diff --git a/.github/workflows/portage-stable-packages-list b/.github/workflows/portage-stable-packages-list
index ee576be89f4..71f77a5f3ef 100644
--- a/.github/workflows/portage-stable-packages-list
+++ b/.github/workflows/portage-stable-packages-list
@@ -302,6 +302,7 @@ dev-python/flit-core
 dev-python/gentoo-common
 dev-python/gpep517
 dev-python/hatchling
+dev-python/hatch-vcs
 dev-python/idna
 dev-python/installer
 dev-python/jaraco-context
@@ -553,7 +554,7 @@ sec-policy/selinux-unconfined
 
 sys-apps/acl
 sys-apps/attr
-sys-apps/azure-nvme-utils
+sys-apps/azure-vm-utils
 sys-apps/bubblewrap
 sys-apps/checkpolicy
 sys-apps/config-site
diff --git a/changelog/security/2024-10-15-weekly-updates.md b/changelog/security/2024-10-15-weekly-updates.md
new file mode 100644
index 00000000000..5c959d74dba
--- /dev/null
+++ b/changelog/security/2024-10-15-weekly-updates.md
@@ -0,0 +1,3 @@
+- curl ([CVE-2024-8096](https://nvd.nist.gov/vuln/detail/CVE-2024-8096))
+- libarchive ([CVE-2024-26256](https://nvd.nist.gov/vuln/detail/CVE-2024-26256), [CVE-2024-48957](https://nvd.nist.gov/vuln/detail/CVE-2024-48957), [CVE-2024-48958](https://nvd.nist.gov/vuln/detail/CVE-2024-48958))
+- openssh ([CVE-2024-39894](https://nvd.nist.gov/vuln/detail/CVE-2024-39894))
diff --git a/changelog/updates/2024-10-15-weekly-updates.md b/changelog/updates/2024-10-15-weekly-updates.md
new file mode 100644
index 00000000000..b5b9a377c75
--- /dev/null
+++ b/changelog/updates/2024-10-15-weekly-updates.md
@@ -0,0 +1,41 @@
+- azure: chrony ([4.6](https://gitlab.com/chrony/chrony/-/blob/4.6/NEWS))
+- base, dev: azure-vm-utils ([0.3.0](https://github.com/Azure/azure-vm-utils/releases/tag/v0.3.0))
+- base, dev: binutils-config ([5.5.2](https://gitweb.gentoo.org/proj/binutils-config.git/log/?h=v5.5.2))
+- base, dev: btrfs-progs ([6.10.1](https://github.com/kdave/btrfs-progs/blob/v6.10.1/CHANGES#L26-L38) (includes [6.10](https://github.com/kdave/btrfs-progs/blob/v6.10/CHANGES)))
+- base, dev: c-ares ([1.33.1](https://github.com/c-ares/c-ares/releases/tag/v1.33.1) (includes [1.33.0](https://github.com/c-ares/c-ares/releases/tag/v1.33.0), [1.32.3](https://github.com/c-ares/c-ares/releases/tag/v1.32.3), [1.32.2](https://github.com/c-ares/c-ares/releases/tag/v1.32.2), [1.32.1](https://github.com/c-ares/c-ares/releases/tag/v1.32.1), [1.32.0](https://github.com/c-ares/c-ares/releases/tag/v1.32.0), [1.31.0](https://github.com/c-ares/c-ares/releases/tag/v1.31.0), [1.30.0](https://github.com/c-ares/c-ares/releases/tag/v1.30.0)))
+- base, dev: cracklib ([2.10.2](https://github.com/cracklib/cracklib/releases/tag/v2.10.2) (includes [2.10.1](https://github.com/cracklib/cracklib/releases/tag/v2.10.1), [2.10.0](https://github.com/cracklib/cracklib/releases/tag/v2.10.0)))
+- base, dev: cryptsetup ([2.7.5](https://gitlab.com/cryptsetup/cryptsetup/-/blob/v2.7.5/docs/v2.7.5-ReleaseNotes) (includes [2.7.4](https://gitlab.com/cryptsetup/cryptsetup/-/blob/v2.7.4/docs/v2.7.4-ReleaseNotes), [2.7.3](https://gitlab.com/cryptsetup/cryptsetup/-/blob/v2.7.3/docs/v2.7.3-ReleaseNotes)))
+- base, dev: curl ([8.10.1](https://curl.se/ch/8.10.1.html) (includes [8.10.0](https://curl.se/ch/8.10.0.html)))
+- base, dev: efivar ([39](https://github.com/rhboot/efivar/releases/tag/39))
+- base, dev: gettext ([0.22.5](https://savannah.gnu.org/news/?id=10597))
+- base, dev: git ([2.45.2](https://github.com/git/git/blob/v2.45.2/Documentation/RelNotes/2.45.2.txt) (includes [2.45.1](https://github.com/git/git/blob/v2.45.1/Documentation/RelNotes/2.45.1.txt), [2.45.0](https://github.com/git/git/blob/v2.45.0/Documentation/RelNotes/2.45.0.txt)))
+- base, dev: gnutls ([3.8.7.1](https://gitlab.com/gnutls/gnutls/-/blob/3.8.7/NEWS) (includes [3.8.6](https://gitlab.com/gnutls/gnutls/-/blob/3.8.6/NEWS)))
+- base, dev: gptfdisk ([1.0.10](https://sourceforge.net/p/gptfdisk/code/ci/53ac725a88a616b9f3395500d6e520aa04742fa5/tree/NEWS))
+- base, dev: intel-microcode ([20240910_p20240915](https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20240910))
+- base, dev: kmod ([33](https://github.com/kmod-project/kmod/blob/v33/NEWS))
+- base, dev: libarchive ([3.7.6](https://github.com/libarchive/libarchive/releases/tag/v3.7.6) (includes [3.7.5](https://github.com/libarchive/libarchive/releases/tag/v3.7.5)))
+- base, dev: libassuan ([3.0.0](https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libassuan.git;a=blob;f=NEWS;h=48ece8b1cf8b81bdf835db00079ae247742cd398;hb=0351ecfa4f35ad44684075abec153574986b11bd))
+- base, dev: libgpg-error ([1.50](https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgpg-error.git;a=blob;f=NEWS;h=b865ecc7197a4f60b1530958fbb25a92bdfdc3de;hb=bb732615daad9bba9026354ae90f0f5292ea4908))
+- base, dev: libnl ([3.10.0](https://lists.infradead.org/pipermail/libnl/2024-July/002440.html))
+- base, dev: libnvme ([1.10](https://github.com/linux-nvme/libnvme/releases/tag/v1.10))
+- base, dev: liburing ([2.7](https://git.kernel.dk/cgit/liburing/tree/CHANGELOG?h=liburing-2.7) (includes [2.6](https://git.kernel.dk/cgit/liburing/tree/CHANGELOG?h=liburing-2.6), [2.5](https://git.kernel.dk/cgit/liburing/tree/CHANGELOG?h=liburing-2.5), [2.4](https://git.kernel.dk/cgit/liburing/tree/CHANGELOG?h=liburing-2.4)))
+- base, dev: nvme-cli ([2.10.2](https://github.com/linux-nvme/nvme-cli/releases/tag/v2.10.2) (includes [2.10.1](https://github.com/linux-nvme/nvme-cli/releases/tag/v2.10.1), [2.10](https://github.com/linux-nvme/nvme-cli/releases/tag/v2.10)))
+- base, dev: oniguruma ([6.9.9](https://github.com/kkos/oniguruma/releases/tag/v6.9.9))
+- base, dev: openssh ([9.8_p1](https://www.openssh.com/txt/release-9.8))
+- base, dev: pinentry ([1.3.1](https://git.gnupg.org/cgi-bin/gitweb.cgi?p=pinentry.git;a=blob;f=NEWS;h=a07d18953341a4eb65c9873e64c06bc7c642606d;hb=dd8894fa60c1f1c08ecc50ba4657580abc348347))
+- base, dev: pkgconf ([2.3.0](https://github.com/pkgconf/pkgconf/blob/pkgconf-2.3.0/NEWS))
+- base, dev: sqlite ([3.46.1](https://www.sqlite.org/releaselog/3_46_1.html))
+- base, dev: tcpdump ([4.99.5](https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.99.5/CHANGES))
+- base, dev: userspace-rcu ([0.14.1](https://lists.lttng.org/pipermail/lttng-dev/2024-August/030860.html))
+- dev: gnuconfig ([20240728](https://git.savannah.gnu.org/cgit/config.git/log/?id=00b15927496058d23e6258a28d8996f87cf1f191))
+- dev: iperf ([3.17.1](https://github.com/esnet/iperf/releases/tag/3.17.1) (includes [3.17](https://github.com/esnet/iperf/releases/tag/3.17)))
+- dev: libpipeline ([1.5.8](https://gitlab.com/libpipeline/libpipeline/-/blob/dd37cf76496b4b999509bd133657c1fc021e3a5f/NEWS.md))
+- dev: man-db ([2.13.0](https://gitlab.com/man-db/man-db/-/releases/2.13.0))
+- sysext-python: idna ([3.10](https://github.com/kjd/idna/blob/v3.10/HISTORY.rst))
+- sysext-python: more-itertools ([10.5.0](https://github.com/more-itertools/more-itertools/blob/v10.5.0/docs/versions.rst#1050))
+- sysext-python: msgpack ([1.1.0](https://github.com/msgpack/msgpack-python/blob/v1.1.0/ChangeLog.rst#110))
+- sysext-python: platformdirs ([4.3.6](https://github.com/tox-dev/platformdirs/releases/tag/4.3.6))
+- sysext-python: rich ([13.8.1](https://github.com/Textualize/rich/releases/tag/v13.8.1))
+- sysext-python: trove-classifiers ([2024.9.12](https://github.com/pypa/trove-classifiers/releases/tag/2024.9.12))
+- sysext-python: urllib3 ([2.2.3](https://github.com/urllib3/urllib3/releases/tag/2.2.3))
+- vmware: xmlsec ([1.3.4](https://github.com/lsh123/xmlsec/releases/tag/1.3.4))
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1-r314.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1-r315.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1-r314.ebuild
rename to sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1-r315.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild
index 9e1f7edc507..21b35197a69 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild
@@ -153,7 +153,7 @@ RDEPEND="${RDEPEND}
 	sec-policy/selinux-unconfined
 	sys-apps/acl
 	sys-apps/attr
-	sys-apps/azure-nvme-utils
+	sys-apps/azure-vm-utils
 	sys-apps/coreutils
 	sys-apps/checkpolicy
 	sys-apps/dbus
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-block/open-iscsi b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-block/open-iscsi
index b7e004428a9..e063af33a4c 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-block/open-iscsi
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-block/open-iscsi
@@ -10,9 +10,3 @@ cros_post_src_install_tmpfiles() {
 		After=systemd-tmpfiles-setup.service
 	EOF
 }
-
-# Masking initiatorname.iscsi.example prevents initiatorname.iscsi from being
-# generated and installed. We want the systemd unit to do this at runtime so
-# that we don't bake the value into Flatcar images.
-INSTALL_MASK+=" ${EPREFIX}/etc/iscsi/initiatorname.iscsi*"
-PKG_INSTALL_MASK+=" ${EPREFIX}/etc/iscsi/initiatorname.iscsi*"
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-boot/grub b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-boot/grub
index 223641d3e1c..759353b3ca2 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-boot/grub
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-boot/grub
@@ -1,7 +1,7 @@
 # Bump the flatcar version stated here every time we or Gentoo change patches
 # that modify parts of GRUB that are installed to the boot partition. Reset the
 # version back to 1 when the upstream GRUB version changes.
-FLATCAR_VERSION=flatcar1
+FLATCAR_VERSION=flatcar2
 
 # Adjust the version string for Flatcar. This propagates throughout the source.
 cros_pre_src_prepare_adjust_version() {
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/pkgcore/0001-build-profiles-patch.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/pkgcore/0001-build-profiles-patch.patch
deleted file mode 100644
index 5d25d2dcbfa..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/pkgcore/0001-build-profiles-patch.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From dd76e415b2a707d31a125201c5d21aadb07282a7 Mon Sep 17 00:00:00 2001
-From: James Le Cuirot <chewi@gentoo.org>
-Date: Tue, 11 Jun 2024 15:39:25 +0100
-Subject: [PATCH] ebuild.profiles: Fix case where a parent path omits the repo
- identifier
-
-According "SPECIFIC FILE DESCRIPTIONS" in `man portage`, it is valid to
-have a parent path like `:path/to/profile` where the repo identifier is
-missing. This refers to a path in the current repo.
-
-Signed-off-by: James Le Cuirot <chewi@gentoo.org>
----
- src/pkgcore/ebuild/profiles.py | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/src/pkgcore/ebuild/profiles.py b/src/pkgcore/ebuild/profiles.py
-index 384e41e22..fea1eacc7 100644
---- a/src/pkgcore/ebuild/profiles.py
-+++ b/src/pkgcore/ebuild/profiles.py
-@@ -254,6 +254,8 @@ def parent_paths(self, data):
-                                     f"unknown repo {repo_id!r}"
-                                 )
-                                 continue
-+                    else:
-+                        location = repo_config.location
-                     l.append(
-                         (
-                             abspath(pjoin(location, "profiles", profile_path)),
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/pkgcore/README.md b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/pkgcore/README.md
deleted file mode 100644
index c61330e6b22..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/pkgcore/README.md
+++ /dev/null
@@ -1,2 +0,0 @@
-The `0001-build-profiles-patch.patch` patch can be dropped when we
-update sys-apps/pkgcore to version greater than `0.12.27`.
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-libs/efivar/0001-src-Makefile-build-util.c-separately-for-makeguids.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-libs/efivar/0001-src-Makefile-build-util.c-separately-for-makeguids.patch
deleted file mode 100644
index 99d98a4195c..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-libs/efivar/0001-src-Makefile-build-util.c-separately-for-makeguids.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From ca48d3964d26f5e3b38d73655f19b1836b16bd2d Mon Sep 17 00:00:00 2001
-From: Alexander Kanavin <alex@linutronix.de>
-Date: Tue, 18 Jan 2022 11:53:41 +0100
-Subject: [PATCH] src/Makefile: build util.c separately for makeguids
-
-util.c needs to be built twice when cross-compiling:
-for the build machine to be able to link with
-makeguids which then runs during the same build,
-and then for the actual target.
-
-Signed-off-by: Alexander Kanavin <alex@linutronix.de>
----
- src/Makefile | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/src/Makefile b/src/Makefile
-index 0e423c4..a86abdc 100644
---- a/src/Makefile
-+++ b/src/Makefile
-@@ -27,10 +27,13 @@ EFIVAR_OBJECTS = $(patsubst %.S,%.o,$(pa
- EFISECDB_SOURCES = efisecdb.c guid-symbols.c secdb-dump.c util.c
- EFISECDB_OBJECTS = $(patsubst %.S,%.o,$(patsubst %.c,%.o,$(EFISECDB_SOURCES)))
- GENERATED_SOURCES = include/efivar/efivar-guids.h guid-symbols.c
--MAKEGUIDS_SOURCES = makeguids.c util.c
-+MAKEGUIDS_SOURCES = makeguids.c util-makeguids.c
- MAKEGUIDS_OBJECTS = $(patsubst %.S,%.o,$(patsubst %.c,%.o,$(MAKEGUIDS_SOURCES)))
- MAKEGUIDS_OUTPUT = $(GENERATED_SOURCES)
- 
-+util-makeguids.c : util.c
-+	cp util.c util-makeguids.c
-+
- ALL_SOURCES=$(LIBEFISEC_SOURCES) $(LIBEFIBOOT_SOURCES) $(LIBEFIVAR_SOURCES) \
- 	    $(MAKEGUIDS_SOURCES) $(GENERATED_SOURCES) $(EFIVAR_SOURCES) \
- 	    $(sort $(wildcard include/efivar/*.h))
--- 
-2.34.1
-
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-libs/efivar/README.md b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-libs/efivar/README.md
deleted file mode 100644
index 10994158722..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-libs/efivar/README.md
+++ /dev/null
@@ -1,4 +0,0 @@
-The `0001-src-Makefile-build-util.c-separately-for-makeguids.patch`
-patch fixes a cross-compilation issue. We will ask Gentoo to include
-this patch too in their ebuild. Currently there is no release of
-efivar that has this patch.
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
index 51c1f1e7e46..23b25761b92 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
@@ -13,6 +13,10 @@
 # Keep versions on both arches in sync.
 =app-containers/cri-tools-1.27.0 ~arm64
 
+# Accept unstable for Docker and its CLI.
+=app-containers/docker-27.2.1 ~amd64 ~arm64
+=app-containers/docker-cli-27.2.1 ~amd64 ~arm64
+
 # Needed to address CVE-2024-3727
 =app-containers/podman-5.0.3 ~amd64 ~arm64
 
@@ -34,33 +38,45 @@
 # Needed by arm64-native SDK.
 =app-crypt/efitools-1.9.2-r1 ~arm64
 
+# Keep versions on both arches in sync.
+=app-crypt/gnupg-2.4.5-r2 ~arm64
+=app-crypt/pinentry-1.3.1 ~arm64
+
 # Needed by arm64-native SDK.
 =app-emulation/open-vmdk-1.0 *
 
 # Keep versions on both arches in sync.
+=app-portage/elt-patches-20240912
+=app-shells/bash-5.2_p37 ~arm64
+=dev-build/ninja-1.12.1 ~arm64
 =dev-cpp/abseil-cpp-20230125.3-r4 ~arm64
 
 # Keep versions on both arches in sync.
 =dev-cpp/glog-0.6.0 ~arm64
-=dev-lang/perl-5.40.0 ~arm64
-
-# Needed by arm64-native SDK.
+=dev-db/sqlite-3.46.1 ~arm64
+=dev-lang/tcl-8.6.14 ~arm64
 =dev-lang/yasm-1.3.0-r1 ~arm64
-
-# Keep versions on both arches in sync.
 =dev-libs/ding-libs-0.6.2-r1 ~arm64
 
 # The only available ebuild (from GURU) has ~amd64 and no keyword for arm64 yet.
 =dev-libs/jose-12 **
 
+# Keep versions on both arches in sync.
+=dev-libs/libassuan-3.0.0 ~arm64
+=dev-libs/libgpg-error-1.50 ~arm64
+=dev-libs/libnl-3.10.0 ~arm64
+
 # The only available ebuild (from GURU) has ~amd64 and no keyword for arm64 yet.
 =dev-libs/luksmeta-9-r1 **
 
+# Keep versions on both arches in sync.
+=dev-libs/userspace-rcu-0.14.1 ~arm64
+
 # These seem to be the versions we initially got, but the
 # modifications made to the ebuilds were clobbered, so these are here
 # to keep using the same version. Can be dropped when these or newer
 # get stabilized in Gentoo.
-=dev-libs/yajl-2.1.0-r5 ~amd64 ~arm64
+=dev-libs/yajl-2.1.0-r5 ~arm64
 
 # Keep versions on both arches in sync.
 =dev-util/bpftool-7.5.0-r1 ~arm64
@@ -68,32 +84,47 @@
 # Catalyst 4 is not stable yet, but earlier versions are masked now.
 dev-util/catalyst ~amd64 ~arm64
 
+# Keep versions on both arches in sync.
+=dev-util/pkgconf-2.3.0 ~arm64
+
 # Needed for the MIT License
 =net-analyzer/netperf-2.7.0_p20210121 ~amd64 ~arm64
 
 # Keep versions on both arches in sync.
+=net-analyzer/tcpdump-4.99.5 ~arm64
+=net-dns/c-ares-1.33.1 ~arm64
 =net-firewall/conntrack-tools-1.4.8 ~arm64
-
-# Required for addressing CVE-2023-0361, CVE-2023-5981, CVE-2024-0567,
-# CVE-2024-0553, CVE-2024-28834 and CVE-2024-28835.
-=net-libs/gnutls-3.8.5-r1 ~amd64 ~arm64
-
-# Keep versions on both arches in sync.
+=net-firewall/ipset-7.22-r2 ~arm64
+=net-libs/gnutls-3.8.7.1-r1 ~arm64
 =net-libs/libnetfilter_cthelper-1.0.1-r1 ~arm64
 =net-libs/libnetfilter_cttimeout-1.0.1 ~arm64
 
 # Needed to address CVE-2023-7256 and CVE-2024-8006.
-=net-libs/libpcap-1.10.5 ~amd64 ~arm64
+=net-libs/libpcap-1.10.5 ~arm64
+
+# Keep versions on both arches in sync.
+=net-misc/chrony-4.6 ~arm64
 
-# Needed to address CVE-2024-6197, CVE-2024-6874 and CVE-2024-7264.
-=net-misc/curl-8.9.1-r1 ~amd64 ~arm64
+# Needed to address CVE-2024-6197, CVE-2024-6874, CVE-2024-7264 and
+# CVE-2024-8096.
+=net-misc/curl-8.10.1 ~amd64 ~arm64
+
+# Keep versions on both arches in sync.
+=net-misc/iperf-3.17.1 ~arm64
+=net-misc/openssh-9.8_p1-r2 ~arm64
 
 # Package has not been stabilised yet.
-=sys-apps/azure-nvme-utils-0.2.0 ~amd64 ~arm64
+=sys-apps/azure-vm-utils-0.3.0 ~amd64 ~arm64
 
 # Keep versions on both arches in sync.
+=sys-apps/bubblewrap-0.10.0 ~arm64
+=sys-apps/dtc-1.7.1 ~arm64
 =sys-apps/kexec-tools-2.0.28 ~arm64
+=sys-apps/kmod-33 ~arm64
+=sys-apps/man-db-2.13.0 ~arm64
+=sys-apps/nvme-cli-2.10.2 ~arm64
 =sys-apps/zram-generator-1.1.2 ~arm64
+=sys-block/open-iscsi-2.1.10-r1 ~arm64
 
 # Upgrade to latest version for secureboot
 =sys-boot/mokutil-0.6.0 ~amd64
@@ -102,14 +133,11 @@ dev-util/catalyst ~amd64 ~arm64
 =sys-cluster/ipvsadm-1.31-r1 ~arm64
 
 # Keep versions on both arches in sync.
+=sys-devel/binutils-config-5.5.2 ~arm64
+=sys-devel/gettext-0.22.5 ~arm64
+=sys-fs/btrfs-progs-6.10.1 ~arm64
+=sys-fs/quota-4.09-r1 ~arm64
+=sys-libs/cracklib-2.10.2 ~arm64
+=sys-libs/efivar-39-r1 ~arm64
+=sys-libs/readline-8.2_p13 ~arm64
 =sys-process/audit-4.0.1-r1 ~arm64
-=virtual/perl-Data-Dumper-2.189.0 ~arm64
-=virtual/perl-Encode-3.210.0-r1 ~arm64
-=virtual/perl-Getopt-Long-2.570.0-r1 ~arm64
-=virtual/perl-Exporter-5.780.0 ~arm64
-=virtual/perl-File-Spec-3.900.0 ~arm64
-=virtual/perl-IO-1.550.0 ~arm64
-
-# Accept unstable for Docker and its CLI.
-=app-containers/docker-27.2.1 ~amd64 ~arm64
-=app-containers/docker-cli-27.2.1 ~amd64 ~arm64
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
index 75aa7f8d28e..6f48f905222 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
@@ -13,7 +13,8 @@ dev-vcs/git		webdav curl
 
 # Mask support for http3 for now (unavailable on arm64 for now, and
 # I'm not sure we really need it.)
-net-misc/curl		kerberos telnet -http3 -quic -curl_quic_openssl
+# Disable websockets, we never had them, and now they are enabled by default.
+net-misc/curl		kerberos telnet -http3 -quic -curl_quic_openssl -websockets
 net-misc/iputils	arping tracepath
 sys-devel/gettext	-git
 
@@ -39,7 +40,7 @@ net-firewall/ipset -modules
 dev-libs/glib -mime
 
 # keep grub build simple
-sys-boot/grub -multislot -themes -fonts
+sys-boot/grub -multislot -themes -fonts -device-mapper
 
 # disable "high performance ssh" patch, turn on kerberos
 net-misc/openssh -hpn kerberos
@@ -95,8 +96,8 @@ sys-kernel/coreos-firmware -savedconfig
 # Make kmod support kernel modules compressed via lzma(xz)
 sys-apps/kmod lzma
 
-# These (qmanifest and qtegrity) are new tools and they pull even more dependencies.
-app-portage/portage-utils -qmanifest -qtegrity
+# The qmanifest is a new tool and it pulls even more dependencies.
+app-portage/portage-utils -qmanifest
 
