8eb037867b99e7ea6f23c99d487426986cf9e5bc5a89179bd1ad4f363c5621d7c81214f4e38eed4ddbce9cd2cb569ff700325585e56ba706c7f1b56cabd6 SHA512 9cc84a4e32b7a67965106e8f414f87a160b632d49a5489880cd4f3f43daa7043d33894b22a16efdef5cd04914cf69019a1abefc8b9234ba2a92d1dc7c46f72fa
-DIST ncurses-6.4-20230211.patch.gz 13004 BLAKE2B 1935bee908c20f065f93100745755177012a49709bca3b14edb0414aa1493dbd6c52313a16ed04b58dff635fb6e853c39e3e3fe2b47ac5662fc274d59976ae94 SHA512 f70ad2605dfe867d8cdcbd6516c759bbf5422bf297d1ee0fb20b2b4262177cb018b7612c735efeccf8794a6fde55e388e4c9ef0bed41e9c467902835c6bf678e
-DIST ncurses-6.4-20230211.patch.gz.asc 729 BLAKE2B 42a64222042021f85a70d88555cdb6854abcc0202fd3580fff0984aee1d6154bb995d6357ed45cbb90ba92c17c32d8fd573ba0c59d37e9add2d7ece68044ac52 SHA512 27930c85a4ff2cb83c54def0fdf8f1765c4d1ca36935b26022bfe48ab6e87f39c6e45b8d1427d448e0a7b2bae864b00811ac9f1f1ab9f97d4c8f4b001dc2cb01
-DIST ncurses-6.4-20230218.patch.gz 146502 BLAKE2B 571cf7f5df5eeef21ab719ea2e941a431751ffd973de11783b96bea1ff6162f9fbbd3c3616d4c63906135cb4a6f16f8ee1a566743760c20bf026c2f378d57ce6 SHA512 7c8cec6437bef737235cf0a684646d3b6bf38c66314c14d5f07ec5dc2ca20e3036ffbd9900bb5c45e48929b1454711de412b77e527a7df643dd4403a5abfc787
-DIST ncurses-6.4-20230218.patch.gz.asc 729 BLAKE2B ca55b37bf6e647c5e39eaba1174c9c9699ffa77fc7ec1b53771586303184cf4b64cf5def844fc87d563a847109d7b00beac17e758a9803350831ebe14d36b0d9 SHA512 5471a2c8389742c0c8b74f1c27e9b97012c5d5eb0256fbd4bb904daab685614fe2506b5a204d958273eb66b56c5ff4b5e5aba8e28f59e2fe0cba392dde59b473
-DIST ncurses-6.4-20230225.patch.gz 68561 BLAKE2B ab80ea189f975e6fc0c2a1dd22898e2d4dde6bf2767ed47000c534430af09948266188cf54a527aabdfa6f4b5df4946c8bc3afdd7869bcccc75429b3e828b48a SHA512 fed222bbdb5d3c472ec7283f5612e12d6b1806c49ca5d1dc7dde68bbf72e8b1fe9c31a4737b6bbcf721d97babc9156a524d127f9e3d6c41547813bef70fb247d
-DIST ncurses-6.4-20230225.patch.gz.asc 729 BLAKE2B f7b4ff7fe78a69ec20c79225cce7bee628476663600129e5eee0c0f1ef2f0783e46485f57a774847851e6e192231610405ff923dcafd68c1dcc3d2ec622f0b78 SHA512 937a4bb33acf0c86b201145f2abe65e5b7defe63c064aeb2b7cb8869494c02a5d50af3f048dd758ea39b828b8cdd0dac54004dc41cd609afcf3de71454195135
-DIST ncurses-6.4-20230311.patch.gz 15262 BLAKE2B b3ca38dc63d64dd59af08b4c642c5b081eb137db6d7590a92f29c55be7148b26032553e1b72b0977394608ac144a12dfa0f919d943d41fd6ff419f8e568c655d SHA512 17662557194e81668dac748bce1240276d48e09df2416934da9660861154137024aee989287e9aac17b884e9707cf1c86c438cbcc583902af8a5ecc5a5e08140
-DIST ncurses-6.4-20230311.patch.gz.asc 729 BLAKE2B c5f513390bae7cbd5cf9d6a6f67c00161cb7c1712ebfa7ee9b27b391dbdb8f9386fc55daaa25b34c55955cc0362191256a2288b85d2d1dd9ff945561a2850449 SHA512 2b0f9ec58e011bb969397018258519b09a5af42ac49b7609677f983c1d69543aaeb052fb762d358b3fcfba7a3d40c01f61f3a680102d10f76958750b531a89d2
-DIST ncurses-6.4-20230401.patch.gz 5172 BLAKE2B bf4a9d9bcecc2fa91191139a4f1aa39aa4f08346986fe14f43b7dc4cbdaed767d198f426c8517024c5d4fe481a45c6d7e0a0b62d35cd72250e08da47edcbe86e SHA512 dd3d89cabec528c95c4b065a32d3496210571b0baaab079c2b381563f374072630aab0ec919c26e10ea476b7aebf1eab45ea25f8b4dfcd8172f44270d03c9cc9
-DIST ncurses-6.4-20230401.patch.gz.asc 729 BLAKE2B 18588b7cc4e3f256a4e9aa9e6221e54b1a29711df01784397b1055d9fea8ae5f1bb544a8acfd660ef1b7d72ccae1ab94b61f38ba19159e4efc7563a79e93fbb3 SHA512 bf9da77a0da1640d883e0a6ac7f807995f3678eaa054255e8591dbe9a2c4cebb43d8d2781b8ddf7c7432a38f63eb72d519445edcc2721a01d7a785964adee8a1
-DIST ncurses-6.4-20230408.patch.gz 15680 BLAKE2B 7d1fa16a79e317be3c2746f7117559a9cc65b7ca20aca86a314591d376db59f8a151d739bfbc502691808f16130b89a9d5b4ee8bcd357a01ef033ac2ad7277d1 SHA512 036d4b08c0d17656c75f89625d5b5a253e70458bc9f2303269b4c72349ad62c719951b9ebd65385d6d8ad4be9e89a36090fa842fbb62713d9b8fa6a359170a88
-DIST ncurses-6.4-20230408.patch.gz.asc 729 BLAKE2B 7648e24297dc66dc4d5f08bf592b2db628a5962b0d6d34c1f0725257c3a04d2430897edd99d741ba837196e9a6f2c138e4826f40f80ea88e9d5dc04a41c11986 SHA512 eabe6e49b94969fbba7bf8de3bef803a8151e6d3bb0e9d1f0d4b11d27c7156be37f623e6785a205b7b8acaef2a2d646099aef8c410a6addb7592a9af2ec930c4
-DIST ncurses-6.4-20230415.patch.gz 23979 BLAKE2B d89402d39bd71e23021d1ad28a27965239409b8d29397a9a9f3172178dd060cc42f736224b6438e7048cd05f38c24e4d229f83fc87fc207d5d2cb3b9577e1bcc SHA512 63a6368745c2c418fa263cec4da69a06e981fb8cb466f0694163fd324ef328251acb38ca3ace02f18b8b6b44dcaf414f74335a2239ae7af2b0c8ed916ca6644d
-DIST ncurses-6.4-20230415.patch.gz.asc 729 BLAKE2B c7ad19d4ae544c64eed538e7c6fd03959988e80140cbc185c6eebb932d026fa316df1d53f9e049e82fec811860e3a0a32b6af76f980fe1603684ce2678dd4fd9 SHA512 4637e09e4620da328d163bdd100756760b0f5469304ef7963a93346d263039ea608fd510fba0079feb094a37fa857b7fcdcb938d2ff5d93aa809cb9c74cf4d5b
-DIST ncurses-6.4-20230418.patch.gz 32130 BLAKE2B 912efedd3a615ce383b09218031ffc49f87e0bfc7fe8aec37330394b9235fd61337fa707898c308cbfd7426fc6f06b3639e533138ca390d42139583c58ac06c0 SHA512 4952d56a3fd54be512dcfabe48d967af43c7c51b9e49fbdf575301861940f00fd5e88b994a2088baf4a0e551338b978e47c6ac232bc9ae4e8ee417bd17405288
-DIST ncurses-6.4-20230418.patch.gz.asc 729 BLAKE2B 59d8ca3ab665e1bbfa7a1602b2856de79289c42eda33f8f517f419e41f7eebd57dbcfd73c292d6a2debd08f02cb39a6b6b47b389a15b1ab845a5fd4b4f73432f SHA512 d8be7ff7c1ba083f1c7e10dcb9fd88d7be661201534922d1a136e24081767702b6cac897a3cf5b7d96bc65687690998e4a9a3c57ed39a146df5d6be95080704f
-DIST ncurses-6.4-20230423.patch.gz 115574 BLAKE2B 72a98086f00f02cf0ea018392373f7ce0a741674e61835e66b2a211c63047716c2aa41fec937ccda13cd01f2f3943c7670f4f8d5be4ab3bf6902c92c2ee95a26 SHA512 a5ebe239b9a6a4a99a1afe0b1a6f7a09058402927077c4c2ca537f3a9f13606573af4ebbe4e0aa5715bd4e71d5bd67d9c95fb4e9d700ac1e7edd809c71667a3a
-DIST ncurses-6.4-20230423.patch.gz.asc 729 BLAKE2B 74a5e9cdc519788bb3c501a37061fe5f9ebbed531d274f252f21d293d4687b5767f7935f4bf1cf209980d9c2690959bac1ceb883bcb17d49ba012afe9bcda139 SHA512 3f840f5f8dcf2d901077d7b717431c3f6146e7ad895102b2af46d8b329e428baf15225d905f46027c7e9c4796be40d95b7322e764cc8d56afc357657e019f1cf
-DIST ncurses-6.4-20230424.patch.gz 4488 BLAKE2B faebd76ba1f868b8637b4a72b427123c08b33871fc366b989fccb107898702f089c2014c453fecbb12dc260816e5acf97212f3fa2b9a7ace9fa384c31b6ba1f2 SHA512 bdaa63e0494b981443f07e9ce134785b2420dff3d561eef7a8041e7df5d04e9c9242cdd1cd9e4592fa0724f073b829bff36e74e480235f4eacf37bb639d914ef
-DIST ncurses-6.4-20230424.patch.gz.asc 729 BLAKE2B 6eab548bea6fb01f6845ec03a41bb0ab3969b5982baed9458910d207542a480e911d53e3bfd968f485aaf754f94fb166b910bf8965646c3de035b255489dcb1f SHA512 91645fb4997f0e276468aca9a702d79b487d7018b56665e0fda8e37e8fadb6cda7f8b1e653eb3c1cd0ad563360b410d8143102d2ba3bb6d1c7b18ba1657a86dc
-DIST ncurses-6.4-20230429.patch.gz 9195 BLAKE2B 6ed8c3cac11d3c3e52b7dce20be5b7695967622aa517c364d0f1af7f4a813befe5cfe200eb3097fba610e63e22092100066968f55eba499c9fc21a95bced7524 SHA512 f37164116ed9f09c51a62d90e28dbef68b19a4444c4aa7e2ccdafa3cfa2c7530bcac65b421910a273d0e34b91382bf4f7957f0116af30e13856710199dd266e3
-DIST ncurses-6.4-20230429.patch.gz.asc 729 BLAKE2B 2e063a7818ac443182ec4f4d8da13884accd563ab66e04297ca0bd4b9610f974efd3ca29dfcf13939cd9ee369c5e5799eb13a55050249036ebbc375e6ef8d6d1 SHA512 55167510e21aa3ad6d4a57fa37ae82308424ae9141e6e4756b4b335d30136675add5c00ee102d74ed93eccfc2d752eff5045d88e708928df3cecde3c0be77c79
-DIST ncurses-6.4-20230506.patch.gz 52834 BLAKE2B 55d2351a507a60aa5baeb9e7e392fbbf714a6bffcf4729e9b195aabc2dc81372336d0dc3501f95abda04491013220060983d2186531471694f40b35d4ef3196d SHA512 04967b96d9723b2939fe64eff4388ceee0adf478f659b58cac8601770dd7763fa192d673e78b33c267e00f4ecbfc2863bc49b12fcdeaa8ce24df39126f20b4e1
-DIST ncurses-6.4-20230506.patch.gz.asc 729 BLAKE2B 5ccb09f5b48a4a9c98ad4224cde68df659a365aca12210ec14a6519216e32b10531b1dfc4184bd12e62e1f0fdd9f06974b59866bba6115407d52712f5adff6f8 SHA512 2f63a62e37a15aa6a276a5d9a2c4b86a4e50af037ee5b1c339bccb02200d3e477b5b93ce5833a4d3933a952970caec3b38639412281c1df7c30d7b241bc3a2ab
-DIST ncurses-6.4-20230514.patch.gz 42963 BLAKE2B c2d27883884ebb2f14c523b5558d575b84fe8aa6b110a4f246f529d29288118d8393a955d8401aee675a764d52e76495d47487f52c3edb8548dc3419371def49 SHA512 0346fae238637c6a69024982485672e6b1447f5902d9cc6b9deff8296220a381b5b41b23b30d053881b09242a4e8ad728618342300c1dee63770286b81e362df
-DIST ncurses-6.4-20230514.patch.gz.asc 729 BLAKE2B 10ee649be87b46a03d1cb1c31a57ec9cb20da425604900540d04f806cc2c9e9a1e73009f62a96fafdbd81d66c7d47878e256d02cf5b9de9ee6f26621b73a4705 SHA512 57875d11844efbb23052e5cee32aa41a0bddb290069e33504e57613e4ab131efddc9c85f92af82b1d6bfa00182bcb9f1e86812538f5f209096b3ee84c67de280
-DIST ncurses-6.4-20230520.patch.gz 3090 BLAKE2B 93e376bc6250509c1a83e799efc2d4766354451931115d300b74c14af93dda4f3aefdd59f97467eb88e6ea29804595e84cb62c62733022b255d5368a74a38729 SHA512 bf854e4d6f8ed643b8841c9265057f06186699a083edb489e970d1cc8e752fdf49ecaa36518340a2b00a5c6ebf548b7651361b1bd2abb80467d2ce3f9861d28d
-DIST ncurses-6.4-20230520.patch.gz.asc 729 BLAKE2B 08db3a1a8152c4cc29fcc11b24ec3d1a6d3c425eed9a54f33bc370b86f26a13a9cdd273652c448e6e4dd179f5ca41ae653f7ef44902a10eaa18828e2be3a6247 SHA512 7bf2aa9442bc5041ce316af7edc2ff5c5da2ab1bf941c26c6592c8785dc0e47539da3bc2c1e570daafb6a293812f55b8b3b327f90ff9908984eba37e89d5eb7d
-DIST ncurses-6.4-20230527.patch.gz 9787 BLAKE2B 951a53b87056f2b3b530f03d0bab5a06ecf6bae0bf2fb580af8c0d96ae169e4813ed2063bf1696fd0fcc1cb0f7da03348904818de7ce454cbcb9a42bb939b6b8 SHA512 f600d7bdbde1f0752d3d530ceb98e9ba51a246a3bd898cc0d0d65bb8b51dab68fa5668789f5f86473c28eb890ec62cecf8e4dc901ac96fccf162c1a5f161f897
-DIST ncurses-6.4-20230527.patch.gz.asc 729 BLAKE2B 472421bd7c9093a293e99ec0f343ed471a77e7aa7f705cd99bb61f907c7059b134158c176fb232c542842ba042a1a88ca8e192df81d2d760a70f26a4d76ae624 SHA512 74a0ae5123b339c00f786d4d15a6c100d5d323731b7534e495dd396c9fd03b7ebc61d3fdf6eb71f2fa106160e15da5d093af6e4d53b4a6cfc53c436045a5a614
-DIST ncurses-6.4-20230603.patch.gz 95019 BLAKE2B b6523f5218b819fd53af288e9adc54001a86bfb683f3b956b2e2237ed233b12607116a10c2dcbf4c627dfc52bf0c915ab506fe9693e8695908110524ac4ae216 SHA512 c71863e458a312dd37205d2087e4bce4d3a6abb2c07b15ec90796953c3f422fc30d3094e3ffd176befd1de9eef1067153f8c5be682475cdacdb5b7c83c99363a
-DIST ncurses-6.4-20230603.patch.gz.asc 729 BLAKE2B ed072a6a00031bd4814f195913030ab597c5547f240309cb0fe95460e4c5d6d45477dfb054b2f09cbfc34c4eb583499902146fc498e58811417ca61e7a4787f9 SHA512 95bc59ecdce1bd7499c819e692a2d44f90c9734b20b3903034f94c7ee5efeb7b9f3f31ec1327ea00907c99c6783702af91d648d61b362e56abed5e60e7e11b97
-DIST ncurses-6.4-20230610.patch.gz 22125 BLAKE2B 2004558a329c8a6827818b782f4c7b68bb8c24cb93b22e1259363432c6cc5ebfeb716d81b4f14fd82ca22f70e4591877c9836b3a0dba58099f9fc6bbe5190947 SHA512 b11e7638ae237e0f9e8ebb9c7657759be8d9504775757ff71d2efafe589e4a81969b5e6229c171b5008a5788cdf16e19fa544f2d4b2fd24f122f8cd66ed25d61
-DIST ncurses-6.4-20230610.patch.gz.asc 729 BLAKE2B 2f7159fdac2a3d946ab787ce294704bde8da6cb7482c527edcde91ac9369b349c16b7d267e05d785acdc9447d3aa3e1f231ebfc616aed4cf452fd4c31a2e66f8 SHA512 3e2b6bf42e3b2f82eb51213b58d962ed7d11cb582fad5f710bd3067b2ccb52e1d4a27aff24cecf68a01b2bbe88f0e85c43e2edc6c57353926f60152a9b4095b3
-DIST ncurses-6.4-20230615.patch.gz 3562 BLAKE2B e20de7ca077ce7ce37c59beb731408be16beff9656ab115b23c46d94f95b2b6a92bc8d0ccef253403dd3d7e493b0cb067054b93e06e5cfbb73bdf1485484b89b SHA512 22779515ac54e19cfc9e84ef851dc15bbb8d818cae8e0fd2b866ee1ba20caf4168c30a72c7cb206434cf4db6a9bb09c016210a2fdcc2dcdcf9892f7a6e0bf3da
-DIST ncurses-6.4-20230615.patch.gz.asc 729 BLAKE2B a1fb16d1483ca895ea7db7ffd4992cd1939e9f2e682508dbb0af38d78edaec11f2fe10b547d801783e2c61a33252f24be94c9eb4a2367a19ef73a65f926dadbc SHA512 71055081b458dc285856c9916124025023b59005a2568d252ecc93ba21c7fe8edb8bbe933ae1675a0d3f606602bc19b2fbbbfb5df42fe40c84227547183d2b20
-DIST ncurses-6.4-20230617.patch.gz 29168 BLAKE2B e15a2a1fadfc64ddb64f26b4b267f4ed58ea5fa9b43e8664315caa6858787af61501710ba273ff12a914327b451a0aa329459d48487f9edb882ff9b218f8fc9f SHA512 29e5d387382d38a2297fe3f642441019bf829ff6e94d938eba85067ab455863283a50bd8856e4cba406c840a5ecfa381eeae2d6406b548927320ac2e99b89adc
-DIST ncurses-6.4-20230617.patch.gz.asc 729 BLAKE2B 3338b8020f37c6c19cb1819db9e2b9f9257702603757e7e107b74ab0e7bf1696c0a91e79fde1aa404dc706ba3bbd0e6014ae753147838d5bfc917df302daf408 SHA512 db5ec7182b070db9079978c05130f53659b3bd5108ad246b7f7d6696d1c739149508d1c5f3b9091bf4862d8bfa43bec29f5ecd7787d5840625e99437fe7dcbe7
-DIST ncurses-6.4-20230624.patch.gz 8748 BLAKE2B f61800ebdaa4f982694d38f51ad0478207b928f81b87db3d837bbfc53ba265a89f10add92f5f27a03c54e829a490a8c39a4bf3cd84a0c43bb2cf70ee7795e0ec SHA512 9592247f9eec8d5ce7cffb3e4f7f3a39e4c3c83c96d11db7bd8cdcff54a8fec936651a7c2aece559d0573ac244b59d1ef0b4d2e46368605b9f8e8b4a436e9baf
-DIST ncurses-6.4-20230624.patch.gz.asc 729 BLAKE2B 6f522f12c45de2824cdf6014edf6bc3f377d97a784d3344eae2dc66c4adf1a4043c1982224fdb6a4eea7a582b80c60f8556e8ae645338078638f14a6080864eb SHA512 fbb70541f028813a6815a37c258d7accc6711faef19e41c36b7953880bac645188e101a34109e3db2f263e9ec736fdf91f035431b6e2b84f6e591198f1fd6e1f
-DIST ncurses-6.4-20230625.patch.gz 3517 BLAKE2B d287c8ffb5f6314b9deb9c3954d833167eeaf32560dac674bfaa5c5230179e929dfffeb8d3d2a4310be7821a26a677886139e549b5d4376992eec9db9a0e8ae7 SHA512 bf71c7a5368d6eb4e676d57c720314f01b25d4a51108ba2018b3e1d4fbab736e18a7a39e2a662b611ee272a2a2afc0c267e05807255ab7f07d8b557b7895fc9a
-DIST ncurses-6.4-20230625.patch.gz.asc 729 BLAKE2B 58d5d4415cb61ca15de15f79d6f5ae16e28a372676ed26754e27d7cfc70b9aac1a23696b174ce9069beea0263fab9ca565879b2e9cdf6a150f7c0ca4448e1439 SHA512 9512bdb1eabe4bee0910969c2219748a4f88b9ed1338ce1709d61e3cd0173dfa583c050fea18a69f8b3fb504b4915ef40a5f0b9c61fd3acc96512c262dfabd2a
-DIST ncurses-6.4-20230701.patch.gz 62047 BLAKE2B ac4719825504f20195ef4ba229b1ee29649eaff66d63ffb226553050a1727f7b08f9e7d93bb5a7f042218afa2834c1663943cf3a64b6da6a10348f5637b8cc21 SHA512 e027eee228ab3473fcbae0786c0cf6b6f8533e861c5475acce3af2162f55b8ba6612e292d046864857a600ac3f59d2d6001a3a30a3d1b1a4239936f147eb5083
-DIST ncurses-6.4-20230701.patch.gz.asc 729 BLAKE2B 1ee18e5ff3782c2f271dbe857da94fd6ee4c994b1faa81b9b218b665e1e4e61d9b62d41c5439cc681da1b2a7b6fb3f3ea284387748680b483db473553b46e4eb SHA512 a53699f5c5d34464616e11d8c21f5d5e5b0f567fc145a4ad6abdf397807cc1215b9cb769deab9533873dc9779e267522fa6403ba1b56ef7fc058befb2a37e19d
-DIST ncurses-6.4-20230708.patch.gz 6669 BLAKE2B 4c662af33d9ee679abeedd275835ec786e2099de7e87d447539655147bafd08fb28eda64bc6f7d3daca2200abd6e351e5bad18a7592c1bbd7eb15fb8cbed194f SHA512 551ae4c5a0edb9d0e830b3c87c8ffcfb45c35537d60971bff72ab4d479cffcd7b5fb1db4dfdaec4b5eb2a06b0a4ec17074fe4007f2cec441be28dde02805174c
-DIST ncurses-6.4-20230708.patch.gz.asc 729 BLAKE2B fb54428fb1f43ce3505f1a6c719aea357471e5a488497ac15595d97201ebd6fbc109630e5927e1bfc53635f40c4cf2a8305c89d60cc8c570e1e4849e50a2512d SHA512 dd62ed66b315a350a12dff03175eb7a61ff1f86aa9b66683cb0c940a27cd30542492005338a7c099d81bfcdc0c6b0139b139f2e12f194b655caa6e985658343a
-DIST ncurses-6.4-20230715.patch.gz 53780 BLAKE2B 71216e305cb55efc55ce18b40bfb2390d3d23211192450f22a06bd35b8dd3460a0cd6bfbffa012f08632d34d4d5030b70446cd1466b717196949db345724bcf4 SHA512 c145dd5f5dd59e8cdf80b37cff427ff6f0af1597c4d550f8fe2a09a395b57cc5d37968d0cd84868539215d1750537a7f5e554410abba600e26bbde51f9fb6c15
-DIST ncurses-6.4-20230715.patch.gz.asc 729 BLAKE2B af309534f6ed38596cca07d278a6e40addb6198f26bedbec5e3a17d5225be7be5efde3a6b1aa9e32d085edec347686c9771677b6b37633b45f4492598c24f881 SHA512 2610bd6b77d68cee82f5a295200d3d2459805e101e91a28a42b3a8badb230ee29963736a4320060ce59b4c9ed40a69cc9111a49ebf24e12114d03bf5a836ad01
-DIST ncurses-6.4-20230722.patch.gz 59087 BLAKE2B 16e94b44300010930a55ea3cf0a9950aa74e9937acc09246b3943addac07dcb98c0a0bf59eff0bd6ab2347670ea0f25dba3a19504c00a5b4a0fa988026080911 SHA512 63f067d289c807830b1dd327491a43669563710f6f5b1d631c62d75d654cfa9cd5767e0bfe0bdec65777e4c92e045177ea864d370007c9f4cbff4b73e3a0a0ec
-DIST ncurses-6.4-20230722.patch.gz.asc 729 BLAKE2B 8f915ff9d447bb2b68bee18fa40bc7aa08fb695aa873f983bac4f162c7ab355bf59a8cfdd03a377ce55e1128b4215c1265fe572674f420fc410d07ee1b4e3d98 SHA512 3c45f818e6bff4c6e9aecc57d4a236bdcdeffda6e8d342cf0bbd523cbff3af61bb27f8249789208540df4702bfbf6c7473b165c00ba770408b0f2d2547c39ed3
-DIST ncurses-6.4-20230729.patch.gz 54267 BLAKE2B 3c3b6fc5e24bf39b4c0308254f86a53cc470fd79d42c0b4377346642633fb04329ea4e7ed167bee4b590e9ea66f6e59fd73663ef83e4a711ec6fc4ebf8ab1427 SHA512 84ec8e0429364a25d0b284a19d8cca2d14e6308f0a3ff07d1a214e4cdc93430bf3d249471518c675bd040cf113da3b760337d7f268a776318b94b56c10264856
-DIST ncurses-6.4-20230729.patch.gz.asc 729 BLAKE2B 0aeab7b90c4919d97df1fd7c717a8b27a0d506a4d04d4b73023089298f0975cb1905c9f6ea0884bd83fa63769d9b27d84b6b26ecb46a84b3cae87a5b3fb8c4cd SHA512 eadac56f03b8630a21971dc37e5a9c9afeb0402d9f784cf1886d7a5f737ff4fdd5d4caf37f7bc96d2ea13e517809b71324c850ab21854ce918f81cae061d78cf
-DIST ncurses-6.4-20230805.patch.gz 7681 BLAKE2B 1eba96968b7835555c22299c59f678dc912f03c0a3c55dca87f796e590f37e96442664174ad609005e2d6affa011654a4729f1489d0bbda6188216e83c500d82 SHA512 604a098bb5888209213254d195da8bee6b16ecadf5cc843cd50cf504c9e9dd4b8e0115a4ed512dc64e57567270fc35cc10aab3dbb81f1d033e928ada8a4d3610
-DIST ncurses-6.4-20230805.patch.gz.asc 729 BLAKE2B dd8fa046eb07fef7b60b6854fc0c8ae5917abc9ad1793ad3dfb699f1d0537cd17ed3196af7a795525d85fa5164156e4dd33af4c13934909eb9dd11d3c37dc097 SHA512 59db184440e47d1a702cfc5ee1eaffc1c54664015f727f31fa5eb5a1cf6f86b15592c7918401b69b633bcdb6534be6f29dd20c823fc98a934dd857628f6e0b53
-DIST ncurses-6.4-20230812.patch.gz 21242 BLAKE2B 0ad1068e92016726fc56c51843897bf2eeb85ef19236c149265feaeb7a2bc512b1f897695e1675d58d8866fe75f7bed3b9731c079587a6c02c3a5d420b6e76f3 SHA512 e5f2ff264afa44f632a45e050bbeab59d2f7e27885f9afa72db32cfd7a672f95de998906df3687dffab5ab3a09b50e24bdd3f546e7c81a6d521ebccf3a868749
-DIST ncurses-6.4-20230812.patch.gz.asc 729 BLAKE2B c2551ef9da2fb12a9c4a8acbb253dba7d5a026c295ce43164e892dc0149438a5c67313fb8f18ea3702bf250dbc296a658557ca14d4357e7ca44b64a6e008d05f SHA512 61f81ad20584a20e2c15ed2609406f31017102bcf692d3cb05af4de1bf48be7f68b0880c249f33b0480dd64307b0ea97ba1774f321edec10fc0692c1e8372094
-DIST ncurses-6.4-20230819.patch.gz 24761 BLAKE2B d7b8b3a375d7168f83c904e0ab350455ba51add882bdd916dbe5fd65a1e51a1603df79349474cc86245a15fd3e2b3831e093b271c9db4d5629bffb793b9ff5b7 SHA512 30c1a98a46dbede109f741dbecd379d9bedd42a365be4d8b935ef745f03add48dbb44defb2ed7c102ed45a68853183d0e38a08cf355cc4f4bb82aa29203a339f
-DIST ncurses-6.4-20230819.patch.gz.asc 729 BLAKE2B bf5eb879b781b8373d3f9dab69b3c6c027217af5e67734de01e292ffba58ab386b7b9f939ad5253fd330918b3d799e9c054ddcf9b454d2e84e4cff4262e62ecf SHA512 0e4ae793efff9c019858d9a0821402025510a4ec3716ff394258758665022b639cfff6e9c5fba698acc7b3bb74c039475a41511f62141e570da3f19aec045eaa
-DIST ncurses-6.4-20230826.patch.gz 6017 BLAKE2B e20ae640651f24b71c720a71538e8bf89b61fc63ca2ddea04725f66b83587d2c6d26c70ba25489d9e268793678a8599eeb7f0865ce47d9a89a46d8e9ef57f784 SHA512 1af5953e241606b9cb2d3b12f45da9f2348a3bb40c1839850e3364639ea5067bdb083f6b9518669aa42b8a624d87b2546947a2aa8e74ad2c6c8f1c3fd15db5f3
-DIST ncurses-6.4-20230826.patch.gz.asc 729 BLAKE2B 147e368afe357716a70c520e0a2e92dc134f8d6d5f387e8f00ed3d3e9b416b5e3ba15ee6a02e91abebc41c8798df3258f44a561f79d8b19837bca5f9e23f6050 SHA512 84184f7b0e30dc44b01f4556aef488100e2bee730d19531a918b5de536414e814820bcca59c25b79c14befc5049d76fdc0f8048889ba16590d96edb7e902420e
-DIST ncurses-6.4-20230902.patch.gz 51844 BLAKE2B bbb6d896e2717feaf30ef4f3945441b9fd80cadd96e0319b27dd17c0de845f50721380f0b5d054aef0413b42e596778306fd9590b6552839888cd7dce94fd197 SHA512 1d849f4447066e180bc5f0c3c62f6694a32b4b254d732e4304fc7b8eeed276f790b6e87846eff625d8a739c77fd38304a33e1b3dc8c16824adeed9c51c6357ac
-DIST ncurses-6.4-20230902.patch.gz.asc 729 BLAKE2B 3a20532b223263dae2c7a6c657983c113b465d74d8b690946c46e70187d17c4ab743bf837fcab5aa6bed7f2ea9d604c7a3b8cb37ebdfc19b66683d12f839020b SHA512 aa3de6f6bc15d76fe867bcf0d8b8e307863ea5fa935659f0e2a5e7925acc1eed6e02b70f072e6d3250f549879d41d29038814b3a5483425af5e4c4eca524a443
-DIST ncurses-6.4-20230909.patch.gz 19653 BLAKE2B ca11d7df796d2f1a294309db49cfb9f8c158f2d3db2ee6e632e8f171a737d5948ee239f4d2f5fc7fd88d68871f70bbd3589cf53d677eda2420235f475d6d96a3 SHA512 340f685e1d7a495ea07c7c492b2dae4e91005ba6596d4590e28eb3067a3485aab4d4b390856837577730a0a3ce7cc7523fe19ede50d5d6906c407a576b2bf401
-DIST ncurses-6.4-20230909.patch.gz.asc 729 BLAKE2B 213018592dd38ab9b8493cf45a2253be44ad2497412af19c5e93aa6d940896fbae4cccd0ea49a8efae36ac72b592a371c1b517fbf3bf6f07563dcfb9d0a857e4 SHA512 a0fb4b1f9c2df404a792e71f29f2397de0f14a695adbc38e379278e9a1c4ee50ece3fe3f18ac85217fe6ac5ec6daf06738548f8af6d8db2a1fc3db54244c3500
-DIST ncurses-6.4-20230917.patch.gz 153988 BLAKE2B 6df37b08266c350de4dcfa28cdf67a546a64675414d133899c48181aa8aec5ae8f73dbe7932733a406cdc1a3fc7933f4bc7884c744087f057c923f3f3d7224ea SHA512 75b4363c1ecdeebd20aae2a2289e0834ba7ce2e0ac104f7b47179ef651efc0d9255174a0bc2a374d3e03255098715c97b84d917d0268801288ae5e1d9df59ed4
-DIST ncurses-6.4-20230917.patch.gz.asc 729 BLAKE2B ecb3c166924454271a49f17d8f1f84f181cf490bf486b0618b1d7b2c7bf0d4aaea4da5cc648e4965e5f8f3c12d9cae0f88fcde8958b7b7c7854e19196c3ff6e2 SHA512 f6d81df216d2cb8e2e741ca0bfebe164c96fc8bbd88d17bab79629a74965b416ded77067dfe6beb751e6b9ea0f2807d7b345aa093b1e0f2c352a439c3d34f621
-DIST ncurses-6.4-20230918.patch.gz 1772 BLAKE2B 2c5b08699b1171c51940693c253d40580fcf34fd3053ee0146acc82da575c2b08b0a43b794b8425c08edffcf3cca37dd6826b1d20d4bcf8109e1a675b405ec22 SHA512 e8f9d325278ec87b3971b954968a061d5fb2345d2c1035348a07834bc1135c6480bd90c9d0111925729c7000c44c2b45853faa1db784f230ce99c156779487f9
-DIST ncurses-6.4-20230918.patch.gz.asc 729 BLAKE2B b590981a91a23b98273b8e4c1d0d12f6eadfda00e4a8f77d7031de10a21bacd049de9c440bebfbb29be9eb5d99b2dd43f2068a1af6dd7d50c9389173aab5fd8e SHA512 bb1a800a7a5eacdab7e95816c035ebac8dc190c55ceb41351b1a0169d5a63a2fb7d26c93738367ff7ca95c9769e06d26c67a0f2df04c6b3a93c924c35181253a
-DIST ncurses-6.4-20230923.patch.gz 61673 BLAKE2B 5501e262a9495f30ac79c327fc95d0f5e54e8e246db7c3acb329ff08e17a2e7502f35f8b8496386b13054471927d52494dd8e6b534ddbaf555c11b312b520ae9 SHA512 3892a8e3fcc3c048b20676931b6be02158537db3afba87d63262cfcb2871eea978bb84879bf5f8fbc20ec52f411a397de50bc83a35de8ba5bfbd22f247dca5c3
-DIST ncurses-6.4-20230923.patch.gz.asc 729 BLAKE2B 327687ccfe242f4bd82631c5b92e0146181b2ce795394b44119eb64a7b88739362502f61fffaad780c031cd9f98da7406f3d2bc1818f6fe779b25bfe1bd63a05 SHA512 2671b781ae1fdb5d6573ef14d5113c656c7125be1745d2d94487e44031d39438aef56c992fa2d59cbd3a0e20265e552eb3b0a9b25fd8ee37af2de5d9189a3768
-DIST ncurses-6.4-20231001.patch.gz 101411 BLAKE2B 25d644b708901027f443c6d93e30860bdc2af2d41995034871fa9a33931bc7ef9c6d62ceaaa96c139bd46a4198e7b727e7c0fc1c130cd495fa8501d45fac993f SHA512 901f391634fed7bf7e46db8a2242d9c4f7503e84ad31d9068e9bb7fffaeb0380eeffb60992686bd8442a033205ac9f27688612be1d26c1ceb30708c62ac551c3
-DIST ncurses-6.4-20231001.patch.gz.asc 729 BLAKE2B 92e50014775ef7b096983c2375884464b299c56aa49622ee095ee13b5cac598c77540319644f9c04e5a57adb57d9d01d38f5e8122e027030855789b06b766024 SHA512 051b62b3550d2a78799214f08e3e61b0d3bcd964d4df5cf320c44861a812033805fb9a5e5f079cd9ab6e75c5552c7a4b3a3a64211f05b94d602c5d8a8ef041d3
-DIST ncurses-6.4-20231007.patch.gz 67626 BLAKE2B 81cacf8b01215844ceac5d5e8e4b8b7c8df9b4d8fcf07646745b6d8f97af6261f4999261afcbf9d7ec4ebd333853350cdc7dfeef84a33eeea2b0729977a2724f SHA512 f3ecf1592fc72906e3a2f9586061a9d7c6dce31d604e5da9bf83c9d90147fa747c2bffe006121d14e318eafa0701c2f834f9a24968244cd86aaf65b3bf863ff6
-DIST ncurses-6.4-20231007.patch.gz.asc 729 BLAKE2B fdfe7216e44b1b5dc4bc10d495a575ebdfbd611a85540b3be3aff4be8580d10b7a5b335d854d8e0d85d5c811e9360de6ed35437cd8977091d847014d03bd20b0 SHA512 d73163070853034a23d893619fed151757dd153da7aa579421a48deb4f82179e69f2ad0e090a7c6facb43709fb07ed5cf515436a201ee40400d16e9bbd131dc0
-DIST ncurses-6.4-20231014.patch.gz 189356 BLAKE2B b974507e8f5f873c57dc8d9a2a008cc577b47717d7a1f472e52ed06c5c4c182fdb9baa3a86f023dec3d63b3e00102d6b0d1ce2a0df6ab97140dae93f76e8c12f SHA512 195e220f76d227b7233551ca05d5368f8bb3ca58b0a3dc26774831ced6b4c69cba8051bbcb9099f474d7a86e12bedafb913aae285441fc51e760edd0550a8697
-DIST ncurses-6.4-20231014.patch.gz.asc 729 BLAKE2B ce6b6da4fa06d6b6f9e0674f4b64221f88c5477ed59fa57c5065934cec388d91b8b3a90e0259b477c4eb5b2fdc946207916cd3a566180faa35b169c53ca48db5 SHA512 70f36abf69221bdaadd36797a2c846dfa623a4eb7c27fee1079a1fa4c95e6c5ebc1ff7a3ac6c0d2e4761b96967c1c6afc736f593d93a0388c09c3c3b94f33af0
-DIST ncurses-6.4-20231016.patch.gz 91957 BLAKE2B 31564200abebea4d904a428fb6ea5e1bf9d100f67e2cd5db7683c4cbf9ed2aa0aeaccd390f4c0871da5a5a60911e4ed4e97a08149244bea0a2910a0248f4bca8 SHA512 c09407f16263f2dcb49cd70ef05adc039f28da7124e46a09241f9be03b729a80352afe693ad8f9013d18b0bd78698ba588582aaa0759b7ca74f445312ebb9879
-DIST ncurses-6.4-20231016.patch.gz.asc 729 BLAKE2B b659353515fc77d04e0aef074e243362041907fb96ed15fccd819205edb12760004c2e434f98c014bc996455da608942b29cffcf090802da44da2fb9cb466652 SHA512 9a50d06b351ace9893fc9a5d08c14968cc79e6eec99c5914a545e6912d1e518db6cc33a725f5a6839261bfd03bd2d4c27403b7cbe53101115e11189ba8225899