 # Disable unnecessary regedit in samba to minimize the package size.
 net-fs/samba -regedit
diff --git a/sdk_container/src/third_party/portage-stable/app-admin/perl-cleaner/perl-cleaner-2.31-r2.ebuild b/sdk_container/src/third_party/portage-stable/app-admin/perl-cleaner/perl-cleaner-2.31-r2.ebuild
index 6c13c04a420..b4b2b6605db 100644
--- a/sdk_container/src/third_party/portage-stable/app-admin/perl-cleaner/perl-cleaner-2.31-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-admin/perl-cleaner/perl-cleaner-2.31-r2.ebuild
@@ -13,7 +13,7 @@ if [[ "${PV}" == "9999" ]] ; then
 	EGIT_REPO_URI="https://github.com/gentoo-perl/perl-cleaner.git"
 else
 	SRC_URI="https://dev.gentoo.org/~dilfridge/distfiles/${P}.tar.bz2"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="GPL-2"
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
index 0c49596464d..f44273cc39b 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
@@ -1,2 +1,6 @@
 DIST libarchive-3.7.4.tar.xz 5417660 BLAKE2B 128f72235da61e112201046c0cfe62a8c580cf73b426c4cfe270ae913356f6ad430ba33a663dcd617b082c7baf45ada8d1c9928c45fea16fd57e8020693a60bc SHA512 84bc346ba15861ab10aa54a3d687de955178e4efbe12bf3a49a467181e7f819673949f131f4c8338de8ed6e319a8565af376e5a540380bda08e60dffbc7c8686
 DIST libarchive-3.7.4.tar.xz.asc 659 BLAKE2B 77e705194f6e9a9f97da0ac43c9b3157e1a8a490d26da34079e4ef3f2bcf98d6f6e95567e110287fab0ec26d3fc27e5bbeff7569c9ca138de2caf47af737c6d0 SHA512 82caa18a78661ea717ce93cdcb0806eed48450c20fb4d45cb4c33001f2d4d0fb5a791552acbb24ad8c41772e1d0b66c76c9cb86946bc862109721a0c986f5331
+DIST libarchive-3.7.5.tar.xz 5437940 BLAKE2B e1cf8490b2db64e912bd181391310653b4e3524e74f35557e1ddb8c5eb53dcde307da945d393921acf7549ef0d4a6bf228d8f42ab4d795d06dd2248196a11c85 SHA512 b9cfb0a147bf0f77cca9e2bdea173f47a78dcba5df1d97a8e0e7b14a15039ac6d5467e325423b2a05741848f73ca7ab4fece922153f24f934f9370cb521d20df
+DIST libarchive-3.7.5.tar.xz.asc 659 BLAKE2B 7310b8d7e3f07b8c75910ff3355ffda653402ca2d6db9cdf7d669b9a4ac5f3fb4c4c4482e85184fd68a23c96bce587a95b56efb88ae971399e130e533bd0969a SHA512 7494518b61a58a9aa1e991a2cf6b16340e34d7aa2c25a3c531799785e165541781d1a915437260bc536fe8267140cc69abb2670e8c0576e975a5a2b7ecf8e20d
+DIST libarchive-3.7.6.tar.xz 5458552 BLAKE2B 3251dc4d59867d1c9b43e78ac7735c27670e819a1aba4f4a76372b8509e2427ff24e379f6102a4cc3c92b965d182c8939bb6df4c82d4d1141cdd1db13bf039a2 SHA512 3ca90d665772418b9ac444044511989e81e785a13db3c101851390ba7c2ba0793c799cedb9df990e900ab78c98207f70ecee7e21829578555dde99424950ae2a
+DIST libarchive-3.7.6.tar.xz.asc 659 BLAKE2B 9f6a621dd4aa20f06dff71225723e60a6cee1f2a54ff07d2d19670153105f2f75d6439320f49eb46c28a4416828af7dc4f0d827e46ec9aeb5b703f06eb329d77 SHA512 2840b13f910f47d34daeed9680beb4b3cdde2d7de26ab8453756261c51fb7a39b727454f370b0ee60f8e1646c65544331a22558cbe8faf79a201b1d1346b37c1
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/files/libarchive-3.7.5-attr-dep.patch b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/files/libarchive-3.7.5-attr-dep.patch
new file mode 100644
index 00000000000..3b26c51ea9d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/files/libarchive-3.7.5-attr-dep.patch
@@ -0,0 +1,28 @@
+From 44b8e3b676746352cb3e08f76e58510c78209091 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20G=C3=B3rny?= <mgorny@gentoo.org>
+Date: Wed, 18 Sep 2024 14:10:58 +0200
+Subject: [PATCH] tar/write.c: Support `sys/xattr.h`
+
+Synchronize the last use of `attr/xattr.h` to support using
+`sys/xattr.h` instead.  The former header is deprecated on GNU/Linux,
+and this replacement makes it possible to build libarchive without
+the `attr` package.
+---
+ tar/write.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tar/write.c b/tar/write.c
+index 1d1139f4c..43cd70233 100644
+--- a/tar/write.c
++++ b/tar/write.c
+@@ -32,7 +32,9 @@
+ #ifdef HAVE_SYS_STAT_H
+ #include <sys/stat.h>
+ #endif
+-#ifdef HAVE_ATTR_XATTR_H
++#if HAVE_SYS_XATTR_H
++#include <sys/xattr.h>
++#elif HAVE_ATTR_XATTR_H
+ #include <attr/xattr.h>
+ #endif
+ #ifdef HAVE_ERRNO_H
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/files/libarchive-3.7.5-iso9660-times.patch b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/files/libarchive-3.7.5-iso9660-times.patch
new file mode 100644
index 00000000000..2c5bcc27736
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/files/libarchive-3.7.5-iso9660-times.patch
@@ -0,0 +1,334 @@
+From b65d12b344a5d81c6060b1c1794afa8858fe234b Mon Sep 17 00:00:00 2001
+From: Tim Kientzle <kientzle@acm.org>
+Date: Sat, 14 Sep 2024 21:09:34 -0700
+Subject: [PATCH] Be more cautious about parsing ISO-9660 timestamps
+
+Some ISO images don't have valid timestamps for the root directory
+entry.  Parsing such timestamps can generate nonsensical results,
+which in one case showed up as an unexpected overflow on a 32-bit system.
+
+Add some validation logic that can check whether a 7-byte or 17-byte
+timestamp is reasonable-looking, and use this to ignore invalid
+timestamps in various locations.  This also requires us to be a little
+more careful about tracking which timestamps are actually known.
+
+Resolves issue #2329
+---
+ .../archive_read_support_format_iso9660.c     | 186 ++++++++++++++++--
+ libarchive/test/test_read_format_iso_Z.c      |  12 +-
+ 2 files changed, 177 insertions(+), 21 deletions(-)
+
+diff --git a/libarchive/archive_read_support_format_iso9660.c b/libarchive/archive_read_support_format_iso9660.c
+index 056beb5ff..951afb603 100644
+--- a/libarchive/archive_read_support_format_iso9660.c
++++ b/libarchive/archive_read_support_format_iso9660.c
+@@ -273,7 +273,7 @@ struct file_info {
+ 	char		 re;		/* Having RRIP "RE" extension.	*/
+ 	char		 re_descendant;
+ 	uint64_t	 cl_offset;	/* Having RRIP "CL" extension.	*/
+-	int		 birthtime_is_set;
++	int		 time_is_set;	/* Bitmask indicating which times are known */
+ 	time_t		 birthtime;	/* File created time.		*/
+ 	time_t		 mtime;		/* File last modified time.	*/
+ 	time_t		 atime;		/* File last accessed time.	*/
+@@ -306,6 +306,11 @@ struct file_info {
+ 	} rede_files;
+ };
+ 
++#define BIRTHTIME_IS_SET 1
++#define MTIME_IS_SET 2
++#define ATIME_IS_SET 4
++#define CTIME_IS_SET 8
++
+ struct heap_queue {
+ 	struct file_info **files;
+ 	int		 allocated;
+@@ -394,7 +399,9 @@ static void	dump_isodirrec(FILE *, const unsigned char *isodirrec);
+ #endif
+ static time_t	time_from_tm(struct tm *);
+ static time_t	isodate17(const unsigned char *);
++static int	isodate17_valid(const unsigned char *);
+ static time_t	isodate7(const unsigned char *);
++static int	isodate7_valid(const unsigned char *);
+ static int	isBootRecord(struct iso9660 *, const unsigned char *);
+ static int	isVolumePartition(struct iso9660 *, const unsigned char *);
+ static int	isVDSetTerminator(struct iso9660 *, const unsigned char *);
+@@ -1351,13 +1358,22 @@ archive_read_format_iso9660_read_header(struct archive_read *a,
+ 	archive_entry_set_uid(entry, file->uid);
+ 	archive_entry_set_gid(entry, file->gid);
+ 	archive_entry_set_nlink(entry, file->nlinks);
+-	if (file->birthtime_is_set)
++	if ((file->time_is_set & BIRTHTIME_IS_SET))
+ 		archive_entry_set_birthtime(entry, file->birthtime, 0);
+ 	else
+ 		archive_entry_unset_birthtime(entry);
+-	archive_entry_set_mtime(entry, file->mtime, 0);
+-	archive_entry_set_ctime(entry, file->ctime, 0);
+-	archive_entry_set_atime(entry, file->atime, 0);
++	if ((file->time_is_set & MTIME_IS_SET))
++		archive_entry_set_mtime(entry, file->mtime, 0);
++	else
++		archive_entry_unset_mtime(entry);
++	if ((file->time_is_set & CTIME_IS_SET))
++		archive_entry_set_ctime(entry, file->ctime, 0);
++	else
++		archive_entry_unset_ctime(entry);
++	if ((file->time_is_set & ATIME_IS_SET))
++		archive_entry_set_atime(entry, file->atime, 0);
++	else
++		archive_entry_unset_atime(entry);
+ 	/* N.B.: Rock Ridge supports 64-bit device numbers. */
+ 	archive_entry_set_rdev(entry, (dev_t)file->rdev);
+ 	archive_entry_set_size(entry, iso9660->entry_bytes_remaining);
+@@ -1898,8 +1914,11 @@ parse_file_info(struct archive_read *a, struct file_info *parent,
+ 	file->parent = parent;
+ 	file->offset = offset;
+ 	file->size = fsize;
+-	file->mtime = isodate7(isodirrec + DR_date_offset);
+-	file->ctime = file->atime = file->mtime;
++	if (isodate7_valid(isodirrec + DR_date_offset)) {
++		file->time_is_set |= MTIME_IS_SET | ATIME_IS_SET | CTIME_IS_SET;
++		file->mtime = isodate7(isodirrec + DR_date_offset);
++		file->ctime = file->atime = file->mtime;
++	}
+ 	file->rede_files.first = NULL;
+ 	file->rede_files.last = &(file->rede_files.first);
+ 
+@@ -2573,51 +2592,73 @@ parse_rockridge_TF1(struct file_info *file, const unsigned char *data,
+ 		/* Use 17-byte time format. */
+ 		if ((flag & 1) && data_length >= 17) {
+ 			/* Create time. */
+-			file->birthtime_is_set = 1;
+-			file->birthtime = isodate17(data);
++			if (isodate17_valid(data)) {
++				file->time_is_set |= BIRTHTIME_IS_SET;
++				file->birthtime = isodate17(data);
++			}
+ 			data += 17;
+ 			data_length -= 17;
+ 		}
+ 		if ((flag & 2) && data_length >= 17) {
+ 			/* Modify time. */
+-			file->mtime = isodate17(data);
++			if (isodate17_valid(data)) {
++				file->time_is_set |= MTIME_IS_SET;
++				file->mtime = isodate17(data);
++			}
+ 			data += 17;
+ 			data_length -= 17;
+ 		}
+ 		if ((flag & 4) && data_length >= 17) {
+ 			/* Access time. */
+-			file->atime = isodate17(data);
++			if (isodate17_valid(data)) {
++				file->time_is_set |= ATIME_IS_SET;
++				file->atime = isodate17(data);
++			}
+ 			data += 17;
+ 			data_length -= 17;
+ 		}
+ 		if ((flag & 8) && data_length >= 17) {
+ 			/* Attribute change time. */
+-			file->ctime = isodate17(data);
++			if (isodate17_valid(data)) {
++				file->time_is_set |= CTIME_IS_SET;
++				file->ctime = isodate17(data);
++			}
+ 		}
+ 	} else {
+ 		/* Use 7-byte time format. */
+ 		if ((flag & 1) && data_length >= 7) {
+ 			/* Create time. */
+-			file->birthtime_is_set = 1;
+-			file->birthtime = isodate7(data);
++			if (isodate7_valid(data)) {
++				file->time_is_set |= BIRTHTIME_IS_SET;
++				file->birthtime = isodate7(data);
++			}
+ 			data += 7;
+ 			data_length -= 7;
+ 		}
+ 		if ((flag & 2) && data_length >= 7) {
+ 			/* Modify time. */
+-			file->mtime = isodate7(data);
++			if (isodate7_valid(data)) {
++				file->time_is_set |= MTIME_IS_SET;
++				file->mtime = isodate7(data);
++			}
+ 			data += 7;
+ 			data_length -= 7;
+ 		}
+ 		if ((flag & 4) && data_length >= 7) {
+ 			/* Access time. */
+-			file->atime = isodate7(data);
++			if (isodate7_valid(data)) {
++				file->time_is_set |= ATIME_IS_SET;
++				file->atime = isodate7(data);
++			}
+ 			data += 7;
+ 			data_length -= 7;
+ 		}
+ 		if ((flag & 8) && data_length >= 7) {
+ 			/* Attribute change time. */
+-			file->ctime = isodate7(data);
++			if (isodate7_valid(data)) {
++				file->time_is_set |= CTIME_IS_SET;
++				file->ctime = isodate7(data);
++			}
+ 		}
+ 	}
+ }
+@@ -3226,6 +3267,56 @@ isValid733Integer(const unsigned char *p)
+ 		&& p[3] == p[4]);
+ }
+ 
++static int
++isodate7_valid(const unsigned char *v)
++{
++	int year = v[0];
++	int month = v[1];
++	int day = v[2];
++	int hour = v[3];
++	int minute = v[4];
++	int second = v[5];
++	int gmt_off = (signed char)v[6];
++
++	/* ECMA-119 9.1.5 "If all seven values are zero, it shall mean
++	 * that the date is unspecified" */
++	if (year == 0
++	    && month == 0
++	    && day == 0
++	    && hour == 0
++	    && minute == 0
++	    && second == 0
++	    && gmt_off == 0)
++		return 0;
++	/*
++	 * Sanity-test each individual field
++	 */
++	/* Year can have any value */
++	/* Month must be 1-12 */
++	if (month < 1 || month > 12)
++		return 0;
++	/* Day must be 1-31 */
++	if (day < 1 || day > 31)
++		return 0;
++	/* Hour must be 0-23 */
++	if (hour > 23)
++		return 0;
++	/* Minute must be 0-59 */
++	if (minute > 59)
++		return 0;
++	/* second must be 0-59 according to ECMA-119 9.1.5 */
++	/* BUT: we should probably allow for the time being in UTC, which
++	   allows up to 61 seconds in a minute in certain cases */
++	if (second > 61)
++		return 0;
++	/* Offset from GMT must be -48 to +52 */
++	if (gmt_off < -48 || gmt_off > +52)
++		return 0;
++
++	/* All tests pass, this is OK */
++	return 1;
++}
++
+ static time_t
+ isodate7(const unsigned char *v)
+ {
+@@ -3252,6 +3343,67 @@ isodate7(const unsigned char *v)
+ 	return (t);
+ }
+ 
++static int
++isodate17_valid(const unsigned char *v)
++{
++	/* First 16 bytes are all ASCII digits */
++	for (int i = 0; i < 16; i++) {
++		if (v[i] < '0' || v[i] > '9')
++			return 0;
++	}
++
++	int year = (v[0] - '0') * 1000 + (v[1] - '0') * 100
++		+ (v[2] - '0') * 10 + (v[3] - '0');
++	int month = (v[4] - '0') * 10 + (v[5] - '0');
++	int day = (v[6] - '0') * 10 + (v[7] - '0');
++	int hour = (v[8] - '0') * 10 + (v[9] - '0');
++	int minute = (v[10] - '0') * 10 + (v[11] - '0');
++	int second = (v[12] - '0') * 10 + (v[13] - '0');
++	int hundredths = (v[14] - '0') * 10 + (v[15] - '0');
++	int gmt_off = (signed char)v[16];
++
++	if (year == 0 && month == 0 && day == 0
++	    && hour == 0 && minute == 0 && second == 0
++	    && hundredths == 0 && gmt_off == 0)
++		return 0;
++	/*
++	 * Sanity-test each individual field
++	 */
++
++	/* Year must be 1900-2300 */
++	/* (Not specified in ECMA-119, but these seem
++	   like reasonable limits. */
++	if (year < 1900 || year > 2300)
++		return 0;
++	/* Month must be 1-12 */
++	if (month < 1 || month > 12)
++		return 0;
++	/* Day must be 1-31 */
++	if (day < 1 || day > 31)
++		return 0;
++	/* Hour must be 0-23 */
++	if (hour > 23)
++		return 0;
++	/* Minute must be 0-59 */
++	if (minute > 59)
++		return 0;
++	/* second must be 0-59 according to ECMA-119 9.1.5 */
++	/* BUT: we should probably allow for the time being in UTC, which
++	   allows up to 61 seconds in a minute in certain cases */
++	if (second > 61)
++		return 0;
++	/* Hundredths must be 0-99 */
++	if (hundredths > 99)
++		return 0;
++	/* Offset from GMT must be -48 to +52 */
++	if (gmt_off < -48 || gmt_off > +52)
++		return 0;
++
++	/* All tests pass, this is OK */
++	return 1;
++
++}
++
+ static time_t
+ isodate17(const unsigned char *v)
+ {
+diff --git a/libarchive/test/test_read_format_iso_Z.c b/libarchive/test/test_read_format_iso_Z.c
+index d07bc1bc8..716552fa3 100644
+--- a/libarchive/test/test_read_format_iso_Z.c
++++ b/libarchive/test/test_read_format_iso_Z.c
+@@ -93,16 +93,20 @@ test_small(const char *name)
+ 	assertEqualIntA(a, ARCHIVE_OK,
+ 	    archive_read_next_header(a, &ae));
+ 	assertEqualString(".", archive_entry_pathname(ae));
+-	assertEqualIntA(a, 3443989665, archive_entry_atime(ae));
+-	assertEqualIntA(a, 0, archive_entry_birthtime(ae));
+-	assertEqualIntA(a, 3443989665, archive_entry_ctime(ae));
++	assertEqualInt(0, archive_entry_atime_is_set(ae));
++	assertEqualInt(0, archive_entry_atime(ae));
++	assertEqualInt(0, archive_entry_birthtime_is_set(ae));
++	assertEqualInt(0, archive_entry_birthtime(ae));
++	assertEqualInt(0, archive_entry_ctime_is_set(ae));
++	assertEqualInt(0, archive_entry_ctime(ae));
+ 	assertEqualIntA(a, 0, archive_entry_dev(ae));
+ 	assertEqualIntA(a, AE_IFDIR, archive_entry_filetype(ae));
+ 	assertEqualIntA(a, 0, archive_entry_gid(ae));
+ 	assertEqualStringA(a, NULL, archive_entry_gname(ae));
+ 	assertEqualIntA(a, 0, archive_entry_ino(ae));
+ 	assertEqualIntA(a, AE_IFDIR | 0700, archive_entry_mode(ae));
+-	assertEqualIntA(a, 3443989665, archive_entry_mtime(ae));
++	assertEqualInt(0, archive_entry_mtime_is_set(ae));
++	assertEqualInt(0, archive_entry_mtime(ae));
+ 	assertEqualIntA(a, 4, archive_entry_nlink(ae));
+ 	assertEqualIntA(a, 0700, archive_entry_perm(ae));
+ 	assertEqualIntA(a, 2048, archive_entry_size(ae));
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.5.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.5.ebuild
new file mode 100644
index 00000000000..1b511581671
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.5.ebuild
@@ -0,0 +1,177 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit libtool multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="Multi-format archive and compression library"
+HOMEPAGE="
+	https://www.libarchive.org/
+	https://github.com/libarchive/libarchive/
+"
+SRC_URI="
+	https://www.libarchive.de/downloads/${P}.tar.xz
+	verify-sig? ( https://www.libarchive.de/downloads/${P}.tar.xz.asc )
+"
+
+LICENSE="BSD BSD-2 BSD-4 public-domain"
+SLOT="0/13"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="
+	acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle
+	static-libs test xattr +zstd
+"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/zlib:=[${MULTILIB_USEDEP}]
+	acl? ( virtual/acl:=[${MULTILIB_USEDEP}] )
+	blake2? ( app-crypt/libb2:=[${MULTILIB_USEDEP}] )
+	bzip2? ( app-arch/bzip2:=[${MULTILIB_USEDEP}] )
+	expat? ( dev-libs/expat:=[${MULTILIB_USEDEP}] )
+	!expat? ( dev-libs/libxml2:=[${MULTILIB_USEDEP}] )
+	iconv? ( virtual/libiconv:=[${MULTILIB_USEDEP}] )
+	dev-libs/openssl:=[${MULTILIB_USEDEP}]
+	lz4? ( >=app-arch/lz4-0_p131:=[${MULTILIB_USEDEP}] )
+	lzma? ( >=app-arch/xz-utils-5.2.5-r1:=[${MULTILIB_USEDEP}] )
+	lzo? ( >=dev-libs/lzo-2:=[${MULTILIB_USEDEP}] )
+	nettle? ( dev-libs/nettle:=[${MULTILIB_USEDEP}] )
+	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
+"
+DEPEND="${RDEPEND}
+	kernel_linux? (
+		virtual/os-headers
+		e2fsprogs? ( sys-fs/e2fsprogs[${MULTILIB_USEDEP}] )
+	)
+	test? (
+		app-arch/lrzip
+		app-arch/lz4
+		app-arch/lzip
+		app-arch/lzop
+		app-arch/xz-utils
+		app-arch/zstd
+		lzma? ( app-arch/xz-utils[extra-filters(+)] )
+	)
+"
+BDEPEND="
+	verify-sig? ( >=sec-keys/openpgp-keys-libarchive-20221209 )
+	elibc_musl? ( sys-libs/queue-standalone )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/libarchive.org.asc
+
+# false positives (checks for libc-defined hash functions)
+QA_CONFIG_IMPL_DECL_SKIP=(
+	SHA256_Init SHA256_Update SHA256_Final
+	SHA384_Init SHA384_Update SHA384_Final
+	SHA512_Init SHA512_Update SHA512_Final
+)
+
+PATCHES=(
+	# https://github.com/libarchive/libarchive/issues/2069
+	# (we can simply update the command since we don't support old lrzip)
+	"${FILESDIR}/${PN}-3.7.2-lrzip.patch"
+	# https://github.com/libarchive/libarchive/pull/2330
+	"${FILESDIR}/${P}-iso9660-times.patch"
+	# https://github.com/libarchive/libarchive/pull/2335
+	"${FILESDIR}/${P}-attr-dep.patch"
+)
+
+src_prepare() {
+	default
+
+	# Needed for flags to be respected w/ LTO
+	elibtoolize
+}
+
+multilib_src_configure() {
+	export ac_cv_header_ext2fs_ext2_fs_h=$(usex e2fsprogs) #354923
+
+	local myconf=(
+		$(use_enable acl)
+		$(use_enable static-libs static)
+		$(use_enable xattr)
+		$(use_with blake2 libb2)
+		$(use_with bzip2 bz2lib)
+		$(use_with expat)
+		$(use_with !expat xml2)
+		$(use_with iconv)
+		$(use_with lz4)
+		$(use_with lzma)
+		$(use_with lzo lzo2)
+		$(use_with nettle)
+		--with-zlib
+		$(use_with zstd)
+
+		# Windows-specific
+		--without-cng
+	)
+	if multilib_is_native_abi ; then
+		myconf+=(
+			--enable-bsdcat="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdcpio="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdtar="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdunzip="$(tc-is-static-only && echo static || echo shared)"
+		)
+	else
+		myconf+=(
+			--disable-bsdcat
+			--disable-bsdcpio
+			--disable-bsdtar
+			--disable-bsdunzip
+		)
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+}
+
+multilib_src_compile() {
+	if multilib_is_native_abi ; then
+		emake
+	else
+		emake libarchive.la
+	fi
+}
+
+src_test() {
+	mkdir -p "${T}"/bin || die
+	# tests fail when lbzip2[symlink] is used in place of ref bunzip2
+	ln -s "${BROOT}/bin/bunzip2" "${T}"/bin || die
+	# workaround lrzip broken on 32-bit arches with >= 10 threads
+	# https://bugs.gentoo.org/927766
+	cat > "${T}"/bin/lrzip <<-EOF || die
+		#!/bin/sh
+		exec "$(type -P lrzip)" -p1 "\${@}"
+	EOF
+	chmod +x "${T}/bin/lrzip" || die
+	local -x PATH=${T}/bin:${PATH}
+	multilib-minimal_src_test
+}
+
+multilib_src_test() {
+	# sandbox is breaking long symlink behavior
+	local -x SANDBOX_ON=0
+	local -x LD_PRELOAD=
+	# some locales trigger different output that breaks tests
+	local -x LC_ALL=C.UTF-8
+	emake check
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi ; then
+		emake DESTDIR="${D}" install
+	else
+		local install_targets=(
+			install-includeHEADERS
+			install-libLTLIBRARIES
+			install-pkgconfigDATA
+		)
+		emake DESTDIR="${D}" "${install_targets[@]}"
+	fi
+
+	# Libs.private: should be used from libarchive.pc instead
+	find "${ED}" -type f -name "*.la" -delete || die
+	# https://github.com/libarchive/libarchive/issues/1766
+	sed -e '/Requires\.private/s:iconv::' \
+		-i "${ED}/usr/$(get_libdir)/pkgconfig/libarchive.pc" || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.6.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.6.ebuild
new file mode 100644
index 00000000000..8ba743b21dc
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.6.ebuild
@@ -0,0 +1,173 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit libtool multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="Multi-format archive and compression library"
+HOMEPAGE="
+	https://www.libarchive.org/
+	https://github.com/libarchive/libarchive/
+"
+SRC_URI="
+	https://www.libarchive.de/downloads/${P}.tar.xz
+	verify-sig? ( https://www.libarchive.de/downloads/${P}.tar.xz.asc )
+"
+
+LICENSE="BSD BSD-2 BSD-4 public-domain"
+SLOT="0/13"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="
+	acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle
+	static-libs test xattr +zstd
+"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/zlib:=[${MULTILIB_USEDEP}]
+	acl? ( virtual/acl:=[${MULTILIB_USEDEP}] )
+	blake2? ( app-crypt/libb2:=[${MULTILIB_USEDEP}] )
+	bzip2? ( app-arch/bzip2:=[${MULTILIB_USEDEP}] )
+	expat? ( dev-libs/expat:=[${MULTILIB_USEDEP}] )
+	!expat? ( dev-libs/libxml2:=[${MULTILIB_USEDEP}] )
+	iconv? ( virtual/libiconv:=[${MULTILIB_USEDEP}] )
+	dev-libs/openssl:=[${MULTILIB_USEDEP}]
+	lz4? ( >=app-arch/lz4-0_p131:=[${MULTILIB_USEDEP}] )
+	lzma? ( >=app-arch/xz-utils-5.2.5-r1:=[${MULTILIB_USEDEP}] )
+	lzo? ( >=dev-libs/lzo-2:=[${MULTILIB_USEDEP}] )
+	nettle? ( dev-libs/nettle:=[${MULTILIB_USEDEP}] )
+	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
+"
+DEPEND="${RDEPEND}
+	kernel_linux? (
+		virtual/os-headers
+		e2fsprogs? ( sys-fs/e2fsprogs[${MULTILIB_USEDEP}] )
+	)
+	test? (
+		app-arch/lrzip
+		app-arch/lz4
+		app-arch/lzip
+		app-arch/lzop
+		app-arch/xz-utils
+		app-arch/zstd
+		lzma? ( app-arch/xz-utils[extra-filters(+)] )
+	)
+"
+BDEPEND="
+	verify-sig? ( >=sec-keys/openpgp-keys-libarchive-20221209 )
+	elibc_musl? ( sys-libs/queue-standalone )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/libarchive.org.asc
+
+# false positives (checks for libc-defined hash functions)
+QA_CONFIG_IMPL_DECL_SKIP=(
+	SHA256_Init SHA256_Update SHA256_Final
+	SHA384_Init SHA384_Update SHA384_Final
+	SHA512_Init SHA512_Update SHA512_Final
+)
+
+PATCHES=(
+	# https://github.com/libarchive/libarchive/issues/2069
+	# (we can simply update the command since we don't support old lrzip)
+	"${FILESDIR}/${PN}-3.7.2-lrzip.patch"
+)
+
+src_prepare() {
+	default
+
+	# Needed for flags to be respected w/ LTO
+	elibtoolize
+}
+
+multilib_src_configure() {
+	export ac_cv_header_ext2fs_ext2_fs_h=$(usex e2fsprogs) #354923
+
+	local myconf=(
+		$(use_enable acl)
+		$(use_enable static-libs static)
+		$(use_enable xattr)
+		$(use_with blake2 libb2)
+		$(use_with bzip2 bz2lib)
+		$(use_with expat)
+		$(use_with !expat xml2)
+		$(use_with iconv)
+		$(use_with lz4)
+		$(use_with lzma)
+		$(use_with lzo lzo2)
+		$(use_with nettle)
+		--with-zlib
+		$(use_with zstd)
+
+		# Windows-specific
+		--without-cng
+	)
+	if multilib_is_native_abi ; then
+		myconf+=(
+			--enable-bsdcat="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdcpio="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdtar="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdunzip="$(tc-is-static-only && echo static || echo shared)"
+		)
+	else
+		myconf+=(
+			--disable-bsdcat
+			--disable-bsdcpio
+			--disable-bsdtar
+			--disable-bsdunzip
+		)
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+}
+
+multilib_src_compile() {
+	if multilib_is_native_abi ; then
+		emake
+	else
+		emake libarchive.la
+	fi
+}
+
+src_test() {
+	mkdir -p "${T}"/bin || die
+	# tests fail when lbzip2[symlink] is used in place of ref bunzip2
+	ln -s "${BROOT}/bin/bunzip2" "${T}"/bin || die
+	# workaround lrzip broken on 32-bit arches with >= 10 threads
+	# https://bugs.gentoo.org/927766
+	cat > "${T}"/bin/lrzip <<-EOF || die
+		#!/bin/sh
+		exec "$(type -P lrzip)" -p1 "\${@}"
+	EOF
+	chmod +x "${T}/bin/lrzip" || die
+	local -x PATH=${T}/bin:${PATH}
+	multilib-minimal_src_test
+}
+
+multilib_src_test() {
+	# sandbox is breaking long symlink behavior
+	local -x SANDBOX_ON=0
+	local -x LD_PRELOAD=
+	# some locales trigger different output that breaks tests
+	local -x LC_ALL=C.UTF-8
+	emake check
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi ; then
+		emake DESTDIR="${D}" install
+	else
+		local install_targets=(
+			install-includeHEADERS
+			install-libLTLIBRARIES
+			install-pkgconfigDATA
+		)
+		emake DESTDIR="${D}" "${install_targets[@]}"
+	fi
+
+	# Libs.private: should be used from libarchive.pc instead
+	find "${ED}" -type f -name "*.la" -delete || die
+	# https://github.com/libarchive/libarchive/issues/1766
+	sed -e '/Requires\.private/s:iconv::' \
+		-i "${ED}/usr/$(get_libdir)/pkgconfig/libarchive.pc" || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/Manifest b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/Manifest
index 97458d71004..d52f3613354 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/Manifest
@@ -1,6 +1,6 @@
-DIST xz-5.4.2.tar.gz 2799022 BLAKE2B 3c622b0823f0cbb5fbc5eaa0372fc2f0fefe0950d131417f831bce47b6d9747d145429f0649de106819331f9ae6a289c497182c7b6d1e211513308dd083a9b72 SHA512 149f980338bea3d66de1ff5994b2b236ae1773135eda68b62b009df0c9dcdf5467f8cb2c06da95a71b6556d60bd3d21f475feced34d5dfdb80ee95416a2f9737
-DIST xz-5.4.2.tar.gz.sig 566 BLAKE2B 95c9c70fdd25b92095dd9691e4d9d4306a3f982becfe7bd42ca6132a76f29be2c2bc66f4fc2bda547058c18e227292f4185799eb905084fc3ab415ae867b4b1b SHA512 30e965c228ed3a8ecb804db8eb11703a765b7ee934030ea69bb3940b630811eb71bf74fd20371ef7759761904ece4f0144a0b00be4d843cf98299fd016f161aa
 DIST xz-5.4.7.tar.gz 2798247 BLAKE2B e02f3a62c81882c83254e1c94f002aadcd59479dbd031a4d5ea68ce3303c066c298c2709845f2d4ef436511b21d35ab66a080542ac70aaf6c0a0daf448a47d02 SHA512 82c3e5d39fbaa5dcd61b45d5db99d740d811323456a9af3b1acfccbe66b074d1650bc810ee8272a8ae0a1bcf116fc73fc09297b8acb4c6568cf912708306e8ea
 DIST xz-5.4.7.tar.gz.sig 566 BLAKE2B 525eeeddb219c6e46ef2079af0cd28c8514969ce33b2ab61ccae59ae26289e7ddbd29dd492f88f4e4da9db750dd60ce1831a23a0275cdac39bd5b29c663d1a72 SHA512 00e9004739a168fd8a1ca4bb8b8a9de456bbef2576565722158140f341e94f461dab05c6e457f62a1613229419a978898e878007872571afdc1bb8a9582fa00a
 DIST xz-5.6.2.tar.gz 2355785 BLAKE2B d2d5f9772714b5b5993ec26c313bd27dc10d88928d9d3a1c71b78f80797e376cf065dcdd0c2c7977a83b67cbe2558140c74c5df44a9408e5a72529212c2205ad SHA512 c32c32c95e3541b906e0284e66a953ace677e0ce6af2084e7b122600047bf7542c1b0fabb5909b19ff79fba6def530be674df1c675b22a47a8d57f3f0b736a82
 DIST xz-5.6.2.tar.gz.sig 566 BLAKE2B 9b1f19d0449de18057eb5bd3cceaa073fc245e9a05fb19fabdac98b1d2e708b39c8070130c522b78ff75df724e207f978d8da65e2ccb1c6fa295aa892eda0d23 SHA512 f3d1055a2a6e96eec2fd5c0b733f2ab5e150bac9645f1fe9a7558ed6f34a241b4f57e17fd4504f311be26cf1e2b9b797f2e78b1b9d2db02e9cd0c1548cb6160b
+DIST xz-5.6.3.tar.gz 2279396 BLAKE2B 9f09926f1ec7d72e6564f5816101512717bcb37610b551616117818d4e6a3b6c00b4ac74bf13a06cd299ff199a0561f2c05a3884a6f6b7e94951de2c1c2e6dc3 SHA512 b07b45e18615d1946e9d12157af99b54700d757832a638fccab70549574dcd7f28e69e71cc4c0b9c808959f818e79b668a5ccf108429ea0f40b6125bfd55d274
+DIST xz-5.6.3.tar.gz.sig 566 BLAKE2B b59899d9ddc3325bd0de084dac420440ccdeb5f57f3656300f235fdae997a8943c2dc44edc3b83150b78717a7bf761152f09b41035d245fa536c45b8c06dd00d SHA512 65a0eb674b804309417d736b3ec9edb9c9bf39485593d81f352ee847662f5a95b3d5084fab21451e3510d74e4e2ee8f9cf4e8615d1128b6e16d5c211481481db
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.2.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.3.ebuild
similarity index 54%
rename from sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.2.ebuild
rename to sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.3.ebuild
index a1b67180aee..0a33785a8c4 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.3.ebuild
@@ -6,7 +6,7 @@
 
 EAPI=8
 
-inherit flag-o-matic libtool multilib multilib-minimal preserve-libs toolchain-funcs
+inherit libtool multilib multilib-minimal preserve-libs toolchain-funcs
 
 if [[ ${PV} == 9999 ]] ; then
 	# Per tukaani.org, git.tukaani.org is a mirror of github and
@@ -35,7 +35,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 
 	S="${WORKDIR}/${MY_P}"
@@ -45,12 +45,12 @@ DESCRIPTION="Utils for managing LZMA compressed files"
 HOMEPAGE="https://tukaani.org/xz/"
 
 # See top-level COPYING file as it outlines the various pieces and their licenses.
-LICENSE="public-domain LGPL-2.1+ GPL-2+"
+LICENSE="0BSD LGPL-2.1+ GPL-2+ doc? ( CC-BY-SA-4.0 )"
 SLOT="0"
-IUSE="doc +extra-filters pgo nls static-libs"
+IUSE="cpu_flags_arm_crc32 doc +extra-filters pgo nls static-libs"
 
 if [[ ${PV} != 9999 ]] ; then
-	BDEPEND+=" verify-sig? ( >=sec-keys/openpgp-keys-lassecollin-20230213 )"
+	BDEPEND+=" verify-sig? ( >=sec-keys/openpgp-keys-lassecollin-20240529 )"
 fi
 
 src_prepare() {
@@ -66,11 +66,16 @@ src_prepare() {
 }
 
 multilib_src_configure() {
+	# Workaround for bug #934370 (libtool-2.5.0), drop when dist tarball
+	# uses newer libtool with the fix.
+	export ac_cv_prog_ac_ct_FILECMD='file' FILECMD='file'
+
 	local myconf=(
 		--enable-threads
 		$(multilib_native_use_enable doc)
 		$(use_enable nls)
 		$(use_enable static-libs static)
+		$(use_enable cpu_flags_arm_crc32 arm64-crc32)
 	)
 
 	if ! multilib_is_native_abi ; then
@@ -88,7 +93,9 @@ multilib_src_configure() {
 			# those are used by default, depending on preset
 			--enable-match-finders=hc3,hc4,bt4
 
-			# CRC64 is used by default, though some (old?) files use CRC32
+			# CRC64 is used by default, though 7-Zip uses CRC32 by default.
+			# Also, XZ Embedded in Linux doesn't support CRC64, so
+			# kernel modules and friends are CRC32.
 			--enable-checks=crc32,crc64
 		)
 	fi
@@ -96,7 +103,7 @@ multilib_src_configure() {
 	if [[ ${CHOST} == *-solaris* ]] ; then
 		export gl_cv_posix_shell="${EPREFIX}"/bin/sh
 
-		# Undo Solaris-based defaults pointing to /usr/xpg5/bin
+		# Undo Solaris-based defaults pointing to /usr/xpg4/bin
 		myconf+=( --disable-path-for-script )
 	fi
 
@@ -104,16 +111,61 @@ multilib_src_configure() {
 }
 
 multilib_src_compile() {
-	# -fprofile-partial-training because upstream note the test suite isn't super comprehensive
-	# See https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
-	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/${ABI}-pgo -fprofile-generate=${T}/${ABI}-pgo $(test-flags-CC -fprofile-partial-training)")
-	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/${ABI}-pgo -fprofile-dir=${T}/${ABI}-pgo $(test-flags-CC -fprofile-partial-training)")
+	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/${ABI}-pgo -fprofile-generate=${T}/${ABI}-pgo")
+	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/${ABI}-pgo -fprofile-dir=${T}/${ABI}-pgo")
 
 	emake CFLAGS="${CFLAGS} ${pgo_generate_flags}"
 
 	if use pgo ; then
 		emake CFLAGS="${CFLAGS} ${pgo_generate_flags}" -k check
 
+		local tar_pgo_args=()
+
+		if has_version -b "app-alternatives/tar[gnu]" ; then
+			tar_pgo_args+=(
+				--mtime=@2718281828
+				--sort=name
+			)
+		fi
+
+		if multilib_is_native_abi ; then
+			(
+				shopt -s globstar
+
+				tar \
+					"${tar_pgo_args[@]}" \
+					-cf xz-pgo-test-01.tar \
+					{"${S}","${BUILD_DIR}"}/**/*.[cho] \
+					{"${S}","${BUILD_DIR}"}/**/.libs/* \
+					{"${S}","${BUILD_DIR}"}/**/**.txt \
+					{"${S}","${BUILD_DIR}"}/tests/files
+
+				stat --printf="xz-pgo-test-01.tar.tar size: %s\n" xz-pgo-test-01.tar || die
+				md5sum xz-pgo-test-01.tar || die
+			)
+
+			local test_variants=(
+				# Borrowed from ALT Linux
+				# https://packages.altlinux.org/en/sisyphus/srpms/xz/specfiles/#line-80
+				'-0 -C none'
+				'-2 -C crc32'
+				"$(usev extra-filters '-6 --arm --lzma2 -C crc64')"
+				"$(usev extra-filters '-6 --x86 --lzma2=lc=4 -C sha256')"
+				'-7e --format=lzma'
+
+				# Our own variants
+				''
+				'-e'
+				"$(usev extra-filters '--x86 --lzma2=preset=6e')"
+			)
+			local test_variant
+			for test_variant in "${test_variants[@]}" ; do
+				einfo "Testing '${test_variant}' variant"
+				"${BUILD_DIR}"/src/xz/xz -c ${test_variant} xz-pgo-test-01.tar | "${BUILD_DIR}"/src/xz/xz -c -d - > /dev/null
+				assert "Testing '${test_variant}' variant failed"
+			done
+		fi
+
 		if tc-is-clang; then
 			llvm-profdata merge "${T}"/${ABI}-pgo --output="${T}"/${ABI}-pgo/default.profdata || die
 		fi
@@ -123,6 +175,17 @@ multilib_src_compile() {
 	fi
 }
 
+multilib_src_install() {
+	default
+
+	# bug #934370 and bug #450436 (and bug #934515)
+	if ! tc-is-static-only && [[ ! -f "${ED}/usr/$(get_libdir)/liblzma$(get_libname)" ]] ; then
+		eerror "Sanity check for liblzma$(get_libname) failed."
+		eerror "Shared library wasn't built, possible libtool bug"
+		[[ -z ${I_KNOW_WHAT_I_AM_DOING} ]] && die "liblzma$(get_libname) not found in build, aborting"
+	fi
+}
+
 multilib_src_install_all() {
 	find "${ED}" -type f -name '*.la' -delete || die
 
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/ccid/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/ccid/Manifest
index e6910d3ce7d..f933cfb4c21 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/ccid/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/ccid/Manifest
@@ -1,3 +1 @@
-DIST ccid-1.5.1.tar.bz2 702586 BLAKE2B 7b9e3c6daf03c186f34ac9b13bd960293a6481f9237ee52937ece1040bd3a79b7dab318e1244205a7feae992261ab5e82292d80ae023a4f621e0e7af7cdb9df5 SHA512 492bde96f5752e2a5316693c44e35e2d041785a00d15e094905c0aafad392f5329009d12801899367276328a582936ee53a1c5239c1813c4536001cb8a608f2e
-DIST ccid-1.5.4.tar.bz2 706834 BLAKE2B 8b7f08145808ac94d085eef62c204f8146892cb11f2ce811e46e674272cab016d602afb945c6e808ce3957a80e847c0de2815fedaf15fc8c935cafaccf102762 SHA512 4b30f4768aebf49486a1b1e959615fa077bd393bfdd9e52c15bdc8d6ed63ce27fa7cf82a067d1f80d8b3534c66194036925d3fea5af64b6a775779d38267c757
 DIST ccid-1.5.5.tar.bz2 708374 BLAKE2B a82986ead2dbb3241ef419ad16eb0fac835c5ab4fa988e5ee53cd1608a30a9381210a6fd013b6a059ca2835d55b4a41afa4064575e91b8eb356bff6d01d19add SHA512 9d2aebe645a5880bfad7d420ddab96811d1fd989c79afa28f5471ae53f36b6d45ee5e13b32ac4afcf59fc762ae835db7e6312ad6642b263158c2d9a30c7651bd
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/ccid/ccid-1.5.1.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/ccid/ccid-1.5.1.ebuild
deleted file mode 100644
index 10523364f72..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-crypt/ccid/ccid-1.5.1.ebuild
+++ /dev/null
@@ -1,45 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit udev
-
-DESCRIPTION="CCID free software driver"
-HOMEPAGE="https://ccid.apdu.fr https://github.com/LudovicRousseau/CCID"
-SRC_URI="https://ccid.apdu.fr/files/${P}.tar.bz2"
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ppc ppc64 ~riscv ~sparc x86"
-IUSE="twinserial +usb"
-
-RDEPEND="
-	>=sys-apps/pcsc-lite-1.8.3
-	twinserial? ( dev-lang/perl )
-	usb? ( virtual/libusb:1 )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="virtual/pkgconfig"
-
-src_configure() {
-	econf \
-		LEX=: \
-		$(use_enable twinserial) \
-		$(use_enable usb libusb)
-}
-
-src_install() {
-	default
-	udev_newrules src/92_pcscd_ccid.rules 92-pcsc-ccid.rules
-}
-
-pkg_postinst() {
-	udev_reload
-	einfo "Check https://github.com/LudovicRousseau/CCID/blob/master/INSTALL"
-	einfo "for more info about how to configure and use ccid"
-}
-
-pkg_postrm() {
-	udev_reload
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/ccid/ccid-1.5.4.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/ccid/ccid-1.5.4.ebuild
deleted file mode 100644
index e5153164d98..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-crypt/ccid/ccid-1.5.4.ebuild
+++ /dev/null
@@ -1,55 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit autotools udev
-
-DESCRIPTION="CCID free software driver"
-HOMEPAGE="https://ccid.apdu.fr https://github.com/LudovicRousseau/CCID"
-SRC_URI="https://ccid.apdu.fr/files/${P}.tar.bz2"
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ppc ppc64 ~riscv ~sparc x86"
-IUSE="twinserial +usb"
-
-RDEPEND="
-	>=sys-apps/pcsc-lite-1.8.3
-	twinserial? ( dev-lang/perl )
-	usb? ( virtual/libusb:1 )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="virtual/pkgconfig"
-
-PATCHES=(
-	"${FILESDIR}"/${P}-remove-flex-configure-dependency.patch
-)
-
-src_prepare() {
-	default
-
-	eautoreconf
-}
-
-src_configure() {
-	econf \
-		LEX=: \
-		$(use_enable twinserial) \
-		$(use_enable usb libusb)
-}
-
-src_install() {
-	default
-	udev_newrules src/92_pcscd_ccid.rules 92-pcsc-ccid.rules
-}
-
-pkg_postinst() {
-	udev_reload
-	einfo "Check https://github.com/LudovicRousseau/CCID/blob/master/INSTALL"
-	einfo "for more info about how to configure and use ccid"
-}
-
-pkg_postrm() {
-	udev_reload
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/ccid/ccid-1.5.5.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/ccid/ccid-1.5.5.ebuild
index 2a6414eadb4..e5153164d98 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/ccid/ccid-1.5.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/ccid/ccid-1.5.5.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://ccid.apdu.fr/files/${P}.tar.bz2"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~riscv ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ppc ppc64 ~riscv ~sparc x86"
 IUSE="twinserial +usb"
 
 RDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/ccid/files/ccid-1.5.4-remove-flex-configure-dependency.patch b/sdk_container/src/third_party/portage-stable/app-crypt/ccid/files/ccid-1.5.4-remove-flex-configure-dependency.patch
deleted file mode 100644
index b0c8122b6ec..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-crypt/ccid/files/ccid-1.5.4-remove-flex-configure-dependency.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From 5bd94d9670ad10df9f14349dfa098d0a2e40ab08 Mon Sep 17 00:00:00 2001
-From: Eli Schwartz <eschwartz93@gmail.com>
-Date: Mon, 10 Jun 2024 22:02:37 -0400
-Subject: [PATCH] make building work again when flex is not installed
-
-This explicitly reverts commit eec7cdf03dda2bd26e320ead73b91da5a9d86443
-because it was a bad idea.
-
-The motivating bug report was https://github.com/LudovicRousseau/PCSC/issues/124
-and the issue there occurred when building from a git clone, running
-./bootstrap && ./configure && make, and having:
-
-- configure succeed
-- make "succeeeds" at having $LEX run, do nothing and fail to generate
-  required sources
-- compiling nonexistent files fail with highly confusing errors
-
-The autoconf manual has always documented the correct way to handle this
-is to check if lex is unavailable, and set it to the famous automake
-wrapper "missing", which checks if a program is missing at build time
-rather than at ./configure time, and fails the build if the rule cannot
-be run. This means:
-
-When building from a git clone, if flex is not available then
-- configure succeeds
-- make fails to run $LEX, and tells you to install flex
-
-The previous attempt to fix the highly confusing error instead resulted
-in configure erroring out, and saying flex is required, even when it is
-*not* required because a `make dist` tarball was used, which contains
-pregenerated tokenparser.c for the express purpose of making flex
-unnecessary.
-
-See autoconf documentation on $LEX:
-https://www.gnu.org/software/autoconf/manual/autoconf-2.72/html_node/Particular-Programs.html#index-AC_005fPROG_005fLEX-1
-
-And automake documentation on why to use "missing":
-https://www.gnu.org/software/automake/manual/html_node/maintainer_002dmode.html
-
-Signed-off-by: Eli Schwartz <eschwartz93@gmail.com>
----
- configure.ac | 9 ++++-----
- 1 file changed, 4 insertions(+), 5 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index d291f2b..a5af2eb 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -33,10 +33,10 @@ AC_PROG_INSTALL
- AC_PROG_MAKE_SET
- AC_PROG_LN_S
- AC_PROG_LEX([noyywrap])
--if test $LEX = ":"
--then
--    AC_MSG_ERROR([no lex or flex found])
--fi
-+AS_IF([test $LEX = ":"], [
-+       AM_MISSING_PROG(MISSINGLEX, [flex])
-+       LEX=$MISSINGLEX]
-+)
- AM_PROG_AR
- PKG_PROG_PKG_CONFIG
- 
-@@ -354,4 +354,3 @@ AC_CONFIG_FILES(Makefile
- 	examples/Makefile)
- 
- AC_OUTPUT
--
--- 
-2.44.2
-
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/gnupg/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/gnupg/Manifest
index 59f7652f5ad..8b4089714cd 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/gnupg/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/gnupg/Manifest
@@ -4,3 +4,5 @@ DIST gnupg-2.2.43.tar.bz2 7435426 BLAKE2B ddf5c89d317e6ce8d1a5348f0ef81ffa1c61c9
 DIST gnupg-2.2.43.tar.bz2.sig 119 BLAKE2B 38fd3790f5065d67d6b5323ef7abbb79facf00e5b9daba98e5078302fc3887423173ba434c7eff1e64faecef88d87aab9c057c570d6e96e8d0808f07f32d8fa1 SHA512 47c5354869b1825e56fa4276826fcde1ee41c70aab9b411686cf2733f4d1df9c006049e49e066b22e475bd37b337f9ffc97f8bbca0c62c0f32296909464a0643
 DIST gnupg-2.4.5.tar.bz2 7889060 BLAKE2B a8b80cd4dfbb377066efb5c9f1b6cdc6d0cd1b18358c962781b5c06de1545117b13038a4655ae627c36bfd2e5fee127692df8729d6b23e1b31051ab6d897b733 SHA512 4d54744f09399c5899144d0cb5fdc2756e45b058db41b9ea9df3be03e80b914509e16ef35aa0248e7561185b80f7a5f9fd6afcab8ccff75ff82ed555448a38ff
 DIST gnupg-2.4.5.tar.bz2.sig 238 BLAKE2B b236e7d62f49c8385f4fb81389bf10715d9c0a0cb5c0b4c20fb6ff1465d05a3c3657061284db23af988a1ca16c9fa393af3ce5cbd27934501eb41a4f448fff0a SHA512 5a06970e499d1eb5213b142a8a182e46f5f21b7cb32785a9e5069378797c124e151ce74727382003820042d60fd7a2f909143f44aa9ef282605875e1cab04aef
+DIST gnupg-2.5.1.tar.bz2 8126739 BLAKE2B 46955d2eebe14395adc0fdf81e89a32f3f9baaabfe1eee78f256a1fab25ce6fdb96b873678cfeb5e4abf4894c7ab4908359ed04cc6571ff442dcc5325b3ccd66 SHA512 733a11ff24145e23dd7d34d954a70c25bf70ecb1d517b8e15cc34bf690786c9f7007e4e99cde573500ac012852e91b29568fed00491f8c8254b3fb63ca5777cd
+DIST gnupg-2.5.1.tar.bz2.sig 238 BLAKE2B cd024a63ecb82a12e92444cbff8dbc9bef6a4e436d59957aae77927cce0baf9e282e63df7a5159a521c7c8694a0dbe96d6537ad3ec5f779c7c0dea8d02b5e70d SHA512 8ffd5cc72a2907972bf1854e804f6c215ff66ba2d6e91952700f49b2b5ba8bab035d0f42efdb0d3c3166301cda6e716394928bdd9c0d0d1e1789a02c7aa1a926
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/gnupg/gnupg-2.4.5-r2.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/gnupg/gnupg-2.4.5-r2.ebuild
index efcb0ec1ad0..bb88f4014f4 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/gnupg/gnupg-2.4.5-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/gnupg/gnupg-2.4.5-r2.ebuild
@@ -23,7 +23,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="GPL-3+"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="bzip2 doc ldap nls readline selinux +smartcard ssl test +tofu tpm tools usb user-socket wks-server"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="test? ( tofu )"
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/gnupg/gnupg-2.5.1.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/gnupg/gnupg-2.5.1.ebuild
new file mode 100644
index 00000000000..382e366f6c0
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/gnupg/gnupg-2.5.1.ebuild
@@ -0,0 +1,197 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintainers should:
+# 1. Join the "Gentoo" project at https://dev.gnupg.org/project/view/27/
+# 2. Subscribe to release tasks like https://dev.gnupg.org/T6159
+# (find the one for the current release then subscribe to it +
+# any subsequent ones linked within so you're covered for a while.)
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
+# in-source builds are not supported: https://dev.gnupg.org/T6313#166339
+inherit flag-o-matic out-of-source multiprocessing systemd toolchain-funcs verify-sig
+
+MY_P="${P/_/-}"
+
+DESCRIPTION="The GNU Privacy Guard, a GPL OpenPGP implementation"
+HOMEPAGE="https://gnupg.org/"
+SRC_URI="mirror://gnupg/gnupg/${MY_P}.tar.bz2"
+SRC_URI+=" verify-sig? ( mirror://gnupg/gnupg/${P}.tar.bz2.sig )"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="GPL-3+"
+SLOT="0"
+#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="bzip2 doc ldap nls readline selinux +smartcard ssl test +tofu tpm tools usb user-socket wks-server"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="test? ( tofu )"
+
+# Existence of executables is checked during configuration.
+# Note: On each bump, update dep bounds on each version from configure.ac!
+DEPEND="
+	>=dev-libs/libassuan-2.5.0:=
+	>=dev-libs/libgcrypt-1.9.1:=
+	>=dev-libs/libgpg-error-1.46
+	>=dev-libs/libksba-1.6.3
+	>=dev-libs/npth-1.2
+	>=net-misc/curl-7.10
+	sys-libs/zlib
+	bzip2? ( app-arch/bzip2 )
+	ldap? ( net-nds/openldap:= )
+	readline? ( sys-libs/readline:0= )
+	smartcard? ( usb? ( virtual/libusb:1 ) )
+	tofu? ( >=dev-db/sqlite-3.27 )
+	tpm? ( >=app-crypt/tpm2-tss-2.4.0:= )
+	ssl? ( >=net-libs/gnutls-3.2:0= )
+"
+RDEPEND="
+	${DEPEND}
+	nls? ( virtual/libintl )
+	selinux? ( sec-policy/selinux-gpg )
+	wks-server? ( virtual/mta )
+"
+PDEPEND="
+	app-crypt/pinentry
+"
+BDEPEND="
+	virtual/pkgconfig
+	doc? ( sys-apps/texinfo )
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-gnupg )
+"
+
+DOCS=(
+	ChangeLog NEWS README THANKS TODO VERSION
+	doc/FAQ doc/DETAILS doc/HACKING doc/TRANSLATE doc/OpenPGP doc/KEYSERVER
+)
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.1.20-gpgscm-Use-shorter-socket-path-lengts-to-improve-tes.patch
+	"${FILESDIR}"/${PN}-2.4.5-revert-rfc4880bis.patch # bug #926186
+)
+
+src_prepare() {
+	default
+
+	GNUPG_SYSTEMD_UNITS=(
+		dirmngr.service
+		dirmngr.socket
+		gpg-agent-browser.socket
+		gpg-agent-extra.socket
+		gpg-agent.service
+		gpg-agent.socket
+		gpg-agent-ssh.socket
+	)
+
+	cp "${GNUPG_SYSTEMD_UNITS[@]/#/${FILESDIR}/}" "${T}" || die
+
+	# Inject SSH_AUTH_SOCK into user's sessions after enabling gpg-agent-ssh.socket in systemctl --user mode,
+	# idea borrowed from libdbus, see
+	#   https://gitlab.freedesktop.org/dbus/dbus/-/blob/master/bus/systemd-user/dbus.socket.in#L6
+	#
+	# This cannot be upstreamed, as it requires determining the exact prefix of 'systemctl',
+	# which in turn requires discovery in Autoconf, something that upstream deeply resents.
+	sed -e "/DirectoryMode=/a ExecStartPost=-${EPREFIX}/bin/systemctl --user set-environment SSH_AUTH_SOCK=%t/gnupg/S.gpg-agent.ssh" \
+		-i "${T}"/gpg-agent-ssh.socket || die
+
+	# definition of getpeername etc uses different things like socket_fd_t
+	[[ ${CHOST} == *-solaris* ]] &&
+		append-cflags $(test-flags-CC -Wno-incompatible-pointer-types)
+}
+
+my_src_configure() {
+	# Upstream don't support LTO, bug #854222.
+	filter-lto
+
+	local myconf=(
+		$(use_enable bzip2)
+		$(use_enable nls)
+		$(use_enable smartcard scdaemon)
+		$(use_enable ssl gnutls)
+		$(use_enable test all-tests)
+		$(use_enable test tests)
+		$(use_enable tofu)
+		$(use_enable tofu keyboxd)
+		$(use_enable tofu sqlite)
+		$(usex tpm '--with-tss=intel' '--disable-tpm2d')
+		$(use smartcard && use_enable usb ccid-driver || echo '--disable-ccid-driver')
+		$(use_enable wks-server wks-tools)
+		$(use_with ldap)
+		$(use_with readline)
+
+		# Hardcode mailprog to /usr/libexec/sendmail even if it does not exist.
+		# As of GnuPG 2.3, the mailprog substitution is used for the binary called
+		# by wks-client & wks-server; and if it's autodetected but not not exist at
+		# build time, then then 'gpg-wks-client --send' functionality will not
+		# work. This has an unwanted side-effect in stage3 builds: there was a
+		# [R]DEPEND on virtual/mta, which also brought in virtual/logger, bloating
+		# the build where the install guide previously make the user chose the
+		# logger & mta early in the install.
+		--with-mailprog=/usr/libexec/sendmail
+
+		--disable-ntbtls
+		--enable-gpgsm
+		--enable-large-secmem
+
+		CC_FOR_BUILD="$(tc-getBUILD_CC)"
+		GPGRT_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpgrt-config"
+
+		$("${S}/configure" --help | grep -o -- '--without-.*-prefix')
+	)
+
+	if use prefix && use usb; then
+		# bug #649598
+		append-cppflags -I"${ESYSROOT}/usr/include/libusb-1.0"
+	fi
+
+	# bug #663142
+	if use user-socket; then
+		myconf+=( --enable-run-gnupg-user-socket )
+	fi
+
+	# glib fails and picks up clang's internal stdint.h causing weird errors
+	tc-is-clang && export gl_cv_absolute_stdint_h="${ESYSROOT}"/usr/include/stdint.h
+
+	econf "${myconf[@]}"
+}
+
+my_src_compile() {
+	default
+
+	use doc && emake -C doc html
+}
+
+my_src_test() {
+	export TESTFLAGS="--parallel=$(makeopts_jobs)"
+
+	default
+}
+
+my_src_install() {
+	emake DESTDIR="${D}" install
+
+	use tools && dobin tools/{gpgconf,gpgsplit,gpg-check-pattern} tools/make-dns-cert
+
+	dosym gpg /usr/bin/gpg2
+	dosym gpgv /usr/bin/gpgv2
+	echo ".so man1/gpg.1" > "${ED}"/usr/share/man/man1/gpg2.1 || die
+	echo ".so man1/gpgv.1" > "${ED}"/usr/share/man/man1/gpgv2.1 || die
+
+	dodir /etc/env.d
+	echo "CONFIG_PROTECT=/usr/share/gnupg/qualified.txt" >> "${ED}"/etc/env.d/30gnupg || die
+
+	use doc && dodoc doc/gnupg.html/*
+}
+
+my_src_install_all() {
+	einstalldocs
+
+	use tools && dobin tools/{convert-from-106,mail-signed-keys,lspgpot}
+	use doc && dodoc doc/*.png
+
+	# Dropped upstream in https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commitdiff;h=eae28f1bd4a5632e8f8e85b7248d1c4d4a10a5ed.
+	dodoc "${FILESDIR}"/README-systemd
+	systemd_douserunit "${GNUPG_SYSTEMD_UNITS[@]/#/${T}/}"
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/Manifest
index cc830bd7a03..48c3c169c49 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/Manifest
@@ -1,5 +1,3 @@
-DIST pinentry-1.2.1.tar.bz2 547698 BLAKE2B aa47612aa3a6f74c3676bf4018780356cb22ed4078792c1f466f9e0465199428c151c0e20dfbe6c784ef93c2b42b673daff0b6adc74c8c98fed9921e65ed42ea SHA512 a665315628f4dcf07e16a22db3f3be15d7e7e93b3deec0546c7275b71b0e3bd65535a08af5e12d6339fd6595132df86529401d9d12bd17c428a3466e8dfafab6
-DIST pinentry-1.2.1.tar.bz2.sig 238 BLAKE2B 01ba3dc296a8e76c546d21d0bb0cd13778476d5d5b3ef55a3401c6a0353a56d79250d11555afb31c77c5a77e63847ded0f8eaef395bb0dc2ee3ff1d6a4ed83bd SHA512 d0e8435dc169a58f111f057f1c9fbb6c70da32a850f1107d6abdf41357c1714832728109ae61507db313d7eaef9596e5faf92fd21bed78adcc46a8c8a590430b
 DIST pinentry-1.3.0.tar.bz2 610363 BLAKE2B a55b80754ef37d18ebdf0bd50e134a7b1bf6362b859b7069a9e4ebd86cd7e733d51f3c21a16779a18aa0d0dfab1f7a3df070d4f7e39e0840339078c4e9cb58bc SHA512 1bbac81c6811cffc8969a46494e6daa6b8447802f47ff6fa3e4dc9ac244cf6e5f629834c9b6a60770d06bff6c9932ad4059f10d2fdf93fd9e26fd5d21c0e3732
 DIST pinentry-1.3.0.tar.bz2.sig 119 BLAKE2B 0f11126761b2a06f8b08cf971f5d610cacbde1a5ee419523a6e704ac21fef4cce26495a160a51bee5ed5f68eca7d6864dfa03efa48030ba2cf783e767b925e1c SHA512 77a61877adf241d67caeea3af4c12a2c7c13ddc423ac001fab79bcec463a5853d8806052d61504fae0c67e0a9d1edf6a12d24b560ff7b4083eea5e86f9b54a90
 DIST pinentry-1.3.1.tar.bz2 611233 BLAKE2B 47a510b3746fc8cdd83b56302132f4f4d9c61324fc857ce0867387f70f79490dad375bca4dc72e5d1cdca707bf89a16e1c9a20bf1aa0e857d69e59dc59403afd SHA512 3b72034dc1792b1475acb6d605ff7c1bd7647a0f02d1b6bdcd475acdef24bc802f49e275055436c3271261c4b7a64168477a698aab812a145962146b2f67a0e2
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.2.1-r7.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.2.1-r7.ebuild
deleted file mode 100644
index c3656d8993e..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.2.1-r7.ebuild
+++ /dev/null
@@ -1,111 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
-inherit autotools qmake-utils verify-sig
-
-DESCRIPTION="Simple passphrase entry dialogs which utilize the Assuan protocol"
-HOMEPAGE="https://gnupg.org/related_software/pinentry/"
-SRC_URI="mirror://gnupg/${PN}/${P}.tar.bz2"
-SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="caps efl emacs gtk keyring ncurses qt5 wayland X"
-
-DEPEND="
-	>=dev-libs/libassuan-2.1:=
-	>=dev-libs/libgcrypt-1.6.3
-	>=dev-libs/libgpg-error-1.17
-	efl? ( dev-libs/efl[X] )
-	keyring? ( app-crypt/libsecret )
-	ncurses? ( sys-libs/ncurses:= )
-	qt5? (
-		dev-qt/qtcore:5
-		dev-qt/qtgui:5
-		dev-qt/qtwidgets:5
-		wayland? ( kde-plasma/kwayland:5 )
-		X? (
-			dev-qt/qtx11extras:5
-			x11-libs/libX11
-		)
-	)
-"
-RDEPEND="
-	${DEPEND}
-	gtk? ( app-crypt/gcr:0[gtk] )
-"
-BDEPEND="
-	sys-devel/gettext
-	virtual/pkgconfig
-	verify-sig? ( sec-keys/openpgp-keys-gnupg )
-"
-PDEPEND="emacs? ( app-emacs/pinentry )"
-IDEPEND=">=app-eselect/eselect-pinentry-0.7.2"
-
-DOCS=( AUTHORS ChangeLog NEWS README THANKS TODO )
-
-PATCHES=(
-	"${FILESDIR}/${PN}-1.0.0-AR.patch"
-	"${FILESDIR}/${PN}-1.2.1-automagic-capslock.patch" # bug #819939, bug #837719
-)
-
-src_prepare() {
-	default
-
-	unset FLTK_CONFIG
-
-	# bug #934771
-	rm m4/libassuan.m4 || die
-
-	eautoreconf
-}
-
-src_configure() {
-	export PATH="$(qt5_get_bindir):${PATH}"
-	export QTLIB="$(qt5_get_libdir)"
-
-	local myeconfargs=(
-		$(use_enable efl pinentry-efl)
-		$(use_enable emacs pinentry-emacs)
-		$(use_enable keyring libsecret)
-		$(use_enable gtk pinentry-gnome3)
-		$(use_enable ncurses fallback-curses)
-		$(use_enable ncurses pinentry-curses)
-		$(use_enable qt5 pinentry-qt)
-		$(use_enable wayland kf5-wayland)
-		$(use_enable X qtx11extras)
-		$(use_with X x)
-
-		--enable-pinentry-tty
-		--disable-pinentry-fltk
-		--disable-pinentry-gtk2
-
-		MOC="$(qt5_get_bindir)"/moc
-		GPG_ERROR_CONFIG="${ESYSROOT}"/usr/bin/${CHOST}-gpg-error-config
-		LIBASSUAN_CONFIG="${ESYSROOT}"/usr/bin/libassuan-config
-
-		$("${S}/configure" --help | grep -- '--without-.*-prefix' | sed -e 's/^ *\([^ ]*\) .*/\1/g')
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_install() {
-	default
-
-	rm "${ED}"/usr/bin/pinentry || die
-
-	use qt5 && dosym pinentry-qt /usr/bin/pinentry-qt5
-}
-
-pkg_postinst() {
-	eselect pinentry update ifunset
-}
-
-pkg_postrm() {
-	eselect pinentry update ifunset
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.2.1-r8.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.2.1-r8.ebuild
deleted file mode 100644
index ea45c42d15e..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.2.1-r8.ebuild
+++ /dev/null
@@ -1,111 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
-inherit autotools qmake-utils verify-sig
-
-DESCRIPTION="Simple passphrase entry dialogs which utilize the Assuan protocol"
-HOMEPAGE="https://gnupg.org/related_software/pinentry/"
-SRC_URI="mirror://gnupg/${PN}/${P}.tar.bz2"
-SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="caps efl emacs gtk keyring ncurses qt5 wayland X"
-
-DEPEND="
-	>=dev-libs/libassuan-2.1:=
-	>=dev-libs/libgcrypt-1.6.3
-	>=dev-libs/libgpg-error-1.17
-	efl? ( dev-libs/efl[X] )
-	keyring? ( app-crypt/libsecret )
-	ncurses? ( sys-libs/ncurses:= )
-	qt5? (
-		dev-qt/qtcore:5
-		dev-qt/qtgui:5
-		dev-qt/qtwidgets:5
-		wayland? ( kde-plasma/kwayland:5 )
-		X? (
-			dev-qt/qtx11extras:5
-			x11-libs/libX11
-		)
-	)
-"
-RDEPEND="
-	${DEPEND}
-	gtk? ( app-crypt/gcr:0[gtk] )
-"
-BDEPEND="
-	sys-devel/gettext
-	virtual/pkgconfig
-	verify-sig? ( sec-keys/openpgp-keys-gnupg )
-"
-PDEPEND="emacs? ( app-emacs/pinentry )"
-IDEPEND=">=app-eselect/eselect-pinentry-0.7.2"
-
-DOCS=( AUTHORS ChangeLog NEWS README THANKS TODO )
-
-PATCHES=(
-	"${FILESDIR}/${PN}-1.0.0-AR.patch"
-	"${FILESDIR}/${PN}-1.2.1-automagic-capslock.patch" # bug #819939, bug #837719
-	"${FILESDIR}/${PN}-1.2.1-include-memory.patch"
-)
-
-src_prepare() {
-	default
-
-	unset FLTK_CONFIG
-
-	# bug #934771
-	rm m4/libassuan.m4 || die
-
-	eautoreconf
-}
-
-src_configure() {
-	export PATH="$(qt5_get_bindir):${PATH}"
-	export QTLIB="$(qt5_get_libdir)"
-
-	local myeconfargs=(
-		$(use_enable efl pinentry-efl)
-		$(use_enable emacs pinentry-emacs)
-		$(use_enable keyring libsecret)
-		$(use_enable gtk pinentry-gnome3)
-		$(use_enable ncurses fallback-curses)
-		$(use_enable ncurses pinentry-curses)
-		$(use_enable qt5 pinentry-qt)
-		$(use_enable wayland kf5-wayland)
-		$(use_enable X qtx11extras)
-		$(use_with X x)
-
-		--enable-pinentry-tty
-		--disable-pinentry-fltk
-		--disable-pinentry-gtk2
-
-		MOC="$(qt5_get_bindir)"/moc
-		ac_cv_path_GPGRT_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpgrt-config"
-
-		$("${S}/configure" --help | grep -- '--without-.*-prefix' | sed -e 's/^ *\([^ ]*\) .*/\1/g')
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_install() {
-	default
-
-	rm "${ED}"/usr/bin/pinentry || die
-
-	use qt5 && dosym pinentry-qt /usr/bin/pinentry-qt5
-}
-
-pkg_postinst() {
-	eselect pinentry update ifunset
-}
-
-pkg_postrm() {
-	eselect pinentry update ifunset
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.1.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.1.ebuild
index 0c43eb7f16a..fa9064e3c4d 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.1.ebuild
@@ -13,7 +13,7 @@ SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="caps efl emacs gtk keyring ncurses qt5 qt6 wayland X"
 
 DEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/rhash/rhash-1.4.4-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/rhash/rhash-1.4.4-r1.ebuild
index 35aa2be528d..8972252ec97 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/rhash/rhash-1.4.4-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/rhash/rhash-1.4.4-r1.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://downloads.sourceforge.net/${PN}/${P}-src.tar.gz"
 
 LICENSE="0BSD"
 SLOT="0/1"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="debug nls ssl static-libs"
 
 RDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/Manifest
index de6dabd7aff..46c013c241b 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/Manifest
@@ -1,5 +1 @@
-DIST tpm2-tools-5.5.tar.gz 1241390 BLAKE2B 2225f9e0835988351f84ed06f914616e25fd65bacaa93b51d0bb04185314efb9a6f60eb3539b250f54b2c2ba590f1b76594df3e625e45c8d37e38d13371bea26 SHA512 24f72a3e9840d531d900e96771a863baae1c71a76fcad0fda8020dff06acd8e3b65b86401ace21f034766403caf9ae97ce710ff6013bb7ed25657a6ecf325470
-DIST tpm2-tools-5.6-tpm2_eventlog-Create-raw-and-pretty-print-format-for.patch.xz 47916 BLAKE2B 1bbc84f58ad46507417c89be1b4ce2450fb33cf3abe8f080c23890d96be85379f135ef1dbf4b580e1a386fa6d5ebc4fbaab351b5238bbf1011bb97b0f49a847b SHA512 3db0daa39a8dc756d7cb25e3673149dc3eeafd7410f2c6537464431b501e3704a886d9b7a9acd71440d6d419649dd471fd6f9247d593c89a30b05774a8d1b3de
-DIST tpm2-tools-5.6.1.tar.gz 1255474 BLAKE2B 7fda0084283bbd592c3323605f598ebb77ba267ebb900e62b2eff2742257378d95f99b48aab090f80438a6c86f168e1863f9350c18571a23e17eea90a1b9bdd9 SHA512 7a5903db0578a1364c44ca8ac3672c3cae745e2b0ab66ddf6a91fdb75146441af32dfe4ccad6825bea343fea74bed97f9e45bf752594ee56f32e4cb7be2bed33
-DIST tpm2-tools-5.6.tar.gz 1266731 BLAKE2B fe88722c26d62128cd6dfbdd8ef2568656a75fe27b1443fed28387d0db1f50b7d0651819d34dfa98acde785b4cfb4e7c11420b110bb5333ed2bb6b67cdd4fc70 SHA512 14216f29ed3ecca5fbe356ed3744c8b6b25a62ff11b2aed596d11101328c8bfd29a02f6ca5a218f9a4477a5e9648c50f0ae96e71de0b4ff5ea1f98ebeeb73cd7
 DIST tpm2-tools-5.7.tar.gz 1339035 BLAKE2B 3984f25176e0b092793a33a0b40b396bc650de989e0b600989d11439cccdf7bc410535c01e1a0e985ab67b36b63eb02d392342aa1746b86727ba22d67d522389 SHA512 629b0b1826815877f452935285f7b3fe0f32bd24fe9130eb169a2dc9b7b254a737797043af9eea68be706b87c32ab2b7189151360c9c00bc5c31dce62a799670
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/files/tpm2-tools-5.6-bashism.patch b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/files/tpm2-tools-5.6-bashism.patch
deleted file mode 100644
index 01ce4301d4e..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/files/tpm2-tools-5.6-bashism.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-https://github.com/tpm2-software/tpm2-tools/pull/3339
-
-From 9f244c3f74747b7f79c8c6813657b2f2f8a1c844 Mon Sep 17 00:00:00 2001
-From: Sam James <sam@gentoo.org>
-Date: Sun, 21 Jan 2024 08:08:28 +0000
-Subject: [PATCH] configure.ac: fix bashisms
-
-configure scripts need to be runnable with a POSIX-compliant /bin/sh.
-
-On many (but not all!) systems, /bin/sh is provided by Bash, so errors
-like this aren't spotted. Notably Debian defaults to /bin/sh provided
-by dash which doesn't tolerate such bashisms as '=='.
-
-This retains compatibility with bash.
-
-Fixes configure warnings/errors like:
-```
-checking for libcurl... yes
-./configure: 15201: test: xauto: unexpected operator
-./configure: 15286: test: xauto: unexpected operator
-checking for efivar/efivar.h... yes
-```
-
-This fixes a build error later on too:
-```
-/usr/lib/gcc/x86_64-pc-linux-gnu/14/../../../../x86_64-pc-linux-gnu/bin/ld: lib/libcommon.a(libcommon_a-tpm2_eventlog_yaml.o): in function `yaml_devicepath':
-tpm2_eventlog_yaml.c:(.text.yaml_devicepath+0x2f): undefined reference to `efidp_format_device_path'
-/usr/lib/gcc/x86_64-pc-linux-gnu/14/../../../../x86_64-pc-linux-gnu/bin/ld: tpm2_eventlog_yaml.c:(.text.yaml_devicepath+0x61): undefined reference to `efidp_format_device_path'
-```
-
-Bug: https://bugs.gentoo.org/922592
-Signed-off-by: Sam James <sam@gentoo.org>
---- a/configure.ac
-+++ b/configure.ac
-@@ -94,9 +94,9 @@ AC_ARG_WITH([efivar],
- )
- 
- # use the true program to avoid failing hard
--AS_IF([test "x$with_efivar" == "xauto"],
-+AS_IF([test "x$with_efivar" = "xauto"],
-   [PKG_CHECK_MODULES([EFIVAR], [efivar], [AC_CHECK_HEADERS([efivar/efivar.h], , [true])], [true])],
--  [test "x$with_efivar" == "xyes"],
-+  [test "x$with_efivar" = "xyes"],
-   [PKG_CHECK_MODULES([EFIVAR], [efivar], [AC_CHECK_HEADERS([efivar/efivar.h])])],
- )
- 
-
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/files/tpm2-tools-5.6-test-eventlog-fix-check-eventlog.sh-if-efivar.h-exis.patch b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/files/tpm2-tools-5.6-test-eventlog-fix-check-eventlog.sh-if-efivar.h-exis.patch
deleted file mode 100644
index f24cf50aff5..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/files/tpm2-tools-5.6-test-eventlog-fix-check-eventlog.sh-if-efivar.h-exis.patch
+++ /dev/null
@@ -1,123 +0,0 @@
-From 9cd74df24dbeee81b408e12ac10a98a088008d07 Mon Sep 17 00:00:00 2001
-From: Juergen Repp <juergen_repp@web.de>
-Date: Mon, 20 Nov 2023 13:55:36 +0100
-Subject: [PATCH] test eventlog: fix check eventlog.sh if efivar.h exists
-
-If efivar.h exist a pretty print function for the DevicePath
-is executed. Therefore two yaml test files are needed for
-the bin test file uefiservices.
-Fixes #3302.
-
-Signed-off-by: Juergen Repp <juergen_repp@web.de>
----
- Makefile.am                                   | 13 ++++++
- configure.ac                                  |  3 ++
- .../event-uefiservices.bin.yaml.pretty        | 45 +++++++++++++++++++
- ...n.yaml => event-uefiservices.bin.yaml.raw} |  0
- 4 files changed, 61 insertions(+)
- create mode 100644 test/integration/fixtures/event-uefiservices.bin.yaml.pretty
- rename test/integration/fixtures/{event-uefiservices.bin.yaml => event-uefiservices.bin.yaml.raw} (100%)
-
-diff --git a/Makefile.am b/Makefile.am
-index 413345cd..ef76dca8 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -352,6 +352,7 @@ TEST_EXTENSIONS = .sh
- 
- check-hook:
- 	rm -rf .lock_file
-+	rm -f  $(abs_top_srcdir)/test/integration/fixtures/event-uefiservices.bin.yaml
- 
- EXTRA_DIST_IGNORE = \
-     .gitignore \
-@@ -647,6 +648,18 @@ dist-hook:
- 	for f in $(EXTRA_DIST_IGNORE); do \
- 		rm -rf `find $(distdir) -name $$f`; \
- 	done;
-+
-+prepare-check:
-+if HAVE_EFIVAR_H
-+	cp  $(abs_top_srcdir)/test/integration/fixtures/event-uefiservices.bin.yaml.pretty \
-+	    $(abs_top_srcdir)/test/integration/fixtures/event-uefiservices.bin.yaml
-+else
-+	cp  $(abs_top_srcdir)/test/integration/fixtures/event-uefiservices.bin.yaml.raw \
-+	    $(abs_top_srcdir)/test/integration/fixtures/event-uefiservices.bin.yaml
-+endif
-+
-+check: prepare-check
-+
- if !HAVE_PANDOC
- # If pandoc is not enabled, we want to complain that you need pandoc for make dist,
- # so hook the target and complain.
-diff --git a/configure.ac b/configure.ac
-index 362ae0aa..54224048 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -97,6 +97,9 @@ AS_IF([test "x$with_efivar" == "xauto"],
-   [PKG_CHECK_MODULES([EFIVAR], [efivar], [AC_CHECK_HEADERS([efivar/efivar.h])])],
- )
- 
-+AC_CHECK_HEADERS([efivar/efivar.h],[efivar_h=yes ], [efivar = no ])
-+AM_CONDITIONAL([HAVE_EFIVAR_H], [test "$efivar_h" = yes])
-+
- # backwards compat with older pkg-config
- # - pull in AC_DEFUN from pkg.m4
- m4_ifndef([PKG_CHECK_VAR], [
-diff --git a/test/integration/fixtures/event-uefiservices.bin.yaml.pretty b/test/integration/fixtures/event-uefiservices.bin.yaml.pretty
-new file mode 100644
-index 00000000..f0819f70
---- /dev/null
-+++ b/test/integration/fixtures/event-uefiservices.bin.yaml.pretty
-@@ -0,0 +1,45 @@
-+---
-+version: 1
-+events:
-+- EventNum: 0
-+  PCRIndex: 0
-+  EventType: EV_NO_ACTION
-+  Digest: "0000000000000000000000000000000000000000"
-+  EventSize: 37
-+  SpecID:
-+  - Signature: Spec ID Event03
-+    platformClass: 0
-+    specVersionMinor: 0
-+    specVersionMajor: 2
-+    specErrata: 0
-+    uintnSize: 2
-+    numberOfAlgorithms: 2
-+    Algorithms:
-+    - Algorithm[0]:
-+      algorithmId: sha1
-+      digestSize: 20
-+    - Algorithm[1]:
-+      algorithmId: sha256
-+      digestSize: 32
-+    vendorInfoSize: 0
-+- EventNum: 1
-+  PCRIndex: 2
-+  EventType: EV_EFI_BOOT_SERVICES_DRIVER
-+  DigestCount: 2
-+  Digests:
-+  - AlgorithmId: sha1
-+    Digest: "855685b4dbd4b67d50e0594571055054cfe2b1e9"
-+  - AlgorithmId: sha256
-+    Digest: "dd8576b4ff346c19c56c3e4f97ce55c5afa646f9c669be0a7cdd05057a0ecdf3"
-+  EventSize: 84
-+  Event:
-+    ImageLocationInMemory: 0x7dcf6018
-+    ImageLengthInMemory: 171464
-+    ImageLinkTimeAddress: 0x0
-+    LengthOfDevicePath: 52
-+    DevicePath1: 'PciRoot(0x0)/Pci(0x2,0x0)/Pci(0x0,0x0)/Offset(0x12600,0x3c3ff)'
-+pcrs:
-+  sha1:
-+    2  : 0x5b5f4d5c31664f01670a98a5796a36473671befc
-+  sha256:
-+    2  : 0x35fcf9d737c52c971f7c74058d36937dbd7824177fa0f1de3eba3934fcb83b9d
-diff --git a/test/integration/fixtures/event-uefiservices.bin.yaml b/test/integration/fixtures/event-uefiservices.bin.yaml.raw
-similarity index 100%
-rename from test/integration/fixtures/event-uefiservices.bin.yaml
-rename to test/integration/fixtures/event-uefiservices.bin.yaml.raw
--- 
-2.41.0
-
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/files/tpm2-tools-5.6-test-eventlog.sh-Fix-accidental-deletions.patch b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/files/tpm2-tools-5.6-test-eventlog.sh-Fix-accidental-deletions.patch
deleted file mode 100644
index 7274ee40827..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/files/tpm2-tools-5.6-test-eventlog.sh-Fix-accidental-deletions.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 4dec5295361d753c3466bc9e8b0ae3a3cc58dff5 Mon Sep 17 00:00:00 2001
-From: Juergen Repp <juergen_repp@web.de>
-Date: Thu, 4 Apr 2024 09:42:51 +0200
-Subject: [PATCH] test eventlog.sh Fix accidental deletions.
-
-* Accidental deletions made in commit 196e3d439407e81040ced054a8ed302489348a9d
-  are undone.
-* python3 is used as default instead of python.
-
-Signed-off-by: Juergen Repp <juergen_repp@web.de>
----
- test/integration/tests/eventlog.sh | 33 ++++++++++++++++++++++++++++--
- 1 file changed, 31 insertions(+), 2 deletions(-)
-
-diff --git a/test/integration/tests/eventlog.sh b/test/integration/tests/eventlog.sh
-index 9d5290f0..e7c13706 100755
---- a/test/integration/tests/eventlog.sh
-+++ b/test/integration/tests/eventlog.sh
-@@ -3,7 +3,7 @@
- set -E
- shopt -s expand_aliases
- 
--alias python=${PYTHON-python}
-+alias python=${PYTHON-python3}
- 
- yaml_validate() {
-     cmd=$1
-@@ -88,7 +88,36 @@ expect_pass() {
- expect_fail
- expect_fail foo
- expect_fail foo bar
--expect_fail ${srcdir}/test/integration/fix
-+expect_fail ${srcdir}/test/integration/fixtures/event-bad.bin
-+
-+expect_pass ${srcdir}/test/integration/fixtures/specid-vendordata.bin
-+expect_pass ${srcdir}/test/integration/fixtures/event.bin
-+expect_pass ${srcdir}/test/integration/fixtures/event-uefivar.bin
-+expect_pass ${srcdir}/test/integration/fixtures/event-uefiaction.bin
-+expect_pass ${srcdir}/test/integration/fixtures/event-uefiservices.bin
-+expect_pass ${srcdir}/test/integration/fixtures/event-uefi-sha1-log.bin
-+expect_pass ${srcdir}/test/integration/fixtures/event-bootorder.bin
-+expect_pass ${srcdir}/test/integration/fixtures/event-postcode.bin
-+
-+# Make sure that --eventlog-version=2 works on complete TPM2 logs
-+expect_pass ${srcdir}/test/integration/fixtures/event-arch-linux.bin --eventlog-version=2
-+expect_pass ${srcdir}/test/integration/fixtures/event-gce-ubuntu-2104-log.bin --eventlog-version=2
-+expect_pass ${srcdir}/test/integration/fixtures/event-sd-boot-fedora37.bin --eventlog-version=2
-+expect_pass ${srcdir}/test/integration/fixtures/event-moklisttrusted.bin --eventlog-version=2
-+
-+# Pick an event with leading whitespace and validate we have
-+# preserved it correctly after parsing the YAML
-+event=$(yaml_validate "print(y['events'][80]['Event']['String'])" < ${srcdir}/test/integration/fixtures/event-moklisttrusted.bin.yaml | tr -d '\0')
-+expect=$(echo -e "grub_cmd: menuentry UEFI Firmware Settings --id uefi-firmware {\n\t\tfwsetup\n\t}")
-+if test "$event" != "$expect"
-+then
-+    echo "Got $event"
-+    echo "Want $expect"
-+    exit 1
-+fi
-+
-+# Compare strings generated by tpm2_eventlog with binary data of the corresponding
-+# events.
- hex_file="${srcdir}/test/integration/fixtures/event-moklisttrusted-hex.yaml"
- tool_file="${srcdir}/test/integration/fixtures/event-moklisttrusted.bin.yaml"
- 
--- 
-2.43.2
-
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/files/tpm2-tools-5.7-tests-Eliminate-dependency-on-which.patch b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/files/tpm2-tools-5.7-tests-Eliminate-dependency-on-which.patch
new file mode 100644
index 00000000000..1872d7d2389
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/files/tpm2-tools-5.7-tests-Eliminate-dependency-on-which.patch
@@ -0,0 +1,42 @@
+From e9af1553f26ebad6e8db14b599dc74bab5663806 Mon Sep 17 00:00:00 2001
+From: Christopher Byrne <salah.coronya@gmail.com>
+Date: Tue, 16 Apr 2024 09:32:30 -0500
+Subject: [PATCH] tests: Eliminate dependency on 'which'
+
+See https://lwn.net/Articles/874049/
+
+Signed-off-by: Christopher Byrne <salah.coronya@gmail.com>
+---
+ test/integration/tests/pcrevent.sh | 2 +-
+ test/integration/tests/symlink.sh  | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/test/integration/tests/pcrevent.sh b/test/integration/tests/pcrevent.sh
+index 5484cfbe..d7166789 100644
+--- a/test/integration/tests/pcrevent.sh
++++ b/test/integration/tests/pcrevent.sh
+@@ -44,7 +44,7 @@ yaml_verify $hash_out_file
+ while IFS='' read -r l || [[ -n "$l" ]]; do
+ 
+   alg=`echo -n $l | cut -d\: -f 1-1`
+-  if ! which "$alg"sum >/dev/null 2>&1; then
++  if ! command -v "$alg"sum >/dev/null 2>&1; then
+       echo "Ignore checking $alg algorithm due to unavailable \"${alg}sum\" program"
+       continue
+   fi
+diff --git a/test/integration/tests/symlink.sh b/test/integration/tests/symlink.sh
+index 606e1a1a..f65a7567 100644
+--- a/test/integration/tests/symlink.sh
++++ b/test/integration/tests/symlink.sh
+@@ -17,7 +17,7 @@ start_up
+ # Positive tests:
+ #
+ fail=0
+-TPM2_TOOL="$(which tpm2)"
++TPM2_TOOL="$(command -v tpm2)"
+ 
+ if [ -z "$TPM2_TOOL" ]; then
+     echo "unable to locate tpm2 tool"
+-- 
+2.45.2
+
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.5.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.5.ebuild
deleted file mode 100644
index 866f1e799d2..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.5.ebuild
+++ /dev/null
@@ -1,66 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..12} )
-inherit bash-completion-r1 flag-o-matic python-any-r1
-
-DESCRIPTION="Tools for the TPM 2.0 TSS"
-HOMEPAGE="https://github.com/tpm2-software/tpm2-tools"
-SRC_URI="https://github.com/tpm2-software/tpm2-tools/releases/download/${PV}/${P}.tar.gz"
-
-LICENSE="BSD"
-SLOT="0"
-KEYWORDS="amd64 arm arm64 ppc64 x86"
-IUSE="+fapi test"
-
-RESTRICT="!test? ( test )"
-
-RDEPEND=">=app-crypt/tpm2-tss-3.0.1:=[fapi?]
-	dev-libs/openssl:=
-	net-misc/curl
-	sys-libs/efivar:="
-DEPEND="${RDEPEND}
-	test? (
-		app-crypt/swtpm
-		app-crypt/tpm2-abrmd
-		dev-util/cmocka
-	)"
-BDEPEND="virtual/pkgconfig
-	dev-build/autoconf-archive
-	test? (
-		app-editors/vim-core
-		dev-tcltk/expect
-		$(python_gen_any_dep 'dev-python/pyyaml[${PYTHON_USEDEP}]')
-	)
-	${PYTHON_DEPS}"
-
-python_check_deps() {
-	python_has_version "dev-python/pyyaml[${PYTHON_USEDEP}]"
-}
-
-pkg_setup() {
-	use test && python-any-r1_pkg_setup
-}
-
-src_configure() {
-	# tests fail with LTO enabbled. See bug 865275 and 865277
-	filter-lto
-	econf \
-		$(use_enable fapi) \
-		$(use_enable test unit) \
-		--with-bashcompdir=$(get_bashcompdir) \
-		--enable-hardening
-}
-
-src_install() {
-	default
-	mv "${ED}"/$(get_bashcompdir)/tpm2{_completion.bash,} || die
-	local utils=( "${ED}"/usr/bin/tpm2_* )
-	utils=("${utils[@]##*/}")
-	# these utiltites don't have bash completions
-	local nobashcomp=( tpm2_encodeobject tpm2_getpolicydigest tpm2_sessionconfig )
-	mapfile -d $'\0' -t utils < <(printf '%s\0' "${utils[@]}" | grep -Ezvw "${nobashcomp[@]/#/-e}")
-	bashcomp_alias tpm2 "${utils[@]}"
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.6-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.6-r1.ebuild
deleted file mode 100644
index ab59eed9520..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.6-r1.ebuild
+++ /dev/null
@@ -1,81 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..12} )
-inherit autotools bash-completion-r1 flag-o-matic python-any-r1
-
-DESCRIPTION="Tools for the TPM 2.0 TSS"
-HOMEPAGE="https://github.com/tpm2-software/tpm2-tools"
-SRC_URI="https://github.com/tpm2-software/tpm2-tools/releases/download/${PV}/${P}.tar.gz"
-SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/tpm2-tools-5.6-tpm2_eventlog-Create-raw-and-pretty-print-format-for.patch.xz"
-
-LICENSE="BSD"
-SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~x86"
-IUSE="+fapi test"
-
-RESTRICT="!test? ( test )"
-
-RDEPEND=">=app-crypt/tpm2-tss-3.0.1:=[fapi?]
-	dev-libs/openssl:=
-	net-misc/curl
-	sys-libs/efivar:="
-DEPEND="${RDEPEND}
-	test? (
-		app-crypt/swtpm
-		app-crypt/tpm2-abrmd
-		dev-util/cmocka
-	)"
-BDEPEND="virtual/pkgconfig
-	dev-build/autoconf-archive
-	test? (
-		app-editors/vim-core
-		dev-tcltk/expect
-		$(python_gen_any_dep 'dev-python/pyyaml[${PYTHON_USEDEP}]')
-	)
-	${PYTHON_DEPS}"
-
-PATCHES=(
-	"${FILESDIR}/${PN}-5.6-test-eventlog-fix-check-eventlog.sh-if-efivar.h-exis.patch"
-	"${WORKDIR}/${PN}-5.6-tpm2_eventlog-Create-raw-and-pretty-print-format-for.patch"
-	"${FILESDIR}/${PN}-5.6-Makefile-am-Dont-require-pandoc-for-tests.patch"
-	"${FILESDIR}/${PN}-5.6-bashism.patch"
-	"${FILESDIR}/${PN}-5.6-test-eventlog.sh-Fix-accidental-deletions.patch"
-)
-
-python_check_deps() {
-	python_has_version "dev-python/pyyaml[${PYTHON_USEDEP}]"
-}
-
-pkg_setup() {
-	use test && python-any-r1_pkg_setup
-}
-
-src_prepare() {
-	default
-	eautoreconf
-}
-
-src_configure() {
-	# tests fail with LTO enabbled. See bug 865275 and 865277
-	filter-lto
-	econf \
-		$(use_enable fapi) \
-		$(use_enable test unit) \
-		--with-bashcompdir=$(get_bashcompdir) \
-		--enable-hardening
-}
-
-src_install() {
-	default
-	mv "${ED}"/$(get_bashcompdir)/tpm2{_completion.bash,} || die
-	local utils=( "${ED}"/usr/bin/tpm2_* )
-	utils=("${utils[@]##*/}")
-	# these utiltites don't have bash completions
-	local nobashcomp=( tpm2_encodeobject tpm2_getpolicydigest\
-			   tpm2_sessionconfig tpm2_tr_encode)
-	mapfile -d $'\0' -t utils < <(printf '%s\0' "${utils[@]}" | grep -Ezvw "${nobashcomp[@]/#/-e}")
-	bashcomp_alias tpm2 "${utils[@]}"
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.6.1.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.6.1.ebuild
deleted file mode 100644
index f8ad3a1b74c..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.6.1.ebuild
+++ /dev/null
@@ -1,87 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..12} )
-inherit autotools bash-completion-r1 flag-o-matic python-any-r1
-
-DESCRIPTION="Tools for the TPM 2.0 TSS"
-HOMEPAGE="https://github.com/tpm2-software/tpm2-tools"
-SRC_URI="https://github.com/tpm2-software/tpm2-tools/releases/download/${PV}/${P}.tar.gz"
-SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/tpm2-tools-5.6-tpm2_eventlog-Create-raw-and-pretty-print-format-for.patch.xz"
-
-LICENSE="BSD"
-SLOT="0"
-KEYWORDS="amd64 arm arm64 ~ppc64 x86"
-IUSE="+fapi test"
-
-RESTRICT="!test? ( test )"
-
-RDEPEND=">=app-crypt/tpm2-tss-3.0.1:=[fapi?]
-	dev-libs/openssl:=
-	net-misc/curl
-	sys-libs/efivar:="
-DEPEND="${RDEPEND}
-	test? (
-		app-crypt/swtpm
-		app-crypt/tpm2-abrmd
-		dev-util/cmocka
-	)"
-BDEPEND="virtual/pkgconfig
-	dev-build/autoconf-archive
-	test? (
-		app-editors/vim-core
-		dev-tcltk/expect
-		$(python_gen_any_dep 'dev-python/pyyaml[${PYTHON_USEDEP}]')
-	)
-	${PYTHON_DEPS}"
-
-PATCHES=(
-	"${FILESDIR}/${PN}-5.6-test-eventlog-fix-check-eventlog.sh-if-efivar.h-exis.patch"
-	"${WORKDIR}/${PN}-5.6-tpm2_eventlog-Create-raw-and-pretty-print-format-for.patch"
-	"${FILESDIR}/${PN}-5.6-Makefile-am-Dont-require-pandoc-for-tests.patch"
-	"${FILESDIR}/${PN}-5.6-test-eventlog.sh-Fix-accidental-deletions.patch"
-)
-
-python_check_deps() {
-	python_has_version "dev-python/pyyaml[${PYTHON_USEDEP}]"
-}
-
-pkg_setup() {
-	use test && python-any-r1_pkg_setup
-}
-
-src_prepare() {
-	default
-	eautoreconf
-}
-
-src_configure() {
-	# tests fail with LTO enabbled. See bug 865275 and 865277
-	filter-lto
-	econf \
-		$(use_enable fapi) \
-		$(use_enable test unit) \
-		--with-bashcompdir=$(get_bashcompdir) \
-		--enable-hardening
-}
-
-src_install() {
-	default
-	mv "${ED}"/$(get_bashcompdir)/tpm2{_completion.bash,} || die
-	local utils=( "${ED}"/usr/bin/tpm2_* )
-	utils=("${utils[@]##*/}")
-	# these utiltites don't have bash completions
-	local nobashcomp=( tpm2_encodeobject tpm2_getpolicydigest\
-			   tpm2_sessionconfig tpm2_tr_encode)
-	mapfile -d $'\0' -t utils < <(printf '%s\0' "${utils[@]}" | grep -Ezvw "${nobashcomp[@]/#/-e}")
-	bashcomp_alias tpm2 "${utils[@]}"
-}
-
-src_test() {
-# This hook doesn't get invoked consisently, so call it manually
-# else one of the tests will fail
-	emake prepare-check
-	default
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.7.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.7.ebuild
index 99c2a66f1a7..530587f97e2 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.7.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 inherit autotools bash-completion-r1 flag-o-matic python-any-r1
 