-DIST ncurses-6.4-20231021.patch.gz 104022 BLAKE2B 84985c8b1bb3b3cf0181fff3ddc50a378e144aed5a3896e44d0fa56fd8807ec8c37a381a22d87d0aa7e693a0a0363e3e32614a0ccc3519f89aba6fac755f2c55 SHA512 0435ada2640ec65894b47a3f07d4efa1c5a15d46927cee3f57458e0d440b94d81a2869dfc34f1a271b6b0a0b9556e9860dd67806159e75265d875bfd96d58064
-DIST ncurses-6.4-20231021.patch.gz.asc 729 BLAKE2B 4a1a2ce1b8b237c8e67f4a98f604a390917c87e9ec96ecdb990413f631cc5bb62af1e4ff8677c51f32ad6a5d8358321c33958f4d6cbcb8d56c58b1d609802992 SHA512 7ddf107ba2b2f59daa639e5f763ccef97a066dc5e19f5014f1b295db2627c300d2b4a528f1cb3621796944fd63ad11dd3aaacc234addb794d6a494978bb32b1b
-DIST ncurses-6.4-20231028.patch.gz 113875 BLAKE2B 16ce1507ed43830840068ce5fbc0777af46a71a14fa547bc73d0e42e6de5062e83475b432f8e849121d56371a7150f223a37b9d76c85d932e60bc33e4131d7c8 SHA512 9b91df0d75315a7aae8c5189ad91dea1d9d45864694494c3cf9644ac341caba8217b931d4082ba89090ff0f2ce9f06d75cef7c3fd9e45db49f708ea88ae4f947
-DIST ncurses-6.4-20231028.patch.gz.asc 729 BLAKE2B 5d500540a1e108f6a56d24fe3e9ab6843a6cf9f5dc330f4b0146d53c9e5cfb64c647f21031bec31353bf989050a4b7ec835eb928a34ff6a75b8e26ed4f40b606 SHA512 732222068452d3caea4e67edd459dedcc5bed7ac35a8db98ec319278dd0b8a65c05729c8a095d0756579b90a80f9f2580f6c71d2dd4804445f7a54b5872e192f
-DIST ncurses-6.4-20231104.patch.gz 6145 BLAKE2B 458fedf34df29affda1970efdb9d8acef28d5f469335d78b62e6ce25da7cd05e21905ae3a7de8ffd067b64d07ed8e76f53f6f7aeb94926165e1b94191d441874 SHA512 35ef3056d168db5e031a18c497ee8d5a9f71b760ad517aded3319829e722804d62685dc49f74063551663e11e0a400584ea455fdc3f0a7bc06bf5a24515fb0f5
-DIST ncurses-6.4-20231104.patch.gz.asc 729 BLAKE2B e7858261fe5de878d37a2c052723b7889e14be6ef5c6efe75859beb89b68ba96eed3c0691bc9465273aa277d17927ff7dea60d81c0b2f96053742733fdb64d0f SHA512 900bb9fd5ba729f76788fa273f4b9d04747a8c7fd627d358621222f9965864b59c1d989f55775b766d099a1a0081a6e195ea6a16216faa77c892154304da58d5
-DIST ncurses-6.4-20231111.patch.gz 31095 BLAKE2B 12ec2d5a693a9ba34abeb1b5863f9549594734138b01a698ff9a55c9cc0519fa9777045e22f3623171724ff4ed841f8ee373cc2eca540aea19a325e0c63d24d0 SHA512 3170ac79bea59a1de9f91b647ac41a7f2df3c93943bad1573322cc3911337c16db2e55563198f6dd5c963c31800636fef98ea7c02316f049071b2a41b6b15c14
-DIST ncurses-6.4-20231111.patch.gz.asc 729 BLAKE2B 2b3e510d826905afe5cf23c4737874cb2a569bc6fd3f081a0eb16777d2791d7fad46d7620f1f229dd5ba9652095199c684e5e5d6e8f38947226664021746c24e SHA512 bfb5d15779ed7088bedd7ffc26d16af69fe8b83706088a5171daa955425e1f0697429f3e29a5d286055790bd2e8512d6507e85e2b541564f349f8c3dcf274221
-DIST ncurses-6.4-20231118.patch.gz 15202 BLAKE2B a8cd152e11da3eb4b7687e1ce05afb86c11d519f0a798099c459bd50a7e019353c71ba55ba7872b57131948e945786d3821f431a3a0d5279ca0bc111f080a5e5 SHA512 d3ecbbf17b9ce8d899fe2a77fe884ebd95ed091d0f194ad6fed98aa9897a59642242b2a3a04b0fda786251d7f584b3ee2fc402d88f3c1a4ff8ba600cb8e20d01
-DIST ncurses-6.4-20231118.patch.gz.asc 729 BLAKE2B 76767bba1425ea00cb06415c1011bd235e95ee8b360138d237224972802800a90c582506e121c2da63f6ccd90ff98193229522672f6c66bd68af9cba3988a271 SHA512 fa3e4fdef23e2ea258ce1068fd18afbf68b5406aff6bc37d78556f2337f9e0341290641dc106c862596e8fb62606ed13e2013afc66c5fb90c13618ad561e21be
-DIST ncurses-6.4-20231121.patch.gz 2725 BLAKE2B 8acdf10bbc3db2236e6088591c19a4c4996e8ce337b7155828d82474b2dc1f00bac68bdd530356e7e30c44c8aa0b9eb5a0504848b58b2406bfd5371e42c28dfb SHA512 673b445f4393d3705cb497232ae58f7a5dd07143a10973a319f40411b946bc0b2b22ba8ae979ce3380fe104077dc63823562349163c266799b777e7f3ba9f716
-DIST ncurses-6.4-20231121.patch.gz.asc 729 BLAKE2B f91437a508906e28bdc9b0b897150db6144280b965bd2c669656a84dc4cf180a04b0711b8025f536bded39ea3af02487d5067fe8b1add76a7695778c58ec590e SHA512 1c52a1d935ca7ec367e0229face73c522d232ab1ae0d3ac33b7d2d5398823fb6b7dd232c7d3d3bc08026b9454367a9e9fa86e8a2a0a2de754bf638e594dabe83
-DIST ncurses-6.4-20231125.patch.gz 221965 BLAKE2B a02689cb8f5ff85cac11a31559c261573221f64e55e25ac55ce17d648cc56e3db55abd8742fd08de8c9192c51fcc83bd95c877cce8cf5d18493e7f3567cbe581 SHA512 c838aa74fd81463dcc99bc2ef50bfc382b0bd0e277f46ef996a1d7bbbec2ca9588b4dde626965170b083cd385b7c34ee1e7bfd25fb0af1abdb83da0da9d05d7b
-DIST ncurses-6.4-20231125.patch.gz.asc 729 BLAKE2B ea13453856f8b4c1565a3b708253ec7a35d921e6a6f162022370cee17b261a7fdda861655bbee87aac09f481f3b36c8b6181654d5c5d7e8468ee9a0d87399973 SHA512 e7174e87d338d35e487dd1f9af22fdc71d48f2ab2ac1f8e8158f08994b35395f6f5a36b75d0a803af40e59d91fc47e1c064851c2cf1ec02bc8f64a8f5a0f4f96
-DIST ncurses-6.4-20231202.patch.gz 50653 BLAKE2B 20d9973db850d0d19003204308c052806af6a44d1c2a03f233b0a8c25a3668b1fa650de91ee2f6083eef15bfb711bbb792f410feb918afa94d75e612f52678c8 SHA512 08ae960c00fe1137986bb5f19e3ba2ec96fdbf6203fc37636c95bc8aee3ec204158a8b28119c9476df41999ecd77aed5f45df25c9bcf1e681f0404329f14afa0
-DIST ncurses-6.4-20231202.patch.gz.asc 729 BLAKE2B 25f07e646f17b6083c0cf6d57fd9bf1cd8a68e00f310c3ab68659cc0412bead62dd1428223b7390dd5dda0695f2803b15456462d2c275da84ec79742662a7208 SHA512 a28fd17268c12dd1b395523bd307aad98ad91ac6aca0e6557d74b56256dc673d1dfe10665dd465d96ff0b44eb891565ff3003e7f7bbf7d72b52c09c8adab5f8b
-DIST ncurses-6.4-20231209.patch.gz 81338 BLAKE2B cc8bbef3e8ae839f67625e2e7c69f853a838e1be7642db36b0768c37980b069d5b5a685756251b6a74fd07e44ea94644b745e1f4fbf2195d9a7c132797d84ebf SHA512 40057fbf43fe26debc139f47fb39474843e296fac120a9a8a17e2da7a7957b15cd73ef7a97d553ebac901cac3f8de2f3b31d7d14503ffc2c61c9b9b4049800ff
-DIST ncurses-6.4-20231209.patch.gz.asc 729 BLAKE2B 8738944f8138139d701de123253d63d1f61c1c8f92c63e6d6e5c28516d338db693151aa295700128cd56e53f0c28a2ad08006473d4e164290b1340663d35bda5 SHA512 647589e2d820ae9ede81e7119b08e9215de63f145cf51c24c337bd86983a7b2029c6d51f53cef6fe97962f5a507f3b64f4512c15af8bbf041796bf5beaab275b
-DIST ncurses-6.4-20231217.patch.gz 189513 BLAKE2B 26c0158ae6b82576f2c7f79f881417655551ed208cb1af18fe54cf0939d2a9f5c3f109b07d0eeed0791c6b332bc7b3dd4a5bbd07f59f4ba83389b3800c0c78b9 SHA512 cc59856be71ae35c8c297c19d1f4ea39484258089c95b72b2a41b150edfc54fcf59dc5c4e6b155c1d09f556263af56e3d0cc9678515081a5608c8d9289051a58
-DIST ncurses-6.4-20231217.patch.gz.asc 729 BLAKE2B 70a4d98a71d5346b311e8b5a3fc3c30520e0c5d244f42b219eb0eeaee7dc51fd7282c650058c2145af6603cd25f3e24346a6c21dc5fb4e15d0e0fdd863e9f4fe SHA512 b4e18ebf39f4591a22228da60d9ba95d108c087d7744daa4b33c65ca702b6723e44c240e2e8d508606da6a11f1c94fa70f23a9aa2066ca38c1ddfbff2a0141b7
-DIST ncurses-6.4-20231223.patch.gz 107172 BLAKE2B caf812ee111a6de68a4958748bb78c1ac640c94ed975527ba682578951d75d10004dd50ec0cfdab5eeb76bce2207083abc04842fa26db9395064f72304b2856c SHA512 c6de7bd56566ca3bd5b789bfcaa1188573400110ae35ce5ca9d4ea230671a13296360fe3a4862a097d436b9e5e422f115867a8879745d5486393a9bb829889ec
-DIST ncurses-6.4-20231223.patch.gz.asc 729 BLAKE2B bd4d83e2c102cdb899854ab203a675f02a82ab21501e7dfcf656bbec19d813c0fc2f1a8d0cc126b20703bda9b7a057200ebf813444b5dd18e35beb50e80f87c2 SHA512 374c56304eadc88eec577741e884c0313e3419e9179a128bb92d5e622f4ead3dc3e78ec25421f6ce813b38598a699a8bf7527933c95cad1f2ca181911b0c39b2
-DIST ncurses-6.4-20231230.patch.gz 75387 BLAKE2B 730aebf19c91cf02ba7f28672271734e266913e49ea83c36aca10ba7c7932c335898c8ef294d881f5ae7f263a29886083eb90ebc5f2b9f9e1e60471b0d97a9bb SHA512 6ff39e65fa674dde1aa377db47d66d6143b107199a41e6497c8633125d3713d063ac699435f9bbbf2c7f8a40a5b06433d5083b0069337ccce51ebccf5e54bfcc
-DIST ncurses-6.4-20231230.patch.gz.asc 729 BLAKE2B 490fc8f5673f2efed7e62bfd89d1d8ce7a7bc11d3fa7a59f68720a694a19bb5bb44d8eac86695c5173044c1128f95dd1d1ce341554e498e6fe429cbc4857c968 SHA512 abc3f3dff374067ab5c2ca26e752bff8148b658efb3507f59ada10143714b8b70710f691afbdc7b231bca0b4ab4db2fc74c7c9cffac8e758a8d22d0f696d5a4e
-DIST ncurses-6.4-20240106.patch.gz 77283 BLAKE2B 50234e8452ac53212271f2a17d1dbb2308fa2c9b68ebb51c272b018dd5c6a4b9769adcca9b718b28fc7289698c01f15f60497bf99a9102e855cc1d8fc44c0412 SHA512 66ae87b463d9239c6953305b4bfb69434d50c89fc0ce3877f1e9dea54fda427e0c8ebbda85275726c7ee1c07b97d9163c73d351fa8fc7c6adf30361c89780b88
-DIST ncurses-6.4-20240106.patch.gz.asc 729 BLAKE2B ad5867bee1ff817718a9540624eda20b6ef62a63b7a19728c5ff0b988b65ae64fc412e196badf29b7c27b629a756f2899c88e29b9f5cb15b90a424ea65a0ca59 SHA512 805a3d86cea8b099d3d45be5d794de73c01e533427bedbf8ad86d965bd3c84e23e9937c1c0ca9898c3b2a97ddb063e53d88481d36d288c6aa554d85c5db697f2
-DIST ncurses-6.4-20240113.patch.gz 212108 BLAKE2B 8cff40c4612e0633e1938cfa82e255b99efdd4c6383928c59cc0a46922b76ed758881b7ec280ec6984336ef2bcb6ac0bedf85fd1844add9337c9a6905e06d3d6 SHA512 38a59a574d53008cc3b298a45b08b86cb873dbc130dbeb8842f3fefbfab6a280e291bde187cd2e50b7b221afdafa087889a6b5faf305fefcc5444402bcd0b0fe
-DIST ncurses-6.4-20240113.patch.gz.asc 729 BLAKE2B a62a912a0b4d4d08a6b319e3beb0ba17c5359875376e920a0a31c8697c82b7a9e2bc2547ccf95fffe1def3f299c1d1379ea14a34ff86b3fff91adb9c2317d53f SHA512 473a9aabe87dcabd19677b8da1dd060212757fa50dd06008bbb188c76a53ad147c15c7796df5a643d26621bb2dc440dc8d69554198fd1e3478394cc15d55af76
-DIST ncurses-6.4-20240120.patch.gz 150509 BLAKE2B 89bdc8a958582269b48116a2484015087fbf53bdf2e52bd80cc2fe9be01dcd317f83c1c5dd9e6a9e6ac9f06717f7900ab1828bd2d69db891361c5fde8ea44592 SHA512 5c1fbe8fbcf375d6392afa53904a747e7bea1976fab63fda35db92411a4770ca4f71f3d4020fb51494d543a1a33ea743a590a473107e38b92202882bb17e4903
-DIST ncurses-6.4-20240120.patch.gz.asc 729 BLAKE2B 5c8a59cff6de9a00ce82d05be7462a9baa5c01cad6cd3173fd10224ca3081c0f7eed9b6b451bf3921b1ad4a7c94379848f8dcc3e676a0f6071516f64150c374d SHA512 def46080c3511258d6ea4df09dde6b4588d9c59298f938afd0f48507c4b12b75140c8801eb6e937f265328613174d0237f02871a52af68b57dd8b13f85620767
-DIST ncurses-6.4-20240127.patch.gz 24225 BLAKE2B 571acc6b1f0c194f88f76b4fbc0f76a03db4ffdb41acf813a847770c3642e3ccdddc21ef2c26a40de347ee3752749f3d8f9834c4418b96268cd69c0d3d780aff SHA512 0d97e7e4837804b2daad92240300bb4267ba7a845271adbee9c8e2173a973086180101365fc77fd21f61aae1ab7549764cb37b5bd8edaabfdc6deea2baa11379
-DIST ncurses-6.4-20240127.patch.gz.asc 729 BLAKE2B 0378d7c11395fd27ce4366668c69dbef84a0399cb3bb43673bd16334b04fa4b5dce321ff2543b1c79d67c2bda6cdbf795eeda994a03c02060bacbbd0ab4107b6 SHA512 293371e914b5577e66a9efa775a6409ea19a65ccb3086b277a7ec083ae26c00154c7fd15e1d30b86c5bdf04c72245c7f21da463a5d29f109f4c7e4f6b7945e97
-DIST ncurses-6.4-20240203.patch.gz 3868 BLAKE2B 3859b1e5ea907a0340ab4c1f0f211c4264d6efa8a04f7ec21cfb4b4a8e8f956822fef926f24bfa25ad6c8c1b0467a05a96d5316dd7e06bf71ce894b6e897d21a SHA512 729ff4a076c5285deb8ef2a187ae4116826ac2f50aea6cab19271119035d13f93b6ff0fdd134e1066b1075eac5ffa3289cd3e20a32e0d07ec533e34818496885
-DIST ncurses-6.4-20240203.patch.gz.asc 729 BLAKE2B 9de1398c7ebe91a10b98364f12811daec8d1b9178514146704810202d8acc2aa30cb7f5b4ddf62c47794298fdd2832a4faab644d63cd07f6b60c7767d6cfd5ce SHA512 ded529f2f917f9b34db3fbdd221b91138b14fccf123e2a2a89115ec3159f3d2085a9f639604a9df085848837f41c437819e74cbdccb92c238c301f75f6308205
-DIST ncurses-6.4-20240210.patch.gz 3820 BLAKE2B c200bc74b5703093beb85e4ecbb49c8a7fe0e8377a28b01af5929ffbf44583d1d68add001de6e565010724d5a66c5a0e1735117753f7b8eb31050ffe2bc17de0 SHA512 8ac1b766fec97d1aa6bd61b02ed176acb70e59a7833f8ecfbb4c8b8d80529609a58f6f7ec6d410b7fcbae32f818af3f613ff571de7e4ae53e2f1ce7b0f93739e
-DIST ncurses-6.4-20240210.patch.gz.asc 729 BLAKE2B dd58d7dd963773b80b497b5fad439889922011dc293a9c09b43f40edff5abe5884e05691349e0991a348bd531920f1c5bbe6a0f5f7306b86a4eeb8234b187244 SHA512 7ace2db56b71e21d8c5ac5786cf5e3aefb97a767f08fcedf90e76d26bd5f3770200f89cf7321a9876870bfefa9cbf0f2ad344140131f5a2d3542f57de289b9ed
-DIST ncurses-6.4-20240217.patch.gz 13442 BLAKE2B 946d39849c815a3924aed7ba5ef96321b79310bc4822cf44426d340d2156c0977eb8ded858adbcb7bb6fdc08931d868b021572a5b28ed871493cd11967b302eb SHA512 cd486f12bb11d0e6a4d575902d22276be3bffeb66ca5e83d0eef05ea7474ef91fd174d6929e8e4b05625eee9bbcd06618ade71509c98d208f84bea031e372f77
-DIST ncurses-6.4-20240217.patch.gz.asc 729 BLAKE2B 69a3ce2018acd626babd44fd0b286d29d927baaa7b381b8feb2961b3c5a731905ddc0f0fe62252101497de7a49adb150fd8e0feb04db2d5c2f78ef768d9cf593 SHA512 81f4f4c9315ef1605459041d2a523c8751a926f72e93a513bd922ddc27c91a999a11ecffa79a21577739dc6a46f23317d8867a2a5b8ecd372c5c820211da71c3
-DIST ncurses-6.4-20240224.patch.gz 11576 BLAKE2B 0ba4a7d7d38fbb2a0a985f7114935f4effe7c12a138af1a9aab974f5a38beb7986f9f9e4cdb1ab5563de68d7a99b762338afab30b5ad0aef299e4c677719e317 SHA512 58eec6d77026d58488711d8805334f17474bf30f3cacc10abffbd5bc38c0dbb287a586af9c0fc918f9f98ff124532c95e4d92e0850117982ca5afe0dbe9dec2c
-DIST ncurses-6.4-20240224.patch.gz.asc 729 BLAKE2B 18ef11d2ed0f94199fe28e732ebf2460dec8a42705ae89fc339e76870c343b849a311d7915cfd042c761465ce5cb4f42acdc9a2bc57312138e4e6f51546fed23 SHA512 b8e096066947aa2a567a6374afe41fb4f96c869eb3fed179a24d1f3a51af24a0bce135a9a0cb2680218224812b1ff2762470c15292d4555bf9f4231571b573d2
-DIST ncurses-6.4-20240302.patch.gz 37371 BLAKE2B 5d4d5af8fc10cab3e7b6b14751406737396fb5c63b361186d5881ed08cf61cffff64df5a326e1114e4b423f575799bcd0b10fa2c29ed61d4c123a373087d185a SHA512 4eaf59d3ded356f21c891e0ca9dd323e869597489da7322f3ea7ade14a01b2b205b7cbdc9d9beb38abe6f76f2a287a1715f3006599dcb4cbe5e7eb6ca1430e3c
-DIST ncurses-6.4-20240302.patch.gz.asc 729 BLAKE2B 6650fcea22bbb9fa619a9796f29ab63c0622f0be27b093ff8e7ae582fb4072ded5797f2f06064f3f1b594d037d8e74a84a156f9f213580da208b1c896be9c911 SHA512 08030171f2eb9208805f55c0da741883472e31b0443ee1e9c2758780e29ee3da3bc88fc91db1015464c473a98e2bc7556080fb20e69a07678320a5116d0c4a33
-DIST ncurses-6.4-20240309.patch.gz 2631 BLAKE2B 4f101f8f263c378b3c76e2da1399b286a71d70a67d0b639a58d914e61a292b99d5d51d27fab16efc26ab6269bc3718ff89db357f351603d9ca931916675cbe9c SHA512 a0c8e90015f933169329796cf247cdee19a7e1a8b263cfdeba1376d4042dc02f33878eaf56860deebfd55888ccbedcf9b76db4adf70ee6fa92ea7c4f823fdb07
-DIST ncurses-6.4-20240309.patch.gz.asc 729 BLAKE2B fd1c4b7c9b208427be6280f2ea899d970250ff8e4251c437e6e6ec0d3f5f9c6539f68bb4735da2d968769660d6f81aa40c922cde97fe26c2b0bf3630fdba3e75 SHA512 d49ecd327d1bbcd566990a43b54e554ac7c73142ff21fa58d3402b2cc2e8eba3b45780835c58c7f9a8e1a596ffb9cef5e669487d6f56b873d03a91e16ba303f8
-DIST ncurses-6.4-20240323.patch.gz 143301 BLAKE2B f51c229985025950ebe0b35e1e9cb17d36c5277aac966a10c77bb6e60831a6a017431b83ca06a07a660ca42066bf2e5792a37dd39c4e32e55423fe4b66333732 SHA512 a8977192912666dee7e6e1ba4766db352691b647feca169d447b484e5975a40429a2390c2a99136c2f96166973433a0a8d569381560e9ab47f161c85da273de5
-DIST ncurses-6.4-20240323.patch.gz.asc 729 BLAKE2B 380eaa8b0f3faa3e2ff21a3847c6f2ba59019adec68391134bb68bdecfd13cb56589ad4ec062dd391ae3d7bd96a306d85e78ef0827300de594723d188272e7c4 SHA512 380675d04ad1db69a039001b109bea6e7ef3f9fa0059ebe8b17ad12d0b59b20dd18b90abedb63f95db2ed6ad770de77aacc85c24d70bb883b1851c72c5dada88
-DIST ncurses-6.4-20240330.patch.gz 63526 BLAKE2B 593823a358017e5f98e897ebd6e1a2f945b0329c51a76b0ea65458751d2486dc51a71c1d0fdfbc1741167c47ed0b8aedc52b1a923c4788f23293d7e7729885c7 SHA512 666c8f7a37bc2b93b9b0ff76f2a5fe412f1d5c0c9260b64a26665e7c3ba74a9f05ae3883a512425d901ab943948509792759297ea85b9642cd02b7b64455326e
-DIST ncurses-6.4-20240330.patch.gz.asc 729 BLAKE2B 159c110254d81b1c83d7cdb3250fce7ac12d1b4773e6c1a4a347bc7a5d96893504b1a7066d6a8997c3db467ba7d3705e043714000142fd2ebac6e9a008a62ae8 SHA512 1a0dcc56e79da6e0d615bd0a6571869e42aa6e31233e6cb01fe85c8816c82858c23e93a47650e1a4fd8cee2461e4900f7b78a4f9aa3149a0aec6cda704f9c163
-DIST ncurses-6.4-20240413.patch.gz 113122 BLAKE2B d8e5d011a8ab61dd30624c51d7917ecc66f388c8b0edcba25f35179031a16b5a41379d8c5f2c40a2b6af5e485b25ca8a3cb1c97301450b00c14e2640187f0054 SHA512 45c14df0fc4229667ae173cd4eb37fad2a3dbcb8906763a4d472fad7b563dbe72dbc0bc12e6070e6e7f2e64fc2f3a254bffe5d1e904dce9f5636fccdd2761750
-DIST ncurses-6.4-20240413.patch.gz.asc 729 BLAKE2B 3786f815cddf3f6ebbf89da47e3151c01d50f26c2fa713cb982c61b7190ca25a807b6f7264688a296d5d252c78f4737372f2c6f26d7713bc448c5228676e922f SHA512 c172fe7f308a01474d04b06919b43710abcdb9fe3961396cbc7731f619093ed18bc7deb9bb62075e3bd0bb88d345059c9bf485a4f9ef614dc1109d4549c95a34
-DIST ncurses-6.4-20240414.patch.gz 3007 BLAKE2B a4db0635df3b2669ae1ba0057c21f717db2512aa51545ea5157dbaf33c3db334cf8315ecd60a4c8a6406e6e7ba417e23f00f575af72c56b18046e3c4a34dab87 SHA512 348ffdbeb2b7350493957562a0af1a217590dd35cd9f8f27ff46adfb969018224e170b63581f5b3ad268293441db59878898bd23d1d1a4add77fc681344df526
-DIST ncurses-6.4-20240414.patch.gz.asc 729 BLAKE2B 8d579b2724245756947200a3e704c1ae534ba64e6986ad009a5ca9d33145fff82ddae9003a7c6ffe5b64b68f813661440afcac0a1321e5b80113d3ec94e1ea5a SHA512 0976a253d11fb10d52fee1cd2ad38e80b0b531f89efe94a62b9a0e2d69206bd1574140785776c7f6bd19775f6ca446c582da31cd9f51a8b0f12039d1e9695600
-DIST ncurses-6.4.tar.gz 3612591 BLAKE2B 47fd9c2d27f44fa9942552881a471e5067465dbace40bf68b28998dded0556127a1d8662b96de4de4fd76c1c8b98bdae796036553ab4b05ca9f160839d841ba3 SHA512 1c2efff87a82a57e57b0c60023c87bae93f6718114c8f9dc010d4c21119a2f7576d0225dab5f0a227c2cfc6fb6bdbd62728e407f35fce5bf351bb50cf9e0fd34
-DIST ncurses-6.4.tar.gz.sig 438 BLAKE2B e6a78b8d0cbce1577205b49b0260394094632cefd95294813c7e4e51a2908e8599a9f24b3b648e42ba16c015fb9424b2a82236f58aac3bf96f5400a50482e44e SHA512 f2a7859725b4d5d62f68006338d56598ac6b38a1448983108906e192f0ec922be287cc89bcc79c1ae49ebc80c967af3dd077427f35ae579b00d445c882414fed
-DIST ncurses-6.4_p20240413-patches.tar.xz 63760 BLAKE2B 6a91d453cca3705ca54b3a6f2ef00250d655168c1697726db4b581a1597cbc143479b8794e176d5e4154c794f99ea33c3fe1eb26605789930fc82649a2da3c93 SHA512 59239503a9400e054641428528799aa9c13b12669b31f32b2ff18cb60882698801e04dcdf75ece8357c7a4c3b899a729aa973090ec12a20de72cb80a916878b8
 DIST ncurses-6.5-20240504.patch.gz 16541 BLAKE2B 1b698b61fb738252eb8839f659b8670c743808058da9eaf39e6d288f5c00b3d1fbc4318daee8744fef37cdc42fa176fc41bbc5d4890295ad53a633207cd129a2 SHA512 6d72b5950dd55a2eb36f4c615c851a0879dcee5f97f9aa46eef68fc0f3c6996c7bf06d4646a05c455888a563ca673be3159e89db2266e81f0e72434cf4d3df29
 DIST ncurses-6.5-20240504.patch.gz.asc 729 BLAKE2B 6a9ff6b524bb8ade98d6259514b7d467aee38d12b915c7eb030f025f244a44cc0c2dac524bd2645c5f315f54ef47fe6791dffc1728320e0e4790032a838cbbcd SHA512 4f8a2c6be0471df7c25fc67f596753df48a2a4660c848263d10126bba96010c185d31208b2424c495f29bbed6c93cc9cc88b37b4cc252e00bb971364fe68d2d8
 DIST ncurses-6.5-20240511.patch.gz 85486 BLAKE2B 94a00b7013531509def2e17ec75421897f321763fba970a73813278826071e99dd9ddde815c3b4a6cad7c6a3f16eada3afb030f31ee72123dcf0de710c9bcc03 SHA512 c529f1bac7af6c774447027449ac59e41dee3fc30004f7c82113936cc3aed9b5536466d2ca91d99d13d1e1e0e9d7357b87ceb9cc6dc54b212c730d088835288c
@@ -249,9 +108,24 @@ DIST ncurses-6.5-20250524.patch.gz 3599 BLAKE2B 5e1da13964f10d846afb26f8759590fd
 DIST ncurses-6.5-20250524.patch.gz.asc 729 BLAKE2B ba0c26a977da6874fa9f005dd094527739357384626b86f40edb73f9e41b63f5f43953ef9ec67dcb0d82404f822f6599c38ef8b5d4bb0e3b20e6c8f04115cc27 SHA512 6fafad6288c3fd87efded4faed2f2a4de705bf207cdecb5759f13be9bc6e2f866a1eb7d47719388f974954e78ab8c70e9be8b558e8f2662a2c042d16662ea281
 DIST ncurses-6.5-20250531.patch.gz 3172 BLAKE2B 225875dcf8adaf785efc0137ee0cdd7affb378ad266aab0ec2dffd4197cd74daafcda5638f0e3c09720a41ba9506ce46ff7bbdfd51d13cda4096d6b7be1fadb5 SHA512 763a3ce3e26445f4b978a7305b135e2cf94f7973db22b7228ff1fe9eee93ffe82ed32aa0012c9b2916599ab3980e455140f5150af420d85b75f33a426542acf8
 DIST ncurses-6.5-20250531.patch.gz.asc 729 BLAKE2B 94e72ea10c99afecc97c39854522dab0e95d970e77c36b558003717cf4f8a9f32783a994c88f6e5f657310929c518a7b80e46fbaeaf51f48811b7980458b6621 SHA512 5b7e4b98e2127e914aa997b63b59b4e3e5281f7a453d456ea4a29e5ec84da8ab4c8c74a3723e61613e04e85a412f37488a5cd6f4ff5536a05e3d91033035ecc4
+DIST ncurses-6.5-20250614.patch.gz 43730 BLAKE2B e8f42867dcb03a70024dedd0a635c96b0c913f390cce719c6c0e0adab2c05c24c9aeddfafa5bc7c5b752c45a814ae216d89555485f2e3d9bd49353c4faaf4f8e SHA512 96e91602881c041ecd1d71728114d74066569c9b97908f7e04696f3106c95fa21dc67fed58577f013264aa01c24b647fa47fcf7bf76e734029fa68f99054710e
+DIST ncurses-6.5-20250614.patch.gz.asc 729 BLAKE2B bbda791fa23caa08c25df5eacb100c40bafae51921a757f010412c88b8c28e152fed414cc21079a70c0faf6cbd972bfbfba75dc1cdd8d5d9b43215248a428884 SHA512 7774c6b8215967ef6e9df4d89b16fa969941cd1330951c03b6026b919b90469dd4e801971bc45378239cfb44a3e82b8003ef3c8dbb483a1fef02da49f2a7a315
+DIST ncurses-6.5-20250621.patch.gz 12198 BLAKE2B b342b10304c4e3df42a0d4823b5b9a8c2174569e7e6ea3e34aef7dd15c5af623af05ba9ed2efc5cf38493a7e18f71f15627a1596660d086e5f9ffdf1c5a36cd6 SHA512 e3bfe7b6dbaf02455ccb53f6f178d4b409d26d47b5bb26fcbeffef078696d124aaee04faa8d8a291c8a9e10ccd9184c5177c8a5ecd60b26eb49f0d1ea43e3130
+DIST ncurses-6.5-20250621.patch.gz.asc 729 BLAKE2B 110a2190ca7f2fd902bbcd16d5d499d2cc8a6ed6c2246d36e2766627c66d1e0283fed9eff1152febdebf50d327bd3e3ec598fa4fcf25ebd2a78c559a3ab6d7ee SHA512 adeb65f38a698413451a0d5e626da09e5824ec2c44197ddfd607bb888167ccf239134774c1c363938761ffcd49047b999603aa76681262e73b11f9f1e3d52520
+DIST ncurses-6.5-20250628.patch.gz 3861 BLAKE2B 8707b14c4e9e309f414f8f2d70619f631dd531d3377050d2c331405cd350c28c2ba5579c328a6112f2c4e199f6a13c3c266e985ab33d977f538672798dc01526 SHA512 927838ddd0784ae192f2f43602715bb89f88b05b33f8bbf72275d9920bc4f50e060b1fc49f36b08025487d9cd2d2f7d4b3c38188029d33dd64a31efff38a6bcc
+DIST ncurses-6.5-20250628.patch.gz.asc 729 BLAKE2B e33aacfbdf9e41dc8b457ab213e26523fb11dfc2c9df8db6c128387798a7e18813e352c275aba8524d9d4d4be2c71db56973e725952ca361b418d1bb448e1513 SHA512 2fcccee11626df82508a01eaeb8bc9cb124333705adad7265ea8825aac384bbd774527efc6462184fb2b60fdb10f36cc2a81c4c484ee3239070385ece50e6887
+DIST ncurses-6.5-20250705.patch.gz 180212 BLAKE2B c41b7be224247e63ebb030924c2e5e54409e31713e307bbbfa7f97e10b368ae651dc0e2deb16833c5f2c58891f9558946231db40eabd5ad5e6a91111fdf3afbb SHA512 eeefc5d4247b3bf647d79b83eff7b36c51b543c8240d902afa005842be2322f526a67c9aa8a2acd877a0f41edbeb00018c31e879acde7e67d7a946285936f5f6
+DIST ncurses-6.5-20250705.patch.gz.asc 729 BLAKE2B 8fddbe23e3eac1fc9ef4b9857aaf514c82d5351c48de0fae90a2e16c138e50c69b77863bb66b076f20aa08ca1e8e222db6c8ac302fdb60aba604eb2aa414d53b SHA512 1bcedc2da8eb74bd6737ac1ed05fcb1bea363874d7780ae3b0d2fcf5a9c243bf49cea305ea7316995c5eecb41bb2adac0f25cc8be7ff7f85950403c64da7459f
+DIST ncurses-6.5-20250712.patch.gz 8310 BLAKE2B 20a8696895afe29d4a2c10a425315a87ca33005d629d8f87801dd9562963396b0230f87b6c62e7ba4af487cf9f9e1687cb346ef090a60623533ebd35838a261e SHA512 e49a3d807859be4c7842bdc91eccc393ec39fe04044b077203e978e68168bb251cd60d93176e32c49273e533f694dc858520baf3ae115b33bcb344fe9e0a2277
+DIST ncurses-6.5-20250712.patch.gz.asc 729 BLAKE2B 43bd707944676c871a5a5253b5898e3188d1301fb8ccf5e2fd81787476ba2947b93882996ee1e23f3c68dcd68ebf360e6d6372bf38212e06a2eadcf50bd604c6 SHA512 5c1a4c3a6fb615d8a8eaef30f7f25d996e8907ae23e23d288f9fc5d64827477dbfef36512fb123a2fe3baa13592978a2473621f62ca2e338eb9120ad4b505b5e
+DIST ncurses-6.5-20250720.patch.gz 126004 BLAKE2B 3898a4cadd1d7f903ef5437363208db8412b9de5c718315c73398cdb28daa7d90423aa9c4ba7e1c921b1e3cca9f9980f15d675b6a14ec114835b0766024ec465 SHA512 90a912748ac7cec005172929a9432c8b9f5338d690a863516c09b74e96a38c1390fd2ec4e60616feb0aeeec0d9e5bdf71bf525ed8872b116e309a87701a45a35
+DIST ncurses-6.5-20250720.patch.gz.asc 729 BLAKE2B 27cbd419eaa27199787dbbea8f2049f40d83633760f57520f2dde93f55a5d5fc3b7559d3767e32cfdcd930b2c5b018d5e13b301daef0c733d9ca6acaec7dc4f7 SHA512 d41ed183e64fef73621f7a9e9561a5b44ecaae452fc3bcb4e258099f1f7fb06283c6f7a0674c6c40ecca6a07bd3c10782e22ba3618b6153428265a5003d4def5
+DIST ncurses-6.5-20250726.patch.gz 47760 BLAKE2B 316109ff7e38c6ecdec115e7980d307d7e16f4f88eee096c620b5750158c288505c8f41de1ec9d9da49ff4e56839166ab994393075d2f5fadcbdfb3c7af2d9c9 SHA512 1c47b7db0fbf77c78b53fac1aeb09d75297c1f46fb9a26a50f7c350b70d1e18fd3995ca4856d67fa9664806d9d64759ad13894924ec7d583973791ac127e8b55
+DIST ncurses-6.5-20250726.patch.gz.asc 729 BLAKE2B 0317fe9d4251514a01848b804e1c0d89cbadf6645127bcdb5b854a4a60346de1ffc5464454ac9cb4e930eed566e65e3c5b9624b2e7b76b264f4bd9cbb6f5e70d SHA512 847d6de3cf0ba49ed6cafeae269966d1687e061eb546b0e05ab155af20309ab7fbe0eed6e4d226bc3859a8aa7c526d2781233bf06e9862120c57f2791c2e52f0
+DIST ncurses-6.5-20250802.patch.gz 4000 BLAKE2B 18c7855d0a16ad24947b8f9099729dde3d4bf5509d310ec6fe48e52436a8e9c151b963020c798484184989c9816266ef21f5545d73e5d931a8c07da318612e2d SHA512 ef29aeb611f7362343356b50f602298e52727df62dea661dd9b831f440dd9b3ca3b4e0a57011222db9e8016fa06413ef97b83936445353dbb11993f08936d95f
+DIST ncurses-6.5-20250802.patch.gz.asc 729 BLAKE2B 20bdd09573b76d1f37964f3af89e96fa481a8c3cd3872de5b8c1fdffc718c4777ef7a5a99046b17f06a92a9266f46ac29df5e21c473ed3fbaf1e03fc557157f3 SHA512 e2398af3d20db4fff9d724a8c7d6da32c094b95dc8156c46f6f5f3aaa3f53b9b0eb739bb6be8afab54863180ab56e16168056b0852ff3aefce0875a32f2770b8
 DIST ncurses-6.5.tar.gz 3688489 BLAKE2B d0a05c218b5f320ba9abe2f322787baef1d15d764e503c81d49772b54b2927d28ecbeb500c8e514996226b41f69445b4de44ff423cec25b61847307fe61682ec SHA512 fc5a13409d2a530a1325776dcce3a99127ddc2c03999cfeb0065d0eee2d68456274fb1c7b3cc99c1937bc657d0e7fca97016e147f93c7821b5a4a6837db821e8