 DESCRIPTION="Tools for the TPM 2.0 TSS"
@@ -38,6 +38,7 @@ BDEPEND="virtual/pkgconfig
 
 PATCHES=(
 	"${FILESDIR}/${PN}-5.6-Makefile-am-Dont-require-pandoc-for-tests.patch"
+	"${FILESDIR}/${PN}-5.7-tests-Eliminate-dependency-on-which.patch"
 )
 
 python_check_deps() {
diff --git a/sdk_container/src/third_party/portage-stable/app-editors/nano/Manifest b/sdk_container/src/third_party/portage-stable/app-editors/nano/Manifest
index fc108864338..ce7979d738d 100644
--- a/sdk_container/src/third_party/portage-stable/app-editors/nano/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-editors/nano/Manifest
@@ -1,3 +1,4 @@
 DIST nano-7.2.tar.xz 1608444 BLAKE2B c7e3b18383e9f2f9db1f6059c875ddd164d730ea0e5b363e66fb8e5f30e8598ba49a5afd8eea3a55e295f1e43fb136019f60cc9154ae276c5d589002c0e5298a SHA512 a6dfa70edab62e439a9a998ca214f2415d57dbdc01766ad2e4b14048836557a32755f8b09de13c6a89023f215b61d2854017b389eae8d097ca6f3ba73ce2f583
 DIST nano-8.0.tar.xz 1666272 BLAKE2B ba36182da059a3ee4c1fc60a200dee26f47cc6b1441b7ff665b82871f2f8fcac054f6adf82966d353234141bf9c521518da8fa967aca28307bccf43e015ddaea SHA512 86c484428b8805768fd580d0f62aa32ce8f588f4beedcdd35a4014506b562928c7a2fa6487aa0d853b4c9c1639a4d186f46b4e96721568ff81191d5098403ca8
 DIST nano-8.1.tar.xz 1667392 BLAKE2B e454f6e5ef86afbab3b2cf6707954d8821bf47ebc89bdad8cc6c70e2d4bb9fac27614069140f40140bca156b14605d286b0dca42469901c6559051089645cab8 SHA512 cb7d696bd18322ba1e713282e3156934e2c7f2a8abc17c99b2d5ae91fa40ea1478758853d4ad391f72039f01cfe0db79fd7302f3e67ed2afeff3a447b6f975ec
+DIST nano-8.2.tar.xz 1672076 BLAKE2B 08e078f8f5acc8d70ad50a0a402d06a12bcf836c8161f803e2b674375abaa16d663000f02cd1fa1e0b4aad2f127a85ee3b2f60d725a761ab375ae00c905408fd SHA512 07c69d6894f87cb386afa89e984ded7e11fe7575cf3af1c18237e3b2c00de371015c9ea126e505c7c0e7200f7359d5ae7c3779198e188fbbc617154d09c4ba14
diff --git a/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-8.2.ebuild b/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-8.2.ebuild
new file mode 100644
index 00000000000..33dcb4d8418
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-8.2.ebuild
@@ -0,0 +1,105 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/nano.git"
+	inherit autotools git-r3
+else
+	MY_P="${PN}-${PV/_}"
+	SRC_URI="https://www.nano-editor.org/dist/v${PV:0:1}/${MY_P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+DESCRIPTION="GNU GPL'd Pico clone with more functionality"
+HOMEPAGE="https://www.nano-editor.org/ https://wiki.gentoo.org/wiki/Nano/Guide"
+
+LICENSE="GPL-3+ LGPL-2.1+ || ( GPL-3+ FDL-1.2+ )"
+SLOT="0"
+IUSE="debug justify magic minimal ncurses nls +spell unicode"
+
+RDEPEND="
+	>=sys-libs/ncurses-5.9-r1:=[unicode(+)?]
+	magic? ( sys-apps/file )
+	nls? ( virtual/libintl )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	nls? ( sys-devel/gettext )
+	virtual/pkgconfig
+"
+
+REQUIRED_USE="
+	magic? ( !minimal )
+"
+
+# gnulib FPs
+QA_CONFIG_IMPL_DECL_SKIP=( unreachable MIN static_assert )
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]] ; then
+		eautoreconf
+	fi
+}
+
+src_configure() {
+	local myconfargs=(
+		--bindir="${EPREFIX}"/bin
+		--htmldir=/trash
+		$(use_enable !minimal color)
+		$(use_enable !minimal multibuffer)
+		$(use_enable !minimal nanorc)
+		$(use_enable magic libmagic)
+		$(use_enable spell speller)
+		$(use_enable justify)
+		$(use_enable debug)
+		$(use_enable nls)
+		$(use_enable unicode utf8)
+		$(use_enable minimal tiny)
+	)
+
+	econf "${myconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	# Don't use "${ED}" here or things break (#654534)
+	rm -r "${D}"/trash || die
+
+	dodoc doc/sample.nanorc
+	docinto html
+	dodoc doc/faq.html
+	insinto /etc
+	newins doc/sample.nanorc nanorc
+
+	if ! use minimal ; then
+		# Enable colorization by default.
+		sed -i \
+			-e '/^# include /s:# *::' \
+			"${ED}"/etc/nanorc || die
+
+		# Since nano-5.0 these are no longer being "enabled" by default
+		# (bug #736848)
+		local rcdir="/usr/share/nano"
+		mv "${ED}"${rcdir}/extra/* "${ED}"/${rcdir}/ || die
+		rmdir "${ED}"${rcdir}/extra || die
+
+		insinto "${rcdir}"
+		newins "${FILESDIR}/gentoo.nanorc-r1" gentoo.nanorc
+	fi
+}
+
+pkg_postrm() {
+	[[ -n ${REPLACED_BY_VERSION} ]] && return
+
+	local e
+	e=$(unset EDITOR; . "${EROOT}"/etc/profile &>/dev/null; echo "${EDITOR}")
+	if [[ ${e##*/} == nano ]]; then
+		ewarn "The EDITOR variable is still set to ${e}."
+		ewarn "You can update it with \"eselect editor\"."
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
index 9d9e18f33a7..9f7bf8f38f6 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
@@ -5,6 +5,7 @@ DIST qemu-7.2.0-docs.tar.xz 1984184 BLAKE2B 103900fb7903ed8d75f7f012bf61fa2d6fce
 DIST qemu-7.2.11.tar.xz 121877020 BLAKE2B c546773b9ac7809b39a3afa51da5b1c06c3765fadb4df9d8529f8af65c26098676adf8e516620ca1b39201fa859878780edb56a445778e105cbe7db0f52b9f6a SHA512 c77ff1505128c05fe39eaa95cc11e4d2279bff06093acd613e54f71d4a13144f905551eec1d044c3a3fb751d3369c01d131d68c18b15d9a04bcc77370d93c217
 DIST qemu-7.2.12.tar.xz 124399872 BLAKE2B df0afc8de23f3df7b0ada301584f1d96c7add69ec16755c5b75eced88827ec2719ba79c9191da5c77f00872bf2c492b24b08f310954e5ca97249debd5e520cda SHA512 239623f6f3c15b85ce8da27adb8123886a2b56971742d2a11cde58b0dfac40de1592e1e33591306b830c5cee051d11b00d1bdccf414cc7b111dab79b65b1cf92
 DIST qemu-7.2.13.tar.xz 124399088 BLAKE2B 7d0b86862e663b20e918a211f661aff0bf8eeb480cffef9eba51c819d817368db33989bcc4f1673dd278d1f0f91f7991e22a24fca828559d8da225fdb8a1836b SHA512 be6a1d2efb111c09456be97a431a8881667b0a1d356a9901e6582b9720143826d4719778c228eb342ec865b5a3dc21444ebe296be56e1edafd16ab1b3aef3ae2
+DIST qemu-7.2.14.tar.xz 124392436 BLAKE2B bf4141a910ebd393edc2df3b105c18bbb1d91241a6e2992ceb591b5097dc846fd74171b9c8ffe71e6a7c847277dd17600286da411ae7750e8eae39c0180b5264 SHA512 3fedf9b55ec97faec449f483433e616d8a384933556997bee50b170bb854faa1eb89e43400cc97acea268575bc92b57d8e921e00d4858bc8991fe04a2c2893ff
 DIST qemu-8.0.0-docs.tar.xz 3218024 BLAKE2B b764a625024e78a39470048355471e12cfb57ab3c34e764dc4200fdf5c1aea635d26095ec961979bf46f177101c5bd38618bacf7e98e04bd64688ab5e29591aa SHA512 d9dfe191372e105fe16fe8f66f41ed793ade4c89b5ab1d84b39459f3419a1ca61bd49422a83981965cc257c05eca7fd49054703f58f179f5c7b656e9473a1054
 DIST qemu-8.0.5.tar.xz 126175064 BLAKE2B 1d1f78c185ab64b4ca946a44ad04d0bbb6ea48de058037e4ba18176abeb0f0528754c6e832f742f93227182bbce145544eca5b908a366006e7ee58876aca0bda SHA512 ec9679473dda84a2f56ae8ee0039ec4dafb056414bfc5a3a147b2b6bb45ae3b130dd80f6385e8567b5d18f4be94f3536bc8acc45c61eddf40c9678b46cb8bddc
 DIST qemu-8.1.0-docs.tar.xz 2129912 BLAKE2B 8aaf7b748538afdb5bcb6da15dbd96572d086824377c4b0e93f1ddc695f9a4775471e360a9616d2d481dbf8113e91d2601c69d92cef565fb90b65ffacfdb304e SHA512 905515742bb56a439fc8117ec48ea668e7b2bf0244587673e4352d9e8e49911eb84ff093596ff566e44787197cf9789ec8950e3d75fb7a670c5546394a322ac9
@@ -13,6 +14,10 @@ DIST qemu-8.2.0-docs.tar.xz 2233352 BLAKE2B 22b9499fdf4ff93e72399dab3803f3171c85
 DIST qemu-8.2.3.tar.xz 130106716 BLAKE2B 2ec91b5111952434686064bd603880d87c4f56774d2478ee953eb0454e2b14235b1d1cca484e015b96bceae3182f90b856d222ca590059032b4989babf1dffe8 SHA512 28c789d84754b26cd86ded9db8464ec82f07cdc3b1025a988e74b8c5b05df8839a3e9990ff96cfba50e032dd967e9dc18cf75f3525baeadd0fa019cb69108d0a
 DIST qemu-8.2.5.tar.xz 132743988 BLAKE2B 24da4350cfe5a46771ea257b7baba48f02465c87e819ad3cc0557c06814f24f442ba3b97661af74d5235e31e7883b7c62d108e3180f7ce9e4be524ec966d07d0 SHA512 b95de309d790033452687b488ba869940bc40862ebbc9d91edbeee840e4ffc0b4cae43e1bfcd00f5534da126c62072b7b5309da6d74d30ba537e4c7b430f4255
 DIST qemu-8.2.6.tar.xz 132750000 BLAKE2B da5fdb03fcb44cf764d2ccaf9011b726e5c152d8659ca91550cd04b3e578e7f9bf2cc050b38a64055103775e64303ae949cf7e2cde5508f8a4b976d1311631c5 SHA512 ba702306df0c2a6744fff6fdca5f251ebc572230ee4674113433c74f74187ba33457ea9716d9023aa48cc1e6887af132a2877c30ea098da9ed23e95d4691b88b
+DIST qemu-8.2.7.tar.xz 132676368 BLAKE2B 92235f1a30e1d44cf9f7e40e71e9df0375c5eb2d8b267c35df51e102e560f399e4d3f70c674d7b9e206728d9c4a1bafee5ae8f1a91cda900b422f9a6a48c15a8 SHA512 9806bae62d2bdf0781b6bd1c4d7e88bb97019ca5e85140714d7818912603aed1d522a5d29f3434888974ab73e0cfae8b4136ea018b05dcc2d6f6c8b6252075cd
 DIST qemu-9.0.0-docs.tar.xz 2290196 BLAKE2B 82d22637ff2629bee372550e86651f12051ea6b4a57e314ef83f290425d4973ef01827eaf28a85b635788f22cb7cc1c747438b7525c92c99b90b234fb8f7655c SHA512 7c0ba1f3e7bbaa4e3feebc33a1946a5c190f2c14b9ed78b15c1f642668c8124960f8c85bcf36fe54a10d4edef47d2256e500f06d9173b92b03c599811a15a073
 DIST qemu-9.0.1.tar.xz 132368412 BLAKE2B e96ae5cc3ee935dd31232d38d46bbdc74fd3a2a0dd8517c0e035757f3ded92712dfa68d0068cd8c37f314a92d237e2b4a725b509ba402b7a1ce92df63207a08d SHA512 6c120aaf52f15e79c32d883cc83df8fc83222d538ea6be9c19aaddfba0aef91479b5826bbc03e58688fba639cb24bc6f54e525ccc2404ed5d820766d11735210
 DIST qemu-9.0.2.tar.xz 132387528 BLAKE2B 6b5301f985919ae53e056410be7486b8150a65016127568bd4d58f596e94960d08eb3fc57cff7ff6a3435d71274adee516f57375d856d61b4fc7a3f24cbf75c4 SHA512 58ed84f6fe6263d279356bc9193f96edf62cf3663fb151daa3f047d52329fe49cb91c2d45e09697e0469f4f5409be96403aec9572d4871ffa40848a786c21599
+DIST qemu-9.0.3.tar.xz 132420136 BLAKE2B af44ee6d3e59c28bb84cbf78a4793fa120a7cb811ab0fb0aba7b61d0b2eeb0e47dd094a4a0af9570e26d584f7ae867d46b6f61903610e155deb6479d8ea60fa4 SHA512 fcd72896ae9f9f654628540e09472c8388d980f8081990ee541f3540f92c5fd0d9332fa343dc9eaa6d7fe3dc2a5668d7d5c3784ba9d49bd7df9d37a4f9df7572
+DIST qemu-9.1.0-docs.tar.xz 2376072 BLAKE2B 31d13133b3a2e21a7d9b5af028407610ae8f2fa61dd296fc35e57fc12eb66cfd1a39ec5e3b5a3852095d10a388f424f8a38417b3ab58ca30d0817ece779328cf SHA512 5b705b577daad6aa010d5c713db9dc314114334b89901840ebcecc9032595a969f5ad9054e42b36b2be5ef9f5d6dc1159841ff46dbb08314b5c48491aa631040
+DIST qemu-9.1.0.tar.xz 132478356 BLAKE2B 77bdaf00e6111e6ac94462a6023aac0d3df9d2829a961fd89a5bdafc4aee7f95c2695d9319715e630960e64512a41b3ff987c9096692ff304cfd49357b46ef62 SHA512 bf61d65e37945fa8ee8640712c719ace05164d86e6df700b98bdc5f79e0a8d5e8f85bd48e726edb62b2419db20673f63ec8b63a60393a914b09cb365621b35e2
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-9.1.0-capstone-include-path.patch b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-9.1.0-capstone-include-path.patch
new file mode 100644
index 00000000000..7bb6a004d86
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-9.1.0-capstone-include-path.patch
@@ -0,0 +1,33 @@
+From: Sam James <sam@gentoo.org>
+Date: Sun, 6 Oct 2024 09:47:03 +0100
+Subject: [PATCH] Forward ported from qemu-7.1.0-capstone-include-path.patch.
+
+Bug: https://bugs.gentoo.org/873157
+Signed-off-by: Sam James <sam@gentoo.org>
+---
+ include/disas/capstone.h | 2 +-
+ meson.build              | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/disas/capstone.h
++++ b/include/disas/capstone.h
+@@ -4,7 +4,7 @@
+ #ifdef CONFIG_CAPSTONE
+ 
+ #define CAPSTONE_AARCH64_COMPAT_HEADER
+-#include <capstone.h>
++#include <capstone/capstone.h>
+ 
+ #else
+ 
+--- a/meson.build
++++ b/meson.build
+@@ -1769,7 +1769,7 @@ if not get_option('capstone').auto() or have_system or have_user
+   # that reports a wrong -I path, causing the #include to
+   # fail later. If the system has such a broken version
+   # do not use it.
+-  if capstone.found() and not cc.compiles('#include <capstone.h>',
++  if capstone.found() and not cc.compiles('#include <capstone/capstone.h>',
+                                           dependencies: [capstone])
+     capstone = not_found
+     if get_option('capstone').enabled()
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/metadata.xml b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/metadata.xml
index 6ebf4f397db..7deef8b7711 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/metadata.xml
@@ -60,6 +60,7 @@
 		<flag name="vte">Enable terminal support (<pkg>x11-libs/vte</pkg>) in the GTK+ interface</flag>
 		<flag name="xattr">Add support for getting and setting POSIX extended attributes, through
 		<pkg>sys-apps/attr</pkg>. Requisite for the virtfs backend.</flag>
+		<flag name="xdp">Enable support for XDP through <pkg>net-libs/xdp-tools</pkg></flag>
 		<flag name="xen">Enables support for Xen backends</flag>
 	</use>
 	<upstream>
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.14.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.14.ebuild
new file mode 100644
index 00000000000..f36330d37cf
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.14.ebuild
@@ -0,0 +1,979 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
+QEMU_DOCS_PREBUILT_DEV=ajak
+QEMU_DOCS_VERSION="7.2.0"
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# bug #830088
+QEMU_DOC_USEFLAG="+doc"
+
+PYTHON_COMPAT=( python3_{10,11} )
+PYTHON_REQ_USE="ncurses,readline"
+
+FIRMWARE_ABI_VERSION="7.2.0"
+
+inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
+		pax-utils xdg-utils
+
+if [[ ${PV} == *9999* ]]; then
+	QEMU_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
+	EGIT_SUBMODULES=(
+		tests/fp/berkeley-softfloat-3
+		tests/fp/berkeley-testfloat-3
+		ui/keycodemapdb
+	)
+	inherit git-r3
+	SRC_URI=""
+else
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+
+	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
+HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
+
+LICENSE="GPL-2 LGPL-2 BSD-2"
+SLOT="0"
+
+[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
+
+IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs
+	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
+	+slirp
+	smartcard snappy spice ssh static static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xen
+	zstd"
+
+COMMON_TARGETS="
+	aarch64
+	alpha
+	arm
+	cris
+	hppa
+	i386
+	loongarch64
+	m68k
+	microblaze
+	microblazeel
+	mips
+	mips64
+	mips64el
+	mipsel
+	nios2
+	or1k
+	ppc
+	ppc64
+	riscv32
+	riscv64
+	s390x
+	sh4
+	sh4eb
+	sparc
+	sparc64
+	x86_64
+	xtensa
+	xtensaeb
+"
+IUSE_SOFTMMU_TARGETS="
+	${COMMON_TARGETS}
+	avr
+	rx
+	tricore
+"
+IUSE_USER_TARGETS="
+	${COMMON_TARGETS}
+	aarch64_be
+	armeb
+	hexagon
+	mipsn32
+	mipsn32el
+	ppc64le
+	sparc32plus
+"
+
+use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
+use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
+IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
+
+RESTRICT="!test? ( test )"
+
+# Allow no targets to be built so that people can get a tools-only build.
+# Block USE flag configurations known to not work.
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	qemu_softmmu_targets_arm? ( fdt )
+	qemu_softmmu_targets_microblaze? ( fdt )
+	qemu_softmmu_targets_mips64el? ( fdt )
+	qemu_softmmu_targets_ppc64? ( fdt )
+	qemu_softmmu_targets_ppc? ( fdt )
+	qemu_softmmu_targets_riscv32? ( fdt )
+	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
+	sdl-image? ( sdl )
+	static? ( static-user !alsa !gtk !jack !opengl !pam !pulseaudio !plugins !rbd !snappy !udev )
+	static-user? ( !plugins )
+	virgl? ( opengl )
+	virtfs? ( xattr )
+	vnc? ( gnutls )
+	vte? ( gtk )
+	multipath? ( udev )
+	plugins? ( !static !static-user )
+"
+for smname in ${IUSE_SOFTMMU_TARGETS} ; do
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( seccomp ) "
+done
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# and user/softmmu targets (qemu-*, qemu-system-*).
+#
+# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
+#
+# The attr lib isn't always linked in (although the USE flag is always
+# respected).  This is because qemu supports using the C library's API
+# when available rather than always using the external library.
+ALL_DEPEND="
+	dev-libs/glib:2[static-libs(+)]
+	sys-libs/zlib[static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	systemtap? ( dev-debug/systemtap )
+	xattr? ( sys-apps/attr[static-libs(+)] )"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# softmmu targets (qemu-system-*).
+SOFTMMU_TOOLS_DEPEND="
+	sys-libs/libcap-ng[static-libs(+)]
+	>=x11-libs/pixman-0.28.0[static-libs(+)]
+	accessibility? (
+		app-accessibility/brltty[api]
+		app-accessibility/brltty[static-libs(+)]
+	)
+	aio? ( dev-libs/libaio[static-libs(+)] )
+	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
+	bzip2? ( app-arch/bzip2[static-libs(+)] )
+	capstone? ( dev-libs/capstone:=[static-libs(+)] )
+	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
+	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
+	gnutls? (
+		>=net-libs/gnutls-3.0:=[static-libs(+)]
+		dev-libs/nettle:=[static-libs(+)]
+	)
+	gtk? (
+		x11-libs/cairo
+		x11-libs/gdk-pixbuf:2
+		x11-libs/gtk+:3
+		x11-libs/libX11
+		vte? ( x11-libs/vte:2.91 )
+	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
+	iscsi? ( net-libs/libiscsi )
+	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
+	jack? ( virtual/jack )
+	jemalloc? ( dev-libs/jemalloc )
+	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	lzo? ( dev-libs/lzo:2[static-libs(+)] )
+	multipath? ( sys-fs/multipath-tools )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)]
+		sys-libs/ncurses:=[static-libs(+)]
+	)
+	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
+	numa? ( sys-process/numactl[static-libs(+)] )
+	opengl? (
+		virtual/opengl
+		media-libs/libepoxy[static-libs(+)]
+		media-libs/mesa[static-libs(+)]
+		media-libs/mesa[egl(+),gbm(+)]
+	)
+	pam? ( sys-libs/pam )
+	png? ( media-libs/libpng:0=[static-libs(+)] )
+	pulseaudio? ( media-libs/libpulse )
+	rbd? ( sys-cluster/ceph )
+	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
+	sdl? (
+		media-libs/libsdl2[video]
+		media-libs/libsdl2[static-libs(+)]
+	)
+	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
+	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
+	slirp? ( net-libs/libslirp[static-libs(+)] )
+	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
+	snappy? ( app-arch/snappy:= )
+	spice? (
+		>=app-emulation/spice-protocol-0.12.3
+		>=app-emulation/spice-0.12.0[static-libs(+)]
+	)
+	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
+	udev? ( virtual/libudev:= )
+	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
+	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
+	vde? ( net-misc/vde[static-libs(+)] )
+	virgl? ( media-libs/virglrenderer[static-libs(+)] )
+	virtfs? ( sys-libs/libcap )
+	xen? ( app-emulation/xen-tools:= )
+	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
+"
+
+EDK2_OVMF_VERSION="202202"
+SEABIOS_VERSION="1.16.0"
+
+X86_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		~sys-firmware/sgabios-0.1_pre10[binary]
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/edk2-ovmf-${EDK2_OVMF_VERSION}
+			>=sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		)
+		sys-firmware/ipxe[qemu]
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+		sys-firmware/sgabios
+	)"
+PPC_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+	)
+"
+
+BDEPEND="
+	$(python_gen_impl_dep)
+	dev-lang/perl
+	dev-build/meson
+	sys-apps/texinfo
+	virtual/pkgconfig
+	doc? (
+		dev-python/sphinx[${PYTHON_USEDEP}]
+		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+	)
+	gtk? ( nls? ( sys-devel/gettext ) )
+	test? (
+		dev-libs/glib[utils]
+		app-alternatives/bc
+	)
+"
+CDEPEND="
+	!static? (
+		${ALL_DEPEND//\[static-libs(+)]}
+		${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
+	)
+	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
+"
+DEPEND="${CDEPEND}
+	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
+	static? (
+		${ALL_DEPEND}
+		${SOFTMMU_TOOLS_DEPEND}
+	)
+	static-user? ( ${ALL_DEPEND} )"
+RDEPEND="${CDEPEND}
+	acct-group/kvm
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-5.2.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-6.0.0-make.patch
+	"${FILESDIR}"/${PN}-7.1.0-also-build-virtfs-proxy-helper.patch
+	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-7.2.0-disable-gmp.patch
+)
+
+QA_PREBUILT="
+	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/openbios-ppc
+	usr/share/qemu/openbios-sparc64
+	usr/share/qemu/openbios-sparc32
+	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
+	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
+	usr/share/qemu/palcode-clipper
+	usr/share/qemu/s390-ccw.img
+	usr/share/qemu/s390-netboot.img
+	usr/share/qemu/u-boot.e500
+"
+
+QA_WX_LOAD="usr/bin/qemu-i386
+	usr/bin/qemu-x86_64
+	usr/bin/qemu-alpha
+	usr/bin/qemu-arm
+	usr/bin/qemu-cris
+	usr/bin/qemu-m68k
+	usr/bin/qemu-microblaze
+	usr/bin/qemu-microblazeel
+	usr/bin/qemu-mips
+	usr/bin/qemu-mipsel
+	usr/bin/qemu-or1k
+	usr/bin/qemu-ppc
+	usr/bin/qemu-ppc64
+	usr/bin/qemu-sh4
+	usr/bin/qemu-sh4eb
+	usr/bin/qemu-sparc
+	usr/bin/qemu-sparc64
+	usr/bin/qemu-armeb
+	usr/bin/qemu-sparc32plus
+	usr/bin/qemu-s390x
+	usr/bin/qemu-unicore32
+"
+
+DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
+kernel module loaded before running kvm. The easiest way to ensure that the
+kernel module is loaded is to load it on boot.
+	For AMD CPUs the module is called 'kvm-amd'.
+	For Intel CPUs the module is called 'kvm-intel'.
+Please review /etc/conf.d/modules for how to load these.
+
+Make sure your user is in the 'kvm' group. Just run
+	$ gpasswd -a <USER> kvm
+then have <USER> re-login.
+
+For brand new installs, the default permissions on /dev/kvm might not let
+you access it.  You can tell udev to reset ownership/perms:
+	$ udevadm trigger -c add /dev/kvm
+
+If you want to register binfmt handlers for qemu user targets:
+For openrc:
+	# rc-update add qemu-binfmt
+For systemd:
+	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
+
+pkg_pretend() {
+	if use kernel_linux && kernel_is lt 2 6 25; then
+		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
+	elif use kernel_linux; then
+		if ! linux_config_exists; then
+			eerror "Unable to check your kernel for KVM support"
+		else
+			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
+			ERROR_KVM="You must enable KVM in your kernel to continue"
+			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
+			ERROR_KVM_AMD+=" your kernel configuration."
+			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
+			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
+			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
+			ERROR_TUN+=" into your kernel or loaded as a module to use the"
+			ERROR_TUN+=" virtual network device if using -net tap."
+			ERROR_BRIDGE="You will also need support for 802.1d"
+			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
+			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
+			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
+			ERROR_VHOST_NET+=" support"
+
+			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
+				if grep -q AuthenticAMD /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_AMD"
+				elif grep -q GenuineIntel /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_INTEL"
+				fi
+			fi
+
+			use python && CONFIG_CHECK+=" ~DEBUG_FS"
+			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
+
+			# Now do the actual checks setup above
+			check_extra_config
+		fi
+	fi
+
+	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
+		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
+		eerror "instances are still pointing to it.  Please update your"
+		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
+		eerror "and the right system binary (e.g. qemu-system-x86_64)."
+		die "update your virt configs to not use qemu-kvm"
+	fi
+}
+
+# Sanity check to make sure target lists are kept up-to-date.
+check_targets() {
+	local var=$1 mak=$2
+	local detected sorted
+
+	pushd "${S}"/configs/targets/ >/dev/null || die
+
+	# Force C locale until glibc is updated. #564936
+	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
+	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
+	if [[ ${sorted} != "${detected}" ]] ; then
+		eerror "The ebuild needs to be kept in sync."
+		eerror "${var}: ${sorted}"
+		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
+		die "sync ${var} to the list of targets"
+	fi
+
+	popd >/dev/null
+}
+
+src_prepare() {
+	check_targets IUSE_SOFTMMU_TARGETS softmmu
+	check_targets IUSE_USER_TARGETS linux-user
+
+	default
+
+	# Use correct toolchain to fix cross-compiling
+	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
+	export WINDRES=${CHOST}-windres
+
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		cat >> "${S}"/configs/meson/linux.txt <<-EOF || die
+		[binaries]
+		dtrace='stap-dtrace'
+		EOF
+	fi
+
+	# Verbose builds
+	MAKEOPTS+=" V=1"
+
+	# We already force -D_FORTIFY_SOURCE=2 (or 3) in our toolchain, but
+	# this setting (-U then -D..=2) will prevent us from trying out 3, so
+	# drop it. No change to level of protection b/c we patch our toolchain.
+	sed -i -e 's/-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2//' configure || die
+
+	# Remove bundled modules
+	rm -r dtc meson roms/*/ || die
+}
+
+##
+# configures qemu based on the build directory and the build type
+# we are using.
+#
+qemu_src_configure() {
+	debug-print-function ${FUNCNAME} "$@"
+
+	local buildtype=$1
+	local builddir="${S}/${buildtype}-build"
+
+	mkdir "${builddir}" || die
+
+	local conf_opts=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--bindir=/usr/bin
+		--libdir=/usr/$(get_libdir)
+		--datadir=/usr/share
+		--docdir=/usr/share/doc/${PF}/html
+		--mandir=/usr/share/man
+		--localstatedir=/var
+		--disable-bsd-user
+		--disable-containers # bug #732972
+		--disable-guest-agent
+		--disable-strip
+		--with-git-submodules=ignore
+
+		# bug #746752: TCG interpreter has a few limitations:
+		# - it does not support FPU
+		# - it's generally slower on non-self-modifying code
+		# It's advantage is support for host architectures
+		# where native codegeneration is not implemented.
+		# Gentoo has qemu keyworded only on targets with
+		# native code generation available. Avoid the interpreter.
+		--disable-tcg-interpreter
+
+		--disable-werror
+		# We support gnutls/nettle for crypto operations.  It is possible
+		# to use gcrypt when gnutls/nettle are disabled (but not when they
+		# are enabled), but it's not really worth the hassle.  Disable it
+		# all the time to avoid automatically detecting it. #568856
+		--disable-gcrypt
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--host-cc="$(tc-getBUILD_CC)"
+
+		$(use_enable alsa)
+		$(use_enable debug debug-info)
+		$(use_enable debug debug-tcg)
+		$(use_enable jack)
+		$(use_enable nls gettext)
+		$(use_enable oss)
+		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
+		$(use_enable xattr attr)
+	)
+
+	# Disable options not used by user targets. This simplifies building
+	# static user targets (USE=static-user) considerably.
+	conf_notuser() {
+		if [[ ${buildtype} == "user" ]] ; then
+			echo "--disable-${2:-$1}"
+		else
+			use_enable "$@"
+		fi
+	}
+	# Enable option only for softmmu build, but not 'user' or 'tools'
+	conf_softmmu() {
+		if [[ ${buildtype} == "softmmu" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Enable option only for tools build, but not 'user' or 'softmmu'