 DIST ncurses-6.5.tar.gz.sig 438 BLAKE2B 5789b47932ec97d3863c7a65306369f0a36cb5b1a35c1e009b5174f50941edceafc22e6f07db3843a096773663a0ca602c0ecb9465e6042d9a78d76ae5008215 SHA512 96ce61a3d529e48e249acecbf4bb9eae2d9f2f67506e92ffa3182f5e98040c38babf0c2c15d92fc5d96e1181e72be1b29fdbff7bee859dfe2ae387f9b8883092
-DIST ncurses-6.5_p20241109-patches.tar.xz 63676 BLAKE2B 9981b740fcec18cc794074ccc93ae1dbe175e52449af2bddfd10a6fb1d5dfe9b545bd19fce5e601d2d85008425fd5cd6fc33042d7bcc854363b0642b9c880efe SHA512 076d2d39c46cf9236e5e65472e10182da2dffffa936c7567b11e23323d64f9739bb3818d4fdbdd75a14fd3f5b202dcdb7aaa6813afb5e303f81c094339824162
-DIST ncurses-6.5_p20250118-patches.tar.xz 64188 BLAKE2B 46ac7c8bcfb0ec4fb032ccff4ba0c57d15f925910eb4d108c626aba8fdecefd21660a05cf54a88a4668b50e489ce0a08526f978a0084c66b2105fc4d929fdfe5 SHA512 12ff29d5ec76487f8b368d481fc19d841e8ce6bc216ff614b6d6d543a1fa36020b403432c802665d99b7fb4f08ae863d7ac331e6e2d95ff86c719fdca383c3e2
 DIST ncurses-6.5_p20250301-patches.tar.xz 65224 BLAKE2B 9db65c728cc6d79e21b7673bb7700069cbf09287acfb65b23a65d607c3172835a9bf7df9a705d3a05b6197684bc7935e1cbed91bf18343c4fb8ebacf17e61dc1 SHA512 f5808f0c2fc1f6027678d8980a0cf598a64c9e85e1d72459dd712090c2dd24eb45261f35b025fd543aed56e903c658942c163b8fe8bace24a56fb8e9238da29e
 DIST ncurses-6.5_p20250531-patches.tar.xz 65304 BLAKE2B b696a473c34df2aa1fe8b03fcbd6dd4bffdc8620917c0651994037bf902526a0c0b2be843beee2dec543677a0289aea35dd7e9ba7161eaef2c5663b4f1e356a8 SHA512 cb638cd2fd7128a7245b95a686df0725cbe133b42d26bdebabe62f070eacc25545845ea09c44d6d73183776a0ad094ae7857e2079b6561f05d94b86730f355db
+DIST ncurses-6.5_p20250802-patches.tar.xz 64208 BLAKE2B a4e721225ac68590f6d5b492d5ec0a90b2637fe34bbe6bc3bf7eebfd6e295f430f71e63f36bb81db5864868e29d4acb62698dc01511048d929c745b752a95352 SHA512 40d9db23bc9b3baa0fac6bc380c47bc13bf2928796b6a0ab706f952dd6c39cba939e772f13b0323656b661f9006cd4d5dbde705db79a2bf28980c6f423ded374
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/files/ncurses-6.4-t64-1.patch b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/files/ncurses-6.4-t64-1.patch
deleted file mode 100644
index 8df982c371e..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/files/ncurses-6.4-t64-1.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff '--color=auto' -ruN ncurses-6.4.orig/aclocal.m4 ncurses-6.4/aclocal.m4
---- ncurses-6.4.orig/aclocal.m4	2024-08-29 20:47:34.978057133 +0000
-+++ ncurses-6.4/aclocal.m4	2024-08-29 20:48:57.809473044 +0000
-@@ -10139,7 +10139,7 @@
- 	cf_xopen_source="-D_SGI_SOURCE"
- 	cf_XOPEN_SOURCE=
- 	;;
--(linux*gnu|linux*gnuabi64|linux*gnuabin32|linux*gnueabi|linux*gnueabihf|linux*gnux32|uclinux*|gnu*|mint*|k*bsd*-gnu|cygwin|msys|mingw*|linux*uclibc)
-+(linux*gnu*|uclinux*|gnu*|mint*|k*bsd*-gnu|cygwin|msys|mingw*|linux*uclibc)
- 	CF_GNU_SOURCE($cf_XOPEN_SOURCE)
- 	;;
- (minix*)
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/files/ncurses-6.4-t64-2.patch b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/files/ncurses-6.4-t64-2.patch
deleted file mode 100644
index 5abdd5c610d..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/files/ncurses-6.4-t64-2.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff '--color=auto' -ruN ncurses-6.4.orig/configure ncurses-6.4/configure
---- ncurses-6.4.orig/configure	2024-08-29 20:50:18.321117225 +0000
-+++ ncurses-6.4/configure	2024-08-29 20:52:49.308328392 +0000
-@@ -10413,7 +10413,7 @@
- 	cf_xopen_source="-D_SGI_SOURCE"
- 	cf_XOPEN_SOURCE=
- 	;;
--(linux*gnu|linux*gnuabi64|linux*gnuabin32|linux*gnueabi|linux*gnueabihf|linux*gnux32|uclinux*|gnu*|mint*|k*bsd*-gnu|cygwin|msys|mingw*|linux*uclibc)
-+(linux*gnu*|uclinux*|gnu*|mint*|k*bsd*-gnu|cygwin|msys|mingw*|linux*uclibc)
- 
- cf_gnu_xopen_source=$cf_XOPEN_SOURCE
- 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.4_p20240414.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.4_p20240414.ebuild
deleted file mode 100644
index bf4152a97a8..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.4_p20240414.ebuild
+++ /dev/null
@@ -1,492 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# sys-libs/ncurses-compat can be bumped with sys-libs/ncurses as upstream
-# provide a configure option for the ABI version.
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/thomasdickey.asc
-inherit flag-o-matic toolchain-funcs multilib multilib-minimal preserve-libs usr-ldscript verify-sig
-
-MY_PV="${PV:0:3}"
-MY_P="${PN}-${MY_PV}"
-DESCRIPTION="Console display library"
-HOMEPAGE="https://www.gnu.org/software/ncurses/ https://invisible-island.net/ncurses/"
-# Keep invisible-mirror.net here as some users reported 403 forbidden with invisible-island.net
-SRC_URI="
-	mirror://gnu/ncurses/${MY_P}.tar.gz
-	https://invisible-island.net/archives/${PN}/${MY_P}.tar.gz
-	https://invisible-mirror.net/archives/${PN}/${MY_P}.tar.gz
-	verify-sig? ( mirror://gnu/ncurses/${MY_P}.tar.gz.sig )
-"
-
-GENTOO_PATCH_DEV=sam
-GENTOO_PATCH_PV=6.4_p20240413
-GENTOO_PATCH_NAME=${PN}-${GENTOO_PATCH_PV}-patches
-
-# Populated below in a loop. Do not add patches manually here.
-UPSTREAM_PATCHES=()
-
-if [[ ${PV} == *_p* ]] ; then
-	# Sometimes, after releases, there's no megapatch available yet.
-	#
-	# From upstream README at e.g. https://invisible-island.net/archives/ncurses/6.3/:
-	#
-	#	"At times (generally to mark a relatively stable point), I create a rollup
-	#	patch, which consists of all changes from the release through the current date."
-	#
-	# Also, from https://lists.gnu.org/archive/html/bug-ncurses/2019-08/msg00039.html,
-	# the patches are considered to be acceptable to use after some testing. They
-	# are both for development but also bug fixes.
-	#
-	# This array should contain a list of all the snapshots since the last
-	# release if there's no megapatch available yet.
-	PATCH_DATES=(
-		20230107
-		20230114
-		20230121
-		20230128
-		20230211
-		20230218
-		20230225
-		20230311
-		20230401
-		20230408
-		20230415
-		20230418
-		20230423
-		20230424
-		20230429
-		20230506
-		20230514
-		20230520
-		20230527
-		20230603
-		20230610
-		20230615
-		20230617
-		20230624
-		20230625
-		20230701
-		20230708
-		20230715
-		20230722
-		20230729
-		20230805
-		20230812
-		20230819
-		20230826
-		20230902
-		20230909
-		20230917
-		20230918
-		20230923
-		20231001
-		20231007
-		20231014
-		20231016
-		20231021
-		20231028
-		20231104
-		20231111
-		20231118
-		20231121
-		20231125
-		20231202
-		20231209
-		20231217
-		20231223
-		20231230
-		20240106
-		20240113
-		20240120
-		20240127
-		20240203
-		20240210
-		20240217
-		20240224
-		20240302
-		20240309
-		20240323
-		20240330
-		20240413
-
-		# Latest patch is just _pN = $(ver_cut 4)
-		$(ver_cut 4)
-	)
-
-	if [[ -z ${PATCH_DATES[@]} ]] ; then
-		SRC_URI+=" https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P/_p/-}.patch.sh.gz"
-		SRC_URI+=" verify-sig? ( https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P/_p/-}.patch.sh.gz.asc"
-
-		# If we have a rollup patch, use that instead of the individual ones.
-		UPSTREAM_PATCHES+=( patch.sh )
-	else
-		# We use a mirror as well because we've had reports of 403 forbidden for some users.
-		upstream_url_base="https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P}-"
-		upstream_m_url_base="https://invisible-mirror.net/archives/${PN}/${PV/_p*}/${MY_P}-"
-
-		# Prefix each date with the upstream location (https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P})
-		mangled_patches=( "${PATCH_DATES[@]/#/${upstream_url_base}}" )
-		# Suffix each with .patch.gz
-		mangled_patches=( "${mangled_patches[@]/%/.patch.gz}" )
-		mangled_patches_sig=( "${mangled_patches[@]/%/.asc}" )
-		# Repeat for .patch.gz.asc for verify-sig
-		SRC_URI+=" ${mangled_patches[@]}"
-		SRC_URI+=" verify-sig? ( ${mangled_patches_sig[@]} )"
-
-		# For all of the URLs, chuck in invisible-island.net too:
-		SRC_URI+=" ${mangled_patches[@]/${upstream_url_base}/${upstream_m_url_base}}"
-		SRC_URI+=" verify-sig? ( ${mangled_patches_sig[@]/${upstream_url_base}/${upstream_m_url_base}} )"
-
-		UPSTREAM_PATCHES=( "${PATCH_DATES[@]/%/.patch}" )
-
-		unset upstream_url_base upstream_m_url_base mangled_patches mangled_patches_sig
-	fi
-fi
-
-SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${GENTOO_PATCH_NAME}.tar.xz"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="MIT"
-# The subslot reflects the SONAME.
-SLOT="0/6"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="ada +cxx debug doc gpm minimal profile split-usr +stack-realign static-libs test tinfo trace"
-RESTRICT="!test? ( test )"
-
-DEPEND="gpm? ( sys-libs/gpm[${MULTILIB_USEDEP}] )"
-# Block the older ncurses that installed all files w/SLOT=5, bug #557472
-RDEPEND="
-	${DEPEND}
-	!<=sys-libs/ncurses-5.9-r4:5
-	!<sys-libs/slang-2.3.2_pre23
-	!<x11-terms/rxvt-unicode-9.06-r3
-	!<x11-terms/st-0.6-r1
-"
-BDEPEND="verify-sig? ( sec-keys/openpgp-keys-thomasdickey )"
-
-PATCHES=(
-	"${UPSTREAM_PATCHES[@]/#/${WORKDIR}/${MY_P}-}"
-
-	# When rebasing Gentoo's patchset, please use git from a clean
-	# src_prepare with upstream patches already applied. git am --reject
-	# the existing patchset and rebase as required. This makes it easier
-	# to manage future rebasing & adding new patches.
-	#
-	# For the same reasons, please include the original configure.in changes,
-	# NOT just the generated results!
-	"${WORKDIR}"/${GENTOO_PATCH_NAME}
-
-	# Avoid breakage with CHOST ending in t64
-	"${FILESDIR}"/ncurses-6.4-t64-1.patch
-	"${FILESDIR}"/ncurses-6.4-t64-2.patch
-)
-
-src_unpack() {
-	# Avoid trying to verify our own patchset tarball, there's no point
-	if use verify-sig ; then
-		local file
-		for file in ${A} ; do
-			if [[ ${file} == ${MY_P}.tar.gz ]] ; then
-				verify-sig_verify_detached "${DISTDIR}"/${file} "${DISTDIR}"/${file}.sig
-			else
-				[[ ${file} == @(*${GENTOO_PATCH_NAME}.tar.xz|*.asc|*.sig) ]] && continue
-
-				verify-sig_verify_detached "${DISTDIR}"/${file} "${DISTDIR}"/${file}.asc
-			fi
-		done
-	fi
-
-	default
-}
-
-src_configure() {
-	# bug #115036
-	unset TERMINFO
-
-	tc-export_build_env BUILD_{CC,CXX,CPP}
-
-	# bug #214642
-	BUILD_CPPFLAGS+=" -D_GNU_SOURCE"
-
-	# Build the various variants of ncurses -- narrow, wide, and threaded. #510440
-	# Order matters here -- we want unicode/thread versions to come last so that the
-	# binaries in /usr/bin support both wide and narrow.
-	# The naming is also important as we use these directly with filenames and when
-	# checking configure flags.
-	NCURSES_TARGETS=(
-		ncurses
-		ncursesw
-		ncursest
-		ncursestw
-	)
-
-	# When installing ncurses, we have to use a compatible version of tic.
-	# This comes up when cross-compiling, doing multilib builds, upgrading,
-	# or installing for the first time.  Build a local copy of tic whenever
-	# the host version isn't available. bug #249363, bug #557598
-	if ! has_version -b "~sys-libs/${P}:0" ; then
-		local lbuildflags="-static"
-
-		# some toolchains don't quite support static linking
-		local dbuildflags="-Wl,-rpath,${WORKDIR}/lib"
-		case ${CHOST} in
-			*-darwin*)  dbuildflags=     ;;
-			*-solaris*) dbuildflags="-Wl,-R,${WORKDIR}/lib" ;;
-		esac
-		echo "int main() {}" | \
-			$(tc-getCC) -o x -x c - ${lbuildflags} -pipe >& /dev/null \
-			|| lbuildflags="${dbuildflags}"
-
-		# We can't re-use the multilib BUILD_DIR because we run outside of it.
-		BUILD_DIR="${WORKDIR}" \
-		CC=${BUILD_CC} \
-		CXX=${BUILD_CXX} \
-		CPP=${BUILD_CPP} \
-		CHOST=${CBUILD} \
-		CFLAGS=${BUILD_CFLAGS} \
-		CXXFLAGS=${BUILD_CXXFLAGS} \
-		CPPFLAGS=${BUILD_CPPFLAGS} \
-		LDFLAGS="${BUILD_LDFLAGS} ${lbuildflags}" \
-		do_configure cross --without-shared --with-normal --with-progs --without-ada
-	fi
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	if [[ ${ABI} == x86 ]] ; then
-		# For compatibility with older binaries at slight performance cost.
-		# bug #616402
-		use stack-realign && append-flags -mstackrealign
-	fi
-
-	local t
-	for t in "${NCURSES_TARGETS[@]}" ; do
-		do_configure "${t}"
-	done
-}
-
-do_configure() {
-	local target=$1
-	shift
-
-	mkdir "${BUILD_DIR}/${target}" || die
-	cd "${BUILD_DIR}/${target}" || die
-
-	local conf=(
-		# We need the basic terminfo files in /etc, bug #37026.  We will
-		# add '--with-terminfo-dirs' and then populate /etc/terminfo in
-		# src_install() ...
-		--with-terminfo-dirs="${EPREFIX}/etc/terminfo:${EPREFIX}/usr/share/terminfo"
-
-		# Enable installation of .pc files.
-		--enable-pc-files
-		# This path is used to control where the .pc files are installed.
-		--with-pkg-config-libdir="${EPREFIX}/usr/$(get_libdir)/pkgconfig"
-
-		# Now the rest of the various standard flags.
-		--with-shared
-		# (Originally disabled until bug #245417 is sorted out, but now
-		# just keeping it off for good, given nobody needed it until now
-		# (2022) and we're trying to phase out bdb.)
-		--without-hashed-db
-		$(use_with ada)
-		$(use_with cxx)
-		$(use_with cxx cxx-binding)
-		--with-cxx-shared
-		$(use_with debug)
-		$(use_with profile)
-		# The configure script uses ldd to parse the linked output which
-		# is flaky for cross-compiling/multilib/ldd versions/etc...
-		$(use_with gpm gpm libgpm.so.1)
-		--disable-term-driver
-		--disable-termcap
-		--enable-symlinks
-		--with-manpage-format=normal
-		--enable-const
-		--enable-colorfgbg
-		--enable-hard-tabs
-		--enable-echo
-		$(use_enable !ada warnings)
-		$(use_with debug assertions)
-		$(use_enable !debug leaks)
-		$(use_with debug expanded)
-		$(use_with !debug macros)
-		$(multilib_native_with progs)
-		$(use_with test tests)
-		$(use_with trace)
-		$(use_with tinfo termlib)
-		--disable-stripping
-		--disable-pkg-ldflags
-	)
-
-	if [[ ${target} == ncurses*w ]] ; then
-		conf+=( --enable-widec )
-	else
-		conf+=( --disable-widec )
-	fi
-	if [[ ${target} == ncursest* ]] ; then
-		conf+=( --with-{pthread,reentrant} )
-	else
-		conf+=(
-			--without-{pthread,reentrant}
-
-			# XXX: Revisit on next ABI break (>6) (bug #928873)
-			--disable-opaque-curses
-			--disable-opaque-form
-			--disable-opaque-menu
-			--disable-opaque-panel
-		)
-	fi
-
-	# Make sure each variant goes in a unique location.
-	if [[ ${target} == "ncurses" ]] ; then
-		# "ncurses" variant goes into "${EPREFIX}"/usr/include
-		# It is needed on Prefix because the configure script appends
-		# "ncurses" to "${prefix}/include" if "${prefix}" is not /usr.
-		conf+=( --enable-overwrite )
-	else
-		conf+=( --includedir="${EPREFIX}"/usr/include/${target} )
-	fi
-	# See comments in src_configure.
-	if [[ ${target} != "cross" ]] ; then
-		local cross_path="${WORKDIR}/cross"
-		[[ -d ${cross_path} ]] && export TIC_PATH="${cross_path}/progs/tic"
-	fi
-
-	ECONF_SOURCE="${S}" econf "${conf[@]}" "$@"
-}
-
-src_compile() {
-	# See comments in src_configure.
-	if ! has_version -b "~sys-libs/${P}:0" ; then
-		BUILD_DIR="${WORKDIR}" do_compile cross -C progs tic$(get_exeext)
-	fi
-
-	multilib-minimal_src_compile
-}
-
-multilib_src_compile() {
-	local t
-	for t in "${NCURSES_TARGETS[@]}" ; do
-		do_compile "${t}"
-	done
-}
-
-do_compile() {
-	local target=$1
-	shift
-
-	cd "${BUILD_DIR}/${target}" || die
-
-	# A little hack to fix parallel builds ... they break when
-	# generating sources so if we generate the sources first (in
-	# non-parallel), we can then build the rest of the package
-	# in parallel.  This is not really a perf hit since the source
-	# generation is quite small.
-	emake -j1 sources
-
-	# For some reason, sources depends on pc-files which depends on
-	# compiled libraries which depends on sources which ...
-	# Manually delete the pc-files file so the install step will
-	# create the .pc files we want.
-	rm -f misc/pc-files || die
-	emake "$@"
-}
-
-multilib_src_install() {
-	local target
-	for target in "${NCURSES_TARGETS[@]}" ; do
-		emake -C "${BUILD_DIR}/${target}" DESTDIR="${D}" install
-	done
-
-	# Move main libraries into /.
-	if multilib_is_native_abi ; then
-		gen_usr_ldscript -a \
-			"${NCURSES_TARGETS[@]}" \
-			$(usex tinfo 'tinfow tinfo' '')
-	fi
-
-	# Don't delete '*.dll.a', needed for linking, bug #631468
-	if ! use static-libs; then
-		find "${ED}"/usr/ -name '*.a' ! -name '*.dll.a' -delete || die
-	fi
-
-	# Build fails to create this ...
-	# -FIXME-
-	# Ugly hackaround for riscv having two parts libdir (bug #689240)
-	# Replace this hack with an official solution once we have one...
-	# -FIXME-
-	dosym $(sed 's@[^/]\+@..@g' <<< $(get_libdir))/share/terminfo \
-		/usr/$(get_libdir)/terminfo
-
-	# Remove obsolete libcurses symlink that is created by the build
-	# system. Technically, this could be also achieved
-	# via --disable-overwrite but it also moves headers implicitly,
-	# and we do not want to do this yet.
-	# bug #836696
-	rm "${ED}"/usr/$(get_libdir)/libcurses* || die
-}
-
-multilib_src_install_all() {
-	local terms=(
-		# Dumb/simple values that show up when using the in-kernel VT.
-		ansi console dumb linux
-		vt{52,100,102,200,220}
-		# [u]rxvt users used to be pretty common.  Probably should drop this
-		# since upstream is dead and people are moving away from it.
-		rxvt{,-unicode}{,-256color}
-		# xterm users are common, as is terminals re-using/spoofing it.
-		xterm xterm-{,256}color
-		# screen is common (and reused by tmux).
-		screen{,-256color}
-		screen.xterm-256color
-	)
-	if use split-usr ; then
-		local x
-		# We need the basic terminfo files in /etc for embedded/recovery, bug #37026
-		einfo "Installing basic terminfo files in /etc..."
-		for x in "${terms[@]}"; do
-			local termfile=$(find "${ED}"/usr/share/terminfo/ -name "${x}" 2>/dev/null)
-			local basedir=$(basename "$(dirname "${termfile}")")
-
-			if [[ -n ${termfile} ]] ; then
-				dodir "/etc/terminfo/${basedir}"
-				mv "${termfile}" "${ED}/etc/terminfo/${basedir}/" || die
-				dosym "../../../../etc/terminfo/${basedir}/${x}" \
-					"/usr/share/terminfo/${basedir}/${x}"
-			fi
-		done
-
-		echo "CONFIG_PROTECT_MASK=\"/etc/terminfo\"" | newenvd - 50ncurses
-
-		use minimal && rm -r "${ED}"/usr/share/terminfo*
-		# Because ncurses5-config --terminfo returns the directory we keep it
-		# bug #245374
-		keepdir /usr/share/terminfo
-	elif use minimal ; then
-		# Keep only the basic terminfo files
-		find "${ED}"/usr/share/terminfo/ \
-			\( -type f -o -type l \) ${terms[*]/#/! -name } -delete , \
-			-type d -empty -delete || die
-	fi
-
-	cd "${S}" || die
-	dodoc ANNOUNCE MANIFEST NEWS README* TO-DO doc/*.doc
-	if use doc ; then
-		docinto html
-		dodoc -r doc/html/
-	fi
-}
-
-pkg_preinst() {
-	preserve_old_lib /$(get_libdir)/libncurses.so.5
-	preserve_old_lib /$(get_libdir)/libncursesw.so.5
-}
-
-pkg_postinst() {
-	preserve_old_lib_notify /$(get_libdir)/libncurses.so.5
-	preserve_old_lib_notify /$(get_libdir)/libncursesw.so.5
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20241109.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20241109.ebuild
deleted file mode 100644
index 373f1c811b3..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20241109.ebuild
+++ /dev/null
@@ -1,460 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# sys-libs/ncurses-compat can be bumped with sys-libs/ncurses as upstream
-# provide a configure option for the ABI version.
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/thomasdickey.asc
-inherit flag-o-matic toolchain-funcs multilib multilib-minimal preserve-libs usr-ldscript verify-sig
-
-MY_PV="${PV:0:3}"
-MY_P="${PN}-${MY_PV}"
-DESCRIPTION="Console display library"
-HOMEPAGE="https://www.gnu.org/software/ncurses/ https://invisible-island.net/ncurses/"
-# Keep invisible-mirror.net here as some users reported 403 forbidden with invisible-island.net
-SRC_URI="
-	mirror://gnu/ncurses/${MY_P}.tar.gz
-	https://invisible-island.net/archives/${PN}/${MY_P}.tar.gz
-	https://invisible-mirror.net/archives/${PN}/${MY_P}.tar.gz
-	verify-sig? ( mirror://gnu/ncurses/${MY_P}.tar.gz.sig )
-"
-
-GENTOO_PATCH_DEV=sam
-GENTOO_PATCH_PV=6.5_p20241109
-GENTOO_PATCH_NAME=${PN}-${GENTOO_PATCH_PV}-patches
-
-# Populated below in a loop. Do not add patches manually here.
-UPSTREAM_PATCHES=()
-
-if [[ ${PV} == *_p* ]] ; then
-	# Sometimes, after releases, there's no megapatch available yet.
-	#
-	# From upstream README at e.g. https://invisible-island.net/archives/ncurses/6.3/:
-	#
-	#	"At times (generally to mark a relatively stable point), I create a rollup
-	#	patch, which consists of all changes from the release through the current date."
-	#
-	# Also, from https://lists.gnu.org/archive/html/bug-ncurses/2019-08/msg00039.html,
-	# the patches are considered to be acceptable to use after some testing. They
-	# are both for development but also bug fixes.
-	#
-	# This array should contain a list of all the snapshots since the last
-	# release if there's no megapatch available yet.
-	PATCH_DATES=(
-		20240504
-		20240511
-		20240518
-		20240519
-		20240525
-		20240601
-		20240608
-		20240615
-		20240622
-		20240629
-		20240706
-		20240713
-		20240720
-		20240727
-		20240810
-		20240817
-		20240824
-		20240831
-		20240914
-		20240922
-		20240928
-		20241006
-		20241019
-		20241026
-		20241102
-
-		# Latest patch is just _pN = $(ver_cut 4)
-		$(ver_cut 4)
-	)
-
-	if [[ -z ${PATCH_DATES[@]} ]] ; then
-		SRC_URI+=" https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P/_p/-}.patch.sh.gz"
-		SRC_URI+=" verify-sig? ( https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P/_p/-}.patch.sh.gz.asc"
-
-		# If we have a rollup patch, use that instead of the individual ones.
-		UPSTREAM_PATCHES+=( patch.sh )
-	else
-		# We use a mirror as well because we've had reports of 403 forbidden for some users.
-		upstream_url_base="https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P}-"
-		upstream_m_url_base="https://invisible-mirror.net/archives/${PN}/${PV/_p*}/${MY_P}-"
-
-		# Prefix each date with the upstream location (https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P})
-		mangled_patches=( "${PATCH_DATES[@]/#/${upstream_url_base}}" )
-		# Suffix each with .patch.gz
-		mangled_patches=( "${mangled_patches[@]/%/.patch.gz}" )
-		mangled_patches_sig=( "${mangled_patches[@]/%/.asc}" )
-		# Repeat for .patch.gz.asc for verify-sig
-		SRC_URI+=" ${mangled_patches[@]}"
-		SRC_URI+=" verify-sig? ( ${mangled_patches_sig[@]} )"
-
-		# For all of the URLs, chuck in invisible-island.net too:
-		SRC_URI+=" ${mangled_patches[@]/${upstream_url_base}/${upstream_m_url_base}}"
-		SRC_URI+=" verify-sig? ( ${mangled_patches_sig[@]/${upstream_url_base}/${upstream_m_url_base}} )"
-
-		UPSTREAM_PATCHES=( "${PATCH_DATES[@]/%/.patch}" )
-
-		unset upstream_url_base upstream_m_url_base mangled_patches mangled_patches_sig
-	fi
-fi
-
-SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${GENTOO_PATCH_NAME}.tar.xz"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="MIT"
-# The subslot reflects the SONAME.
-SLOT="0/6"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="ada +cxx debug doc gpm minimal profile split-usr +stack-realign static-libs test tinfo trace"
-RESTRICT="!test? ( test )"
-
-# TODO: ncurses allows (and we take advantage of this, even) passing
-# the SONAME for dlopen() use, so only the header is needed at build time.
-# Maybe we should bundle a copy of gpm.h so we can move gpm to PDEPEND
-# which would be far nicer UX-wise.
-DEPEND="gpm? ( sys-libs/gpm[${MULTILIB_USEDEP}] )"
-# Block the older ncurses that installed all files w/SLOT=5, bug #557472
-RDEPEND="
-	${DEPEND}
-	!<=sys-libs/ncurses-5.9-r4:5
-	!<sys-libs/slang-2.3.2_pre23
-	!<x11-terms/rxvt-unicode-9.06-r3
-	!<x11-terms/st-0.6-r1
-"
-BDEPEND="verify-sig? ( sec-keys/openpgp-keys-thomasdickey )"
-
-PATCHES=(
-	"${UPSTREAM_PATCHES[@]/#/${WORKDIR}/${MY_P}-}"
-
-	# When rebasing Gentoo's patchset, please use git from a clean
-	# src_prepare with upstream patches already applied. git am --reject
-	# the existing patchset and rebase as required. This makes it easier
-	# to manage future rebasing & adding new patches.
-	#
-	# For the same reasons, please include the original configure.in changes,
-	# NOT just the generated results!
-	"${WORKDIR}"/${GENTOO_PATCH_NAME}
-)
-
-src_unpack() {
-	# Avoid trying to verify our own patchset tarball, there's no point
-	if use verify-sig ; then
-		local file
-		for file in ${A} ; do
-			if [[ ${file} == ${MY_P}.tar.gz ]] ; then
-				verify-sig_verify_detached "${DISTDIR}"/${file} "${DISTDIR}"/${file}.sig
-			else
-				[[ ${file} == @(*${GENTOO_PATCH_NAME}.tar.xz|*.asc|*.sig) ]] && continue
-
-				verify-sig_verify_detached "${DISTDIR}"/${file} "${DISTDIR}"/${file}.asc
-			fi
-		done
-	fi
-
-	default
-}
-
-src_configure() {
-	# bug #115036
-	unset TERMINFO
-
-	tc-export_build_env BUILD_{CC,CXX,CPP}
-
-	# bug #214642
-	BUILD_CPPFLAGS+=" -D_GNU_SOURCE"
-
-	# NCURSES_BOOL confusion, see https://lists.gnu.org/archive/html/bug-ncurses/2024-11/msg00010.html
-	append-cflags $(test-flags-CC -std=gnu17)
-
-	# Build the various variants of ncurses -- narrow, wide, and threaded. #510440
-	# Order matters here -- we want unicode/thread versions to come last so that the
-	# binaries in /usr/bin support both wide and narrow.
-	# The naming is also important as we use these directly with filenames and when
-	# checking configure flags.
-	NCURSES_TARGETS=(
-		ncurses
-		ncursesw
-		ncursest
-		ncursestw
-	)
-
-	# When installing ncurses, we have to use a compatible version of tic.
-	# This comes up when cross-compiling, doing multilib builds, upgrading,
-	# or installing for the first time.  Build a local copy of tic whenever
-	# the host version isn't available. bug #249363, bug #557598
-	if ! has_version -b "~sys-libs/${P}:0" ; then
-		local lbuildflags="-static"
-
-		# some toolchains don't quite support static linking
-		local dbuildflags="-Wl,-rpath,${WORKDIR}/lib"
-		case ${CHOST} in
-			*-darwin*)  dbuildflags=     ;;
-			*-solaris*) dbuildflags="-Wl,-R,${WORKDIR}/lib" ;;
-		esac
-		echo "int main() {}" | \
-			$(tc-getCC) -o x -x c - ${lbuildflags} -pipe >& /dev/null \
-			|| lbuildflags="${dbuildflags}"
-
-		# We can't re-use the multilib BUILD_DIR because we run outside of it.
-		BUILD_DIR="${WORKDIR}" \
-		CC=${BUILD_CC} \
-		CXX=${BUILD_CXX} \
-		CPP=${BUILD_CPP} \
-		CHOST=${CBUILD} \
-		CFLAGS=${BUILD_CFLAGS} \
-		CXXFLAGS=${BUILD_CXXFLAGS} \
-		CPPFLAGS=${BUILD_CPPFLAGS} \
-		LDFLAGS="${BUILD_LDFLAGS} ${lbuildflags}" \
-		do_configure cross --without-shared --with-normal --with-progs --without-ada
-	fi
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	if [[ ${ABI} == x86 ]] ; then
-		# For compatibility with older binaries at slight performance cost.
-		# bug #616402
-		use stack-realign && append-flags -mstackrealign
-	fi
-
-	local t
-	for t in "${NCURSES_TARGETS[@]}" ; do
-		do_configure "${t}"
-	done
-}
-
-do_configure() {
-	local target=$1
-	shift
-
-	mkdir "${BUILD_DIR}/${target}" || die
-	cd "${BUILD_DIR}/${target}" || die
-
-	local conf=(
-		# We need the basic terminfo files in /etc, bug #37026.  We will
-		# add '--with-terminfo-dirs' and then populate /etc/terminfo in
-		# src_install() ...
-		--with-terminfo-dirs="${EPREFIX}/etc/terminfo:${EPREFIX}/usr/share/terminfo"
-
-		# Enable installation of .pc files.
-		--enable-pc-files
-		# This path is used to control where the .pc files are installed.
-		--with-pkg-config-libdir="${EPREFIX}/usr/$(get_libdir)/pkgconfig"
-
-		# Now the rest of the various standard flags.
-		--with-shared
-		--enable-fvisibility
-		# (Originally disabled until bug #245417 is sorted out, but now
-		# just keeping it off for good, given nobody needed it until now
-		# (2022) and we're trying to phase out bdb.)
-		--without-hashed-db
-		$(use_with ada)
-		$(use_with cxx)
-		$(use_with cxx cxx-binding)
-		--with-cxx-shared
-		$(use_with debug)
-		$(use_with profile)
-		# The configure script uses ldd to parse the linked output which
-		# is flaky for cross-compiling/multilib/ldd versions/etc...
-		$(use_with gpm gpm libgpm.so.1)
-
-		# bug #930806
-		--disable-setuid-environ
-		# TODO: Maybe do these for USE=hardened
-		#--disable-root-access
-		#--disable-root-environ
-
-		--disable-termcap
-		--enable-symlinks
-		--with-manpage-format=normal
-		--enable-const
-		--enable-colorfgbg
-		--enable-hard-tabs
-		--enable-echo
-		$(use_enable !ada warnings)
-		$(use_with debug assertions)
-		$(use_enable !debug leaks)
-		$(use_with debug expanded)
-		$(use_with !debug macros)
-		$(multilib_native_with progs)
-		$(use_with test tests)
-		$(use_with trace)
-		$(use_with tinfo termlib)
-		--disable-stripping
-		--disable-pkg-ldflags
-	)
-
-	case ${CHOST} in
-		*-mingw32*)
-			conf+=( --enable-term-driver )
-			;;
-		*)
-			conf+=( --disable-term-driver )
-			;;
-	esac
-
-	if [[ ${target} == ncurses*w ]] ; then
-		conf+=( --enable-widec )
-	else
-		conf+=( --disable-widec )
-	fi
-	if [[ ${target} == ncursest* ]] ; then
-		conf+=( --with-{pthread,reentrant} )
-	else
-		conf+=( --without-{pthread,reentrant} )
-	fi
-
-	# Make sure each variant goes in a unique location.
-	if [[ ${target} == "ncurses" ]] ; then
-		# "ncurses" variant goes into "${EPREFIX}"/usr/include
-		# It is needed on Prefix because the configure script appends
-		# "ncurses" to "${prefix}/include" if "${prefix}" is not /usr.
-		conf+=( --enable-overwrite )
-	else
-		conf+=( --includedir="${EPREFIX}"/usr/include/${target} )
-	fi
-	# See comments in src_configure.
-	if [[ ${target} != "cross" ]] ; then
-		local cross_path="${WORKDIR}/cross"
-		[[ -d ${cross_path} ]] && export TIC_PATH="${cross_path}/progs/tic"
-	fi
-
-	ECONF_SOURCE="${S}" econf "${conf[@]}" "$@"
-}
-
-src_compile() {
-	# See comments in src_configure.
-	if ! has_version -b "~sys-libs/${P}:0" ; then
-		BUILD_DIR="${WORKDIR}" do_compile cross -C progs tic$(get_exeext)
-	fi
-
-	multilib-minimal_src_compile
-}
-
-multilib_src_compile() {
-	local t
-	for t in "${NCURSES_TARGETS[@]}" ; do
-		do_compile "${t}"
-	done
-}
-
-do_compile() {
-	local target=$1
-	shift
-
-	cd "${BUILD_DIR}/${target}" || die
-
-	# A little hack to fix parallel builds ... they break when
-	# generating sources so if we generate the sources first (in
-	# non-parallel), we can then build the rest of the package
-	# in parallel.  This is not really a perf hit since the source
-	# generation is quite small.
-	emake -j1 sources
-
-	# For some reason, sources depends on pc-files which depends on
-	# compiled libraries which depends on sources which ...
-	# Manually delete the pc-files file so the install step will
-	# create the .pc files we want.
-	rm -f misc/pc-files || die
-	emake "$@"
-}
-
-multilib_src_install() {
-	local target
-	for target in "${NCURSES_TARGETS[@]}" ; do
-		emake -C "${BUILD_DIR}/${target}" DESTDIR="${D}" install
-	done
-
-	# Move main libraries into /.
-	if multilib_is_native_abi ; then
-		gen_usr_ldscript -a \
-			"${NCURSES_TARGETS[@]}" \
-			$(usex tinfo 'tinfow tinfo' '')
-	fi
-
-	# Don't delete '*.dll.a', needed for linking, bug #631468
-	if ! use static-libs; then
-		find "${ED}"/usr/ -name '*.a' ! -name '*.dll.a' -delete || die
-	fi
-
-	# Build fails to create this ...
-	# -FIXME-
-	# Ugly hackaround for riscv having two parts libdir (bug #689240)
-	# Replace this hack with an official solution once we have one...
-	# -FIXME-
-	dosym $(sed 's@[^/]\+@..@g' <<< $(get_libdir))/share/terminfo \
-		/usr/$(get_libdir)/terminfo
-
-	# Remove obsolete libcurses symlink that is created by the build
-	# system. Technically, this could be also achieved
-	# via --disable-overwrite but it also moves headers implicitly,
-	# and we do not want to do this yet.
-	# bug #836696
-	rm "${ED}"/usr/$(get_libdir)/libcurses* || die
-}
-
-multilib_src_install_all() {
-	local terms=(
-		# Dumb/simple values that show up when using the in-kernel VT.
-		ansi console dumb linux
-		vt{52,100,102,200,220}
-		# [u]rxvt users used to be pretty common.  Probably should drop this
-		# since upstream is dead and people are moving away from it.
-		rxvt{,-unicode}{,-256color}
-		# xterm users are common, as is terminals re-using/spoofing it.
-		xterm xterm-{,256}color
-		# screen is common (and reused by tmux).
-		screen{,-256color}
-		screen.xterm-256color
-	)
-	if use split-usr ; then
-		local x
-		# We need the basic terminfo files in /etc for embedded/recovery, bug #37026
-		einfo "Installing basic terminfo files in /etc..."
-		for x in "${terms[@]}"; do
-			local termfile=$(find "${ED}"/usr/share/terminfo/ -name "${x}" 2>/dev/null)
-			local basedir=$(basename "$(dirname "${termfile}")")
-
-			if [[ -n ${termfile} ]] ; then
-				dodir "/etc/terminfo/${basedir}"
-				mv "${termfile}" "${ED}/etc/terminfo/${basedir}/" || die
-				dosym "../../../../etc/terminfo/${basedir}/${x}" \
-					"/usr/share/terminfo/${basedir}/${x}"
-			fi
-		done
-
-		echo "CONFIG_PROTECT_MASK=\"/etc/terminfo\"" | newenvd - 50ncurses
-
-		use minimal && rm -r "${ED}"/usr/share/terminfo*
-		# Because ncurses5-config --terminfo returns the directory we keep it
-		# bug #245374
-		keepdir /usr/share/terminfo
-	elif use minimal ; then
-		# Keep only the basic terminfo files
-		find "${ED}"/usr/share/terminfo/ \
-			\( -type f -o -type l \) ${terms[*]/#/! -name } -delete , \
-			-type d -empty -delete || die
-	fi
-
-	cd "${S}" || die
-	dodoc ANNOUNCE MANIFEST NEWS README* TO-DO doc/*.doc
-	if use doc ; then
-		docinto html
-		dodoc -r doc/html/
-	fi
-}
-
-pkg_preinst() {
-	preserve_old_lib /$(get_libdir)/libncurses.so.5
-	preserve_old_lib /$(get_libdir)/libncursesw.so.5
-}
-
-pkg_postinst() {
-	preserve_old_lib_notify /$(get_libdir)/libncurses.so.5
-	preserve_old_lib_notify /$(get_libdir)/libncursesw.so.5
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250125.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250125.ebuild
deleted file mode 100644
index fd177aa7fa0..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250125.ebuild
+++ /dev/null
@@ -1,474 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# sys-libs/ncurses-compat can be bumped with sys-libs/ncurses as upstream
-# provide a configure option for the ABI version.
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/thomasdickey.asc
-inherit flag-o-matic toolchain-funcs multilib multilib-minimal preserve-libs usr-ldscript verify-sig
-
-MY_PV="${PV:0:3}"
-MY_P="${PN}-${MY_PV}"
-DESCRIPTION="Console display library"
-HOMEPAGE="https://www.gnu.org/software/ncurses/ https://invisible-island.net/ncurses/"
-# Keep invisible-mirror.net here as some users reported 403 forbidden with invisible-island.net
-SRC_URI="
-	mirror://gnu/ncurses/${MY_P}.tar.gz
-	https://invisible-island.net/archives/${PN}/${MY_P}.tar.gz
-	https://invisible-mirror.net/archives/${PN}/${MY_P}.tar.gz
-	verify-sig? ( mirror://gnu/ncurses/${MY_P}.tar.gz.sig )
-"
-
-GENTOO_PATCH_DEV=sam
-GENTOO_PATCH_PV=6.5_p20250118
-GENTOO_PATCH_NAME=${PN}-${GENTOO_PATCH_PV}-patches
-
-# Populated below in a loop. Do not add patches manually here.
-UPSTREAM_PATCHES=()
-
-if [[ ${PV} == *_p* ]] ; then
-	# Sometimes, after releases, there's no megapatch available yet.
-	#
-	# From upstream README at e.g. https://invisible-island.net/archives/ncurses/6.3/:
-	#
-	#	"At times (generally to mark a relatively stable point), I create a rollup
-	#	patch, which consists of all changes from the release through the current date."
-	#
-	# Also, from https://lists.gnu.org/archive/html/bug-ncurses/2019-08/msg00039.html,
-	# the patches are considered to be acceptable to use after some testing. They
-	# are both for development but also bug fixes.
-	#
-	# This array should contain a list of all the snapshots since the last
-	# release if there's no megapatch available yet.
-	PATCH_DATES=(
-		20240504
-		20240511
-		20240518
-		20240519
-		20240525
-		20240601
-		20240608
-		20240615
-		20240622
-		20240629
-		20240706
-		20240713
-		20240720
-		20240727
-		20240810
-		20240817
-		20240824
-		20240831
-		20240914
-		20240922
-		20240928
-		20241006
-		20241019
-		20241026
-		20241102
-		20241109
-		20241123
-		20241130
-		20241207
-		20241214
-		20241221
-		20241228
-		20250104
-		20250111
-		20250118
-
-		# Latest patch is just _pN = $(ver_cut 4)
-		$(ver_cut 4)
-	)
-
-	if [[ -z ${PATCH_DATES[@]} ]] ; then
-		SRC_URI+=" https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P/_p/-}.patch.sh.gz"
-		SRC_URI+=" verify-sig? ( https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P/_p/-}.patch.sh.gz.asc"
-
-		# If we have a rollup patch, use that instead of the individual ones.
-		UPSTREAM_PATCHES+=( patch.sh )
-	else
-		# We use a mirror as well because we've had reports of 403 forbidden for some users.
-		upstream_url_base="https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P}-"
-		upstream_m_url_base="https://invisible-mirror.net/archives/${PN}/${PV/_p*}/${MY_P}-"
-
-		# Prefix each date with the upstream location (https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P})
-		mangled_patches=( "${PATCH_DATES[@]/#/${upstream_url_base}}" )
-		# Suffix each with .patch.gz
-		mangled_patches=( "${mangled_patches[@]/%/.patch.gz}" )
-		mangled_patches_sig=( "${mangled_patches[@]/%/.asc}" )
-		# Repeat for .patch.gz.asc for verify-sig
-		SRC_URI+=" ${mangled_patches[@]}"
-		SRC_URI+=" verify-sig? ( ${mangled_patches_sig[@]} )"
-
-		# For all of the URLs, chuck in invisible-island.net too:
-		SRC_URI+=" ${mangled_patches[@]/${upstream_url_base}/${upstream_m_url_base}}"
-		SRC_URI+=" verify-sig? ( ${mangled_patches_sig[@]/${upstream_url_base}/${upstream_m_url_base}} )"
-
-		UPSTREAM_PATCHES=( "${PATCH_DATES[@]/%/.patch}" )
-
-		unset upstream_url_base upstream_m_url_base mangled_patches mangled_patches_sig
-	fi
-fi
-
-SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${GENTOO_PATCH_NAME}.tar.xz"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="MIT"
-# The subslot reflects the SONAME.
-SLOT="0/6"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="ada +cxx debug doc gpm minimal profile split-usr +stack-realign static-libs test tinfo trace"
-# In 6.5_p20250118, the C++ examples fail to link, but there's no automated
-# testsuite anyway. Controlling building examples isn't really what USE=test
-# is for. Just restrict them.
-RESTRICT="!test? ( test ) test"
-
-# TODO: ncurses allows (and we take advantage of this, even) passing
-# the SONAME for dlopen() use, so only the header is needed at build time.
-# Maybe we should bundle a copy of gpm.h so we can move gpm to PDEPEND
-# which would be far nicer UX-wise.
-DEPEND="gpm? ( sys-libs/gpm[${MULTILIB_USEDEP}] )"
-# Block the older ncurses that installed all files w/SLOT=5, bug #557472
-RDEPEND="
-	${DEPEND}
-	!<=sys-libs/ncurses-5.9-r4:5
-	!<sys-libs/slang-2.3.2_pre23
-	!<x11-terms/rxvt-unicode-9.06-r3
-	!<x11-terms/st-0.6-r1
-	!minimal? ( !<x11-terms/ghostty-1.1.0 )
-"
-BDEPEND="verify-sig? ( sec-keys/openpgp-keys-thomasdickey )"
-
-PATCHES=(
-	"${UPSTREAM_PATCHES[@]/#/${WORKDIR}/${MY_P}-}"
-
-	# When rebasing Gentoo's patchset, please use git from a clean
-	# src_prepare with upstream patches already applied. git am --reject
-	# the existing patchset and rebase as required. This makes it easier
-	# to manage future rebasing & adding new patches.
-	#
-	# For the same reasons, please include the original configure.in changes,
-	# NOT just the generated results!
-	"${WORKDIR}"/${GENTOO_PATCH_NAME}
-)
-
-src_unpack() {
-	# Avoid trying to verify our own patchset tarball, there's no point
-	if use verify-sig ; then
-		local file
-		for file in ${A} ; do
-			if [[ ${file} == ${MY_P}.tar.gz ]] ; then
-				verify-sig_verify_detached "${DISTDIR}"/${file} "${DISTDIR}"/${file}.sig
-			else
-				[[ ${file} == @(*${GENTOO_PATCH_NAME}.tar.xz|*.asc|*.sig) ]] && continue
-
-				verify-sig_verify_detached "${DISTDIR}"/${file} "${DISTDIR}"/${file}.asc
-			fi
-		done
-	fi
-
-	default
-}
-
-src_configure() {
-	# bug #115036
-	unset TERMINFO
-
-	tc-export_build_env BUILD_{CC,CXX,CPP}
-
-	# bug #214642
-	BUILD_CPPFLAGS+=" -D_GNU_SOURCE"
-
-	# NCURSES_BOOL confusion, see https://lists.gnu.org/archive/html/bug-ncurses/2024-11/msg00010.html
-	append-cflags $(test-flags-CC -std=gnu17)
-
-	# Build the various variants of ncurses -- narrow, wide, and threaded. #510440
-	# Order matters here -- we want unicode/thread versions to come last so that the
-	# binaries in /usr/bin support both wide and narrow.
-	# The naming is also important as we use these directly with filenames and when
-	# checking configure flags.
-	NCURSES_TARGETS=(
-		ncurses
-		ncursesw
-		ncursest
-		ncursestw
-	)
-
-	# When installing ncurses, we have to use a compatible version of tic.
-	# This comes up when cross-compiling, doing multilib builds, upgrading,
-	# or installing for the first time.  Build a local copy of tic whenever
-	# the host version isn't available. bug #249363, bug #557598
-	if ! has_version -b "~sys-libs/${P}:0" ; then
-		local lbuildflags="-static"
-
-		# some toolchains don't quite support static linking
-		local dbuildflags="-Wl,-rpath,${WORKDIR}/lib"
-		case ${CHOST} in
-			*-darwin*)  dbuildflags=     ;;
-			*-solaris*) dbuildflags="-Wl,-R,${WORKDIR}/lib" ;;
-		esac
-		echo "int main() {}" | \
-			$(tc-getCC) -o x -x c - ${lbuildflags} -pipe >& /dev/null \
-			|| lbuildflags="${dbuildflags}"
-
-		# We can't re-use the multilib BUILD_DIR because we run outside of it.
-		BUILD_DIR="${WORKDIR}" \
-		CC=${BUILD_CC} \
-		CXX=${BUILD_CXX} \
-		CPP=${BUILD_CPP} \
-		CHOST=${CBUILD} \
-		CFLAGS=${BUILD_CFLAGS} \
-		CXXFLAGS=${BUILD_CXXFLAGS} \
-		CPPFLAGS=${BUILD_CPPFLAGS} \
-		LDFLAGS="${BUILD_LDFLAGS} ${lbuildflags}" \
-		do_configure cross --without-shared --with-normal --with-progs --without-ada
-	fi
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	if [[ ${ABI} == x86 ]] ; then
-		# For compatibility with older binaries at slight performance cost.
-		# bug #616402
-		use stack-realign && append-flags -mstackrealign
-	fi
-
-	local t
-	for t in "${NCURSES_TARGETS[@]}" ; do
-		do_configure "${t}"
-	done
-}
-
-do_configure() {
-	local target=$1
-	shift
-
-	mkdir "${BUILD_DIR}/${target}" || die
-	cd "${BUILD_DIR}/${target}" || die
-
-	local conf=(
-		# We need the basic terminfo files in /etc, bug #37026.  We will
-		# add '--with-terminfo-dirs' and then populate /etc/terminfo in
-		# src_install() ...
-		--with-terminfo-dirs="${EPREFIX}/etc/terminfo:${EPREFIX}/usr/share/terminfo"
-
-		# Enable installation of .pc files.
-		--enable-pc-files
-		# This path is used to control where the .pc files are installed.
-		--with-pkg-config-libdir="${EPREFIX}/usr/$(get_libdir)/pkgconfig"
-
-		# Now the rest of the various standard flags.
-		--with-shared
-		--enable-fvisibility
-		# (Originally disabled until bug #245417 is sorted out, but now
-		# just keeping it off for good, given nobody needed it until now
-		# (2022) and we're trying to phase out bdb.)
-		--without-hashed-db
-		$(use_with ada)
-		$(use_with cxx)
-		$(use_with cxx cxx-binding)
-		--with-cxx-shared
-		$(use_with debug)
-		$(use_with profile)
-		# The configure script uses ldd to parse the linked output which
-		# is flaky for cross-compiling/multilib/ldd versions/etc...
-		$(use_with gpm gpm libgpm.so.1)
-
-		# bug #930806
-		--disable-setuid-environ
-		# TODO: Maybe do these for USE=hardened
-		#--disable-root-access
-		#--disable-root-environ
-
-		--disable-termcap
-		--enable-symlinks
-		--with-manpage-format=normal
-		--enable-const
-		--enable-colorfgbg
-		--enable-hard-tabs
-		--enable-echo
-		$(use_enable !ada warnings)
-		$(use_with debug assertions)
-		$(use_enable !debug leaks)
-		$(use_with debug expanded)
-		$(use_with !debug macros)
-		$(multilib_native_with progs)
-		$(use_with test tests)
-		$(use_with trace)
-		$(use_with tinfo termlib)
-		--disable-stripping
-		--disable-pkg-ldflags
-	)
-
-	case ${CHOST} in
-		*-mingw32*)
-			conf+=( --enable-term-driver )
-			;;
-		*)
-			conf+=( --disable-term-driver )
-			;;
-	esac
-
-	if [[ ${target} == ncurses*w ]] ; then
-		conf+=( --enable-widec )
-	else
-		conf+=( --disable-widec )
-	fi
-	if [[ ${target} == ncursest* ]] ; then
-		conf+=( --with-{pthread,reentrant} )
-	else
-		conf+=( --without-{pthread,reentrant} )
-	fi
-
-	# Make sure each variant goes in a unique location.
-	if [[ ${target} == "ncurses" ]] ; then
-		# "ncurses" variant goes into "${EPREFIX}"/usr/include
-		# It is needed on Prefix because the configure script appends
-		# "ncurses" to "${prefix}/include" if "${prefix}" is not /usr.
-		conf+=( --enable-overwrite )
-	else
-		conf+=( --includedir="${EPREFIX}"/usr/include/${target} )
-	fi
-	# See comments in src_configure.
-	if [[ ${target} != "cross" ]] ; then
-		local cross_path="${WORKDIR}/cross"
-		[[ -d ${cross_path} ]] && export TIC_PATH="${cross_path}/progs/tic"
-	fi
-
-	ECONF_SOURCE="${S}" econf "${conf[@]}" "$@"
-}
-
-src_compile() {
-	# See comments in src_configure.
-	if ! has_version -b "~sys-libs/${P}:0" ; then
-		BUILD_DIR="${WORKDIR}" do_compile cross -C progs tic$(get_exeext)
-	fi
-
-	multilib-minimal_src_compile
-}
-
-multilib_src_compile() {
-	local t
-	for t in "${NCURSES_TARGETS[@]}" ; do
-		do_compile "${t}"
-	done
-}
-
-do_compile() {
-	local target=$1
-	shift
-
-	cd "${BUILD_DIR}/${target}" || die
-
-	# A little hack to fix parallel builds ... they break when
-	# generating sources so if we generate the sources first (in
-	# non-parallel), we can then build the rest of the package
-	# in parallel.  This is not really a perf hit since the source
-	# generation is quite small.
-	emake -j1 sources
-
-	# For some reason, sources depends on pc-files which depends on
-	# compiled libraries which depends on sources which ...
-	# Manually delete the pc-files file so the install step will
-	# create the .pc files we want.
-	rm -f misc/pc-files || die
-	emake "$@"
-}
-
-multilib_src_install() {
-	local target
-	for target in "${NCURSES_TARGETS[@]}" ; do
-		emake -C "${BUILD_DIR}/${target}" DESTDIR="${D}" install
-	done
-
-	# Move main libraries into /.
-	if multilib_is_native_abi ; then
-		gen_usr_ldscript -a \
-			"${NCURSES_TARGETS[@]}" \
-			$(usex tinfo 'tinfow tinfo' '')
-	fi
-
-	# Don't delete '*.dll.a', needed for linking, bug #631468
-	if ! use static-libs; then
-		find "${ED}"/usr/ -name '*.a' ! -name '*.dll.a' -delete || die
-	fi
-
-	# Build fails to create this ...
-	# -FIXME-
-	# Ugly hackaround for riscv having two parts libdir (bug #689240)
-	# Replace this hack with an official solution once we have one...
-	# -FIXME-
-	dosym $(sed 's@[^/]\+@..@g' <<< $(get_libdir))/share/terminfo \
-		/usr/$(get_libdir)/terminfo
-
-	# Remove obsolete libcurses symlink that is created by the build
-	# system. Technically, this could be also achieved
-	# via --disable-overwrite but it also moves headers implicitly,
-	# and we do not want to do this yet.
-	# bug #836696
-	rm "${ED}"/usr/$(get_libdir)/libcurses* || die
-}
-
-multilib_src_install_all() {
-	local terms=(
-		# Dumb/simple values that show up when using the in-kernel VT.
-		ansi console dumb linux
-		vt{52,100,102,200,220}
-		# [u]rxvt users used to be pretty common.  Probably should drop this
-		# since upstream is dead and people are moving away from it.
-		rxvt{,-unicode}{,-256color}
-		# xterm users are common, as is terminals re-using/spoofing it.
-		xterm xterm-{,256}color
-		# screen is common (and reused by tmux).
-		screen{,-256color}
-		screen.xterm-256color
-	)
-	if use split-usr ; then
-		local x
-		# We need the basic terminfo files in /etc for embedded/recovery, bug #37026
-		einfo "Installing basic terminfo files in /etc..."
-		for x in "${terms[@]}"; do
-			local termfile=$(find "${ED}"/usr/share/terminfo/ -name "${x}" 2>/dev/null)
-			local basedir=$(basename "$(dirname "${termfile}")")
-
-			if [[ -n ${termfile} ]] ; then
-				dodir "/etc/terminfo/${basedir}"
-				mv "${termfile}" "${ED}/etc/terminfo/${basedir}/" || die
-				dosym "../../../../etc/terminfo/${basedir}/${x}" \
-					"/usr/share/terminfo/${basedir}/${x}"
-			fi
-		done
-
-		echo "CONFIG_PROTECT_MASK=\"/etc/terminfo\"" | newenvd - 50ncurses
-
-		use minimal && rm -r "${ED}"/usr/share/terminfo*
-		# Because ncurses5-config --terminfo returns the directory we keep it
-		# bug #245374
-		keepdir /usr/share/terminfo
-	elif use minimal ; then
-		# Keep only the basic terminfo files
-		find "${ED}"/usr/share/terminfo/ \
-			\( -type f -o -type l \) ${terms[*]/#/! -name } -delete , \
-			-type d -empty -delete || die
-	fi
-
-	cd "${S}" || die
-	dodoc ANNOUNCE MANIFEST NEWS README* TO-DO doc/*.doc
-	if use doc ; then
-		docinto html
-		dodoc -r doc/html/
-	fi
-}
-
-pkg_preinst() {
-	preserve_old_lib /$(get_libdir)/libncurses.so.5
-	preserve_old_lib /$(get_libdir)/libncursesw.so.5
-}
-
-pkg_postinst() {
-	preserve_old_lib_notify /$(get_libdir)/libncurses.so.5
-	preserve_old_lib_notify /$(get_libdir)/libncursesw.so.5
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250531.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250531-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250531.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250531-r1.ebuild
index d32df669b86..25d08e29b6e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250531.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250531-r1.ebuild
@@ -307,10 +307,10 @@ do_configure() {
 		--enable-hard-tabs
 		--enable-echo
 		$(use_enable !ada warnings)
-		$(use_with debug assertions)
+		$(use_enable debug assertions)
 		$(use_enable !debug leaks)
-		$(use_with debug expanded)
-		$(use_with !debug macros)
+		$(use_enable debug expanded)
+		$(use_enable !debug macros)
 		$(multilib_native_with progs)
 		$(use_with test tests)
 		$(use_with trace)
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250308.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250802.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250308.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250802.ebuild
index 78a75ac0c0e..fe59c3f8d65 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250308.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250802.ebuild
@@ -22,7 +22,7 @@ SRC_URI="
 "
 