+	conf_tools() {
+		if [[ ${buildtype} == "tools" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
+	conf_opts+=(
+		$(conf_notuser accessibility brlapi)
+		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
+		$(conf_notuser bzip2)
+		$(conf_notuser capstone)
+		$(conf_notuser curl)
+		$(conf_tools doc docs)
+		$(conf_notuser fdt)
+		$(conf_notuser fuse)
+		$(conf_notuser glusterfs)
+		$(conf_notuser gnutls)
+		$(conf_notuser gnutls nettle)
+		$(conf_notuser gtk)
+		$(conf_notuser infiniband rdma)
+		$(conf_notuser iscsi libiscsi)
+		$(conf_notuser io-uring linux-io-uring)
+		$(conf_malloc jemalloc)
+		$(conf_notuser jpeg vnc-jpeg)
+		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser lzo)
+		$(conf_notuser multipath mpath)
+		$(conf_notuser ncurses curses)
+		$(conf_notuser nfs libnfs)
+		$(conf_notuser numa)
+		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
+		$(conf_notuser png)
+		$(conf_notuser rbd)
+		$(conf_notuser sasl vnc-sasl)
+		$(conf_notuser sdl)
+		$(conf_softmmu sdl-image)
+		$(conf_notuser seccomp)
+		$(conf_notuser slirp)
+		$(conf_notuser smartcard)
+		$(conf_notuser snappy)
+		$(conf_notuser spice)
+		$(conf_notuser ssh libssh)
+		$(conf_notuser udev libudev)
+		$(conf_notuser usb libusb)
+		$(conf_notuser usbredir usb-redir)
+		$(conf_notuser vde)
+		$(conf_notuser vhost-net)
+		$(conf_notuser virgl virglrenderer)
+		$(conf_softmmu virtfs)
+		$(conf_notuser vnc)
+		$(conf_notuser vte)
+		$(conf_notuser xen)
+		$(conf_notuser xen xen-pci-passthrough)
+		# use prebuilt keymaps, bug #759604
+		--disable-xkbcommon
+		$(conf_notuser zstd)
+	)
+
+	if [[ ! ${buildtype} == "user" ]] ; then
+		# audio options
+		local audio_opts=(
+			# Note: backend order matters here: #716202
+			# We iterate from higher-level to lower level.
+			$(usex pulseaudio pa "")
+			$(usev jack)
+			$(usev sdl)
+			$(usev alsa)
+			$(usev oss)
+		)
+		conf_opts+=(
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
+		)
+	fi
+
+	case ${buildtype} in
+	user)
+		conf_opts+=(
+			--enable-linux-user
+			--disable-system
+			--disable-blobs
+			--disable-tools
+			--disable-cap-ng
+			--disable-seccomp
+		)
+		local static_flag="static-user"
+		;;
+	softmmu)
+		conf_opts+=(
+			--disable-linux-user
+			--enable-system
+			--disable-tools
+			--enable-cap-ng
+			--enable-seccomp
+		)
+		local static_flag="static"
+		;;
+	tools)
+		conf_opts+=(
+			--disable-linux-user
+			--disable-system
+			--disable-blobs
+			--enable-tools
+			--enable-cap-ng
+		)
+		local static_flag="static"
+		;;
+	esac
+
+	local targets="${buildtype}_targets"
+	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
+
+	# Add support for SystemTap
+	use systemtap && conf_opts+=( --enable-trace-backend=dtrace )
+
+	# We always want to attempt to build with PIE support as it results
+	# in a more secure binary. But it doesn't work with static or if
+	# the current GCC doesn't have PIE support.
+	if use ${static_flag}; then
+		conf_opts+=( --static --disable-pie )
+	else
+		tc-enables-pie && conf_opts+=( --enable-pie )
+	fi
+
+	# Meson will not use a cross-file unless cross_prefix is set.
+	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
+
+	# Plumb through equivalent of EXTRA_ECONF to allow experiments
+	# like bug #747928.
+	conf_opts+=( ${EXTRA_CONF_QEMU} )
+
+	echo "../configure ${conf_opts[*]}"
+	cd "${builddir}"
+	../configure "${conf_opts[@]}" || die "configure failed"
+}
+
+src_configure() {
+	local target
+
+	python_setup
+
+	softmmu_targets= softmmu_bins=()
+	user_targets= user_bins=()
+
+	for target in ${IUSE_SOFTMMU_TARGETS} ; do
+		if use "qemu_softmmu_targets_${target}"; then
+			softmmu_targets+=",${target}-softmmu"
+			softmmu_bins+=( "qemu-system-${target}" )
+		fi
+	done
+
+	for target in ${IUSE_USER_TARGETS} ; do
+		if use "qemu_user_targets_${target}"; then
+			user_targets+=",${target}-linux-user"
+			user_bins+=( "qemu-${target}" )
+		fi
+	done
+
+	softmmu_targets=${softmmu_targets#,}
+	user_targets=${user_targets#,}
+
+	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
+	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
+	qemu_src_configure "tools"
+}
+
+src_compile() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build" || die
+		default
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		default
+	fi
+
+	cd "${S}/tools-build" || die
+	default
+}
+
+src_test() {
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		pax-mark m */qemu-system-* #515550
+		emake check
+	fi
+}
+
+qemu_python_install() {
+	python_domodule "${S}/python/qemu"
+
+	python_doscript "${S}/scripts/kvm/vmxcap"
+	python_doscript "${S}/scripts/qmp/qmp-shell"
+	python_doscript "${S}/scripts/qmp/qemu-ga-client"
+}
+
+# Generate binfmt support files.
+#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
+#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
+generate_initd() {
+	local out="${T}/qemu-binfmt"
+	local out_systemd="${T}/qemu.conf"
+	local d="${T}/binfmt.d"
+
+	einfo "Generating qemu binfmt scripts and configuration files"
+
+	# Generate the debian fragments first.
+	mkdir -p "${d}"
+	"${S}"/scripts/qemu-binfmt-conf.sh \
+		--debian \
+		--exportdir "${d}" \
+		--qemu-path "${EPREFIX}/usr/bin" \
+		|| die
+	# Then turn the fragments into a shell script we can source.
+	sed -E -i \
+		-e 's:^([^ ]+) (.*)$:\1="\2":' \
+		"${d}"/* || die
+
+	# Generate the init.d script by assembling the fragments from above.
+	local f qcpu package interpreter magic mask
+	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
+	for f in "${d}"/qemu-* ; do
+		source "${f}"
+
+		# Normalize the cpu logic like we do in the init.d for the native cpu.
+		qcpu=${package#qemu-}
+		case ${qcpu} in
+		arm*)   qcpu="arm";;
+		mips*)  qcpu="mips";;
+		ppc*)   qcpu="ppc";;
+		s390*)  qcpu="s390";;
+		sh*)    qcpu="sh";;
+		sparc*) qcpu="sparc";;
+		esac
+
+		# we use 'printf' here to be portable across 'sh'
+		# implementations: #679168
+		cat <<EOF >>"${out}"
+	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
+		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
+	fi
+EOF
+
+		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
+
+	done
+	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
+}
+
+src_install() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		emake DESTDIR="${ED}" install
+
+		# Install binfmt handler init script for user targets.
+		generate_initd
+		doinitd "${T}/qemu-binfmt"
+
+		# Install binfmt/qemu.conf.
+		insinto "/usr/share/qemu/binfmt.d"
+		doins "${T}/qemu.conf"
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		emake DESTDIR="${ED}" install
+
+		# This might not exist if the test failed. #512010
+		[[ -e check-report.html ]] && dodoc check-report.html
+
+		if use kernel_linux; then
+			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
+		fi
+
+		if use python; then
+			python_foreach_impl qemu_python_install
+		fi
+	fi
+
+	cd "${S}/tools-build" || die
+	emake DESTDIR="${ED}" install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
+	fi
+
+	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
+	pushd "${ED}"/usr/bin >/dev/null || die
+	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
+	popd >/dev/null || die
+
+	# Install config file example for qemu-bridge-helper
+	insinto "/etc/qemu"
+	doins "${FILESDIR}/bridge.conf"
+
+	cd "${S}" || die
+	dodoc MAINTAINERS docs/specs/pci-ids.txt
+	newdoc pc-bios/README README.pc-bios
+
+	# Disallow stripping of prebuilt firmware files.
+	dostrip -x ${QA_PREBUILT}
+
+	if [[ -n ${softmmu_targets} ]]; then
+		# Remove SeaBIOS since we're using the SeaBIOS packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
+		fi
+
+		# Remove vgabios since we're using the seavgabios packaged one
+		rm "${ED}/usr/share/qemu/vgabios.bin"
+		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
+		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
+		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
+		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
+		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
+
+		# PPC/PPC64 loads vgabios-stdvga
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
+			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
+			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
+			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
+			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
+			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
+			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
+		fi
+
+		# Remove sgabios since we're using the sgabios packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
+		fi
+
+		# Remove iPXE since we're using the iPXE packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
+			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
+			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
+			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
+			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
+			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
+		fi
+	fi
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+firmware_abi_change() {
+	local pv
+	for pv in ${REPLACING_VERSIONS}; do
+		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
+			return 0
+		fi
+	done
+	return 1
+}
+
+pkg_postinst() {
+	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
+		udev_reload
+	fi
+
+	xdg_icon_cache_update
+
+	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
+		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_print_elog
+
+	if use pin-upstream-blobs && firmware_abi_change; then
+		ewarn "This version of qemu pins new versions of firmware blobs:"
+
+		if has_version 'sys-firmware/edk2-ovmf-bin'; then
+			ewarn "	$(best_version sys-firmware/edk2-ovmf-bin)"
+		else
+			ewarn " $(best_version sys-firmware/edk2-ovmf)"
+		fi
+
+		if has_version 'sys-firmware/seabios-bin'; then
+			ewarn "	$(best_version sys-firmware/seabios-bin)"
+		else
+			ewarn " $(best_version sys-firmware/seabios)"
+		fi
+
+		ewarn "	$(best_version sys-firmware/ipxe)"
+		ewarn "	$(best_version sys-firmware/sgabios)"
+		ewarn "This might break resume of hibernated guests (started with a different"
+		ewarn "firmware version) and live migration to/from qemu versions with different"
+		ewarn "firmware. Please (cold) restart all running guests. For functional"
+		ewarn "guest migration ensure that all"
+		ewarn "hosts run at least"
+		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
+	fi
+}
+
+pkg_info() {
+	echo "Using:"
+	echo "  $(best_version app-emulation/spice-protocol)"
+
+	if has_version 'sys-firmware/edk2-ovmf-bin'; then
+		echo "  $(best_version sys-firmware/edk2-ovmf-bin)"
+	else
+		echo "  $(best_version sys-firmware/edk2-ovmf)"
+	fi
+
+	if has_version 'sys-firmware/seabios-bin'; then
+		echo "  $(best_version sys-firmware/seabios-bin)"
+	else
+		echo "  $(best_version sys-firmware/seabios)"
+	fi
+
+	echo "  $(best_version sys-firmware/ipxe)"
+	echo "  $(best_version sys-firmware/sgabios)"
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.7.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.7.ebuild
new file mode 100644
index 00000000000..97bf795e95b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.7.ebuild
@@ -0,0 +1,1000 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
+QEMU_DOCS_PREBUILT_DEV=sam
+QEMU_DOCS_VERSION=$(ver_cut 1-2).0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# bug #830088
+QEMU_DOC_USEFLAG="+doc"
+
+PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_REQ_USE="ncurses,readline"
+
+FIRMWARE_ABI_VERSION="7.2.0"
+
+inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
+		pax-utils xdg-utils
+
+if [[ ${PV} == *9999* ]]; then
+	QEMU_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
+	EGIT_SUBMODULES=()
+	inherit git-r3
+	SRC_URI=""
+	declare -A SUBPROJECTS=(
+		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
+		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
+		[berkeley-testfloat-3]="40619cbb3bf32872df8c53cc457039229428a263"
+	)
+
+	for proj in "${!SUBPROJECTS[@]}"; do
+		c=${SUBPROJECTS[${proj}]}
+		SRC_URI+=" https://gitlab.com/qemu-project/${proj}/-/archive/${c}/${proj}-${c}.tar.bz2"
+	done
+else
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+
+	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
+HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
+
+LICENSE="GPL-2 LGPL-2 BSD-2"
+SLOT="0"
+
+[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
+
+IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg keyutils
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs pipewire
+	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
+	+slirp
+	smartcard snappy spice ssh static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xen
+	zstd"
+
+COMMON_TARGETS="
+	aarch64
+	alpha
+	arm
+	cris
+	hppa
+	i386
+	loongarch64
+	m68k
+	microblaze
+	microblazeel
+	mips
+	mips64
+	mips64el
+	mipsel
+	nios2
+	or1k
+	ppc
+	ppc64
+	riscv32
+	riscv64
+	s390x
+	sh4
+	sh4eb
+	sparc
+	sparc64
+	x86_64
+	xtensa
+	xtensaeb
+"
+IUSE_SOFTMMU_TARGETS="
+	${COMMON_TARGETS}
+	avr
+	rx
+	tricore
+"
+IUSE_USER_TARGETS="
+	${COMMON_TARGETS}
+	aarch64_be
+	armeb
+	hexagon
+	mipsn32
+	mipsn32el
+	ppc64le
+	sparc32plus
+"
+
+use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
+use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
+IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
+
+RESTRICT="!test? ( test )"
+
+# Allow no targets to be built so that people can get a tools-only build.
+# Block USE flag configurations known to not work.
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	qemu_softmmu_targets_arm? ( fdt )
+	qemu_softmmu_targets_microblaze? ( fdt )
+	qemu_softmmu_targets_mips64el? ( fdt )
+	qemu_softmmu_targets_ppc64? ( fdt )
+	qemu_softmmu_targets_ppc? ( fdt )
+	qemu_softmmu_targets_riscv32? ( fdt )
+	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
+	sdl-image? ( sdl )
+	static-user? ( !plugins )
+	virgl? ( opengl )
+	virtfs? ( xattr )
+	vnc? ( gnutls )
+	vte? ( gtk )
+	multipath? ( udev )
+	plugins? ( !static-user )
+"
+for smname in ${IUSE_SOFTMMU_TARGETS} ; do
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( kernel_linux? ( seccomp ) )"
+done
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# and user/softmmu targets (qemu-*, qemu-system-*).
+#
+# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
+#
+# The attr lib isn't always linked in (although the USE flag is always
+# respected).  This is because qemu supports using the C library's API
+# when available rather than always using the external library.
+ALL_DEPEND="
+	dev-libs/glib:2[static-libs(+)]
+	sys-libs/zlib[static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	systemtap? ( dev-debug/systemtap )
+	xattr? ( sys-apps/attr[static-libs(+)] )
+"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# softmmu targets (qemu-system-*).
+SOFTMMU_TOOLS_DEPEND="
+	>=x11-libs/pixman-0.28.0[static-libs(+)]
+	accessibility? (
+		app-accessibility/brltty[api]
+		app-accessibility/brltty[static-libs(+)]
+	)
+	aio? ( dev-libs/libaio[static-libs(+)] )
+	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
+	bzip2? ( app-arch/bzip2[static-libs(+)] )
+	capstone? ( dev-libs/capstone:=[static-libs(+)] )
+	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
+	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
+	gnutls? (
+		>=net-libs/gnutls-3.0:=[static-libs(+)]
+		dev-libs/nettle:=[static-libs(+)]
+	)
+	gtk? (
+		x11-libs/gtk+:3
+		vte? ( x11-libs/vte:2.91 )
+	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
+	iscsi? ( net-libs/libiscsi )
+	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
+	jack? ( virtual/jack )
+	jemalloc? ( dev-libs/jemalloc )
+	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	kernel_linux? ( sys-libs/libcap-ng[static-libs(+)] )
+	keyutils? ( sys-apps/keyutils[static-libs(+)] )
+	lzo? ( dev-libs/lzo:2[static-libs(+)] )
+	multipath? ( sys-fs/multipath-tools )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)]
+		sys-libs/ncurses:=[static-libs(+)]
+	)
+	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
+	numa? ( sys-process/numactl[static-libs(+)] )
+	opengl? (
+		virtual/opengl
+		media-libs/libepoxy[static-libs(+)]
+		media-libs/mesa[static-libs(+)]
+		media-libs/mesa[egl(+),gbm(+)]
+	)
+	pam? ( sys-libs/pam )
+	pipewire? ( >=media-video/pipewire-0.3.60 )
+	png? ( >=media-libs/libpng-1.6.34:=[static-libs(+)] )
+	pulseaudio? ( media-libs/libpulse )
+	rbd? ( sys-cluster/ceph )
+	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
+	sdl? (
+		media-libs/libsdl2[video]
+		media-libs/libsdl2[static-libs(+)]
+	)
+	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
+	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
+	slirp? ( net-libs/libslirp[static-libs(+)] )
+	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
+	snappy? ( app-arch/snappy:= )
+	spice? (
+		>=app-emulation/spice-protocol-0.14.0
+		>=app-emulation/spice-0.14.0[static-libs(+)]
+	)
+	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
+	udev? ( virtual/libudev:= )
+	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
+	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
+	vde? ( net-misc/vde[static-libs(+)] )
+	virgl? ( media-libs/virglrenderer[static-libs(+)] )
+	virtfs? ( sys-libs/libcap )
+	xen? ( app-emulation/xen-tools:= )
+	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
+"
+
+EDK2_OVMF_VERSION="202202"
+SEABIOS_VERSION="1.16.3"
+
+X86_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		~sys-firmware/sgabios-0.1_pre10[binary]
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/edk2-ovmf-${EDK2_OVMF_VERSION}
+			>=sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		)
+		sys-firmware/ipxe[qemu]
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+		sys-firmware/sgabios
+	)
+"
+PPC_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+	)
+"
+
+# See bug #913084 for pip dep
+BDEPEND="
+	$(python_gen_impl_dep)
+	dev-lang/perl
+	>=dev-build/meson-0.63.0
+	app-alternatives/ninja
+	dev-python/pip[${PYTHON_USEDEP}]
+	virtual/pkgconfig
+	doc? (
+		>=dev-python/sphinx-1.6.0[${PYTHON_USEDEP}]
+		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+	)
+	gtk? ( nls? ( sys-devel/gettext ) )
+	test? (
+		dev-libs/glib[utils]
+		app-alternatives/bc
+	)
+"
+CDEPEND="
+	${ALL_DEPEND//\[static-libs(+)]}
+	${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
+	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
+"
+DEPEND="
+	${CDEPEND}
+	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
+	static-user? ( ${ALL_DEPEND} )
+"
+RDEPEND="
+	${CDEPEND}
+	acct-group/kvm
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-8.0.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-8.1.0-also-build-virtfs-proxy-helper.patch
+	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
+	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
+)
+
+QA_PREBUILT="
+	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/openbios-ppc
+	usr/share/qemu/openbios-sparc64
+	usr/share/qemu/openbios-sparc32
+	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
+	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
+	usr/share/qemu/palcode-clipper
+	usr/share/qemu/s390-ccw.img
+	usr/share/qemu/s390-netboot.img
+	usr/share/qemu/u-boot.e500
+"
+
+QA_WX_LOAD="
+	usr/bin/qemu-i386
+	usr/bin/qemu-x86_64
+	usr/bin/qemu-alpha
+	usr/bin/qemu-arm
+	usr/bin/qemu-cris
+	usr/bin/qemu-m68k
+	usr/bin/qemu-microblaze
+	usr/bin/qemu-microblazeel
+	usr/bin/qemu-mips
+	usr/bin/qemu-mipsel
+	usr/bin/qemu-or1k
+	usr/bin/qemu-ppc
+	usr/bin/qemu-ppc64
+	usr/bin/qemu-sh4
+	usr/bin/qemu-sh4eb
+	usr/bin/qemu-sparc
+	usr/bin/qemu-sparc64
+	usr/bin/qemu-armeb
+	usr/bin/qemu-sparc32plus
+	usr/bin/qemu-s390x
+	usr/bin/qemu-unicore32
+"
+
+DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
+kernel module loaded before running kvm. The easiest way to ensure that the
+kernel module is loaded is to load it on boot.
+	For AMD CPUs the module is called 'kvm-amd'.
+	For Intel CPUs the module is called 'kvm-intel'.
+Please review /etc/conf.d/modules for how to load these.
+
+Make sure your user is in the 'kvm' group. Just run
+	$ gpasswd -a <USER> kvm
+then have <USER> re-login.
+
+For brand new installs, the default permissions on /dev/kvm might not let
+you access it.  You can tell udev to reset ownership/perms:
+	$ udevadm trigger -c add /dev/kvm
+
+If you want to register binfmt handlers for qemu user targets:
+For openrc:
+	# rc-update add qemu-binfmt
+For systemd:
+	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
+
+pkg_pretend() {
+	if use kernel_linux && kernel_is lt 2 6 25; then
+		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
+	elif use kernel_linux; then
+		if ! linux_config_exists; then
+			eerror "Unable to check your kernel for KVM support"
+		else
+			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
+			ERROR_KVM="You must enable KVM in your kernel to continue"
+			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
+			ERROR_KVM_AMD+=" your kernel configuration."
+			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
+			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
+			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
+			ERROR_TUN+=" into your kernel or loaded as a module to use the"
+			ERROR_TUN+=" virtual network device if using -net tap."
+			ERROR_BRIDGE="You will also need support for 802.1d"
+			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
+			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
+			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
+			ERROR_VHOST_NET+=" support"
+
+			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
+				if grep -q AuthenticAMD /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_AMD"
+				elif grep -q GenuineIntel /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_INTEL"
+				fi
+			fi
+
+			use python && CONFIG_CHECK+=" ~DEBUG_FS"
+			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
+
+			# Now do the actual checks setup above
+			check_extra_config
+		fi
+	fi
+
+	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
+		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
+		eerror "instances are still pointing to it.  Please update your"
+		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
+		eerror "and the right system binary (e.g. qemu-system-x86_64)."
+		die "update your virt configs to not use qemu-kvm"
+	fi
+}
+
+# Sanity check to make sure target lists are kept up-to-date.
+check_targets() {
+	local var=$1 mak=$2
+	local detected sorted
+
+	pushd "${S}"/configs/targets/ >/dev/null || die
+
+	# Force C locale until glibc is updated. #564936
+	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
+	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
+	if [[ ${sorted} != "${detected}" ]] ; then
+		eerror "The ebuild needs to be kept in sync."
+		eerror "${var}: ${sorted}"
+		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
+		die "sync ${var} to the list of targets"
+	fi
+
+	popd >/dev/null
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		for file in ${A}; do
+			unpack "${file}"
+		done
+		cd "${WORKDIR}" || die
+		for proj in "${!SUBPROJECTS[@]}"; do
+			mv "${proj}-${SUBPROJECTS[${proj}]}" "${S}/subprojects/${proj}" || die
+		done
+		cd "${S}" || die
+		meson subprojects packagefiles --apply || die
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	check_targets IUSE_SOFTMMU_TARGETS softmmu
+	check_targets IUSE_USER_TARGETS linux-user
+
+	default
+
+	# Use correct toolchain to fix cross-compiling
+	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
+	export WINDRES=${CHOST}-windres
+
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		cat >> "${S}"/configs/meson/linux.txt <<-EOF || die
+		[binaries]
+		dtrace='stap-dtrace'
+		EOF
+	fi
+
+	# Verbose builds
+	MAKEOPTS+=" V=1"
+
+	# Remove bundled modules
+	rm -r roms/*/ || die
+}
+
+##
+# configures qemu based on the build directory and the build type
+# we are using.
+#
+qemu_src_configure() {
+	debug-print-function ${FUNCNAME} "$@"
+
+	local buildtype=$1
+	local builddir="${S}/${buildtype}-build"
+
+	mkdir "${builddir}" || die
+
+	local conf_opts=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--bindir=/usr/bin
+		--libdir=/usr/$(get_libdir)
+		--datadir=/usr/share
+		--docdir=/usr/share/doc/${PF}/html
+		--mandir=/usr/share/man
+		--localstatedir=/var
+		--disable-bsd-user
+		--disable-containers # bug #732972
+		--disable-guest-agent
+		--disable-strip
+		--disable-download
+
+		# bug #746752: TCG interpreter has a few limitations:
+		# - it does not support FPU
+		# - it's generally slower on non-self-modifying code
+		# It's advantage is support for host architectures
+		# where native codegeneration is not implemented.
+		# Gentoo has qemu keyworded only on targets with
+		# native code generation available. Avoid the interpreter.
+		--disable-tcg-interpreter
+
+		--disable-werror
+		# We support gnutls/nettle for crypto operations.  It is possible
+		# to use gcrypt when gnutls/nettle are disabled (but not when they
+		# are enabled), but it's not really worth the hassle.  Disable it
+		# all the time to avoid automatically detecting it. #568856
+		--disable-gcrypt
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--objcc="$(tc-getCC)"
+		--host-cc="$(tc-getBUILD_CC)"
+
+		$(use_enable alsa)
+		$(use_enable debug debug-info)
+		$(use_enable debug debug-tcg)
+		$(use_enable jack)
+		$(use_enable nls gettext)
+		$(use_enable oss)
+		$(use_enable pipewire)
+		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
+		$(use_enable xattr attr)
+	)
+
+	# Disable options not used by user targets. This simplifies building
+	# static user targets (USE=static-user) considerably.
+	conf_notuser() {
+		if [[ ${buildtype} == "user" ]] ; then
+			echo "--disable-${2:-$1}"
+		else
+			use_enable "$@"
+		fi
+	}
+	# Enable option only for softmmu build, but not 'user' or 'tools'
+	conf_softmmu() {
+		if [[ ${buildtype} == "softmmu" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Enable option only for tools build, but not 'user' or 'softmmu'
+	conf_tools() {
+		if [[ ${buildtype} == "tools" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
+	conf_opts+=(
+		$(conf_notuser accessibility brlapi)
+		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
+		$(conf_notuser bzip2)
+		$(conf_notuser capstone)
+		$(conf_notuser curl)
+		$(conf_tools doc docs)
+		$(conf_notuser fdt)
+		$(conf_notuser fuse)
+		$(conf_notuser glusterfs)
+		$(conf_notuser gnutls)
+		$(conf_notuser gnutls nettle)
+		$(conf_notuser gtk)
+		$(conf_notuser infiniband rdma)
+		$(conf_notuser iscsi libiscsi)
+		$(conf_notuser io-uring linux-io-uring)
+		$(conf_malloc jemalloc)
+		$(conf_notuser jpeg vnc-jpeg)
+		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser keyutils libkeyutils)