 GENTOO_PATCH_DEV=sam
-GENTOO_PATCH_PV=6.5_p20250301
+GENTOO_PATCH_PV=6.5_p20250802
 GENTOO_PATCH_NAME=${PN}-${GENTOO_PATCH_PV}-patches
 
 # Populated below in a loop. Do not add patches manually here.
@@ -85,6 +85,26 @@ if [[ ${PV} == *_p* ]] ; then
 		20250216
 		20250222
 		20250301
+		20250308
+		20250315
+		20250322
+		20250329
+		20250405
+		20250412
+		20250419
+		20250426
+		20250503
+		20250510
+		20250517
+		20250524
+		20250531
+		20250614
+		20250621
+		20250628
+		20250705
+		20250712
+		20250720
+		20250726
 
 		# Latest patch is just _pN = $(ver_cut 4)
 		$(ver_cut 4)
@@ -189,9 +209,6 @@ src_configure() {
 	# bug #214642
 	BUILD_CPPFLAGS+=" -D_GNU_SOURCE"
 
-	# NCURSES_BOOL confusion, see https://lists.gnu.org/archive/html/bug-ncurses/2024-11/msg00010.html
-	append-cflags $(test-flags-CC -std=gnu17)
-
 	# Build the various variants of ncurses -- narrow, wide, and threaded. #510440
 	# Order matters here -- we want unicode/thread versions to come last so that the
 	# binaries in /usr/bin support both wide and narrow.
@@ -298,10 +315,10 @@ do_configure() {
 		--enable-hard-tabs
 		--enable-echo
 		$(use_enable !ada warnings)
-		$(use_with debug assertions)
+		$(use_enable debug assertions)
 		$(use_enable !debug leaks)
-		$(use_with debug expanded)
-		$(use_with !debug macros)
+		$(use_enable debug expanded)
+		$(use_enable !debug macros)
 		$(multilib_native_with progs)
 		$(use_with test tests)
 		$(use_with trace)

From 899146c725b28d03151dc003a637fc2a9bcac449 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:16:41 +0000
Subject: [PATCH 116/122] sys-libs/readline: Sync with Gentoo

It's from Gentoo commit f0932f7a65b2ffffced5ff2d01de355819b8399b.
---
 .../portage-stable/sys-libs/readline/Manifest |   1 +
 .../readline-8.4_alpha_pre20250805.ebuild     | 257 ++++++++++++++++++
 2 files changed, 258 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.4_alpha_pre20250805.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/readline/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/readline/Manifest
index a1b3b2bcb5c..b3b3fa5a55e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/readline/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/readline/Manifest
@@ -3,6 +3,7 @@ DIST readline-8.2.tar.gz 3043952 BLAKE2B 7974322b9c092a756a79e537df08e8532f8e0fc
 DIST readline-8.2.tar.gz.sig 95 BLAKE2B dc510459c0c47782ca87364a6677b4d8f0b68a984143122c08bd15aef08a71bff59ac92d3c3ada518dad09f189c144748e840175041eb619f679e2d8b95dc2aa SHA512 0effd273689e5f7fe7e049c8f2c5f3c97149f198a90d053231ee4de34901560a465ab0d4fd71fd07c7d7e233caed7f42e5b668bffaf1e23a7eb373c8f9e150fe
 DIST readline-8.3.tar.gz 3419642 BLAKE2B 45d6fe7e34c56d309102a94aa776a7f5284201e844450e14ff818df9fa84a72154bdca70f11828c94954b080cbbe4666fa0b00ffa8460118ec8f3ea551b73dad SHA512 513002753dcf5db9213dbbb61d51217245f6a40d33b1dd45238e8062dfa8eef0c890b87a5548e11db959e842724fb572c4d3d7fb433773762a63c30efe808344
 DIST readline-8.3.tar.gz.sig 95 BLAKE2B 088be0a0dbcafc6e9643daac987bf09e37b919b28c87ffbd7d47ee798f71d5e2eb48a07ae040e7290465c95c32385b10b3a0c1285861d4c663e6e1fd28b091b6 SHA512 8f9d4adeb068016e61f76052fb38552db447fc461c7d48811d8af5f0436abce20277e08c475a1c48c99fa37f2b20ca549a94eb5cee0fe6f0d4c854699cc0988c
+DIST readline-8.4_alpha_pre20250805-488d7edc22894d30b6de7f2d4190bf7403f63ffd.tar.gz 3483136 BLAKE2B 0aade82ce2cb240d9c5e3039ac6ff5b674413a71318ec5e60ef2ee34725bf1dee5b24e7300b80c4cfb99f92f4e71c76b02598051eb2b5c558427e877a0321373 SHA512 cbfc17d9350452fdf9ea0a32472d2fde66a0d6e2ed7b2bf0d9ec000082ca5c61ebef3375ab8f95e3354a0df5fe6a47708163405af007f1fd9d55875fa02032bf
 DIST readline82-001 1198 BLAKE2B 2e8f3d2aa14c4c4c4f9621f80f4ffae9bbd6f46c3561e87aaf684c759ffd82e3c46843cf4c4224533b28a847d83f7b8b254813f8a306d438e9f7cb457516c4e0 SHA512 ea3800a62e992b3e594d78e77b6c4b662fb8c501b81010277e478656bb3b56db7747ba40c6c3d68c3ec5ab8e9e41be104788ec52268135d7e642ff40dea421a8
 DIST readline82-001.sig 94 BLAKE2B 542ac331a7da3702b47f4828b3264bc7bf996f473807d675044beeb9688c4ca3645bcba0898d3ea9447c1cde540eb8a6b1934008b0a11baef33235e43f44c6c7 SHA512 01ad9769fee42dc601b511c87bd39e15c74226e1747c4ae8914e303213706005780135add180dbfe538fe847533dc56cfe8f51a3ad9ec55d1fde2cb2e096bfb5
 DIST readline82-002 1134 BLAKE2B 799f089105be9931ba13d562d4579b4d1dbdd5440b625b8fe0f1cec6438a1623bf473944cb278b937ca5ab2b98eac2f5993d6e047b96368b5fcd5649fb536d96 SHA512 2d4058c5c886498486d8514c238c0a05c0a97409011a7da40745e842977f0a29754e8b678f7e6e7a47c00df7e2e4c522d34d473118a24524af3824eed912e74a
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.4_alpha_pre20250805.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.4_alpha_pre20250805.ebuild
new file mode 100644
index 00000000000..5d847c85a35
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.4_alpha_pre20250805.ebuild
@@ -0,0 +1,257 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# There's no standard way of versioning the point releases upstream
+# make anyway, so while this was added for RC versions, it's fine
+# in general.
+QA_PKGCONFIG_VERSION=$(ver_cut 1-2)
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
+inherit flag-o-matic multilib multilib-minimal preserve-libs toolchain-funcs verify-sig
+
+# Official patches
+# See ftp://ftp.cwru.edu/pub/bash/readline-8.1-patches/
+PLEVEL="${PV##*_p}"
+MY_PV="${PV/_p*}"
+MY_PV="${MY_PV/_/-}"
+MY_P="${PN}-${MY_PV}"
+MY_PATCHES=()
+
+# Determine the patchlevel.
+case ${PV} in
+	9999|*_alpha*|*_beta*|*_rc*)
+		# Set a negative patchlevel to indicate that it's a pre-release.
+		PLEVEL=-1
+		;;
+	*_p*)
+		PLEVEL=${PV##*_p}
+		;;
+	*)
+		PLEVEL=0
+esac
+
+DESCRIPTION="Another cute console display library"
+HOMEPAGE="https://tiswww.case.edu/php/chet/readline/rltop.html https://git.savannah.gnu.org/cgit/readline.git"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/readline.git"
+	EGIT_BRANCH=devel
+	inherit git-r3
+elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+	# It can be useful to have snapshots in the pre-release period once
+	# the first alpha is out, as various bugs get reported and fixed from
+	# the alpha, and the next pre-release is usually quite far away.
+	#
+	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
+	READLINE_COMMIT="488d7edc22894d30b6de7f2d4190bf7403f63ffd"
+	SRC_URI="https://git.savannah.gnu.org/cgit/readline.git/snapshot/readline-${READLINE_COMMIT}.tar.gz -> ${P}-${READLINE_COMMIT}.tar.gz"
+	S=${WORKDIR}/${PN}-${READLINE_COMMIT}
+else
+	SRC_URI="mirror://gnu/${PN}/${MY_P}.tar.gz"
+	SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${MY_P}.tar.gz.sig )"
+	S="${WORKDIR}/${MY_P}"
+
+	if [[ ${PLEVEL} -gt 0 ]] ; then
+		# bash-5.1 -> bash51
+		my_p=${PN}$(ver_rs 1-2 '' $(ver_cut 1-2))
+
+		patch_url=
+		my_patch_index=
+
+		upstream_url_base="mirror://gnu/readline"
+
+		for ((my_patch_index=1; my_patch_index <= ${PLEVEL} ; my_patch_index++)) ; do
+			printf -v mangled_patch_ver ${my_p}-%03d ${my_patch_index}
+			patch_url="${upstream_url_base}/${MY_P}-patches/${mangled_patch_ver}"
+
+			SRC_URI+=" ${patch_url}"
+			SRC_URI+=" verify-sig? ( ${patch_url}.sig )"
+
+			MY_PATCHES+=( "${DISTDIR}"/${mangled_patch_ver} )
+		done
+
+		unset my_p patch_url my_patch_index upstream_url_base
+	fi
+fi
+
+LICENSE="GPL-3+"
+SLOT="0/8"  # subslot matches SONAME major
+if (( PLEVEL >= 0 )); then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="static-libs +unicode utils"
+
+RDEPEND=">=sys-libs/ncurses-5.9-r3:=[static-libs?,unicode(+)?,${MULTILIB_USEDEP}]"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-chetramey )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-5.0-no_rpath.patch
+	"${FILESDIR}"/${PN}-7.0-headers.patch
+	"${FILESDIR}"/${PN}-8.0-headers.patch
+)
+
+src_unpack() {
+	local patch
+
+	if [[ ${PV} == 9999 ]]; then
+		git-r3_src_unpack
+	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+		default
+	else
+		if use verify-sig; then
+			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
+
+			for patch in "${MY_PATCHES[@]}"; do
+				verify-sig_verify_detached "${patch}"{,.sig}
+			done
+		fi
+
+		unpack "${MY_P}.tar.gz"
+
+		if [[ ${GENTOO_PATCH_VER} ]]; then
+			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+		fi
+	fi
+}
+
+src_prepare() {
+	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
+
+	default
+
+	#(( PLEVEL < 0 )) && eautoreconf
+
+	if use prefix && [[ ! -x "${BROOT}"/usr/bin/pkg-config ]] ; then
+		# If we're bootstrapping, make a guess. We don't have pkg-config
+		# around yet. bug #818103.
+		# Incorrectly populating this leads to underlinked libreadline.
+		local ncurses_libs
+		local ncurses_libs_suffix=$(usex unicode w '')
+
+		ncurses_libs="-lncurses${ncurses_libs_suffix}"
+
+		if has_version "sys-libs/ncurses[tinfo(+)]" ; then
+			ncurses_libs+=" -ltinfo${ncurses_libs_suffix}"
+		fi
+	else
+		# Force ncurses linking, bug #71420.
+		# Use pkg-config to get the right values, bug #457558.
+		local ncurses_libs=$($(tc-getPKG_CONFIG) ncurses$(usex unicode w '') --libs)
+	fi
+
+	sed -i \
+		-e "/^SHLIB_LIBS=/s:=.*:='${ncurses_libs}':" \
+		support/shobj-conf || die
+	sed -i \
+		-e "/[[:space:]]*LIBS=.-lncurses/s:-lncurses:${ncurses_libs}:" \
+		examples/rlfe/configure || die
+
+	# Fix building under Gentoo/FreeBSD; upstream FreeBSD deprecated
+	# objformat for years, so we don't want to rely on that.
+	sed -i -e '/objformat/s:if .*; then:if true; then:' support/shobj-conf || die
+
+	# For local readline headers
+	ln -s ../.. examples/rlfe/readline || die
+}
+
+src_configure() {
+	# Fix implicit decls with widechar funcs
+	append-cppflags -D_GNU_SOURCE
+	# https://lists.gnu.org/archive/html/bug-readline/2010-07/msg00013.html
+	append-cppflags -Dxrealloc=_rl_realloc -Dxmalloc=_rl_malloc -Dxfree=_rl_free
+
+	# Make sure configure picks a better ar than `ar`, bug #484866
+	export ac_cv_prog_AR="$(tc-getAR)"
+
+	# Force the test since we used sed above to force it.
+	export bash_cv_termcap_lib=ncurses
+
+	# Control cross-compiling cases when we know the right answer.
+	# In cases where the C library doesn't support wide characters, readline
+	# itself won't work correctly, so forcing the answer below should be OK.
+	if tc-is-cross-compiler ; then
+		export bash_cv_func_sigsetjmp="present"
+		export bash_cv_func_ctype_nonascii="yes"
+		# bug #503312
+		export bash_cv_wcwidth_broken="no"
+	fi
+
+	# This is for rlfe, but we need to make sure LDFLAGS doesn't change
+	# so we can re-use the config cache file between the two.
+	append-ldflags -L.
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		--cache-file="${BUILD_DIR}"/config.cache
+		--with-curses
+		$(use_enable static-libs static)
+	)
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+
+	if use utils && multilib_is_native_abi && ! tc-is-cross-compiler ; then
+		# Code is full of AC_TRY_RUN()
+		mkdir -p examples/rlfe || die
+		cd examples/rlfe || die
+
+		ECONF_SOURCE="${S}"/examples/rlfe econf --cache-file="${BUILD_DIR}"/config.cache
+	fi
+}
+
+multilib_src_compile() {
+	emake
+
+	if use utils && multilib_is_native_abi && ! tc-is-cross-compiler ; then
+		# Code is full of AC_TRY_RUN()
+		cd examples/rlfe || die
+		local l
+		for l in readline history ; do
+			ln -s ../../shlib/lib${l}$(get_libname)* lib${l}$(get_libname) || die
+			ln -s ../../lib${l}.a lib${l}.a || die
+		done
+		emake
+	fi
+}
+
+multilib_src_install() {
+	default
+
+	if multilib_is_native_abi ; then
+		if use utils && ! tc-is-cross-compiler; then
+			dobin examples/rlfe/rlfe
+		fi
+	fi
+}
+
+multilib_src_install_all() {
+	HTML_DOCS="doc/history.html doc/readline.html doc/rluserman.html" einstalldocs
+
+	dodoc USAGE
+	docinto ps
+	dodoc doc/*.ps
+}
+pkg_preinst() {
+	# bug #29865
+	# Reappeared in bug #595324 with paludis so keeping this for now...
+	preserve_old_lib \
+		/$(get_libdir)/lib{history,readline}$(get_libname 4) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 5) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 6) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 7)
+}
+
+pkg_postinst() {
+	preserve_old_lib_notify \
+		/$(get_libdir)/lib{history,readline}$(get_libname 4) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 5) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 6) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 7)
+}

From 8f16da176283a60b834fd0b08558e2983848e600 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:16:47 +0000
Subject: [PATCH 117/122] sys-process/lsof: Sync with Gentoo

It's from Gentoo commit 316817f80c23b8d6fab9f2fdd1986cfb46388516.
---
 .../portage-stable/sys-process/lsof/lsof-4.99.4.ebuild     | 7 +++++++
 .../portage-stable/sys-process/lsof/lsof-4.99.5.ebuild     | 7 +++++++
 2 files changed, 14 insertions(+)

diff --git a/sdk_container/src/third_party/portage-stable/sys-process/lsof/lsof-4.99.4.ebuild b/sdk_container/src/third_party/portage-stable/sys-process/lsof/lsof-4.99.4.ebuild
index 8e400d1ef0b..06774a3bb92 100644
--- a/sdk_container/src/third_party/portage-stable/sys-process/lsof/lsof-4.99.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-process/lsof/lsof-4.99.4.ebuild
@@ -3,6 +3,8 @@
 
 EAPI=8
 
+inherit libtool
+
 MY_P="${P/-/_}"
 DESCRIPTION="Lists open files for running Unix processes"
 HOMEPAGE="https://github.com/lsof-org/lsof"
@@ -26,6 +28,11 @@ BDEPEND="
 # Needs fixing first for sandbox
 RESTRICT="test"
 
+src_prepare() {
+	default
+	elibtoolize
+}
+
 src_configure() {
 	local myeconfargs=(
 		$(use_with rpc libtirpc)
diff --git a/sdk_container/src/third_party/portage-stable/sys-process/lsof/lsof-4.99.5.ebuild b/sdk_container/src/third_party/portage-stable/sys-process/lsof/lsof-4.99.5.ebuild
index bcbab028781..1ce631f2a89 100644
--- a/sdk_container/src/third_party/portage-stable/sys-process/lsof/lsof-4.99.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-process/lsof/lsof-4.99.5.ebuild
@@ -3,6 +3,8 @@
 
 EAPI=8
 
+inherit libtool
+
 MY_P="${P/-/_}"
 DESCRIPTION="Lists open files for running Unix processes"
 HOMEPAGE="https://github.com/lsof-org/lsof"
@@ -26,6 +28,11 @@ BDEPEND="
 # Needs fixing first for sandbox
 RESTRICT="test"
 
+src_prepare() {
+	default
+	elibtoolize
+}
+
 src_configure() {
 	local myeconfargs=(
 		$(use_with rpc libtirpc)

From 9f9edd9adca5195dc7fe36be845e251e31de3f44 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:17:33 +0000
Subject: [PATCH 118/122] virtual/pkgconfig: Sync with Gentoo

It's from Gentoo commit 404727eda6b5c9fad544a9420ad4f6d7a56c926c.
---
 .../virtual/pkgconfig/pkgconfig-2-r1.ebuild            | 10 ----------
 1 file changed, 10 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/virtual/pkgconfig/pkgconfig-2-r1.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/virtual/pkgconfig/pkgconfig-2-r1.ebuild b/sdk_container/src/third_party/portage-stable/virtual/pkgconfig/pkgconfig-2-r1.ebuild
deleted file mode 100644
index 0143da2e56a..00000000000
--- a/sdk_container/src/third_party/portage-stable/virtual/pkgconfig/pkgconfig-2-r1.ebuild
+++ /dev/null
@@ -1,10 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-DESCRIPTION="Virtual for the pkg-config implementation"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-RDEPEND=">=dev-util/pkgconf-1.3.7[pkg-config(+)]"

From c24d91192ea5d8ca49aa80508f181c2a8d432ad7 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:17:34 +0000
Subject: [PATCH 119/122] virtual/resolvconf: Sync with Gentoo

It's from Gentoo commit 78bc19571bb7aafdcfef136e0f9212df781eec45.
---
 .../{resolvconf-1.ebuild => resolvconf-2.ebuild}    | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)
 rename sdk_container/src/third_party/portage-stable/virtual/resolvconf/{resolvconf-1.ebuild => resolvconf-2.ebuild} (62%)

diff --git a/sdk_container/src/third_party/portage-stable/virtual/resolvconf/resolvconf-1.ebuild b/sdk_container/src/third_party/portage-stable/virtual/resolvconf/resolvconf-2.ebuild
similarity index 62%
rename from sdk_container/src/third_party/portage-stable/virtual/resolvconf/resolvconf-1.ebuild
rename to sdk_container/src/third_party/portage-stable/virtual/resolvconf/resolvconf-2.ebuild
index 4019dab4188..1961e41e11e 100644
--- a/sdk_container/src/third_party/portage-stable/virtual/resolvconf/resolvconf-1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/virtual/resolvconf/resolvconf-2.ebuild
@@ -1,14 +1,15 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 DESCRIPTION="Virtual to select between different resolvconf providers"
+
 SLOT="0"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+IUSE="systemd"
 
 RDEPEND="
-	|| (
-		net-dns/openresolv
-		>=sys-apps/systemd-239-r1[resolvconf]
-	)"
+	systemd? ( >=sys-apps/systemd-239-r1[resolvconf] )
+	!systemd? ( net-dns/openresolv )
+"

From dddb60fc8e4330f999ee8b561c3cd147ac5e752d Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:17:34 +0000
Subject: [PATCH 120/122] virtual/service-manager: Sync with Gentoo

It's from Gentoo commit 10751ff148982a75a31935d345a47a3ba8057a3b.
---
 .../service-manager-1-r2.ebuild               | 25 -------------------
 .../service-manager-1-r3.ebuild               | 23 -----------------
 2 files changed, 48 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/virtual/service-manager/service-manager-1-r2.ebuild
 delete mode 100644 sdk_container/src/third_party/portage-stable/virtual/service-manager/service-manager-1-r3.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/virtual/service-manager/service-manager-1-r2.ebuild b/sdk_container/src/third_party/portage-stable/virtual/service-manager/service-manager-1-r2.ebuild
deleted file mode 100644
index 0737723e43a..00000000000
--- a/sdk_container/src/third_party/portage-stable/virtual/service-manager/service-manager-1-r2.ebuild
+++ /dev/null
@@ -1,25 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DESCRIPTION="Virtual for various service managers"
-
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-RDEPEND="
-	prefix-guest? ( >=sys-apps/baselayout-prefix-2.2 )
-	!prefix-guest? (
-		|| (
-			sys-apps/openrc
-			kernel_linux? (
-				|| (
-					sys-apps/s6-rc
-					sys-apps/systemd
-					sys-process/runit
-					virtual/daemontools
-				)
-			)
-		)
-	)"
diff --git a/sdk_container/src/third_party/portage-stable/virtual/service-manager/service-manager-1-r3.ebuild b/sdk_container/src/third_party/portage-stable/virtual/service-manager/service-manager-1-r3.ebuild
deleted file mode 100644
index 91f3af84bf9..00000000000
--- a/sdk_container/src/third_party/portage-stable/virtual/service-manager/service-manager-1-r3.ebuild
+++ /dev/null
@@ -1,23 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DESCRIPTION="Virtual for various service managers"
-
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-RDEPEND="
-	!prefix-guest? (
-		|| (
-			sys-apps/openrc
-			kernel_linux? (
-				|| (
-					sys-apps/s6-rc
-					sys-apps/systemd
-					sys-process/runit
-				)
-			)
-		)
-	)"

From 2be9e9f79e6866502f5728407a8c16b2b4e44764 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:17:42 +0000
Subject: [PATCH 121/122] x11-drivers/nvidia-drivers: Sync with Gentoo

It's from Gentoo commit cd5f6c0f60f68ebc51efe08797b9c267a64a188e.
---
 .../x11-drivers/nvidia-drivers/Manifest       |  59 +++++----
 .../nvidia-drivers/files/nvidia-545.conf      |  39 ------
 .../nvidia-drivers-535.261.03.ebuild          |   4 +-
 .../nvidia-drivers-570.172.08.ebuild          |   7 +-
 ...9.ebuild => nvidia-drivers-570.181.ebuild} |  12 +-
 ...ebuild => nvidia-drivers-575.64.05.ebuild} | 124 ++++++++++--------
 ...ebuild => nvidia-drivers-580.65.06.ebuild} |  69 ++++++----
 ...ebuild => nvidia-drivers-580.76.05.ebuild} |   5 +-
 8 files changed, 157 insertions(+), 162 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/files/nvidia-545.conf
 rename sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/{nvidia-drivers-570.169.ebuild => nvidia-drivers-570.181.ebuild} (98%)
 rename sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/{nvidia-drivers-535.247.01-r1.ebuild => nvidia-drivers-575.64.05.ebuild} (83%)
 rename sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/{nvidia-drivers-550.163.01-r1.ebuild => nvidia-drivers-580.65.06.ebuild} (89%)
 rename sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/{nvidia-drivers-575.64.03.ebuild => nvidia-drivers-580.76.05.ebuild} (98%)

diff --git a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/Manifest b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/Manifest
index af4989fc1f3..63cb749506d 100644
--- a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/Manifest
+++ b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/Manifest
@@ -1,63 +1,68 @@
-DIST NVIDIA-Linux-aarch64-535.247.01.run 269861217 BLAKE2B c72eb28472c6a5ee5344618b343efc3f8edac94a5d2c994b86d113f7258c0df228076462d3fb84791f8f1c666554d20116ebb6a7444b680128556a4b9e8b2b29 SHA512 a0bd487238d41fd907c7e87d8ce10b4e19a367c8faafafc914fe6d741b348619e7427a5ff22dd2a475e4dd5cf3148965934b746bcc34b3f572bc01e8a6429bda
 DIST NVIDIA-Linux-aarch64-535.261.03.run 269926298 BLAKE2B 78b696ed9ef01fdc4bec8b955c7f7acb7475f743c7483b5ab799d63f5917e12e97ea522865c1b4e2fa03586977ccefdc4518339c705ff9e8165ac9bd4af32e30 SHA512 3bc4a141fc159e88a3cda19519d325ddfc03fdcd328a50b5a0c6c9f06089ff2a97edb03dbfd1d23ec0e60a4fc549a8f0143e0c4d6beb98771ad8c243ef699faf
-DIST NVIDIA-Linux-aarch64-550.163.01.run 236409124 BLAKE2B 21c79346f6b739f44d7ed2d4955129613f51e1329ff15948ef50a9a06b82975ad890d6142e5dfb163e7b0da19bf5c26029cf507d120037f8a76abc177a286403 SHA512 0ef4ab4aae308ec0cfb5458cef34a1503ac1a85f0e1d0c9f061d8e28f939b15784e3862d96d83e93123d9eb56807a6804318ce230ee68917fb75e363011f8304
-DIST NVIDIA-Linux-aarch64-570.169.run 290106494 BLAKE2B b8b332c3b121063af061f1ab19f87db6c528da977847423f6d7f0b6c6d7d8bd118e6f0518fbd66c6c633647efb64a3a670cd5ecadffd41faf6271916446f2143 SHA512 551615d6ecc982acdbb52049c5afd11cd8ca69999d097f076884c3f632b3880f95c707ebadf66c3aabf5452aab52cd372894eff574382ed2d79444a65c368369
 DIST NVIDIA-Linux-aarch64-570.172.08.run 290144917 BLAKE2B 095a9362f8729f854e0a976d90456d2d061d1a21f3c110b94a4eef0264fda81078058d8e24a76eb7d13066feee8d17d9aee2de4f111debc361362d7a73d119b0 SHA512 291012513c2b9bff94a0892248207734b1d12a13ff994036045fd159f60bf410508fd66873d78388d0e289ded1b76f8d0980219c289fa2ba99303f2cf872e9d6
-DIST NVIDIA-Linux-aarch64-575.64.03.run 305150077 BLAKE2B 5b7a9e0ec90130f8009e9612102e87cc513fef04ffc34e47cc8eb3b787c4642d3445aef0a064005bb33972925a110d7f4716dccc71840e273010b519b019be55 SHA512 16f9fae89102ee1d9f587c8e85098e34e5cd84299766a97920ea4c23aae7e353837e4e69c4c067c27a85ce0d8f18df90c8cc368a100ddc846744d6bff09ad7da
+DIST NVIDIA-Linux-aarch64-570.181.run 292998832 BLAKE2B 259da795e0498b379b663fdff6b120a5bc1d7851b2f32803d87e8ee42e2c8e52158c7fd98aa0ecba2507512361d068e033305d383bcf0cb218dcec1dd9bd988c SHA512 ef49d7572eaca2c2bf2b8c5b53ca818499b9f622d4aa4d0601672173571fab6559bbbb9ffefbc2247f51ec33837d2a23e11bd9eca7279ba1402540ef6ad150ac
+DIST NVIDIA-Linux-aarch64-575.64.05.run 304943447 BLAKE2B 277aed01ab2be1cbbfe7780c4cb9dcbfaebc69824ba4b5a620113829f713d5407829769c7fab224f183656408944d9d6c4dcf6400a333c1116a89d072eb79223 SHA512 0b9b9c6b3316723fba4549fcd346215e5315a7b4c80196f0cd9ada9ecd6a23e8fc1691ae8bda5b246a3c44519cc7f503116023ff5427718fbffb67fe49a12a75
+DIST NVIDIA-Linux-aarch64-580.65.06.run 315886352 BLAKE2B 337c80f460a5ba215f52c201670ef9cc4de96100324e7c408136b57b81adfd0487cf380edd7e62ea22f34bffc4d2726ec5402379279ffc85f5873d270bc5538d SHA512 c4f2902412e9f47006e50c7f687e8f3cfc4580877c945b5da35c9e3a00f5e72eba8b0aaf250ff51d382fcf611177c9115f72f23b7858a520f0a7e1b27354d3e6
+DIST NVIDIA-Linux-aarch64-580.76.05.run 313061150 BLAKE2B f4a32cca4c92ebd2ab43aba0a6fb4fbf86ff5442544fba4fe48d49d9b283213a0e552c8fd94e96163f8eaa93a6dfe9e193f644a19377ea76527f112db7665d3c SHA512 3f2f7a223f083e75178de9773b12d6945c89273b162defa251155af1d6f394b447bc51c13099b221acb2a80576362ea0aaddb10ee66bf0ef8bd25d0b5a1a47c8
 DIST NVIDIA-Linux-x86-390.157.run 49417041 BLAKE2B 435b5e0e60468cc74b41cc5d9b5bb0105d29c11a2d408457835212a96519c9334ecf19278b36749d3ff7f498f5b0ae45a2efae2d428703dac21245c62f1efebe SHA512 dae9ac2c12f9ad90f7441e00e01a984147c577892421911d7f67f6a31e616ac1cb7d434bc9c7f58fbd9b8ae909521b5bece607a63c79588c0bb9d99c6bad5fb0
 DIST NVIDIA-Linux-x86_64-390.157.run 85835541 BLAKE2B 44b855cd11f3b2f231f9fb90492ae2e67a67ea3ea83c413e7c90956d38c9730a8bd0321281ae03c6afce633d102f5b499aed25622b9bfd31bdd2c98f0717e95b SHA512 4780503a4cff0180b1b1f37d20a6ba3438dd78b51fa7f69b98d35521835e5d61099129746929d51d63afa2d47b672b3e145e1e1897584dc3799e7f822c5b3a0a
 DIST NVIDIA-Linux-x86_64-470.256.02.run 272850014 BLAKE2B 0fdc867f92b82b2a60810c3b43751cad7ac2c39928c92c6c343c0c6044f4d7d923d93b8599db3f7c999c0ee7d16940e65d991a61cbb30e1d9e49c5639ac6bdc8 SHA512 a837946dd24d7945c1962a695f1f31965f3ceb6927f52cd08fd51b8db138b7a888bbeab69243f5c8468a7bd7ccd47f5dbdb48a1ca81264866c1ebb7d88628f88
-DIST NVIDIA-Linux-x86_64-535.247.01.run 341853459 BLAKE2B ef91097a36add821a623c8d1f19eca8ca9571fe4a08b8e25eb70f09923899bcb3bd2c0f408dd6ff045ffdccb192be3a46cec4fd7b7d8d7bc17449c436cc2cbde SHA512 f8e04e5f7cf8b7fdae9135cb5f0f2740d5eae0ef9a44a41dbf78996d3c2d4139bdbec99be14f73aa2d275d78658b4a91a274f20545e4325cef787548e3d073a6
 DIST NVIDIA-Linux-x86_64-535.261.03.run 341775057 BLAKE2B d72ed6d4d442c204721667302d300e8e8ec9b8288a0945ba090aa4e4666fb7fbd6bffe8a242c134e6ce8a7947954d7771ec142cf6b6cf1a32b773edf9119e71e SHA512 52ac6db0a057977652f56a279c6e5482fd602d1c637b22e7bb8ae5e5f5a9fbddb8492196371c2bdcacfbd9e7c1bf3954c22254e842f413cb6af1b3c79a6e7ec2
-DIST NVIDIA-Linux-x86_64-550.163.01.run 307143336 BLAKE2B 256106bcd3bace402289e60aca4cd3b447d0fd8ec3dabd50e2bb303c5e866f8da5c28f9b578d95775bf69158f100d68a91d20d9a91426285a8e799817f21db6b SHA512 676b1de35d21e80091528a49080c114e0870ea90b3f3721265ae8071abbc2183c851e6f11ba96a332c743fedfaf4ec9a014ad6ceed586fdbb03d94d33405e356
 DIST NVIDIA-Linux-x86_64-570.123.19.run 375997440 BLAKE2B bc96faaeeb3c52d3c54bc9c5b87d04503ca9d329ad6d4ddb0003d02b7f0ede81ad00ea812dcfe7158acfeb3b9e1714d363d19b7c89c25ec2d8fe239934ccd2d3 SHA512 f892a1fd621ee536a03a1114b69b2d512a4144651c3f146eeb22b70b6b4ad43feb7e5eaf0a8c023f889591c124778471a64ce6356320342b74b69eaef73fbe8e
-DIST NVIDIA-Linux-x86_64-570.169.run 375816796 BLAKE2B 1934cc5276433b6ee54b31358d85f88e3e81dd23732fa72848a6c60c455399b5217301e1c8aa1795dd8292bf4e604c6cbc144700775ec2661029b737ba2e3324 SHA512 79cf53770f11405ea416b4a3fe91edd34e8bc99e2f8e0d47dd2b01045b17f23998bfd3d60fc660c0826c69305ee928dec56fb251205e183ede9235e31d01d7d5
 DIST NVIDIA-Linux-x86_64-570.172.08.run 375905456 BLAKE2B 58418e039f378d78950345edac3c95fc9e4d5ed23419dfb7b256afdb918368ec15653744fcc4625c54cacdd7df00c0e57835ec4ffbf865384b27c623a351bd14 SHA512 8000f31575392ca8a575879f36b6e3e0fdee14e63efb856b77035e5aa434a02de0fd4ff5472d01984cbc541d40656ed6b7b77c78d00f6e1bc4341864bad725c5
-DIST NVIDIA-Linux-x86_64-575.64.03.run 387655074 BLAKE2B af4c42095bff2b195f46cb3472cde599e6b8cea7841110da75f7659c41cb83d8a4ee33b242aab44af606353456d9163bc9a73562be4693ac2d5a31621fb9af13 SHA512 ca705ad35dbb6e3e4872ec85dd78e70760e86b28d5d4b9bfe7b5d5ad0fca3bfdcf794e8708f3b1dfcea8edeabc208e820388af4a57dc9c6dcffb5d1761598779
-DIST NVIDIA-kernel-module-source-535.247.01.tar.xz 12517152 BLAKE2B b12497621ba32da4ca80ca6736d559bc98ba45974e06bbb63c08695c3b24c45752b3fd3dc2854ed64950e89e99b38d1006ce672096e35daced0ebe0a9dda77f6 SHA512 ed8e10d5245447fcdf348509ad62e9ac3d56a052d254b764e3a574a711cfa5c8831a759d425f42795c2db752f3d91d60b6097f6901c88654f242c94768faddb6
+DIST NVIDIA-Linux-x86_64-570.181.run 375778425 BLAKE2B e448f20117379c3428e1dd322e369e5d396c3471b0ed99b9c88492917e273f0f169d2f69bb380d2f7dec9244284e8612b2359f0f51efee51705fca5144f31bdf SHA512 5c6423554c634eb22c286689b28cec92262f36180bf264df83b0526df9923e4f9f9bc7b835a9082cbcfbf7b7a4621c0007b784bd79303bfd6c3fbb03dd3ce53e
+DIST NVIDIA-Linux-x86_64-575.64.05.run 386961985 BLAKE2B d8b5e5cdff3d2166c4fdf8328ae22bc4419509144ad0427b17636696e7398240a3601ded850893412198fc0d4ba76e72a64ed31d6ceaf58149d83a741ad62a05 SHA512 1f5ea98478c913b044cccb25934e12d58561643b83074e5967d84126baac9a5ddc092a6ea017956957abae174520718d747415d09c6fb2da110de51629df98a2
+DIST NVIDIA-Linux-x86_64-580.65.06.run 393832804 BLAKE2B 2e27d607f0a1fdf4112f4f9debbb3afa408ec5550fe6dee8737a3b319bda7e03ee7f67ede8b23823e01ce5006f7f41f772da1c9c439e8ae52cd24b0c390d0db2 SHA512 e9149873cc83c250f601be58ea919cbdc891773157587366d78f505ee1db96bf392bc5e689d39ce8fa339287699118897b8d6eba2b2a9caf163126a9bb2a6044
+DIST NVIDIA-Linux-x86_64-580.76.05.run 393683997 BLAKE2B b4b37e036f936a395092de722ce0774bd6d23d558a841acb3524bded3fa96fac7a5225aa264f34e1e6d8ab5474f73c60922c5a59e4dbc1c732542e43093eda18 SHA512 109b11c10445e24d94fa00495d8d117e7fa866248c0c33e213e8bf3de6c3d264581f1feffa4837c1efe2b8cdb1b39b96b35d58ac88850b59de7b8ea28ce6282c
 DIST NVIDIA-kernel-module-source-535.261.03.tar.xz 12521372 BLAKE2B 214f52874a3cac43ad135e57577f8879b605d67d4cec1756ee2a5ee3986568ce621bae603637fdb9ff0be9295e262a1f14f9dee6d871737bce02ea163aff7505 SHA512 346b12fdcd1a7b5b8067e6cee6567f4ab2a89e8d246ebec4ad0eeb6dc91782c701b9b4d7ef4903c2492726fc8c242572a63a3cb8a06a9fb4a6039b65ce11b8ec
-DIST NVIDIA-kernel-module-source-550.163.01.tar.xz 13552400 BLAKE2B e1fd753127d10097c5f1d3c90d95c7eb0934c0d5e1df0a371aed2a0d7669960b67c46eed20eec3c42ca41c0f34bf6d7d3d2a77a94308c9f86d4f5d831da19363 SHA512 c9f4ce2890db3fdc66dd080da4d6802a8bc3b18feba96be5d33641b02cca637b1bcd2a3748f36f93a32f26ba57eb352156314f139688b0d3a102efdfde6c32ba
-DIST NVIDIA-kernel-module-source-570.169.tar.xz 17928016 BLAKE2B 4d68cbcbbb14f0b9741c09dedad5abf859f971676869d46e8a6749c04dfc39a6f24098aff9c55d8d33e1e5b1f67be16a99af702f29003354635019ff94ee683f SHA512 7d5a06e596235d90ba5b26a4b04b68623b501643ea8c6bcd7342add6563684486f32b6399335a853f03cb588dc57cdb1397e2705bce512a8be57d3b615b8eb22
 DIST NVIDIA-kernel-module-source-570.172.08.tar.xz 17948096 BLAKE2B 23220805e6555e556c99659d9e17f5ab822b0e221cdce2c2639377680fdda9267eea200f7ca579d28497c89fa2167d524497e4c53cdcfaa20a1b0d7eb3aa7522 SHA512 969158a46d70b23911f77d08832c6b307503988bf1cee0b2a0f75a49612d447c23ff1fefa3eac373b53b79475f87f3470de7df72a395fdb8cd57eefa51bc1ad8
-DIST NVIDIA-kernel-module-source-575.64.03.tar.xz 18219744 BLAKE2B 4207f768bdcd1c72a42a1030e5f8e38afb3f3e23ea368a19f0b01dbdaf66d552d4a2573cc4aba31f31f006f6c829e99ccbb3775bf629b41cc1ddf13632a4ea40 SHA512 2acd48d39e9aabc892ad0eb3d98bc9b723fd79a9b7f24b9f55b3e591e5d27445fe5ffc9d1bd8042e9741d56ca815c47065f36d88a3a008e635af2011eb07cf40
+DIST NVIDIA-kernel-module-source-570.181.tar.xz 17932976 BLAKE2B 56c77d3819388af54873bc6b8edcfcda97959996c1f3e61982a5143b5c84f3139af78a478d9f54dc96de719951c9e0b77294174b6aa6fc8af669de115cf72d4b SHA512 3180bb89eeb13ebd1a032bca545d7de4b800a61bb7e36f702f89b3c76f1612f4d13546f224574d343f72babd3e908f4922642bbdc26cf8baffd97b11e248b78c
+DIST NVIDIA-kernel-module-source-575.64.05.tar.xz 18198316 BLAKE2B 622781dfa93ab11993a4cabf14e2104ae7fffa0a16ca504a1257ab9eedd832128dfe73a0b9567a4401bbcf83416305794861cd18c393797ab8d43af0c26cbcc7 SHA512 4cbe2e2d78eab84a8a0153f68ab6b1fefa75225c145b3bd9db4fab9d0cb212a4202a89d0e6d0f2d0dedb5663389f7c9ed6cadb6a656eb32dbde0cf0f806652e2
+DIST NVIDIA-kernel-module-source-580.65.06.tar.xz 22167352 BLAKE2B a96dbadb18d3e4cbc4acced86c5fdcc4a57e1bb1088a70b9b22cb07d50e4c4501db6479dc4b2c8c6db390a99fe94b9087ab4f7955c67ab50c08966f7a1deb814 SHA512 c0e5c63529488eadaeb8added44aad8c0bd532c1aa9bfa1c3fa4e37251b225fb509ea7cef6526a5ae4b82c7f6d331ad7243d479c4cbac1510b333942a55171a2
+DIST NVIDIA-kernel-module-source-580.76.05.tar.xz 22192720 BLAKE2B 421529ddce1e11a10937ee71eb2fb2f59150dc3692fbd001288fc72d072103ca06353fad1f49d7d83f5200d15ea561ef8f9ef6713324ce250242ea0f1adaf529 SHA512 4e672558aea0d690e4be8d85f1df27b1ff1de38818f2cbbdba0bdd8fec3bd7d5fc9d50494e9254eb7190c918f8cefc4dfeb1a5cc1d2bdbee86b2fe8412a31385
 DIST nvidia-installer-390.157.tar.bz2 150323 BLAKE2B 8058ca87a6dea956d564af9f7eab9b1fc82b1f2382bd5cb2f6d97cbe2e19292533522d5f8f2eacbeb16520372715fcb72f8f9b0998962af5d4e75522c8d74524 SHA512 93a7ece648602157496c8e27a88864ede341a100f5328a4c1a25faf8f0b94d252060e5e2f71d0c302fd0566c10773c30b76b3b5f431d8039b71c90a7969f7d7e
 DIST nvidia-installer-470.256.02.tar.bz2 146269 BLAKE2B 4402e725c8fd0157eb84d4ec140a33f97e873014577487ef1e32fb8921cabe79c60ff46532e5bfaabb2b6ac894f7c80086dbab19e61906e2e27346fb85f98829 SHA512 c962dc17d9696256d1ebedcaeb3010994f2ce3895aedc47987599ebfec132a9b9a249d2ece6502b15bd4a93f9b0106aa13487a7da5f64199c274ce11eba27cfd
-DIST nvidia-installer-535.247.01.tar.bz2 148887 BLAKE2B 3455f064d3a5745971e8ca6574bfe16258544e669f05fa6e1f31cc88a7224f76cbf5d1ea26a62e70e908b7261c3264664e090209221a6e64030c6f486b9452b3 SHA512 be97915091e60c56b442dcec45f76380ab316e95b7417d99133419a7883e1cf547ac0c03d7e763574613dfe5bc27dbc6c887ed9870e528ae056b2400175044e4
 DIST nvidia-installer-535.261.03.tar.bz2 148694 BLAKE2B e113e3a548f5cb562b064f97f3f81dad952dbf8acc9158a79caf14d0868bbc673ed2b5038f51361243547792a044f8d7306c69f5ccaa36717fe6de0ae39a89d8 SHA512 4f899eec7ef869bf9b89732bc29a1198792a4b984d308908d3b17917d4824425640ac988bc04f0eb539ad4eace38e7462f204bdb9cc6a6ac583c2e8b6e06f8e5
-DIST nvidia-installer-550.163.01.tar.bz2 155861 BLAKE2B 662064b3ceb4aadebde419057d85c6b4e28b91944bd5bab241bcba9b3c9a105e507afc7651b17fff01e1cccb78d66fdc6789597ce059f882a6f322b08f28e832 SHA512 f8df7a0eccdecb7d4d4f47d96050cdbefff91289b29550b061358614845648451d4b161d9bdbfbf5a9a87ce650d272cb3b795e6d2ed4d0274844a56db097bd15
 DIST nvidia-installer-570.169.tar.bz2 169301 BLAKE2B 2676261d50cfe235d099475bcedcc96549d5140bf0c95b8f41b49d62eb0cd5fdf5c2ed53a59f79c778011b50e95ef440cc7a3a7a6673de7311e4508fa8f5960b SHA512 5864343b23a27cf994e414bb8a3b90e7b740df54188d43172456ea163162cea74e0b38a0b41717756818262d9f80b25cfc7566900bc682ea0546a825d52e3cfd
 DIST nvidia-installer-570.172.08.tar.bz2 169388 BLAKE2B 44d0650e1a7cef00a47b828dc60af5a76eddd6733cef4539ce0199136bcb490355d72a3bc52b6028333d270b950884997dbcbe7d50bceb7a52876f9394a03734 SHA512 e64913fd6c66ee4d33e3de047ff9d901dedee514501c12421688494c995e66d201e69bbf87877f1c8fabe0b2a1d47f0f5a6e7cf865a62b2557526c2030386cd5
-DIST nvidia-installer-575.64.03.tar.bz2 169433 BLAKE2B b7e5b7e064739eff7088f329446db56892f0b2d5c29895da097aced366e248ddc88ba3922b3e94bf12883a7551edee7c9229787d0748df202823f6399cb480a0 SHA512 e32cbb2bfd94769c6808218a939380afc9a2da98c528a195e838c11e807438a6adcdc757bcbdcf7859c54d72f60c69f96bc21008d4cd38b67ac274e193fb6b1f
+DIST nvidia-installer-570.181.tar.bz2 169408 BLAKE2B bc5d33bfd7b380e5612e264636b1efeec58479fe2de579a59136770cb766349bb91e6cf8d0a45e4f3e90bd76290b1c1f07f3bab1f6e11d0728c23a27eea2d85c SHA512 2e2a50933291ac40627c5b042473759e75c493e2634e2fefa6ad33d36f1393d2ad49732551048bf0c7a192b4b2cf1dde53842735924480d8bc3015e557fb1b17
+DIST nvidia-installer-575.64.05.tar.bz2 169369 BLAKE2B ccff48e41296d6682c72f3d25eb7d7816dc83b4c6f279a4f5213db141353772d78d8ff3e23f2fb21ff8ce81a326443d12c3f05792fe1971b1fb54da764140065 SHA512 5033e40762b499e9b04a080942656a0c9b49e8f56c4a8236da38a587f8e13b3935f75e8c8dbdffbd0ef895c537a69f51ce6df7e6beca7be583aab09ed62faf09
+DIST nvidia-installer-580.65.06.tar.bz2 169402 BLAKE2B 8787cd296fe691098aca20a798530b639f02f9a5dfd03209bcae4e549a269744754c6af3e47cb238c1752b339f736a73847ac71710f88cc12a3989b6e38c9f74 SHA512 76fda68916b650918df5d8118b642887cbe54dac8377dc597c3a1827ae8ea7532819527fed0aa7e786eb7bd40d4cc9dcf44d135135c83cdcb63683f04eef80c9
+DIST nvidia-installer-580.76.05.tar.bz2 169100 BLAKE2B 8f5fd7a312216cf87facca4ecc485482759e6f352a66d78a6c2a8a3fc544351321d57a9d5ce40cca0e4647efdb720e986326a91d733297998afe945dccf7c77a SHA512 c478a5d1e2c7a627964f65fcedee1afca3cd70e916a36d1aa232d8425ddaa51612b35ef2cbe406dbffbb62c3207e422f500980f28fed5b157f190a07f8b9cdd8
 DIST nvidia-modprobe-390.157.tar.bz2 35306 BLAKE2B 80d202b39c2f95ec0f909712c2e101483af50124092c32efb33bd98ff58ddfb97b737ff07f1ddc941f688c1b4c26a15f392566d522e18506771f10422fcd571c SHA512 109bbe24a3758b568ea65fe1e9d78f69fae6108ec0497b796c885a3912825fe04ffd7389a3e22987f1a10a2926bf6eaa384faabc59478aa3ee244dd3ac91c6d3
 DIST nvidia-modprobe-470.256.02.tar.bz2 38769 BLAKE2B 0db444b09b0b6d24c04877fae95249e781d82b3141f90eb05d869b64d2b6e65ad00bf44c4e427c64dbd4765fa99a8699f80a1d95b00c66137a54dc878d7ea298 SHA512 c1cbfa6c8e188e5a5eb5d390b9a903406cbff103d212fc30e611e4023be3fde896ad84e8bb45b030beb5d1bcd8155c9e55a8f9636c45ce1e2a5c03f672989a31
-DIST nvidia-modprobe-535.247.01.tar.bz2 40736 BLAKE2B 31172b50777fb0bcc7696af660fd4f8ddc42bb126ff42edcee12097fe37748727c6357ef46b65a96004345fdc501487f8b5ad89eccef991eeb3c83e958f41a09 SHA512 f28340f935804e3cb07d394ad103b296a5e4fbfadeef7905266b85afd7cd145de033d603a4bd7947348add23a866548605264c814b48f4f6a5a1f4254f82cdc1
 DIST nvidia-modprobe-535.261.03.tar.bz2 40757 BLAKE2B 96ecb65511ff1ca033768f1f86e10e553bf686ff42c7f995a43c0e111ad5ddf97bd7b6fe439e5fb207f9b765e2200807703489815dba76599adaa24e4fd1bebc SHA512 755ec96dcdad34472f884383d104aa015ac5b964cded12046316f4dbd033ca723d225026866b59d0637294ebc185706204f889403db37552dd7d716467aea37e
-DIST nvidia-modprobe-550.163.01.tar.bz2 41448 BLAKE2B 23e567d612e669ec6ae9f389651c9e1cebe7ba59ee95bb5961e5071952697860df77f02026040e29135338eb7cf96bba0015b3d94548297235fb5214f35bec48 SHA512 0f5b59468a6e5e95dcdef1d938ea78f4ce09a0c9784e3c70d83f1c3b1bd52e8055b6b332147316445c3be714abab3629320d6117878d50aa7a2d7d2d9b9b6485
 DIST nvidia-modprobe-570.169.tar.bz2 41618 BLAKE2B ce6967fea67a387ab177d75cf0bec4162127e7f440ffc971115b2307d68307fdbddcded8e932022088f1815d7208d4b7b8d1895125866d443750307c1353867a SHA512 e7f4d0ad9b29f13b2fccddd27570832d7a95925d82aac0ea0af8b8dcf80ba220c82352b0394eff2184b7f6da227df2462d5579ed75c1a952727820503f37ea7e
 DIST nvidia-modprobe-570.172.08.tar.bz2 41640 BLAKE2B 7055228ef51da259fc93bd2047b2ba89a4a4cf6a34dc0a3dfe3f2738aa64acc88ff2a3be6d9fa80428d6b6e389084955b2647da9fff91eac7caa751e1ac330c2 SHA512 f3e6f51adfc9eb528cc4ab2f99153f2355ae03bd0f4f49879f165564023603e7fc32598ea768f77f7f901175e03a49e97ceda25f434e6a05aa74e372560f3cde
-DIST nvidia-modprobe-575.64.03.tar.bz2 41690 BLAKE2B dc2811d4c4febba18e0e1dd6632c5f4c3b1e289a27aa2f3b44eaa1e8ef5fc2daf37f52046ac27da1126fd4732be1ad8fa47f11ecc0850a5ff22d606b64710650 SHA512 7b2f99ae0c796e5099b775bee3e7edee898ed504d7165a916ad8a9c289859482866800cf6954f04f5058eb60479c867936fc019b9d2bf6578375534a19482129
+DIST nvidia-modprobe-570.181.tar.bz2 41624 BLAKE2B 38dced2130273ca7f4509263a2a2c42136c504fe4c7d2e935a0d9631ca1cff8b93bbca25a48522d2ead8d11e144bc7b4ddc7df30850b4d722ba45b45c0c2ccee SHA512 a4bcd6f549a1b3b2fad0e984fb2e1de56c4f7ce007a0db851887857282cbbd58009988fe6d89f47334395417cf4408548999e8129f84bd240e92dffffeeb9c6a
+DIST nvidia-modprobe-575.64.05.tar.bz2 41721 BLAKE2B 9b8a6dda556389abe0c2bd81ed3edfa8142f773832b7d955385119b5fd525cbcfd3c01401f471ccf5dc7ce61100ba6a3c4504b8eaf86ea5b378d20a6046ff7ce SHA512 221a0469a974c7db3f3c489f2637b6eef68e614c5ccd3e94c8cbe1b8841a6e9a4f0e2f05642b6c9f7113efe3c211076ac31578e9587df26b76148a198d21cd49
+DIST nvidia-modprobe-580.65.06.tar.bz2 41680 BLAKE2B 20ef65477baf17c761b934176b3df4a8a0e67531c1710b693e1d0f0d2554fbd1560c07bbaba874ff953917ef8d0d053d447c6bf5ea8ce2eb3ccafab5d7203ef2 SHA512 a314a24402cdc49fd1932f7ec4f687aa29682d723bab185d770579f1a374dbebbdcbbda8c3bd33f53304b3c10e3402f1a58c16c00382ddc7a456ee64c9baf8a5
+DIST nvidia-modprobe-580.76.05.tar.bz2 41700 BLAKE2B 3aa8f017417996377ec37f8d5463d258d392ce5e730139dda188a84c53efbe3c0e8f2daa3c496b1c87c834756bc4776551c8b021638c0b65c6453c672cf81fe7 SHA512 cda41ae9fd3c96ad035c1e2b882f342873c8c59b4e9fb24e0afb57d12c856cf0f589a4aee2def66e54a609380326b17570f96ce20140767188d65efff71bf67c
 DIST nvidia-persistenced-390.157.tar.bz2 48654 BLAKE2B 2cf6c92da90acff55e8c180a06b0c6a29d48be9fd8ca3c541202fd14f0697220fba6b66452942aa7ae7cc8821f5c5eb9fa8f7a31d2248624e5f9141d83a176b8 SHA512 70f0707ed6f2b877e69ef90cf782f66cbc9d2071db53ca09ceb7b89427b0fe176708517340621fa251539b7d481b238adeeb60261674eed74de1f62db6dbb72e
 DIST nvidia-persistenced-470.256.02.tar.bz2 46567 BLAKE2B 8f837322a3b88412fd2f6acf38721b49a6cb444fbd842d652519e5596f2e545d8f06bbdf017f46a22301ce87455f96147fab2829ca5fbf26131ec3e4a772e282 SHA512 4fd19258649b7d39945fb5c8578bf11ab118617dd14f3d11cdf15cb3fe77daf7b4719e4ae57af59031b1b809d02f4e8e8afed0ec60b9d0aed4d2488bd3013cd9
-DIST nvidia-persistenced-535.247.01.tar.bz2 48589 BLAKE2B 1b641fb85fb74e5314c0f525361cba23ac08d5f6570bcd9a6d89b376497bd0aa1cbbb52fe391a8f7bf41734e49d46d464440573b0298b5c0fd5db7fcf3100d58 SHA512 be23e7790d582a340e14c7df16f9ed09447ef8efb352d8b8e53e5be91b624953d8237c988ce0b0b0c90e1b15077af7efd6c6a0e628345f2188b6dbe09122373b
 DIST nvidia-persistenced-535.261.03.tar.bz2 48574 BLAKE2B 71e6be9fd37da2532219a025293a286d87efa31c7fb1d2827b859688f0ed433ffda848a8964980f08d61e74b888b81e694ef8622231642e46e800a346890eb9b SHA512 56d079434e18397516ecf7c398f242f5a3a48781f0ed8fcea30bf844c7bbf5b2618c5817f2df7032670a99cee4f93fe0e7798ef6bff7545e9824fb34919e38d5
-DIST nvidia-persistenced-550.163.01.tar.bz2 61450 BLAKE2B 1a11cb89981b88f8d14558227d9493f1f8a81ccb5502002c436e9311a38c9c8fe0402c65eac1517a2893985eec07699b2e7bc7a81aa14dc0d52198ac85a2cd1b SHA512 f17dbcafa917b5b450f7665f98fd24f06ad99e6bcd1fcf42ef95aa9337b55561b7b16eaad8fa408110d08ee7e6d812444792cccbb9c92865099891832da779ce
 DIST nvidia-persistenced-570.169.tar.bz2 61792 BLAKE2B 14568a42ee3473efe341bd9332081d2a1625f91662c58e75b1b218d5a3d19496071fcc5e9840fa1563aec2755c9d6810db531ed3616c825987311cf3690147f5 SHA512 c5e343be16719ba89f1a37ca8fdeb7f15a4fb028dbce554a7c524238ccb1ed1c1b0527a86a2e6dbdc01cd0b6f3a5d996a0895de4698a0ea98278cd93ef911d58
 DIST nvidia-persistenced-570.172.08.tar.bz2 61946 BLAKE2B e15575f73d94614912b5823b16bb64ac571ce5fe4e55bfb2d346ba9ebfdbb5c11562651518382638fe109bf7990bbcabd70d35916dfa0fd94dee317499d7487f SHA512 c43b18e01b46d99ebcd9b9760755984f96430d448f85421d2ad0ebad053aa7f6add6af2b03ebf76b5d5dea6e6958a6ee5baa30189e43ca1f2cc51e3487b41e27
-DIST nvidia-persistenced-575.64.03.tar.bz2 61943 BLAKE2B 745dc8114a0857d4ca0ebe928f4ebc82cf526c1b593717e0fa1148c3d62976e3c8b97b6a96ad9ca3abc10a7d0090fd8f8a9e135df498a4c2bb053db8faa273e2 SHA512 1872b34b4830984b5ea1b79dc328bcc2c013804fb8fbac549291750719a6493606e8d5580a857701fec12cd24e2319d1d1d6c124f2b129473bffa457f3a6ac9b
+DIST nvidia-persistenced-570.181.tar.bz2 61808 BLAKE2B 840e248505a199cc76bc091ae679196618eba3710a29eb7ea30249d22d12a91f62555be97ca3cae28ab0573d72b5e4b26d49c8202d0439d407260e4b98278d98 SHA512 6703b19d06f281bd4df01e64e8d1a17319f681a8826c32b1839363f5ebf53e64da625350f5bcf4887832f18a9f9127d1b749f2419650caa1ffbd68c85470f067
+DIST nvidia-persistenced-575.64.05.tar.bz2 61961 BLAKE2B fa40aea873a30e7c500c2abe85a0ed7e278e4e1cceb2be9fe370752b3e44bccfd94e15e42df2f10237bc02015545b5b31ecdfbfd84b4f0400d56484a69ed96b8 SHA512 77a6fe5665bee6225433e383fe3016a667241e0772223d978ad42df40c8bc77207185c47961859ca9d334bebc7422d1a825ddf58e77d4caa630fcee1ecc5fa54
+DIST nvidia-persistenced-580.65.06.tar.bz2 62200 BLAKE2B 729523f9b5c469949446d0852fef66d404b46251d51680adea9791d24ffc4484d8a8e46256c7dde7fb3c9cb2ab7ba078dec14245778952848562a544944040c9 SHA512 b0f8e329328eb80fd600c711f8f16f1d35dd3deeb1ca6c740b02c79aade0e5d0e4bfa98892a67d1306637b9998aa3ac423e479a5505b6b51d1270ee9b06f528f
+DIST nvidia-persistenced-580.76.05.tar.bz2 62194 BLAKE2B 35201de796378644162308562472a799d361f5b0756235e0e6c468744bfbba832a5b91b6a505fd1908bc9d08562b2623ba9f300b5680376cea372e1a1860fe61 SHA512 3a26b4a801803fc60e4501fe2938e0f27f5be573db5229e1ad9281012faffe248a1fd21a5585e6007aa8242f0f2b886a673488d9a47a163bdf7d142e381ff4b1
 DIST nvidia-settings-390.157.tar.bz2 1108938 BLAKE2B d9ec1ab5d7f157d74627272adf752a671dd17e2ede02069437b6180b927fe315b15cc6416d584ab2f038b76fe01e5b64514a834f24d88ac16676e55205fdecdd SHA512 b16699009bf56a1ff3b623a528c58061c4f5a2c5c4a373756a07bcd667743a1df7c733a572d2d0baa835a904ac2fda8a5c85890dcc00c3a0f223e0467aea902d
 DIST nvidia-settings-470.256.02.tar.bz2 1062273 BLAKE2B 8e66201e7861469b12932595ef8f9fd29d4cfd570c2576ae7fbb7383f61c55ac71fe721cc431e79d6d69f86d998b5b4c3cafe531b573f439e6b499b0fc047a19 SHA512 626e66118ae2e62eacfdf44e37529c409b945a6f33637b9690d74abd87a2afb581aaca5f90328d280da99ceb659959d0e5dc5c22ef8013b2205b2b1c72e08007
-DIST nvidia-settings-535.247.01.tar.bz2 1094617 BLAKE2B 26a12ea76be9ab930553fcdd0f19db1de8e8fd41a5f180a09f418bdbec38aab6f05c019a85249de3fe523df4aba6ffd339ccce4758e739fe092ecaaf25fb5008 SHA512 9651cc907fa78139f4774764132f5a46c1feee016aae021905a463100f102e6321b79c2c4f5b1fe149cde481a5baac17017770244ad35c6d7f14e7975f23a7c9
 DIST nvidia-settings-535.261.03.tar.bz2 1094587 BLAKE2B 3be599e733be97e0a23182d9bfc2862a2ff1d386a8339a34f369ac3e7a29b951ef7c900424502b31d8a50b8a5571c440ba6fd1314874a5ca594657742ef0aca1 SHA512 418f078caed68e9d1feef10a3a772fb9a265fac5a74822e2637c0b8bdbdc43629a8ced83549ee1c237b327490783d7da59e749f3c284a17edea2bbab62462f68
-DIST nvidia-settings-550.163.01.tar.bz2 1099317 BLAKE2B 25419c1796deeea238b3e44fd8d648a8627272565be40cb0745132cef1c16e0c422242a1e6369745d577e674a68bf9dfc3c009e281a84ba58db5429d97ac9cff SHA512 5306ab05f284ba06852d7c96ff62ded7b8b615d3a002009cd5d781fdad716db37f53d1c8a43337ada60d524b4f7d183d98ad2673f40a5ca1ca4c5112bb913e74
 DIST nvidia-settings-570.169.tar.bz2 1123877 BLAKE2B df4309c9230352b88467537e9de9372e3e422a1b346c01ca807191aa322638ead912ffd80eeef8e404231f9d28ec9e45fddb1fe1a94777f6ca122e378c0c5b7b SHA512 34c25843c55e80efc987f344b3226e2715ccbf60e9d9f75f665c1a4199d69bef005f5c27d04f5d1cdf4fee38e4d44857d32f2dd97f84764e054d0050881a6377
 DIST nvidia-settings-570.172.08.tar.bz2 1124326 BLAKE2B 7f47c998b914d15af1612134ffd09ba2c01b649b23813c4170c3b3d529ace5e04322f201b5a80277439cb4ed20a84803eb225539d9c06b7cbe035ed886d3ab64 SHA512 2697ccce69c005550dda5c01a5da975d0dcfe67a32b7872b7c215392397a471152dfdd858920842388800c2f34f4d284735bf9ba34fcae1fd0ca426f10568f77
-DIST nvidia-settings-575.64.03.tar.bz2 1127787 BLAKE2B fc1d1748054261a6a9a86bfdad07955ddea9de1cabdf4a56fa714c2782a018215fd3a12690aaec16a50a7fabc5c3e24d2cb7f18eed2c41f7c9308fbb2cfd0ccf SHA512 fddfe256939f279e86f5ab8cbcee599b052d712be94b724003199c11a8d702742e03a0d9e473a6ae7671e8f56f10e2e86e7f216022dc45558412ae4d045aaeb0
+DIST nvidia-settings-570.181.tar.bz2 1124398 BLAKE2B 9f1df84900e763af0e88f0c2c475d0f9a96f7ef974e3fd2dfe702ee3cd9636fd7f6986e9779b3c083e9b979e8cca133b14bf5481ad1d3c16365ecc0c0f0000f6 SHA512 fcca18c216f6d8de1167f82cb0f170ef845f0a85d279a3e851cf5819c3afb4b18ae8f864a89009709d925ccb7a756e02307b67bf8aedd5cddd45de3f5b399be7
+DIST nvidia-settings-575.64.05.tar.bz2 1127714 BLAKE2B 935649b61361ff9b05f34ba9770704eb945134199edbb17d2581f74188f8b122009b6d4309b225c375fcb80f26fb6a82c9528bf22e5658c5856d1752bee309bb SHA512 3e3df016f1f6b34a802d872c67a9f1c0db6d38c8265343eb607c71c59bf5597c7378800641b1152af404ebc0515f8f79eff1ee0e81b87b84ff7a237c176526f6
+DIST nvidia-settings-580.65.06.tar.bz2 1130649 BLAKE2B b61ba9175db6bf25db878c40f5c2d41fa05f2422b6d93bbfa413e4e8a3edc2fd245fbd8431bbd9c573bd023dff7a2fac0bd1408ce50465aaf0d1c956cd5dbe46 SHA512 f32b2d667c7273fe4557da128e0bb26c4658f279f770e243c85081d572bb716a9809c3ad5fc9253f269619aa3b9cbf20afadbec290c02dd9bf621d25b23e662f
+DIST nvidia-settings-580.76.05.tar.bz2 1130706 BLAKE2B 3a20ef61a2d27ec30555242358ca05965b67235b8baacb6af01a2384f837a9823bab7e35659e29d42a2487ec37a878a68cd07e6b074a1a0365bec53de09e4887 SHA512 89dbe0f4ddddab44e29eac441789cd55a2102d1986339507b57123795afd8f7faf50d500a41167bc2ba4159339d775eccffffbb1252f7de2d51f85fcb078665a
 DIST nvidia-xconfig-390.157.tar.bz2 107399 BLAKE2B 0cbb3b1ba508ddc3ba4a161c290b31bf7a67f67880bdbd01171a962c5fa97ca945b1ef17932403f8589309380743f1da632c728d8accb6d4e56dbd895e7486bb SHA512 50b390811c9bf091b14add41f886925b17496b41006b7d3981d2398caa65cf5db8a579c8cebed78278384bf3acc629befb07b54339c61abcc75852c0dcb8b8ca
 DIST nvidia-xconfig-470.256.02.tar.bz2 108698 BLAKE2B e468574e4bc57e7279d4120e2b08a201671b50d408be0c530eabe5da7d45daaf21cbf5c7fa31410d0d732fe8ea1551cbfb21d1ae193c1b3f5b5c50c764c9e236 SHA512 9dcec1e0c2b56b4d38a5f2c76086302f8bc0860cc15012cce29c3a5062f801a48b6a2bb78344361b07a2717b58502783441a2daf402d9973a17526175b1f15ca
-DIST nvidia-xconfig-535.247.01.tar.bz2 110621 BLAKE2B 3d567d30e19dfc449e23c80e6fe25536f02e2450bb82c4cdc2b508493cad6d6b4f58467d302fd64a8b37e8a129be4c04b365ec3e4e9f18966d25cd23c6adc91c SHA512 2748aa9997e84e0f39b52bc6f49e2b53ffa7181aaf0ce5b9d06d8e6e010ecd589ee77388807d922c3be4a847b8a4e9e1eeba42c905a32ebb5d3f9b93d6f30511
 DIST nvidia-xconfig-535.261.03.tar.bz2 110637 BLAKE2B aafefde5e5079401951432072f27f6500bf3a4390e01b83e46b7230c75b05cd5806fffbde98f8bd8a39afe1a27bec0f52e13920fa1fd156d083b6ef81e482edb SHA512 4c0ee56495dedb08d6ea0e452cadf02ebcfffb86e8649c9b7904285d5dd8959879a1e00396d1560253c755c9490643458e737afcc0613c0c36dcd37411c76607
-DIST nvidia-xconfig-550.163.01.tar.bz2 111149 BLAKE2B d19ef0427e3432798e674dc66447090e8fb8fcb549ebe27aaee19aa38294cf178e175a067b2da5313342c93ea2aebef35861d05cc4cc0ee2c3eae955b3ddbbb3 SHA512 35f95d85928c82bc5de8e462ca5e90a6d8fe03e5b5367b9cdaadddc1e956f0d26b6dc42e716ae7c88512afdfb98cc841fe9b22846f6d6acc578c5dba4d0a16e1
 DIST nvidia-xconfig-570.169.tar.bz2 111343 BLAKE2B ff9c00145277241a5acb290fddfa01a906ba26601c45f12d06ea8754be9d29c836f68640db411de6e904d608523bd9d10b644bf1976ef201c58d55db2fc16a47 SHA512 5db772f2cecb3436a42b0f5cad550afae3453d3b17897f457e8f6b48a9c2a71997a317b121837f68e7f23d9a3e141464485144ce362f33adf3d70b326205bbb8
 DIST nvidia-xconfig-570.172.08.tar.bz2 111153 BLAKE2B ac099f751dbd81c062667eb6fdd9b4007e38ee109fe1da125463e599f6c1e46eb45029a9499f0007c058601e620184affb5ede9f288532cb8d2d8fe52d90349d SHA512 4b2aa9f425380108cd534b68fc2b77ff43498fd18003f644a33f789aa4b9e898f4a02c7a0938e6862bebbb8bc0c1e450345f038a3e77ccbbc5c93814571fdcfa
-DIST nvidia-xconfig-575.64.03.tar.bz2 111258 BLAKE2B 9375391caf27760915417bb9beab02061def4b58a1e4bbd72ca95877931f9431258838f3db56000ddfa7684b3d3ac6d935d3aab790526d670d5ff0ddce7c0461 SHA512 9cc6a87f3ae9cc5dc3a07750c1f4d50b339a4eacee1ab320b47a339d191e0a150536563adaff265f5611a927fc4efc1f5009f22597489cf8521812c55ffc334f
+DIST nvidia-xconfig-570.181.tar.bz2 111274 BLAKE2B 864181bae415b0da164b7d229b25fe0fe963f2e0b89fb0f92c3d799823d6a961b55458e2c6ce80ee3a991b3af387286a0e3d25afb5a90fe1dce8abca77ee2c9c SHA512 44d1a17187f88570382073901b7e64332156cd99a916b5ab483850df496fcfb4f9980bc323df65f73cbe65c32ff70995d00865155ef05b28cba24378fc49accb
+DIST nvidia-xconfig-575.64.05.tar.bz2 111165 BLAKE2B 87b272e12b63e6d4a393b76e4ec4c47d1433caee1e73ab50c3da8b1b3cb4ece0d0adad3e6496df4a81c0efd8aff67f8afa5de192df24cbe4ae7f8a4b86d674ac SHA512 00dfe0cbf0fb1131391a38b2d1bd95e52ac90b77cf19b76cb6cd6d0a3ef83c5020ff5dd8e08f8d424a7b32338e7752675e1f700392df7efd2d9b96bbc8072541
+DIST nvidia-xconfig-580.65.06.tar.bz2 111555 BLAKE2B 0939b3e50a6c64ef8f436f7fa96aea1320a8b74b507feb18f0ec1062b07fe476ce46f121d985d03c10893a61e4f22caca218c69047b99f3a451b98bacd95439c SHA512 7a29708c548e8ad43d74550c579e603fa5936c1439a46afe97ab08d810a4d0d91527f26e55e03104bb351e765e3c2ee2905858e0b99d4b43d514c15992cb7d6a
+DIST nvidia-xconfig-580.76.05.tar.bz2 111510 BLAKE2B b483fc6a8d8285a35d45946d2836f82dd96aacf005c67260a6db08b311b5c21ee538c428f8280429f0f6af4d0e7fc38278e239d1654fc5827b3d6fbedf5e5fa6 SHA512 9daf8f8a00eb7317a3e73c6d1398fbb1154e58c181be5e6d83b4fb3c1c7ac2c50aade9192985ccfe9df08e5c7fd6c27ffaa499b8b62ab289603cf0d294517029
 DIST open-gpu-kernel-modules-570.123.19.tar.gz 18685718 BLAKE2B 67503cefeb07be00ef16eb2d3ffb1287dc1f460f1ad908526046795cdaf2662fef01affcd23a957e97610560d8380d42c0a24d916a4cfd09d77d5b7f1ebfe7da SHA512 88bb3db9f8d38b03a92f60a56ff31b1c27695151fd6cd892d562fc9e31adc8303d54e35bfca59d368ca8d0fdb847674d3b4a240aabed476d6e89c8dcdbbf2d2c
diff --git a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/files/nvidia-545.conf b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/files/nvidia-545.conf
deleted file mode 100644
index 5f7f384c271..00000000000
--- a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/files/nvidia-545.conf
+++ /dev/null
@@ -1,39 +0,0 @@
-# NVIDIA drivers options
-# See /usr/share/doc/nvidia-drivers-*/README.txt* for more information.
-
-# nvidia-drivers and nouveau / nova cannot be used at same time.
-# Comment out the following lines if you wish to allow either.
-blacklist nouveau
-blacklist nova_core
-
-# Kernel Mode Setting (notably needed for fbdev and wayland).
-# Enabling may possibly cause issues with SLI and Reverse PRIME.
-#options nvidia-drm modeset=1
-
-# Enable experimental framebuffer console support (requires modeset=1 above).
-# Replaces efifb, simpledrm, or similar once loaded (emphasis on being
-# experimental, "may" cause issues X mode switching, sleep, or more).
-#options nvidia-drm fbdev=1
-
-# Suspend options. Note that Allocations=1 requires suspend hooks currently
-# only used when either systemd or elogind is used to suspend. If using
-# neither or have issues, try Allocations=0 (revert if it does not help
-# as =0 is not recommended).
-options nvidia \
-	NVreg_PreserveVideoMemoryAllocations=1 \
-	NVreg_TemporaryFilePath=/var/tmp
-
-# !!! Security Warning !!!
-# Do not change the DeviceFile options unless you know what you are doing.
-# Only add trusted users to the 'video' group, these users may be able to
-# crash, compromise, or irreparably damage the machine.
-options nvidia \
-	NVreg_DeviceFileGID=@VIDEOGID@ \
-	NVreg_DeviceFileMode=432 \
-	NVreg_DeviceFileUID=0 \
-	NVreg_ModifyDeviceFiles=1
-
-# Should be no need to touch anything below.
-alias char-major-195 nvidia
-alias /dev/nvidiactl char-major-195
-remove nvidia modprobe -r --ignore-remove nvidia-drm nvidia-modeset nvidia-uvm nvidia
diff --git a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-535.261.03.ebuild b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-535.261.03.ebuild
index df56b447d8f..dca7f85afe0 100644
--- a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-535.261.03.ebuild
+++ b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-535.261.03.ebuild
@@ -7,7 +7,7 @@ MODULES_OPTIONAL_IUSE=+modules
 inherit desktop dot-a eapi9-pipestatus flag-o-matic linux-mod-r1 multilib
 inherit readme.gentoo-r1 systemd toolchain-funcs unpacker user-info
 