+		$(conf_notuser lzo)
+		$(conf_notuser multipath mpath)
+		$(conf_notuser ncurses curses)
+		$(conf_notuser nfs libnfs)
+		$(conf_notuser numa)
+		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
+		$(conf_notuser png)
+		$(conf_notuser rbd)
+		$(conf_notuser sasl vnc-sasl)
+		$(conf_notuser sdl)
+		$(conf_softmmu sdl-image)
+		$(conf_notuser seccomp)
+		$(conf_notuser slirp)
+		$(conf_notuser smartcard)
+		$(conf_notuser snappy)
+		$(conf_notuser spice)
+		$(conf_notuser ssh libssh)
+		$(conf_notuser udev libudev)
+		$(conf_notuser usb libusb)
+		$(conf_notuser usbredir usb-redir)
+		$(conf_notuser vde)
+		$(conf_notuser vhost-net)
+		$(conf_notuser virgl virglrenderer)
+		$(conf_softmmu virtfs)
+		$(conf_notuser vnc)
+		$(conf_notuser vte)
+		$(conf_notuser xen)
+		$(conf_notuser xen xen-pci-passthrough)
+		# use prebuilt keymaps, bug #759604
+		--disable-xkbcommon
+		$(conf_notuser zstd)
+	)
+
+	if [[ ! ${buildtype} == "user" ]] ; then
+		# audio options
+		local audio_opts=(
+			# Note: backend order matters here: #716202
+			# We iterate from higher-level to lower level.
+			$(usex pulseaudio pa "")
+			$(usev pipewire)
+			$(usev jack)
+			$(usev sdl)
+			$(usev alsa)
+			$(usev oss)
+		)
+		conf_opts+=(
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
+		)
+	fi
+
+	case ${buildtype} in
+	user)
+		conf_opts+=(
+			--enable-linux-user
+			--disable-system
+			--disable-tools
+			--disable-cap-ng
+			--disable-seccomp
+		)
+		local static_flag="static-user"
+		;;
+	softmmu)
+		conf_opts+=(
+			--disable-linux-user
+			--enable-system
+			--disable-tools
+			--enable-cap-ng
+			--enable-seccomp
+		)
+		local static_flag="none"
+		;;
+	tools)
+		conf_opts+=(
+			--disable-linux-user
+			--disable-system
+			--enable-tools
+			--enable-cap-ng
+		)
+		local static_flag="none"
+		;;
+	esac
+
+	local targets="${buildtype}_targets"
+	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
+
+	# Add support for SystemTap
+	use systemtap && conf_opts+=( --enable-trace-backends="dtrace" )
+
+	# We always want to attempt to build with PIE support as it results
+	# in a more secure binary. But it doesn't work with static or if
+	# the current GCC doesn't have PIE support.
+	if [[ ${static_flag} != "none" ]] && use ${static_flag}; then
+		conf_opts+=( --static --disable-pie )
+	else
+		tc-enables-pie && conf_opts+=( --enable-pie )
+	fi
+
+	# Meson will not use a cross-file unless cross_prefix is set.
+	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
+
+	# Plumb through equivalent of EXTRA_ECONF to allow experiments
+	# like bug #747928.
+	conf_opts+=( ${EXTRA_CONF_QEMU} )
+
+	echo "../configure ${conf_opts[*]}"
+	cd "${builddir}"
+	../configure "${conf_opts[@]}" || die "configure failed"
+}
+
+src_configure() {
+	local target
+
+	python_setup
+
+	softmmu_targets= softmmu_bins=()
+	user_targets= user_bins=()
+
+	for target in ${IUSE_SOFTMMU_TARGETS} ; do
+		if use "qemu_softmmu_targets_${target}"; then
+			softmmu_targets+=",${target}-softmmu"
+			softmmu_bins+=( "qemu-system-${target}" )
+		fi
+	done
+
+	for target in ${IUSE_USER_TARGETS} ; do
+		if use "qemu_user_targets_${target}"; then
+			user_targets+=",${target}-linux-user"
+			user_bins+=( "qemu-${target}" )
+		fi
+	done
+
+	softmmu_targets=${softmmu_targets#,}
+	user_targets=${user_targets#,}
+
+	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
+	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
+	qemu_src_configure "tools"
+}
+
+src_compile() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build" || die
+		default
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		default
+	fi
+
+	cd "${S}/tools-build" || die
+	default
+}
+
+src_test() {
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		pax-mark m */qemu-system-* #515550
+		emake check
+	fi
+}
+
+qemu_python_install() {
+	python_domodule "${S}/python/qemu"
+
+	python_doscript "${S}/scripts/kvm/vmxcap"
+	python_doscript "${S}/scripts/qmp/qmp-shell"
+	python_doscript "${S}/scripts/qmp/qemu-ga-client"
+}
+
+# Generate binfmt support files.
+#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
+#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
+generate_initd() {
+	local out="${T}/qemu-binfmt"
+	local out_systemd="${T}/qemu.conf"
+	local d="${T}/binfmt.d"
+
+	einfo "Generating qemu binfmt scripts and configuration files"
+
+	# Generate the debian fragments first.
+	mkdir -p "${d}"
+	"${S}"/scripts/qemu-binfmt-conf.sh \
+		--debian \
+		--exportdir "${d}" \
+		--qemu-path "${EPREFIX}/usr/bin" \
+		|| die
+	# Then turn the fragments into a shell script we can source.
+	sed -E -i \
+		-e 's:^([^ ]+) (.*)$:\1="\2":' \
+		"${d}"/* || die
+
+	# Generate the init.d script by assembling the fragments from above.
+	local f qcpu package interpreter magic mask
+	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
+	for f in "${d}"/qemu-* ; do
+		source "${f}"
+
+		# Normalize the cpu logic like we do in the init.d for the native cpu.
+		qcpu=${package#qemu-}
+		case ${qcpu} in
+		arm*)   qcpu="arm";;
+		mips*)  qcpu="mips";;
+		ppc*)   qcpu="ppc";;
+		s390*)  qcpu="s390";;
+		sh*)    qcpu="sh";;
+		sparc*) qcpu="sparc";;
+		esac
+
+		# we use 'printf' here to be portable across 'sh'
+		# implementations: #679168
+		cat <<EOF >>"${out}"
+	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
+		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
+	fi
+EOF
+
+		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
+
+	done
+	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
+}
+
+src_install() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		emake DESTDIR="${ED}" install
+
+		# Install binfmt handler init script for user targets.
+		generate_initd
+		doinitd "${T}/qemu-binfmt"
+
+		# Install binfmt/qemu.conf.
+		insinto "/usr/share/qemu/binfmt.d"
+		doins "${T}/qemu.conf"
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		emake DESTDIR="${ED}" install
+
+		# This might not exist if the test failed. #512010
+		[[ -e check-report.html ]] && dodoc check-report.html
+
+		if use kernel_linux; then
+			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
+		fi
+
+		if use python; then
+			python_foreach_impl qemu_python_install
+		fi
+	fi
+
+	cd "${S}/tools-build" || die
+	emake DESTDIR="${ED}" install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
+	fi
+
+	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
+	pushd "${ED}"/usr/bin >/dev/null || die
+	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
+	popd >/dev/null || die
+
+	# Install config file example for qemu-bridge-helper
+	insinto "/etc/qemu"
+	doins "${FILESDIR}/bridge.conf"
+
+	cd "${S}" || die
+	dodoc MAINTAINERS
+	newdoc pc-bios/README README.pc-bios
+
+	# Disallow stripping of prebuilt firmware files.
+	dostrip -x ${QA_PREBUILT}
+
+	if [[ -n ${softmmu_targets} ]]; then
+		# Remove SeaBIOS since we're using the SeaBIOS packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
+		fi
+
+		# Remove vgabios since we're using the seavgabios packaged one
+		rm "${ED}/usr/share/qemu/vgabios.bin"
+		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
+		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
+		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
+		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
+		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
+
+		# PPC/PPC64 loads vgabios-stdvga
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
+			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
+			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
+			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
+			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
+			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
+			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
+		fi
+
+		# Remove sgabios since we're using the sgabios packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
+		fi
+
+		# Remove iPXE since we're using the iPXE packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
+			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
+			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
+			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
+			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
+			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
+		fi
+	fi
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+firmware_abi_change() {
+	local pv
+	for pv in ${REPLACING_VERSIONS}; do
+		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
+			return 0
+		fi
+	done
+	return 1
+}
+
+pkg_postinst() {
+	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
+		udev_reload
+	fi
+
+	xdg_icon_cache_update
+
+	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
+		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_print_elog
+
+	if use pin-upstream-blobs && firmware_abi_change; then
+		ewarn "This version of qemu pins new versions of firmware blobs:"
+
+		if has_version 'sys-firmware/edk2-ovmf-bin'; then
+			ewarn "	$(best_version sys-firmware/edk2-ovmf-bin)"
+		else
+			ewarn " $(best_version sys-firmware/edk2-ovmf)"
+		fi
+
+		if has_version 'sys-firmware/seabios-bin'; then
+			ewarn "	$(best_version sys-firmware/seabios-bin)"
+		else
+			ewarn " $(best_version sys-firmware/seabios)"
+		fi
+
+		ewarn "	$(best_version sys-firmware/ipxe)"
+		ewarn "	$(best_version sys-firmware/sgabios)"
+		ewarn "This might break resume of hibernated guests (started with a different"
+		ewarn "firmware version) and live migration to/from qemu versions with different"
+		ewarn "firmware. Please (cold) restart all running guests. For functional"
+		ewarn "guest migration ensure that all"
+		ewarn "hosts run at least"
+		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
+	fi
+}
+
+pkg_info() {
+	echo "Using:"
+	echo "  $(best_version app-emulation/spice-protocol)"
+
+	if has_version 'sys-firmware/edk2-ovmf-bin'; then
+		echo "  $(best_version sys-firmware/edk2-ovmf-bin)"
+	else
+		echo "  $(best_version sys-firmware/edk2-ovmf)"
+	fi
+
+	if has_version 'sys-firmware/seabios-bin'; then
+		echo "  $(best_version sys-firmware/seabios-bin)"
+	else
+		echo "  $(best_version sys-firmware/seabios)"
+	fi
+
+	echo "  $(best_version sys-firmware/ipxe)"
+	echo "  $(best_version sys-firmware/sgabios)"
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.0.2-r2.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.0.2-r2.ebuild
new file mode 100644
index 00000000000..2506c1cb610
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.0.2-r2.ebuild
@@ -0,0 +1,1007 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
+QEMU_DOCS_PREBUILT_DEV=sam
+QEMU_DOCS_VERSION=$(ver_cut 1-2).0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# bug #830088
+QEMU_DOC_USEFLAG="+doc"
+
+PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_REQ_USE="ncurses,readline"
+
+FIRMWARE_ABI_VERSION="7.2.0"
+
+inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
+		pax-utils xdg-utils
+
+if [[ ${PV} == *9999* ]]; then
+	QEMU_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
+	EGIT_SUBMODULES=()
+	inherit git-r3
+	SRC_URI=""
+	declare -A SUBPROJECTS=(
+		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
+		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
+		[berkeley-testfloat-3]="e7af9751d9f9fd3b47911f51a5cfd08af256a9ab"
+	)
+
+	for proj in "${!SUBPROJECTS[@]}"; do
+		c=${SUBPROJECTS[${proj}]}
+		SRC_URI+=" https://gitlab.com/qemu-project/${proj}/-/archive/${c}/${proj}-${c}.tar.bz2"
+	done
+else
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+
+	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
+HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
+
+LICENSE="GPL-2 LGPL-2 BSD-2"
+SLOT="0"
+
+[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
+
+IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg keyutils
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs pipewire
+	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
+	+slirp
+	smartcard snappy spice ssh static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xdp xen
+	zstd"
+
+COMMON_TARGETS="
+	aarch64
+	alpha
+	arm
+	cris
+	hppa
+	i386
+	loongarch64
+	m68k
+	microblaze
+	microblazeel
+	mips
+	mips64
+	mips64el
+	mipsel
+	nios2
+	or1k
+	ppc
+	ppc64
+	riscv32
+	riscv64
+	s390x
+	sh4
+	sh4eb
+	sparc
+	sparc64
+	x86_64
+	xtensa
+	xtensaeb
+"
+IUSE_SOFTMMU_TARGETS="
+	${COMMON_TARGETS}
+	avr
+	rx
+	tricore
+"
+IUSE_USER_TARGETS="
+	${COMMON_TARGETS}
+	aarch64_be
+	armeb
+	hexagon
+	mipsn32
+	mipsn32el
+	ppc64le
+	sparc32plus
+"
+
+use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
+use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
+IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
+
+RESTRICT="!test? ( test )"
+
+# Allow no targets to be built so that people can get a tools-only build.
+# Block USE flag configurations known to not work.
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	qemu_softmmu_targets_arm? ( fdt )
+	qemu_softmmu_targets_microblaze? ( fdt )
+	qemu_softmmu_targets_mips64el? ( fdt )
+	qemu_softmmu_targets_ppc64? ( fdt )
+	qemu_softmmu_targets_ppc? ( fdt )
+	qemu_softmmu_targets_riscv32? ( fdt )
+	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
+	sdl-image? ( sdl )
+	static-user? ( !plugins )
+	virgl? ( opengl )
+	virtfs? ( xattr )
+	vnc? ( gnutls )
+	vte? ( gtk )
+	multipath? ( udev )
+	plugins? ( !static-user )
+	xdp? ( bpf )
+"
+for smname in ${IUSE_SOFTMMU_TARGETS} ; do
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( kernel_linux? ( seccomp ) )"
+done
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# and user/softmmu targets (qemu-*, qemu-system-*).
+#
+# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
+#
+# The attr lib isn't always linked in (although the USE flag is always
+# respected).  This is because qemu supports using the C library's API
+# when available rather than always using the external library.
+ALL_DEPEND="
+	dev-libs/glib:2[static-libs(+)]
+	sys-libs/zlib[static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	systemtap? ( dev-debug/systemtap )
+	xattr? ( sys-apps/attr[static-libs(+)] )
+"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# softmmu targets (qemu-system-*).
+SOFTMMU_TOOLS_DEPEND="
+	>=x11-libs/pixman-0.28.0[static-libs(+)]
+	accessibility? (
+		app-accessibility/brltty[api]
+		app-accessibility/brltty[static-libs(+)]
+	)
+	aio? ( dev-libs/libaio[static-libs(+)] )
+	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
+	bzip2? ( app-arch/bzip2[static-libs(+)] )
+	capstone? ( dev-libs/capstone:=[static-libs(+)] )
+	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
+	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
+	gnutls? (
+		>=net-libs/gnutls-3.0:=[static-libs(+)]
+		dev-libs/nettle:=[static-libs(+)]
+	)
+	gtk? (
+		x11-libs/gtk+:3
+		vte? ( x11-libs/vte:2.91 )
+	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
+	iscsi? ( net-libs/libiscsi )
+	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
+	jack? ( virtual/jack )
+	jemalloc? ( dev-libs/jemalloc )
+	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	kernel_linux? ( sys-libs/libcap-ng[static-libs(+)] )
+	keyutils? ( sys-apps/keyutils[static-libs(+)] )
+	lzo? ( dev-libs/lzo:2[static-libs(+)] )
+	multipath? ( sys-fs/multipath-tools )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)]
+		sys-libs/ncurses:=[static-libs(+)]
+	)
+	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
+	numa? ( sys-process/numactl[static-libs(+)] )
+	opengl? (
+		virtual/opengl
+		media-libs/libepoxy[static-libs(+)]
+		media-libs/mesa[static-libs(+)]
+		media-libs/mesa[egl(+),gbm(+)]
+	)
+	pam? ( sys-libs/pam )
+	pipewire? ( >=media-video/pipewire-0.3.60 )
+	png? ( >=media-libs/libpng-1.6.34:=[static-libs(+)] )
+	pulseaudio? ( media-libs/libpulse )
+	rbd? ( sys-cluster/ceph )
+	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
+	sdl? (
+		media-libs/libsdl2[video]
+		media-libs/libsdl2[static-libs(+)]
+	)
+	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
+	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
+	slirp? ( net-libs/libslirp[static-libs(+)] )
+	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
+	snappy? ( app-arch/snappy:= )
+	spice? (
+		>=app-emulation/spice-protocol-0.14.0
+		>=app-emulation/spice-0.14.0[static-libs(+)]
+	)
+	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
+	udev? ( virtual/libudev:= )
+	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
+	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
+	vde? ( net-misc/vde[static-libs(+)] )
+	virgl? ( media-libs/virglrenderer[static-libs(+)] )
+	virtfs? ( sys-libs/libcap )
+	xdp? ( net-libs/xdp-tools )
+	xen? ( app-emulation/xen-tools:= )
+	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
+"
+
+EDK2_OVMF_VERSION="202202"
+SEABIOS_VERSION="1.16.3"
+
+X86_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		~sys-firmware/sgabios-0.1_pre10[binary]
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/edk2-ovmf-${EDK2_OVMF_VERSION}
+			>=sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		)
+		sys-firmware/ipxe[qemu]
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+		sys-firmware/sgabios
+	)
+"
+PPC_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+	)
+"
+
+# See bug #913084 for pip dep
+BDEPEND="
+	$(python_gen_impl_dep)
+	dev-lang/perl
+	>=dev-build/meson-0.63.0
+	app-alternatives/ninja
+	dev-python/pip[${PYTHON_USEDEP}]
+	virtual/pkgconfig
+	doc? (
+		>=dev-python/sphinx-1.6.0[${PYTHON_USEDEP}]
+		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+	)
+	gtk? ( nls? ( sys-devel/gettext ) )
+	test? (
+		dev-libs/glib[utils]
+		app-alternatives/bc
+	)
+"
+CDEPEND="
+	${ALL_DEPEND//\[static-libs(+)]}
+	${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
+	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
+"
+DEPEND="
+	${CDEPEND}
+	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
+	static-user? ( ${ALL_DEPEND} )
+"
+RDEPEND="
+	${CDEPEND}
+	acct-group/kvm
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-9.0.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-9.0.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-9.0.0-also-build-virtfs-proxy-helper.patch
+	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
+	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
+
+)
+
+QA_PREBUILT="
+	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/hppa-firmware64.img
+	usr/share/qemu/openbios-ppc
+	usr/share/qemu/openbios-sparc64
+	usr/share/qemu/openbios-sparc32
+	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
+	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
+	usr/share/qemu/palcode-clipper
+	usr/share/qemu/s390-ccw.img
+	usr/share/qemu/s390-netboot.img
+	usr/share/qemu/u-boot.e500
+"
+
+QA_WX_LOAD="
+	usr/bin/qemu-i386
+	usr/bin/qemu-x86_64
+	usr/bin/qemu-alpha
+	usr/bin/qemu-arm
+	usr/bin/qemu-cris
+	usr/bin/qemu-m68k
+	usr/bin/qemu-microblaze
+	usr/bin/qemu-microblazeel
+	usr/bin/qemu-mips
+	usr/bin/qemu-mipsel
+	usr/bin/qemu-or1k
+	usr/bin/qemu-ppc
+	usr/bin/qemu-ppc64
+	usr/bin/qemu-sh4
+	usr/bin/qemu-sh4eb
+	usr/bin/qemu-sparc
+	usr/bin/qemu-sparc64
+	usr/bin/qemu-armeb
+	usr/bin/qemu-sparc32plus
+	usr/bin/qemu-s390x
+	usr/bin/qemu-unicore32
+"
+
+DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
+kernel module loaded before running kvm. The easiest way to ensure that the
+kernel module is loaded is to load it on boot.
+	For AMD CPUs the module is called 'kvm-amd'.
+	For Intel CPUs the module is called 'kvm-intel'.
+Please review /etc/conf.d/modules for how to load these.
+
+Make sure your user is in the 'kvm' group. Just run
+	$ gpasswd -a <USER> kvm
+then have <USER> re-login.
+
+For brand new installs, the default permissions on /dev/kvm might not let
+you access it.  You can tell udev to reset ownership/perms:
+	$ udevadm trigger -c add /dev/kvm
+
+If you want to register binfmt handlers for qemu user targets:
+For openrc:
+	# rc-update add qemu-binfmt
+For systemd:
+	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
+
+pkg_pretend() {
+	if use kernel_linux && kernel_is lt 2 6 25; then
+		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
+	elif use kernel_linux; then
+		if ! linux_config_exists; then
+			eerror "Unable to check your kernel for KVM support"
+		else
+			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
+			ERROR_KVM="You must enable KVM in your kernel to continue"
+			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
+			ERROR_KVM_AMD+=" your kernel configuration."
+			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
+			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
+			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
+			ERROR_TUN+=" into your kernel or loaded as a module to use the"
+			ERROR_TUN+=" virtual network device if using -net tap."
+			ERROR_BRIDGE="You will also need support for 802.1d"
+			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
+			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
+			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
+			ERROR_VHOST_NET+=" support"
+			use test && CONFIG_CHECK+=" IP_MULTICAST"
+			ERROR_IP_MULTICAST="Test suite requires IP_MULTICAST"
+
+			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
+				if grep -q AuthenticAMD /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_AMD"
+				elif grep -q GenuineIntel /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_INTEL"
+				fi
+			fi
+
+			use python && CONFIG_CHECK+=" ~DEBUG_FS"
+			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
+
+			# Now do the actual checks setup above
+			check_extra_config
+		fi
+	fi
+
+	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
+		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
+		eerror "instances are still pointing to it.  Please update your"
+		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
+		eerror "and the right system binary (e.g. qemu-system-x86_64)."
+		die "update your virt configs to not use qemu-kvm"
+	fi
+}
+
+# Sanity check to make sure target lists are kept up-to-date.
+check_targets() {
+	local var=$1 mak=$2
+	local detected sorted
+
+	pushd "${S}"/configs/targets/ >/dev/null || die
+
+	# Force C locale until glibc is updated. #564936
+	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
+	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
+	if [[ ${sorted} != "${detected}" ]] ; then
+		eerror "The ebuild needs to be kept in sync."
+		eerror "${var}: ${sorted}"
+		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
+		die "sync ${var} to the list of targets"
+	fi
+
+	popd >/dev/null
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		for file in ${A}; do
+			unpack "${file}"
+		done
+		cd "${WORKDIR}" || die
+		for proj in "${!SUBPROJECTS[@]}"; do
+			mv "${proj}-${SUBPROJECTS[${proj}]}" "${S}/subprojects/${proj}" || die
+		done
+		cd "${S}" || die
+		meson subprojects packagefiles --apply || die
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	check_targets IUSE_SOFTMMU_TARGETS softmmu
+	check_targets IUSE_USER_TARGETS linux-user
+
+	default
+
+	# Use correct toolchain to fix cross-compiling
+	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
+	export WINDRES=${CHOST}-windres
+
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		cat >> "${S}"/configs/meson/linux.txt <<-EOF || die
+		[binaries]
+		dtrace='stap-dtrace'
+		EOF
+	fi
+
+	# Verbose builds
+	MAKEOPTS+=" V=1"
+
+	# Remove bundled modules
+	rm -r roms/*/ || die
+}
+
+##
+# configures qemu based on the build directory and the build type
+# we are using.
+#
+qemu_src_configure() {
+	debug-print-function ${FUNCNAME} "$@"
+
+	local buildtype=$1
+	local builddir="${S}/${buildtype}-build"
+
+	mkdir "${builddir}" || die
+
+	local conf_opts=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--bindir=/usr/bin
+		--libdir=/usr/$(get_libdir)
+		--datadir=/usr/share
+		--docdir=/usr/share/doc/${PF}/html
+		--mandir=/usr/share/man
+		--localstatedir=/var
+		--disable-bsd-user
+		--disable-containers # bug #732972
+		--disable-guest-agent
+		--disable-strip
+		--disable-download
+
+		# bug #746752: TCG interpreter has a few limitations:
+		# - it does not support FPU
+		# - it's generally slower on non-self-modifying code
+		# It's advantage is support for host architectures
+		# where native codegeneration is not implemented.
+		# Gentoo has qemu keyworded only on targets with
+		# native code generation available. Avoid the interpreter.
+		--disable-tcg-interpreter
+
+		--disable-werror
+		# We support gnutls/nettle for crypto operations.  It is possible
+		# to use gcrypt when gnutls/nettle are disabled (but not when they
+		# are enabled), but it's not really worth the hassle.  Disable it
+		# all the time to avoid automatically detecting it. #568856
+		--disable-gcrypt
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--objcc="$(tc-getCC)"
+		--host-cc="$(tc-getBUILD_CC)"
+
+		$(use_enable alsa)
+		$(use_enable debug debug-info)
+		$(use_enable debug debug-tcg)
+		$(use_enable jack)
+		$(use_enable nls gettext)
+		$(use_enable oss)
+		$(use_enable pipewire)
+		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
+		$(use_enable xattr attr)
+	)
+
+	# Disable options not used by user targets. This simplifies building
+	# static user targets (USE=static-user) considerably.
+	conf_notuser() {
+		if [[ ${buildtype} == "user" ]] ; then
+			echo "--disable-${2:-$1}"
+		else
+			use_enable "$@"
+		fi
+	}
+	# Enable option only for softmmu build, but not 'user' or 'tools'
+	conf_softmmu() {
+		if [[ ${buildtype} == "softmmu" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Enable option only for tools build, but not 'user' or 'softmmu'
+	conf_tools() {
+		if [[ ${buildtype} == "tools" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
+	conf_opts+=(
+		$(conf_notuser accessibility brlapi)
+		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
+		$(conf_notuser bzip2)
+		$(conf_notuser capstone)
+		$(conf_notuser curl)
+		$(conf_tools doc docs)
+		$(conf_notuser fdt)
+		$(conf_notuser fuse)
+		$(conf_notuser glusterfs)
+		$(conf_notuser gnutls)
+		$(conf_notuser gnutls nettle)
+		$(conf_notuser gtk)
+		$(conf_notuser infiniband rdma)
+		$(conf_notuser iscsi libiscsi)
+		$(conf_notuser io-uring linux-io-uring)
+		$(conf_malloc jemalloc)
+		$(conf_notuser jpeg vnc-jpeg)
+		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser keyutils libkeyutils)
+		$(conf_notuser lzo)
+		$(conf_notuser multipath mpath)
+		$(conf_notuser ncurses curses)
+		$(conf_notuser nfs libnfs)
+		$(conf_notuser numa)
+		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
+		$(conf_notuser png)
+		$(conf_notuser rbd)
+		$(conf_notuser sasl vnc-sasl)
+		$(conf_notuser sdl)
+		$(conf_softmmu sdl-image)
+		$(conf_notuser seccomp)
+		$(conf_notuser slirp)
+		$(conf_notuser smartcard)