-MODULES_KERNEL_MAX=6.15
+MODULES_KERNEL_MAX=6.16
 NV_URI="https://download.nvidia.com/XFree86/"
 
 DESCRIPTION="NVIDIA Accelerated Graphics Driver"
@@ -24,7 +24,7 @@ S=${WORKDIR}
 
 LICENSE="NVIDIA-2023 Apache-2.0 BSD BSD-2 GPL-2 MIT ZLIB curl openssl"
 SLOT="0/${PV%%.*}"
-KEYWORDS="-* ~amd64 ~arm64"
+KEYWORDS="-* amd64 ~arm64"
 IUSE="+X abi_x86_32 abi_x86_64 kernel-open persistenced powerd +static-libs +tools wayland"
 REQUIRED_USE="kernel-open? ( modules )"
 
diff --git a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-570.172.08.ebuild b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-570.172.08.ebuild
index b4532b44929..26b8820d631 100644
--- a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-570.172.08.ebuild
+++ b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-570.172.08.ebuild
@@ -7,7 +7,7 @@ MODULES_OPTIONAL_IUSE=+modules
 inherit desktop dot-a eapi9-pipestatus flag-o-matic linux-mod-r1
 inherit readme.gentoo-r1 systemd toolchain-funcs unpacker user-info
 
-MODULES_KERNEL_MAX=6.15
+MODULES_KERNEL_MAX=6.16
 NV_URI="https://download.nvidia.com/XFree86/"
 
 DESCRIPTION="NVIDIA Accelerated Graphics Driver"
@@ -24,10 +24,7 @@ S=${WORKDIR}
 
 LICENSE="NVIDIA-2025 Apache-2.0 BSD BSD-2 GPL-2 MIT ZLIB curl openssl"
 SLOT="0/${PV%%.*}"
-KEYWORDS="-* ~amd64 ~arm64"
-# TODO: enable kernel-open by default to match nvidia upstream, but should
-# first setup a supported-gpus.json "kernelopen" check to abort and avoid bad
-# surprises (should abort for legacy cards too, and have a bypass variable)
+KEYWORDS="-* amd64 ~arm64"
 IUSE="+X abi_x86_32 abi_x86_64 kernel-open persistenced powerd +static-libs +tools wayland"
 REQUIRED_USE="kernel-open? ( modules )"
 
diff --git a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-570.169.ebuild b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-570.181.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-570.169.ebuild
rename to sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-570.181.ebuild
index 2562854dc50..3fced1ddbaa 100644
--- a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-570.169.ebuild
+++ b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-570.181.ebuild
@@ -7,13 +7,16 @@ MODULES_OPTIONAL_IUSE=+modules
 inherit desktop dot-a eapi9-pipestatus flag-o-matic linux-mod-r1
 inherit readme.gentoo-r1 systemd toolchain-funcs unpacker user-info
 
-MODULES_KERNEL_MAX=6.15
+MODULES_KERNEL_MAX=6.16
 NV_URI="https://download.nvidia.com/XFree86/"
+# x86-64 .run was missing from the usual mirror, use us. until next bump
+# (note that it lacks some other files, thus the separate variable)
+[[ ${PV} == 570.181 ]] && NV_URI_TMP="https://us.download.nvidia.com/XFree86/"
 
 DESCRIPTION="NVIDIA Accelerated Graphics Driver"
 HOMEPAGE="https://www.nvidia.com/"
 SRC_URI="
-	amd64? ( ${NV_URI}Linux-x86_64/${PV}/NVIDIA-Linux-x86_64-${PV}.run )
+	amd64? ( ${NV_URI_TMP}Linux-x86_64/${PV}/NVIDIA-Linux-x86_64-${PV}.run )
 	arm64? ( ${NV_URI}Linux-aarch64/${PV}/NVIDIA-Linux-aarch64-${PV}.run )
 	$(printf "${NV_URI}%s/%s-${PV}.tar.bz2 " \
 		nvidia-{installer,modprobe,persistenced,settings,xconfig}{,})
@@ -24,10 +27,7 @@ S=${WORKDIR}
 
 LICENSE="NVIDIA-2025 Apache-2.0 BSD BSD-2 GPL-2 MIT ZLIB curl openssl"
 SLOT="0/${PV%%.*}"
-KEYWORDS="-* amd64 ~arm64"
-# TODO: enable kernel-open by default to match nvidia upstream, but should
-# first setup a supported-gpus.json "kernelopen" check to abort and avoid bad
-# surprises (should abort for legacy cards too, and have a bypass variable)
+KEYWORDS="-* ~amd64 ~arm64"
 IUSE="+X abi_x86_32 abi_x86_64 kernel-open persistenced powerd +static-libs +tools wayland"
 REQUIRED_USE="kernel-open? ( modules )"
 
diff --git a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-535.247.01-r1.ebuild b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-575.64.05.ebuild
similarity index 83%
rename from sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-535.247.01-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-575.64.05.ebuild
index 814d02552b2..99cd2bf5f04 100644
--- a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-535.247.01-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-575.64.05.ebuild
@@ -4,16 +4,20 @@
 EAPI=8
 
 MODULES_OPTIONAL_IUSE=+modules
-inherit desktop dot-a eapi9-pipestatus flag-o-matic linux-mod-r1 multilib
+inherit desktop dot-a eapi9-pipestatus flag-o-matic linux-mod-r1
 inherit readme.gentoo-r1 systemd toolchain-funcs unpacker user-info
 
-MODULES_KERNEL_MAX=6.14
+MODULES_KERNEL_MAX=6.16
 NV_URI="https://download.nvidia.com/XFree86/"
+# x86-64 .run was missing from the usual mirror at bump time, while
+# aarch64's is missing from this one.. so fetch from different ones
+# for now and drop this next bump
+[[ ${PV} == 575.64.05 ]] && NV_URI_TMP="https://us.download.nvidia.com/XFree86/"
 
 DESCRIPTION="NVIDIA Accelerated Graphics Driver"
 HOMEPAGE="https://www.nvidia.com/"
 SRC_URI="
-	amd64? ( ${NV_URI}Linux-x86_64/${PV}/NVIDIA-Linux-x86_64-${PV}.run )
+	amd64? ( ${NV_URI_TMP}Linux-x86_64/${PV}/NVIDIA-Linux-x86_64-${PV}.run )
 	arm64? ( ${NV_URI}Linux-aarch64/${PV}/NVIDIA-Linux-aarch64-${PV}.run )
 	$(printf "${NV_URI}%s/%s-${PV}.tar.bz2 " \
 		nvidia-{installer,modprobe,persistenced,settings,xconfig}{,})
@@ -22,9 +26,12 @@ SRC_URI="
 # nvidia-installer is unused but here for GPL-2's "distribute sources"
 S=${WORKDIR}
 
-LICENSE="NVIDIA-2023 Apache-2.0 BSD BSD-2 GPL-2 MIT ZLIB curl openssl"
+LICENSE="
+	NVIDIA-2025 Apache-2.0 Boost-1.0 BSD BSD-2 GPL-2 MIT ZLIB
+	curl openssl public-domain
+"
 SLOT="0/${PV%%.*}"
-KEYWORDS="-* amd64 ~arm64"
+KEYWORDS="-* ~amd64 ~arm64"
 IUSE="+X abi_x86_32 abi_x86_64 kernel-open persistenced powerd +static-libs +tools wayland"
 REQUIRED_USE="kernel-open? ( modules )"
 
@@ -60,9 +67,9 @@ RDEPEND="
 	)
 	powerd? ( sys-apps/dbus[abi_x86_32(-)?] )
 	wayland? (
-		gui-libs/egl-gbm
-		>=gui-libs/egl-wayland-1.1.10
-		media-libs/libglvnd
+		>=gui-libs/egl-gbm-1.1.1-r2[abi_x86_32(-)?]
+		>=gui-libs/egl-wayland-1.1.13.1[abi_x86_32(-)?]
+		X? ( gui-libs/egl-x11[abi_x86_32(-)?] )
 	)
 "
 DEPEND="
@@ -73,6 +80,7 @@ DEPEND="
 		x11-libs/libXext
 	)
 	tools? (
+		dev-util/vulkan-headers
 		media-libs/libglvnd
 		sys-apps/dbus
 		x11-base/xorg-proto
@@ -82,6 +90,7 @@ DEPEND="
 	)
 "
 BDEPEND="
+	app-alternatives/awk
 	sys-devel/m4
 	virtual/pkgconfig
 "
@@ -90,18 +99,21 @@ BDEPEND="
 QA_PREBUILT="lib/firmware/* usr/bin/* usr/lib*"
 
 PATCHES=(
-	"${FILESDIR}"/nvidia-kernel-module-source-515.86.01-raw-ldflags.patch
 	"${FILESDIR}"/nvidia-modprobe-390.141-uvm-perms.patch
-	"${FILESDIR}"/nvidia-settings-390.144-raw-ldflags.patch
 	"${FILESDIR}"/nvidia-settings-530.30.02-desktop.patch
 )
 
 pkg_setup() {
 	use modules && [[ ${MERGE_TYPE} != binary ]] || return
 
+	# do early before linux-mod-r1 so can use chkconfig to setup CONFIG_CHECK
+	get_version
+	require_configured_kernel
+
 	local CONFIG_CHECK="
 		PROC_FS
 		~DRM_KMS_HELPER
+		~DRM_FBDEV_EMULATION
 		~SYSVIPC
 		~!LOCKDEP
 		~!PREEMPT_RT
@@ -110,25 +122,29 @@ pkg_setup() {
 		$(usev powerd '~CPU_FREQ')
 	"
 
-	local ERROR_DRM_KMS_HELPER="CONFIG_DRM_KMS_HELPER: is not set but needed for Xorg auto-detection
-	of drivers (no custom config), and for wayland / nvidia-drm.modeset=1.
-	Cannot be directly selected in the kernel's menuconfig, and may need
-	selection of a DRM device even if unused, e.g. CONFIG_DRM_AMDGPU=m or
-	DRM_I915=y, DRM_NOUVEAU=m also acceptable if a module and not built-in."
-
-	local ERROR_X86_KERNEL_IBT="CONFIG_X86_KERNEL_IBT: is set and, if the CPU supports the feature,
-	this *could* lead to modules load failure with ENDBR errors, or to
-	broken CUDA/NVENC. Please ignore if not having issues, but otherwise
-	try to unset or pass ibt=off to the kernel's command line." #911142
-	use kernel-open || CONFIG_CHECK+=" ~!X86_KERNEL_IBT"
+	kernel_is -ge 6 11 && linux_chkconfig_present DRM_FBDEV_EMULATION &&
+		CONFIG_CHECK+=" DRM_TTM_HELPER"
 
 	use amd64 && kernel_is -ge 5 8 && CONFIG_CHECK+=" X86_PAT" #817764
 
 	use kernel-open && CONFIG_CHECK+=" MMU_NOTIFIER" #843827
+
+	local drm_helper_msg="Cannot be directly selected in the kernel's config menus, and may need
+	selection of a DRM device even if unused, e.g. CONFIG_DRM_QXL=m or
+	DRM_AMDGPU=m (among others, consult the kernel config's help), can
+	also use DRM_NOUVEAU=m as long as built as module *not* built-in."
+	local ERROR_DRM_KMS_HELPER="CONFIG_DRM_KMS_HELPER: is not set but needed for Xorg auto-detection
+	of drivers (no custom config), and for wayland / nvidia-drm.modeset=1.
+	${drm_helper_msg}"
+	local ERROR_DRM_TTM_HELPER="CONFIG_DRM_TTM_HELPER: is not set but is needed to compile when using
+	kernel version 6.11.x or newer while DRM_FBDEV_EMULATION is set.
+	${drm_helper_msg}"
+	local ERROR_DRM_FBDEV_EMULATION="CONFIG_DRM_FBDEV_EMULATION: is not set but is needed for
+	nvidia-drm.fbdev=1 support, currently off-by-default and it could
+	be ignored, but note that is due to change in the future."
 	local ERROR_MMU_NOTIFIER="CONFIG_MMU_NOTIFIER: is not set but needed to build with USE=kernel-open.
 	Cannot be directly selected in the kernel's menuconfig, and may need
 	selection of another option that requires it such as CONFIG_KVM."
-
 	local ERROR_PREEMPT_RT="CONFIG_PREEMPT_RT: is set but is unsupported by NVIDIA upstream and
 	will fail to build unless the env var IGNORE_PREEMPT_RT_PRESENCE=1 is
 	set. Please do not report issues if run into e.g. kernel panics while
@@ -159,24 +175,16 @@ src_prepare() {
 	use X || sed -i 's/"libGLX/"libEGL/' nvidia_{layers,icd}.json || die
 
 	# enable nvidia-drm.modeset=1 by default with USE=wayland
-	cp "${FILESDIR}"/nvidia-470.conf "${T}"/nvidia.conf || die
+	cp "${FILESDIR}"/nvidia-570.conf "${T}"/nvidia.conf || die
 	use !wayland || sed -i '/^#.*modeset=1$/s/^#//' "${T}"/nvidia.conf || die
 
 	# makefile attempts to install wayland library even if not built
 	use wayland || sed -i 's/ WAYLAND_LIB_install$//' \
 		nvidia-settings/src/Makefile || die
-
-	# temporary option, nvidia will remove in the future
-	use !kernel-open ||
-		sed -i '/blacklist/a\
-\
-# Enable using kernel-open with workstation GPUs (experimental)\
-options nvidia NVreg_OpenRmEnableUnsupportedGpus=1' "${T}"/nvidia.conf || die
 }
 
 src_compile() {
 	tc-export AR CC CXX LD OBJCOPY OBJDUMP PKG_CONFIG
-	local -x RAW_LDFLAGS="$(get_abi_LDFLAGS) $(raw-ldflags)" # raw-ldflags.patch
 
 	# extra flags for the libXNVCtrl.a static library
 	local xnvflags=-fPIC #840389
@@ -196,11 +204,6 @@ src_compile() {
 	if use modules; then
 		local o_cflags=${CFLAGS} o_cxxflags=${CXXFLAGS} o_ldflags=${LDFLAGS}
 
-		# conftest.sh is broken with c23 due to func() changing meaning,
-		# and then fails later due to ealier misdetections
-		# TODO: try without now and then + drop modargs' CC= (bug #944092)
-		KERNEL_CC+=" -std=gnu17"
-
 		local modlistargs=video:kernel
 		if use kernel-open; then
 			modlistargs+=-module-source:kernel-module-source/kernel-open
@@ -210,11 +213,12 @@ src_compile() {
 			filter-flags -fno-plt #912949
 			filter-lto
 			CC=${KERNEL_CC} CXX=${KERNEL_CXX} strip-unsupported-flags
+
+			LDFLAGS=$(raw-ldflags)
 		fi
 
 		local modlist=( nvidia{,-drm,-modeset,-peermem,-uvm}=${modlistargs} )
 		local modargs=(
-			CC="${KERNEL_CC}" # needed for above gnu17 workaround
 			IGNORE_CC_MISMATCH=yes NV_VERBOSE=1
 			SYSOUT="${KV_OUT_DIR}" SYSSRC="${KV_DIR}"
 
@@ -259,6 +263,7 @@ src_install() {
 		[GBM_BACKEND_LIB_SYMLINK]=/usr/${libdir}/gbm
 		[GLVND_EGL_ICD_JSON]=/usr/share/glvnd/egl_vendor.d
 		[OPENGL_DATA]=/usr/share/nvidia
+		[VULKANSC_ICD_JSON]=/usr/share/vulkansc
 		[VULKAN_ICD_JSON]=/usr/share/vulkan
 		[WINE_LIB]=/usr/${libdir}/nvidia/wine
 		[XORG_OUTPUTCLASS_CONFIG]=/usr/share/X11/xorg.conf.d
@@ -270,17 +275,18 @@ src_install() {
 
 	local skip_files=(
 		$(usev !X "libGLX_nvidia libglxserver_nvidia")
-		$(usev !wayland libnvidia-vulkan-producer)
 		libGLX_indirect # non-glvnd unused fallback
 		libnvidia-{gtk,wayland-client} nvidia-{settings,xconfig} # from source
 		libnvidia-egl-gbm 15_nvidia_gbm # gui-libs/egl-gbm
 		libnvidia-egl-wayland 10_nvidia_wayland # gui-libs/egl-wayland
+		libnvidia-egl-xcb 20_nvidia_xcb.json # gui-libs/egl-x11
+		libnvidia-egl-xlib 20_nvidia_xlib.json # gui-libs/egl-x11
 		libnvidia-pkcs11.so # using the openssl3 version instead
 	)
 	local skip_modules=(
 		$(usev !X "nvfbc vdpau xdriver")
 		$(usev !modules gsp)
-		$(usev !powerd powerd)
+		$(usev !powerd nvtopps)
 		installer nvpd # handled separately / built from source
 	)
 	local skip_types=(
@@ -320,6 +326,12 @@ $(use amd64 && usev !abi_x86_32 "
 Note that without USE=abi_x86_32 on ${PN}, 32bit applications
 (typically using wine / steam) will not be able to use GPU acceleration.")
 
+Be warned that USE=kernel-open may need to be either enabled or
+disabled for certain cards to function:
+- GTX 50xx (blackwell) and higher require it to be enabled
+- GTX 1650 and higher (pre-blackwell) should work either way
+- Older cards require it to be disabled
+
 For additional information or for troubleshooting issues, please see
 https://wiki.gentoo.org/wiki/NVIDIA/nvidia-drivers and NVIDIA's own
 documentation that is installed alongside this README."
@@ -408,8 +420,9 @@ documentation that is installed alongside this README."
 			dosym ${m[4]} ${into}/${m[0]}
 			continue
 		fi
-		[[ ${m[0]} =~ ^libnvidia-ngx.so|^libnvidia-egl-gbm.so ]] &&
-			dosym ${m[0]} ${into}/${m[0]%.so*}.so.1 # soname not in .manifest
+		# avoid portage warning due to missing soname links in manifest
+		[[ ${m[0]} =~ ^libnvidia-ngx.so ]] &&
+			dosym ${m[0]} ${into}/${m[0]%.so*}.so.1
 
 		printf -v m[1] %o $((m[1] | 0200)) # 444->644
 		insopts -m${m[1]}
@@ -423,10 +436,13 @@ documentation that is installed alongside this README."
 	exeinto "${_#"${EPREFIX}"}"
 	doexe systemd/system-sleep/nvidia
 	dobin systemd/nvidia-sleep.sh
-	systemd_dounit systemd/system/nvidia-{hibernate,resume,suspend}.service
+	systemd_dounit systemd/system/nvidia-{hibernate,resume,suspend,suspend-then-hibernate}.service
 
 	dobin nvidia-bug-report.sh
 
+	insinto /usr/share/nvidia/files.d
+	doins sandboxutils-filelist.json
+
 	# MODULE:powerd extras
 	if use powerd; then
 		newinitd "${FILESDIR}"/nvidia-powerd.initd nvidia-powerd #923117
@@ -445,6 +461,8 @@ documentation that is installed alongside this README."
 	dosym {"${unitdir}",/etc/systemd/system/systemd-hibernate.service.wants}/nvidia-resume.service
 	dosym {"${unitdir}",/etc/systemd/system/systemd-suspend.service.wants}/nvidia-suspend.service
 	dosym {"${unitdir}",/etc/systemd/system/systemd-suspend.service.wants}/nvidia-resume.service
+	dosym {"${unitdir}",/etc/systemd/system/systemd-suspend-then-hibernate.service.wants}/nvidia-suspend-then-hibernate.service
+	dosym {"${unitdir}",/etc/systemd/system/systemd-suspend-then-hibernate.service.wants}/nvidia-resume.service
 	# also add a custom elogind hook to do the equivalent of the above
 	exeinto /usr/lib/elogind/system-sleep
 	newexe "${FILESDIR}"/system-sleep.elogind nvidia
@@ -475,12 +493,12 @@ documentation that is installed alongside this README."
 	# don't attempt to strip firmware files (silences errors)
 	dostrip -x ${paths[FIRMWARE]}
 
-	# sandbox issues with /dev/nvidiactl (and /dev/char wrt bug #904292)
+	# sandbox issues with /dev/nvidiactl and others (bug #904292,#921578)
 	# are widespread and sometime affect revdeps of packages built with
 	# USE=opencl/cuda making it hard to manage in ebuilds (minimal set,
 	# ebuilds should handle manually if need others or addwrite)
 	insinto /etc/sandbox.d
-	newins - 20nvidia <<<'SANDBOX_PREDICT="/dev/nvidiactl:/dev/char"'
+	newins - 20nvidia <<<'SANDBOX_PREDICT="/dev/nvidiactl:/dev/nvidia-caps:/dev/char"'
 
 	# dracut does not use /etc/modprobe.d if hostonly=no, but want to make sure
 	# our settings are used for bug 932781#c8 and nouveau blacklist if either
@@ -492,6 +510,7 @@ documentation that is installed alongside this README."
 }
 
 pkg_preinst() {
+	has_version "${CATEGORY}/${PN}[kernel-open]" && NV_HAD_KERNEL_OPEN=
 	has_version "${CATEGORY}/${PN}[wayland]" && NV_HAD_WAYLAND=
 
 	use modules || return
@@ -556,20 +575,17 @@ pkg_postinst() {
 		ewarn "[2] https://wiki.gentoo.org/wiki/Nouveau"
 	fi
 
-	if use kernel-open; then
+	if use kernel-open && [[ ! -v NV_HAD_KERNEL_OPEN ]]; then
 		ewarn
-		ewarn "Open source variant of ${PN} was selected, be warned it is experimental"
-		ewarn "and only for modern GPUs (e.g. GTX 1650+). Try to disable if run into issues."
-		ewarn "Please also see: ${EROOT}/usr/share/doc/${PF}/html/kernel_open.html"
+		ewarn "Open source variant of ${PN} was selected, note that it requires"
+		ewarn "Turing/Ampere+ GPUs (aka GTX 1650+). Try disabling if run into issues."
+		ewarn "Also see: ${EROOT}/usr/share/doc/${PF}/html/kernel_open.html"
 	fi
 
 	if use wayland && use modules && [[ ! -v NV_HAD_WAYLAND ]]; then
 		elog
-		elog "With USE=wayland, this version of ${PN} sets nvidia-drm.modeset=1"
-		elog "in '${EROOT}/etc/modprobe.d/nvidia.conf'. This feature is considered"
-		elog "experimental but is required for wayland."
-		elog
-		elog "If you experience issues, either disable wayland or edit nvidia.conf."
-		elog "Of note, may possibly cause issues with SLI and Reverse PRIME."
+		elog "Note that with USE=wayland, nvidia-drm.modeset=1 will be enabled"
+		elog "in '${EROOT}/etc/modprobe.d/nvidia.conf'. *If* experience issues,"
+		elog "either disable wayland or edit nvidia.conf."
 	fi
 }
diff --git a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-550.163.01-r1.ebuild b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-580.65.06.ebuild
similarity index 89%
rename from sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-550.163.01-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-580.65.06.ebuild
index 6e3b131d18d..ea48dd3c8d7 100644
--- a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-550.163.01-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-580.65.06.ebuild
@@ -7,7 +7,7 @@ MODULES_OPTIONAL_IUSE=+modules
 inherit desktop dot-a eapi9-pipestatus flag-o-matic linux-mod-r1
 inherit readme.gentoo-r1 systemd toolchain-funcs unpacker user-info
 
-MODULES_KERNEL_MAX=6.14
+MODULES_KERNEL_MAX=6.16
 NV_URI="https://download.nvidia.com/XFree86/"
 
 DESCRIPTION="NVIDIA Accelerated Graphics Driver"
@@ -22,9 +22,13 @@ SRC_URI="
 # nvidia-installer is unused but here for GPL-2's "distribute sources"
 S=${WORKDIR}
 
-LICENSE="NVIDIA-2023 Apache-2.0 BSD BSD-2 GPL-2 MIT ZLIB curl openssl"
+LICENSE="
+	NVIDIA-2025 Apache-2.0 Boost-1.0 BSD BSD-2 GPL-2 MIT ZLIB
+	curl openssl public-domain
+"
 SLOT="0/${PV%%.*}"
-KEYWORDS="-* amd64 ~arm64"
+# unkeyworded due to being a beta, feel free to opt-in if want to test
+#KEYWORDS="-* ~amd64 ~arm64"
 IUSE="+X abi_x86_32 abi_x86_64 kernel-open persistenced powerd +static-libs +tools wayland"
 REQUIRED_USE="kernel-open? ( modules )"
 
@@ -60,8 +64,9 @@ RDEPEND="
 	)
 	powerd? ( sys-apps/dbus[abi_x86_32(-)?] )
 	wayland? (
-		gui-libs/egl-gbm
-		>=gui-libs/egl-wayland-1.1.10
+		>=gui-libs/egl-gbm-1.1.1-r2[abi_x86_32(-)?]
+		>=gui-libs/egl-wayland-1.1.13.1[abi_x86_32(-)?]
+		X? ( gui-libs/egl-x11[abi_x86_32(-)?] )
 	)
 "
 DEPEND="
@@ -72,6 +77,7 @@ DEPEND="
 		x11-libs/libXext
 	)
 	tools? (
+		dev-util/vulkan-headers
 		media-libs/libglvnd
 		sys-apps/dbus
 		x11-base/xorg-proto
@@ -81,6 +87,7 @@ DEPEND="
 	)
 "
 BDEPEND="
+	app-alternatives/awk
 	sys-devel/m4
 	virtual/pkgconfig
 "
@@ -103,6 +110,7 @@ pkg_setup() {
 	local CONFIG_CHECK="
 		PROC_FS
 		~DRM_KMS_HELPER
+		~DRM_FBDEV_EMULATION
 		~SYSVIPC
 		~!LOCKDEP
 		~!PREEMPT_RT
@@ -128,6 +136,9 @@ pkg_setup() {
 	local ERROR_DRM_TTM_HELPER="CONFIG_DRM_TTM_HELPER: is not set but is needed to compile when using
 	kernel version 6.11.x or newer while DRM_FBDEV_EMULATION is set.
 	${drm_helper_msg}"
+	local ERROR_DRM_FBDEV_EMULATION="CONFIG_DRM_FBDEV_EMULATION: is not set but is needed for
+	nvidia-drm.fbdev=1 support, currently off-by-default and it could
+	be ignored, but note that is due to change in the future."
 	local ERROR_MMU_NOTIFIER="CONFIG_MMU_NOTIFIER: is not set but needed to build with USE=kernel-open.
 	Cannot be directly selected in the kernel's menuconfig, and may need
 	selection of another option that requires it such as CONFIG_KVM."
@@ -161,7 +172,7 @@ src_prepare() {
 	use X || sed -i 's/"libGLX/"libEGL/' nvidia_{layers,icd}.json || die
 
 	# enable nvidia-drm.modeset=1 by default with USE=wayland
-	cp "${FILESDIR}"/nvidia-545.conf "${T}"/nvidia.conf || die
+	cp "${FILESDIR}"/nvidia-570.conf "${T}"/nvidia.conf || die
 	use !wayland || sed -i '/^#.*modeset=1$/s/^#//' "${T}"/nvidia.conf || die
 
 	# makefile attempts to install wayland library even if not built
@@ -190,11 +201,6 @@ src_compile() {
 	if use modules; then
 		local o_cflags=${CFLAGS} o_cxxflags=${CXXFLAGS} o_ldflags=${LDFLAGS}
 
-		# conftest.sh is broken with c23 due to func() changing meaning,
-		# and then fails later due to ealier misdetections
-		# TODO: try without now and then + drop modargs' CC= (bug #944092)
-		KERNEL_CC+=" -std=gnu17"
-
 		local modlistargs=video:kernel
 		if use kernel-open; then
 			modlistargs+=-module-source:kernel-module-source/kernel-open
@@ -204,11 +210,12 @@ src_compile() {
 			filter-flags -fno-plt #912949
 			filter-lto
 			CC=${KERNEL_CC} CXX=${KERNEL_CXX} strip-unsupported-flags
+
+			LDFLAGS=$(raw-ldflags)
 		fi
 
 		local modlist=( nvidia{,-drm,-modeset,-peermem,-uvm}=${modlistargs} )
 		local modargs=(
-			CC="${KERNEL_CC}" # needed for above gnu17 workaround
 			IGNORE_CC_MISMATCH=yes NV_VERBOSE=1
 			SYSOUT="${KV_OUT_DIR}" SYSSRC="${KV_DIR}"
 
@@ -253,6 +260,7 @@ src_install() {
 		[GBM_BACKEND_LIB_SYMLINK]=/usr/${libdir}/gbm
 		[GLVND_EGL_ICD_JSON]=/usr/share/glvnd/egl_vendor.d
 		[OPENGL_DATA]=/usr/share/nvidia
+		[VULKANSC_ICD_JSON]=/usr/share/vulkansc
 		[VULKAN_ICD_JSON]=/usr/share/vulkan
 		[WINE_LIB]=/usr/${libdir}/nvidia/wine
 		[XORG_OUTPUTCLASS_CONFIG]=/usr/share/X11/xorg.conf.d
@@ -268,12 +276,14 @@ src_install() {
 		libnvidia-{gtk,wayland-client} nvidia-{settings,xconfig} # from source
 		libnvidia-egl-gbm 15_nvidia_gbm # gui-libs/egl-gbm
 		libnvidia-egl-wayland 10_nvidia_wayland # gui-libs/egl-wayland
+		libnvidia-egl-xcb 20_nvidia_xcb.json # gui-libs/egl-x11
+		libnvidia-egl-xlib 20_nvidia_xlib.json # gui-libs/egl-x11
 		libnvidia-pkcs11.so # using the openssl3 version instead
 	)
 	local skip_modules=(
 		$(usev !X "nvfbc vdpau xdriver")
 		$(usev !modules gsp)
-		$(usev !powerd powerd)
+		$(usev !powerd nvtopps)
 		installer nvpd # handled separately / built from source
 	)
 	local skip_types=(
@@ -313,6 +323,12 @@ $(use amd64 && usev !abi_x86_32 "
 Note that without USE=abi_x86_32 on ${PN}, 32bit applications
 (typically using wine / steam) will not be able to use GPU acceleration.")
 
+Be warned that USE=kernel-open may need to be either enabled or
+disabled for certain cards to function:
+- GTX 50xx (blackwell) and higher require it to be enabled
+- GTX 1650 and higher (pre-blackwell) should work either way
+- Older cards require it to be disabled
+
 For additional information or for troubleshooting issues, please see
 https://wiki.gentoo.org/wiki/NVIDIA/nvidia-drivers and NVIDIA's own
 documentation that is installed alongside this README."
@@ -401,8 +417,9 @@ documentation that is installed alongside this README."
 			dosym ${m[4]} ${into}/${m[0]}
 			continue
 		fi
-		[[ ${m[0]} =~ ^libnvidia-ngx.so|^libnvidia-egl-gbm.so ]] &&
-			dosym ${m[0]} ${into}/${m[0]%.so*}.so.1 # soname not in .manifest
+		# avoid portage warning due to missing soname links in manifest
+		[[ ${m[0]} =~ ^libnvidia-ngx.so ]] &&
+			dosym ${m[0]} ${into}/${m[0]%.so*}.so.1
 
 		printf -v m[1] %o $((m[1] | 0200)) # 444->644
 		insopts -m${m[1]}
@@ -416,10 +433,13 @@ documentation that is installed alongside this README."
 	exeinto "${_#"${EPREFIX}"}"
 	doexe systemd/system-sleep/nvidia
 	dobin systemd/nvidia-sleep.sh
-	systemd_dounit systemd/system/nvidia-{hibernate,resume,suspend}.service
+	systemd_dounit systemd/system/nvidia-{hibernate,resume,suspend,suspend-then-hibernate}.service
 
 	dobin nvidia-bug-report.sh
 
+	insinto /usr/share/nvidia/files.d
+	doins sandboxutils-filelist.json
+
 	# MODULE:powerd extras
 	if use powerd; then
 		newinitd "${FILESDIR}"/nvidia-powerd.initd nvidia-powerd #923117
@@ -438,6 +458,8 @@ documentation that is installed alongside this README."
 	dosym {"${unitdir}",/etc/systemd/system/systemd-hibernate.service.wants}/nvidia-resume.service
 	dosym {"${unitdir}",/etc/systemd/system/systemd-suspend.service.wants}/nvidia-suspend.service
 	dosym {"${unitdir}",/etc/systemd/system/systemd-suspend.service.wants}/nvidia-resume.service
+	dosym {"${unitdir}",/etc/systemd/system/systemd-suspend-then-hibernate.service.wants}/nvidia-suspend-then-hibernate.service
+	dosym {"${unitdir}",/etc/systemd/system/systemd-suspend-then-hibernate.service.wants}/nvidia-resume.service
 	# also add a custom elogind hook to do the equivalent of the above
 	exeinto /usr/lib/elogind/system-sleep
 	newexe "${FILESDIR}"/system-sleep.elogind nvidia
@@ -552,18 +574,15 @@ pkg_postinst() {
 
 	if use kernel-open && [[ ! -v NV_HAD_KERNEL_OPEN ]]; then
 		ewarn
-		ewarn "Open source variant of ${PN} was selected, be warned it is experimental"
-		ewarn "and only for modern GPUs (e.g. GTX 1650+). Try to disable if run into issues."
-		ewarn "Please also see: ${EROOT}/usr/share/doc/${PF}/html/kernel_open.html"
+		ewarn "Open source variant of ${PN} was selected, note that it requires"
+		ewarn "Turing/Ampere+ GPUs (aka GTX 1650+). Try disabling if run into issues."
+		ewarn "Also see: ${EROOT}/usr/share/doc/${PF}/html/kernel_open.html"
 	fi
 
 	if use wayland && use modules && [[ ! -v NV_HAD_WAYLAND ]]; then
 		elog
-		elog "With USE=wayland, this version of ${PN} sets nvidia-drm.modeset=1"
-		elog "in '${EROOT}/etc/modprobe.d/nvidia.conf'. This feature is considered"
-		elog "experimental but is required for wayland."
-		elog
-		elog "If you experience issues, either disable wayland or edit nvidia.conf."
-		elog "Of note, may possibly cause issues with SLI and Reverse PRIME."
+		elog "Note that with USE=wayland, nvidia-drm.modeset=1 will be enabled"
+		elog "in '${EROOT}/etc/modprobe.d/nvidia.conf'. *If* experience issues,"
+		elog "either disable wayland or edit nvidia.conf."
 	fi
 }
diff --git a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-575.64.03.ebuild b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-580.76.05.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-575.64.03.ebuild
rename to sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-580.76.05.ebuild
index b39715d6e1e..8581cfa9416 100644
--- a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-575.64.03.ebuild
+++ b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-580.76.05.ebuild
@@ -7,7 +7,7 @@ MODULES_OPTIONAL_IUSE=+modules
 inherit desktop dot-a eapi9-pipestatus flag-o-matic linux-mod-r1
 inherit readme.gentoo-r1 systemd toolchain-funcs unpacker user-info
 
-MODULES_KERNEL_MAX=6.15
+MODULES_KERNEL_MAX=6.16
 NV_URI="https://download.nvidia.com/XFree86/"
 
 DESCRIPTION="NVIDIA Accelerated Graphics Driver"
@@ -28,9 +28,6 @@ LICENSE="
 "
 SLOT="0/${PV%%.*}"
 KEYWORDS="-* ~amd64 ~arm64"
-# TODO: enable kernel-open by default to match nvidia upstream, but should
-# first setup a supported-gpus.json "kernelopen" check to abort and avoid bad
-# surprises (should abort for legacy cards too, and have a bypass variable)
 IUSE="+X abi_x86_32 abi_x86_64 kernel-open persistenced powerd +static-libs +tools wayland"
 REQUIRED_USE="kernel-open? ( modules )"
 

From 3613a618d9c3456565e848bbc7e73794d1c55c5f Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 18 Aug 2025 07:17:42 +0000
Subject: [PATCH 122/122] x11-libs/pixman: Sync with Gentoo

It's from Gentoo commit cfb0ec57dcb2fbf26997f836b0f2712b7ed1e9de.
---
 .../portage-stable/x11-libs/pixman/Manifest   |  2 -
 .../x11-libs/pixman/pixman-0.44.2.ebuild      | 61 ----------------
 .../x11-libs/pixman/pixman-0.46.2-r1.ebuild   | 70 -------------------
 3 files changed, 133 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.44.2.ebuild
 delete mode 100644 sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.46.2-r1.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/Manifest b/sdk_container/src/third_party/portage-stable/x11-libs/pixman/Manifest
index 9ba461174a4..7cf364fd60e 100644
--- a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/Manifest
+++ b/sdk_container/src/third_party/portage-stable/x11-libs/pixman/Manifest
@@ -1,4 +1,2 @@
-DIST pixman-0.44.2.tar.xz 650012 BLAKE2B 856aa35ae705de522d70250beee8acc872b54d2b5caa9cee6bc12ffde7c293b3db76f56c75858cc5ab1bc592fb1d4078485c2def2ae4bcd5a50b6dfc2eb477eb SHA512 b24907f9a0bf6a9aa3278d31986c562c5f2d68f8c178021497c8648aca9f91e4c6f1ecfacf93eb01ba4f03ce4cfc5970fc40bb0fe6724bac9210fc57da09cba4
 DIST pixman-0.46.0.tar.xz 660268 BLAKE2B 5fc9d0df2f685afc1931ac12757d7ec0369c1f90b51f79b696479a2edd0c13e0684938871166318ca5c78b4955195ba5517e98e4666803b9062f4ed2b6593afa SHA512 c7ef987b7db89c58278c537f862bc9eb17c19f8288a3b7e88f8501a0486662f1e2cb6a2c0b81d4bf0464310475192428d6e29d05a6ae3cfc1d2c0941fbb0b9a3
-DIST pixman-0.46.2.tar.xz 660260 BLAKE2B 6d51d4f33f48a1cc991085b5e62e7537b738df78c4efcbce15c37533f24a1d87263401550530d123de86bd72a856d3fd0b1543188c76f074ea3e44d384f1116f SHA512 9419e5a23f4b709e075c5dd33c46bb375d2407b6e90623fe3410a03171f4c5e0a511e8b4414557a39b68d46a4c1ac64f2ef0c9c6eab0b42a2be75d5d52a367fd
 DIST pixman-0.46.4.tar.xz 660536 BLAKE2B b00041009aeed3cd2548251489df6fcb5efb0415a8279451306558b2e736e2b012b11335b4ed3361e0126cad861873c0675dae24eb031b2434e45a7d39e087d8 SHA512 83b133e7969ba34f883f4e08dcc5d388c4397f43ce836c191c05945fe77c16ff501d531600780c12678a0d08105828a6bdeff2156b63f9c1a84087bc7f40ae9f
diff --git a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.44.2.ebuild b/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.44.2.ebuild
deleted file mode 100644
index 08434b2ec36..00000000000
--- a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.44.2.ebuild
+++ /dev/null
@@ -1,61 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-EGIT_REPO_URI="https://gitlab.freedesktop.org/pixman/pixman.git"
-
-if [[ ${PV} = 9999* ]]; then
-	GIT_ECLASS="git-r3"
-fi
-
-inherit ${GIT_ECLASS} meson-multilib multiprocessing toolchain-funcs
-
-DESCRIPTION="Low-level pixel manipulation routines"
-HOMEPAGE="http://www.pixman.org/ https://gitlab.freedesktop.org/pixman/pixman/"
-if [[ ${PV} != 9999* ]]; then
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-	SRC_URI="https://www.x.org/releases/individual/lib/${P}.tar.xz"
-fi
-
-LICENSE="MIT"
-SLOT="0"
-IUSE="cpu_flags_ppc_altivec cpu_flags_arm_neon loongson2f cpu_flags_x86_mmxext cpu_flags_x86_sse2 cpu_flags_x86_ssse3 static-libs test"
-RESTRICT="!test? ( test )"
-
-pkg_pretend() {
-	[[ ${MERGE_TYPE} != binary ]] && use test && tc-check-openmp
-}
-
-pkg_setup() {
-	[[ ${MERGE_TYPE} != binary ]] && use test && tc-check-openmp
-}
-
-multilib_src_configure() {
-	local emesonargs=(
-		$(meson_feature cpu_flags_x86_mmxext mmx)
-		$(meson_feature cpu_flags_x86_sse2 sse2)
-		$(meson_feature cpu_flags_x86_ssse3 ssse3)
-		$(meson_feature cpu_flags_ppc_altivec vmx)
-		$(meson_feature loongson2f loongson-mmi)
-		$(meson_feature test openmp) # only used in unit tests
-		$(meson_feature test tests)
-		-Ddefault_library=$(usex static-libs both shared)
-		-Ddemos=disabled
-		-Dgtk=disabled
-		-Dlibpng=disabled
-	)
-
-	if [[ ${ABI} == arm64 ]]; then
-		emesonargs+=($(meson_feature cpu_flags_arm_neon a64-neon))
-	elif [[ ${ABI} == arm ]]; then
-		emesonargs+=($(meson_feature cpu_flags_arm_neon neon))
-	fi
-
-	meson_src_configure
-}
-
-multilib_src_test() {
-	export OMP_NUM_THREADS=$(makeopts_jobs)
-	meson_src_test -t 100
-}
diff --git a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.46.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.46.2-r1.ebuild
deleted file mode 100644
index ef06454954b..00000000000
--- a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.46.2-r1.ebuild
+++ /dev/null
@@ -1,70 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-EGIT_REPO_URI="https://gitlab.freedesktop.org/pixman/pixman.git"
-
-if [[ ${PV} = 9999* ]]; then
-	GIT_ECLASS="git-r3"
-fi
-
-inherit flag-o-matic ${GIT_ECLASS} meson-multilib multiprocessing toolchain-funcs
-
-DESCRIPTION="Low-level pixel manipulation routines"
-HOMEPAGE="http://www.pixman.org/ https://gitlab.freedesktop.org/pixman/pixman/"
-if [[ ${PV} != 9999* ]]; then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-	SRC_URI="https://www.x.org/releases/individual/lib/${P}.tar.xz"
-fi
-
-LICENSE="MIT"
-SLOT="0"
-IUSE="cpu_flags_ppc_altivec cpu_flags_arm_neon loongson2f cpu_flags_x86_mmxext cpu_flags_x86_sse2 cpu_flags_x86_ssse3 static-libs test"
-RESTRICT="!test? ( test )"
-
-pkg_pretend() {
-	[[ ${MERGE_TYPE} != binary ]] && use test && tc-check-openmp
-}
-
-pkg_setup() {
-	[[ ${MERGE_TYPE} != binary ]] && use test && tc-check-openmp
-}
-
-multilib_src_configure() {
-	# Temporary workaround for a build failure (known gcc issue):
-	#
-	#  * https://bugs.gentoo.org/956715
-	#  * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110812
-	#
-	use riscv && filter-lto
-
-	local emesonargs=(
-		$(meson_feature cpu_flags_x86_mmxext mmx)
-		$(meson_feature cpu_flags_x86_sse2 sse2)
-		$(meson_feature cpu_flags_x86_ssse3 ssse3)
-		$(meson_feature cpu_flags_ppc_altivec vmx)
-		$(meson_feature loongson2f loongson-mmi)
-		$(meson_feature test openmp) # only used in unit tests
-		$(meson_feature test tests)
-		-Ddefault_library=$(usex static-libs both shared)
-		-Ddemos=disabled
-		-Dgtk=disabled
-		-Dlibpng=disabled
-		 # explicitly disable RVV due to https://bugs.gentoo.org/95938
-		-Drvv=disabled
-	)
-
-	if [[ ${ABI} == arm64 ]]; then
-		emesonargs+=($(meson_feature cpu_flags_arm_neon a64-neon))
-	elif [[ ${ABI} == arm ]]; then
-		emesonargs+=($(meson_feature cpu_flags_arm_neon neon))
-	fi
-
-	meson_src_configure
-}
-
-multilib_src_test() {
-	export OMP_NUM_THREADS=$(makeopts_jobs)
-	meson_src_test -t 100
-}