+		$(conf_notuser snappy)
+		$(conf_notuser spice)
+		$(conf_notuser ssh libssh)
+		$(conf_notuser udev libudev)
+		$(conf_notuser usb libusb)
+		$(conf_notuser usbredir usb-redir)
+		$(conf_notuser vde)
+		$(conf_notuser vhost-net)
+		$(conf_notuser virgl virglrenderer)
+		$(conf_softmmu virtfs)
+		$(conf_notuser vnc)
+		$(conf_notuser vte)
+		$(conf_softmmu xdp af-xdp)
+		$(conf_notuser xen)
+		$(conf_notuser xen xen-pci-passthrough)
+		# use prebuilt keymaps, bug #759604
+		--disable-xkbcommon
+		$(conf_notuser zstd)
+	)
+
+	if [[ ! ${buildtype} == "user" ]] ; then
+		# audio options
+		local audio_opts=(
+			# Note: backend order matters here: #716202
+			# We iterate from higher-level to lower level.
+			$(usex pulseaudio pa "")
+			$(usev pipewire)
+			$(usev jack)
+			$(usev sdl)
+			$(usev alsa)
+			$(usev oss)
+		)
+		conf_opts+=(
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
+		)
+	fi
+
+	case ${buildtype} in
+	user)
+		conf_opts+=(
+			--enable-linux-user
+			--disable-system
+			--disable-tools
+			--disable-cap-ng
+			--disable-seccomp
+		)
+		local static_flag="static-user"
+		;;
+	softmmu)
+		conf_opts+=(
+			--disable-linux-user
+			--enable-system
+			--disable-tools
+			--enable-cap-ng
+			--enable-seccomp
+		)
+		local static_flag="none"
+		;;
+	tools)
+		conf_opts+=(
+			--disable-linux-user
+			--disable-system
+			--enable-tools
+			--enable-cap-ng
+		)
+		local static_flag="none"
+		;;
+	esac
+
+	local targets="${buildtype}_targets"
+	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
+
+	# Add support for SystemTap
+	use systemtap && conf_opts+=( --enable-trace-backends="dtrace" )
+
+	# We always want to attempt to build with PIE support as it results
+	# in a more secure binary. But it doesn't work with static or if
+	# the current GCC doesn't have PIE support.
+	if [[ ${static_flag} != "none" ]] && use ${static_flag}; then
+		conf_opts+=( --static --disable-pie )
+	else
+		tc-enables-pie && conf_opts+=( --enable-pie )
+	fi
+
+	# Meson will not use a cross-file unless cross_prefix is set.
+	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
+
+	# Plumb through equivalent of EXTRA_ECONF to allow experiments
+	# like bug #747928.
+	conf_opts+=( ${EXTRA_CONF_QEMU} )
+
+	echo "../configure ${conf_opts[*]}"
+	cd "${builddir}"
+	../configure "${conf_opts[@]}" || die "configure failed"
+}
+
+src_configure() {
+	local target
+
+	python_setup
+
+	softmmu_targets= softmmu_bins=()
+	user_targets= user_bins=()
+
+	for target in ${IUSE_SOFTMMU_TARGETS} ; do
+		if use "qemu_softmmu_targets_${target}"; then
+			softmmu_targets+=",${target}-softmmu"
+			softmmu_bins+=( "qemu-system-${target}" )
+		fi
+	done
+
+	for target in ${IUSE_USER_TARGETS} ; do
+		if use "qemu_user_targets_${target}"; then
+			user_targets+=",${target}-linux-user"
+			user_bins+=( "qemu-${target}" )
+		fi
+	done
+
+	softmmu_targets=${softmmu_targets#,}
+	user_targets=${user_targets#,}
+
+	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
+	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
+	qemu_src_configure "tools"
+}
+
+src_compile() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build" || die
+		default
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		default
+	fi
+
+	cd "${S}/tools-build" || die
+	default
+}
+
+src_test() {
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		pax-mark m */qemu-system-* #515550
+		emake check
+	fi
+}
+
+qemu_python_install() {
+	python_domodule "${S}/python/qemu"
+
+	python_doscript "${S}/scripts/kvm/vmxcap"
+	python_doscript "${S}/scripts/qmp/qmp-shell"
+	python_doscript "${S}/scripts/qmp/qemu-ga-client"
+}
+
+# Generate binfmt support files.
+#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
+#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
+generate_initd() {
+	local out="${T}/qemu-binfmt"
+	local out_systemd="${T}/qemu.conf"
+	local d="${T}/binfmt.d"
+
+	einfo "Generating qemu binfmt scripts and configuration files"
+
+	# Generate the debian fragments first.
+	mkdir -p "${d}"
+	"${S}"/scripts/qemu-binfmt-conf.sh \
+		--debian \
+		--exportdir "${d}" \
+		--qemu-path "${EPREFIX}/usr/bin" \
+		|| die
+	# Then turn the fragments into a shell script we can source.
+	sed -E -i \
+		-e 's:^([^ ]+) (.*)$:\1="\2":' \
+		"${d}"/* || die
+
+	# Generate the init.d script by assembling the fragments from above.
+	local f qcpu package interpreter magic mask
+	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
+	for f in "${d}"/qemu-* ; do
+		source "${f}"
+
+		# Normalize the cpu logic like we do in the init.d for the native cpu.
+		qcpu=${package#qemu-}
+		case ${qcpu} in
+		arm*)   qcpu="arm";;
+		mips*)  qcpu="mips";;
+		ppc*)   qcpu="ppc";;
+		s390*)  qcpu="s390";;
+		sh*)    qcpu="sh";;
+		sparc*) qcpu="sparc";;
+		esac
+
+		# we use 'printf' here to be portable across 'sh'
+		# implementations: #679168
+		cat <<EOF >>"${out}"
+	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
+		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
+	fi
+EOF
+
+		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
+
+	done
+	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
+}
+
+src_install() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		emake DESTDIR="${ED}" install
+
+		# Install binfmt handler init script for user targets.
+		generate_initd
+		doinitd "${T}/qemu-binfmt"
+
+		# Install binfmt/qemu.conf.
+		insinto "/usr/share/qemu/binfmt.d"
+		doins "${T}/qemu.conf"
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		emake DESTDIR="${ED}" install
+
+		# This might not exist if the test failed. #512010
+		[[ -e check-report.html ]] && dodoc check-report.html
+
+		if use kernel_linux; then
+			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
+		fi
+
+		if use python; then
+			python_foreach_impl qemu_python_install
+		fi
+	fi
+
+	cd "${S}/tools-build" || die
+	emake DESTDIR="${ED}" install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
+	fi
+
+	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
+	pushd "${ED}"/usr/bin >/dev/null || die
+	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
+	popd >/dev/null || die
+
+	# Install config file example for qemu-bridge-helper
+	insinto "/etc/qemu"
+	doins "${FILESDIR}/bridge.conf"
+
+	cd "${S}" || die
+	dodoc MAINTAINERS
+	newdoc pc-bios/README README.pc-bios
+
+	# Disallow stripping of prebuilt firmware files.
+	dostrip -x ${QA_PREBUILT}
+
+	if [[ -n ${softmmu_targets} ]]; then
+		# Remove SeaBIOS since we're using the SeaBIOS packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
+		fi
+
+		# Remove vgabios since we're using the seavgabios packaged one
+		rm "${ED}/usr/share/qemu/vgabios.bin"
+		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
+		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
+		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
+		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
+		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
+
+		# PPC/PPC64 loads vgabios-stdvga
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
+			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
+			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
+			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
+			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
+			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
+			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
+		fi
+
+		# Remove sgabios since we're using the sgabios packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
+		fi
+
+		# Remove iPXE since we're using the iPXE packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
+			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
+			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
+			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
+			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
+			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
+		fi
+	fi
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+firmware_abi_change() {
+	local pv
+	for pv in ${REPLACING_VERSIONS}; do
+		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
+			return 0
+		fi
+	done
+	return 1
+}
+
+pkg_postinst() {
+	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
+		udev_reload
+	fi
+
+	xdg_icon_cache_update
+
+	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
+		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_print_elog
+
+	if use pin-upstream-blobs && firmware_abi_change; then
+		ewarn "This version of qemu pins new versions of firmware blobs:"
+
+		if has_version 'sys-firmware/edk2-ovmf-bin'; then
+			ewarn "	$(best_version sys-firmware/edk2-ovmf-bin)"
+		else
+			ewarn " $(best_version sys-firmware/edk2-ovmf)"
+		fi
+
+		if has_version 'sys-firmware/seabios-bin'; then
+			ewarn "	$(best_version sys-firmware/seabios-bin)"
+		else
+			ewarn " $(best_version sys-firmware/seabios)"
+		fi
+
+		ewarn "	$(best_version sys-firmware/ipxe)"
+		ewarn "	$(best_version sys-firmware/sgabios)"
+		ewarn "This might break resume of hibernated guests (started with a different"
+		ewarn "firmware version) and live migration to/from qemu versions with different"
+		ewarn "firmware. Please (cold) restart all running guests. For functional"
+		ewarn "guest migration ensure that all"
+		ewarn "hosts run at least"
+		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
+	fi
+}
+
+pkg_info() {
+	echo "Using:"
+	echo "  $(best_version app-emulation/spice-protocol)"
+
+	if has_version 'sys-firmware/edk2-ovmf-bin'; then
+		echo "  $(best_version sys-firmware/edk2-ovmf-bin)"
+	else
+		echo "  $(best_version sys-firmware/edk2-ovmf)"
+	fi
+
+	if has_version 'sys-firmware/seabios-bin'; then
+		echo "  $(best_version sys-firmware/seabios-bin)"
+	else
+		echo "  $(best_version sys-firmware/seabios)"
+	fi
+
+	echo "  $(best_version sys-firmware/ipxe)"
+	echo "  $(best_version sys-firmware/sgabios)"
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.0.3.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.0.3.ebuild
new file mode 100644
index 00000000000..2506c1cb610
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.0.3.ebuild
@@ -0,0 +1,1007 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
+QEMU_DOCS_PREBUILT_DEV=sam
+QEMU_DOCS_VERSION=$(ver_cut 1-2).0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# bug #830088
+QEMU_DOC_USEFLAG="+doc"
+
+PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_REQ_USE="ncurses,readline"
+
+FIRMWARE_ABI_VERSION="7.2.0"
+
+inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
+		pax-utils xdg-utils
+
+if [[ ${PV} == *9999* ]]; then
+	QEMU_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
+	EGIT_SUBMODULES=()
+	inherit git-r3
+	SRC_URI=""
+	declare -A SUBPROJECTS=(
+		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
+		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
+		[berkeley-testfloat-3]="e7af9751d9f9fd3b47911f51a5cfd08af256a9ab"
+	)
+
+	for proj in "${!SUBPROJECTS[@]}"; do
+		c=${SUBPROJECTS[${proj}]}
+		SRC_URI+=" https://gitlab.com/qemu-project/${proj}/-/archive/${c}/${proj}-${c}.tar.bz2"
+	done
+else
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+
+	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
+HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
+
+LICENSE="GPL-2 LGPL-2 BSD-2"
+SLOT="0"
+
+[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
+
+IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg keyutils
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs pipewire
+	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
+	+slirp
+	smartcard snappy spice ssh static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xdp xen
+	zstd"
+
+COMMON_TARGETS="
+	aarch64
+	alpha
+	arm
+	cris
+	hppa
+	i386
+	loongarch64
+	m68k
+	microblaze
+	microblazeel
+	mips
+	mips64
+	mips64el
+	mipsel
+	nios2
+	or1k
+	ppc
+	ppc64
+	riscv32
+	riscv64
+	s390x
+	sh4
+	sh4eb
+	sparc
+	sparc64
+	x86_64
+	xtensa
+	xtensaeb
+"
+IUSE_SOFTMMU_TARGETS="
+	${COMMON_TARGETS}
+	avr
+	rx
+	tricore
+"
+IUSE_USER_TARGETS="
+	${COMMON_TARGETS}
+	aarch64_be
+	armeb
+	hexagon
+	mipsn32
+	mipsn32el
+	ppc64le
+	sparc32plus
+"
+
+use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
+use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
+IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
+
+RESTRICT="!test? ( test )"
+
+# Allow no targets to be built so that people can get a tools-only build.
+# Block USE flag configurations known to not work.
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	qemu_softmmu_targets_arm? ( fdt )
+	qemu_softmmu_targets_microblaze? ( fdt )
+	qemu_softmmu_targets_mips64el? ( fdt )
+	qemu_softmmu_targets_ppc64? ( fdt )
+	qemu_softmmu_targets_ppc? ( fdt )
+	qemu_softmmu_targets_riscv32? ( fdt )
+	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
+	sdl-image? ( sdl )
+	static-user? ( !plugins )
+	virgl? ( opengl )
+	virtfs? ( xattr )
+	vnc? ( gnutls )
+	vte? ( gtk )
+	multipath? ( udev )
+	plugins? ( !static-user )
+	xdp? ( bpf )
+"
+for smname in ${IUSE_SOFTMMU_TARGETS} ; do
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( kernel_linux? ( seccomp ) )"
+done
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# and user/softmmu targets (qemu-*, qemu-system-*).
+#
+# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
+#
+# The attr lib isn't always linked in (although the USE flag is always
+# respected).  This is because qemu supports using the C library's API
+# when available rather than always using the external library.
+ALL_DEPEND="
+	dev-libs/glib:2[static-libs(+)]
+	sys-libs/zlib[static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	systemtap? ( dev-debug/systemtap )
+	xattr? ( sys-apps/attr[static-libs(+)] )
+"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# softmmu targets (qemu-system-*).
+SOFTMMU_TOOLS_DEPEND="
+	>=x11-libs/pixman-0.28.0[static-libs(+)]
+	accessibility? (
+		app-accessibility/brltty[api]
+		app-accessibility/brltty[static-libs(+)]
+	)
+	aio? ( dev-libs/libaio[static-libs(+)] )
+	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
+	bzip2? ( app-arch/bzip2[static-libs(+)] )
+	capstone? ( dev-libs/capstone:=[static-libs(+)] )
+	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
+	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
+	gnutls? (
+		>=net-libs/gnutls-3.0:=[static-libs(+)]
+		dev-libs/nettle:=[static-libs(+)]
+	)
+	gtk? (
+		x11-libs/gtk+:3
+		vte? ( x11-libs/vte:2.91 )
+	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
+	iscsi? ( net-libs/libiscsi )
+	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
+	jack? ( virtual/jack )
+	jemalloc? ( dev-libs/jemalloc )
+	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	kernel_linux? ( sys-libs/libcap-ng[static-libs(+)] )
+	keyutils? ( sys-apps/keyutils[static-libs(+)] )
+	lzo? ( dev-libs/lzo:2[static-libs(+)] )
+	multipath? ( sys-fs/multipath-tools )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)]
+		sys-libs/ncurses:=[static-libs(+)]
+	)
+	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
+	numa? ( sys-process/numactl[static-libs(+)] )
+	opengl? (
+		virtual/opengl
+		media-libs/libepoxy[static-libs(+)]
+		media-libs/mesa[static-libs(+)]
+		media-libs/mesa[egl(+),gbm(+)]
+	)
+	pam? ( sys-libs/pam )
+	pipewire? ( >=media-video/pipewire-0.3.60 )
+	png? ( >=media-libs/libpng-1.6.34:=[static-libs(+)] )
+	pulseaudio? ( media-libs/libpulse )
+	rbd? ( sys-cluster/ceph )
+	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
+	sdl? (
+		media-libs/libsdl2[video]
+		media-libs/libsdl2[static-libs(+)]
+	)
+	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
+	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
+	slirp? ( net-libs/libslirp[static-libs(+)] )
+	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
+	snappy? ( app-arch/snappy:= )
+	spice? (
+		>=app-emulation/spice-protocol-0.14.0
+		>=app-emulation/spice-0.14.0[static-libs(+)]
+	)
+	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
+	udev? ( virtual/libudev:= )
+	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
+	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
+	vde? ( net-misc/vde[static-libs(+)] )
+	virgl? ( media-libs/virglrenderer[static-libs(+)] )
+	virtfs? ( sys-libs/libcap )
+	xdp? ( net-libs/xdp-tools )
+	xen? ( app-emulation/xen-tools:= )
+	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
+"
+
+EDK2_OVMF_VERSION="202202"
+SEABIOS_VERSION="1.16.3"
+
+X86_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		~sys-firmware/sgabios-0.1_pre10[binary]
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/edk2-ovmf-${EDK2_OVMF_VERSION}
+			>=sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		)
+		sys-firmware/ipxe[qemu]
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+		sys-firmware/sgabios
+	)
+"
+PPC_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+	)
+"
+
+# See bug #913084 for pip dep
+BDEPEND="
+	$(python_gen_impl_dep)
+	dev-lang/perl
+	>=dev-build/meson-0.63.0
+	app-alternatives/ninja
+	dev-python/pip[${PYTHON_USEDEP}]
+	virtual/pkgconfig
+	doc? (
+		>=dev-python/sphinx-1.6.0[${PYTHON_USEDEP}]
+		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+	)
+	gtk? ( nls? ( sys-devel/gettext ) )
+	test? (
+		dev-libs/glib[utils]
+		app-alternatives/bc
+	)
+"
+CDEPEND="
+	${ALL_DEPEND//\[static-libs(+)]}
+	${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
+	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
+"
+DEPEND="
+	${CDEPEND}
+	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
+	static-user? ( ${ALL_DEPEND} )
+"
+RDEPEND="
+	${CDEPEND}
+	acct-group/kvm
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-9.0.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-9.0.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-9.0.0-also-build-virtfs-proxy-helper.patch
+	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
+	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
+
+)
+
+QA_PREBUILT="
+	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/hppa-firmware64.img
+	usr/share/qemu/openbios-ppc
+	usr/share/qemu/openbios-sparc64
+	usr/share/qemu/openbios-sparc32
+	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
+	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
+	usr/share/qemu/palcode-clipper
+	usr/share/qemu/s390-ccw.img
+	usr/share/qemu/s390-netboot.img
+	usr/share/qemu/u-boot.e500
+"
+
+QA_WX_LOAD="
+	usr/bin/qemu-i386
+	usr/bin/qemu-x86_64
+	usr/bin/qemu-alpha
+	usr/bin/qemu-arm
+	usr/bin/qemu-cris
+	usr/bin/qemu-m68k
+	usr/bin/qemu-microblaze
+	usr/bin/qemu-microblazeel
+	usr/bin/qemu-mips
+	usr/bin/qemu-mipsel
+	usr/bin/qemu-or1k
+	usr/bin/qemu-ppc
+	usr/bin/qemu-ppc64
+	usr/bin/qemu-sh4
+	usr/bin/qemu-sh4eb
+	usr/bin/qemu-sparc
+	usr/bin/qemu-sparc64
+	usr/bin/qemu-armeb
+	usr/bin/qemu-sparc32plus
+	usr/bin/qemu-s390x
+	usr/bin/qemu-unicore32
+"
+
+DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
+kernel module loaded before running kvm. The easiest way to ensure that the
+kernel module is loaded is to load it on boot.
+	For AMD CPUs the module is called 'kvm-amd'.
+	For Intel CPUs the module is called 'kvm-intel'.
+Please review /etc/conf.d/modules for how to load these.
+
+Make sure your user is in the 'kvm' group. Just run
+	$ gpasswd -a <USER> kvm
+then have <USER> re-login.
+
+For brand new installs, the default permissions on /dev/kvm might not let
+you access it.  You can tell udev to reset ownership/perms:
+	$ udevadm trigger -c add /dev/kvm
+
+If you want to register binfmt handlers for qemu user targets:
+For openrc:
+	# rc-update add qemu-binfmt
+For systemd:
+	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
+
+pkg_pretend() {
+	if use kernel_linux && kernel_is lt 2 6 25; then
+		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
+	elif use kernel_linux; then
+		if ! linux_config_exists; then
+			eerror "Unable to check your kernel for KVM support"
+		else
+			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
+			ERROR_KVM="You must enable KVM in your kernel to continue"
+			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
+			ERROR_KVM_AMD+=" your kernel configuration."
+			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
+			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
+			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
+			ERROR_TUN+=" into your kernel or loaded as a module to use the"
+			ERROR_TUN+=" virtual network device if using -net tap."
+			ERROR_BRIDGE="You will also need support for 802.1d"
+			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
+			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
+			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
+			ERROR_VHOST_NET+=" support"
+			use test && CONFIG_CHECK+=" IP_MULTICAST"
+			ERROR_IP_MULTICAST="Test suite requires IP_MULTICAST"
+
+			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
+				if grep -q AuthenticAMD /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_AMD"
+				elif grep -q GenuineIntel /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_INTEL"
+				fi
+			fi
+
+			use python && CONFIG_CHECK+=" ~DEBUG_FS"
+			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
+
+			# Now do the actual checks setup above
+			check_extra_config
+		fi
+	fi
+
+	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
+		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
+		eerror "instances are still pointing to it.  Please update your"
+		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
+		eerror "and the right system binary (e.g. qemu-system-x86_64)."
+		die "update your virt configs to not use qemu-kvm"
+	fi
+}
+
+# Sanity check to make sure target lists are kept up-to-date.
+check_targets() {
+	local var=$1 mak=$2
+	local detected sorted
+
+	pushd "${S}"/configs/targets/ >/dev/null || die
+
+	# Force C locale until glibc is updated. #564936
+	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
+	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
+	if [[ ${sorted} != "${detected}" ]] ; then
+		eerror "The ebuild needs to be kept in sync."
+		eerror "${var}: ${sorted}"
+		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
+		die "sync ${var} to the list of targets"
+	fi
+
+	popd >/dev/null
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		for file in ${A}; do
+			unpack "${file}"
+		done
+		cd "${WORKDIR}" || die
+		for proj in "${!SUBPROJECTS[@]}"; do
+			mv "${proj}-${SUBPROJECTS[${proj}]}" "${S}/subprojects/${proj}" || die
+		done
+		cd "${S}" || die
+		meson subprojects packagefiles --apply || die
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	check_targets IUSE_SOFTMMU_TARGETS softmmu
+	check_targets IUSE_USER_TARGETS linux-user
+
+	default
+
+	# Use correct toolchain to fix cross-compiling
+	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
+	export WINDRES=${CHOST}-windres
+
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		cat >> "${S}"/configs/meson/linux.txt <<-EOF || die
+		[binaries]
+		dtrace='stap-dtrace'
+		EOF
+	fi
+
+	# Verbose builds
+	MAKEOPTS+=" V=1"
+
+	# Remove bundled modules
+	rm -r roms/*/ || die
+}
+
+##
+# configures qemu based on the build directory and the build type
+# we are using.
+#
+qemu_src_configure() {
+	debug-print-function ${FUNCNAME} "$@"
+
+	local buildtype=$1
+	local builddir="${S}/${buildtype}-build"
+
+	mkdir "${builddir}" || die
+
+	local conf_opts=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--bindir=/usr/bin
+		--libdir=/usr/$(get_libdir)
+		--datadir=/usr/share
+		--docdir=/usr/share/doc/${PF}/html
+		--mandir=/usr/share/man
+		--localstatedir=/var
+		--disable-bsd-user
+		--disable-containers # bug #732972
+		--disable-guest-agent
+		--disable-strip
+		--disable-download
+
+		# bug #746752: TCG interpreter has a few limitations:
+		# - it does not support FPU
+		# - it's generally slower on non-self-modifying code
+		# It's advantage is support for host architectures
+		# where native codegeneration is not implemented.
+		# Gentoo has qemu keyworded only on targets with
+		# native code generation available. Avoid the interpreter.
+		--disable-tcg-interpreter
+
+		--disable-werror
+		# We support gnutls/nettle for crypto operations.  It is possible
+		# to use gcrypt when gnutls/nettle are disabled (but not when they
+		# are enabled), but it's not really worth the hassle.  Disable it
+		# all the time to avoid automatically detecting it. #568856
+		--disable-gcrypt
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--objcc="$(tc-getCC)"
+		--host-cc="$(tc-getBUILD_CC)"
+
+		$(use_enable alsa)
+		$(use_enable debug debug-info)
+		$(use_enable debug debug-tcg)
+		$(use_enable jack)
+		$(use_enable nls gettext)
+		$(use_enable oss)
+		$(use_enable pipewire)
+		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
+		$(use_enable xattr attr)
+	)
+
+	# Disable options not used by user targets. This simplifies building
+	# static user targets (USE=static-user) considerably.
+	conf_notuser() {
+		if [[ ${buildtype} == "user" ]] ; then
+			echo "--disable-${2:-$1}"
+		else
+			use_enable "$@"
+		fi
+	}
+	# Enable option only for softmmu build, but not 'user' or 'tools'
+	conf_softmmu() {
+		if [[ ${buildtype} == "softmmu" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Enable option only for tools build, but not 'user' or 'softmmu'
+	conf_tools() {
+		if [[ ${buildtype} == "tools" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
+	conf_opts+=(
+		$(conf_notuser accessibility brlapi)
+		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
+		$(conf_notuser bzip2)
+		$(conf_notuser capstone)
+		$(conf_notuser curl)
+		$(conf_tools doc docs)
+		$(conf_notuser fdt)
+		$(conf_notuser fuse)
+		$(conf_notuser glusterfs)
+		$(conf_notuser gnutls)
+		$(conf_notuser gnutls nettle)
+		$(conf_notuser gtk)
+		$(conf_notuser infiniband rdma)
+		$(conf_notuser iscsi libiscsi)
+		$(conf_notuser io-uring linux-io-uring)
+		$(conf_malloc jemalloc)
+		$(conf_notuser jpeg vnc-jpeg)
+		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser keyutils libkeyutils)
+		$(conf_notuser lzo)
+		$(conf_notuser multipath mpath)
+		$(conf_notuser ncurses curses)
+		$(conf_notuser nfs libnfs)
+		$(conf_notuser numa)
+		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
+		$(conf_notuser png)
+		$(conf_notuser rbd)
+		$(conf_notuser sasl vnc-sasl)
+		$(conf_notuser sdl)
+		$(conf_softmmu sdl-image)
+		$(conf_notuser seccomp)
+		$(conf_notuser slirp)
+		$(conf_notuser smartcard)
+		$(conf_notuser snappy)
+		$(conf_notuser spice)
+		$(conf_notuser ssh libssh)
+		$(conf_notuser udev libudev)
+		$(conf_notuser usb libusb)
+		$(conf_notuser usbredir usb-redir)
+		$(conf_notuser vde)
+		$(conf_notuser vhost-net)
+		$(conf_notuser virgl virglrenderer)
+		$(conf_softmmu virtfs)
+		$(conf_notuser vnc)
+		$(conf_notuser vte)
+		$(conf_softmmu xdp af-xdp)
+		$(conf_notuser xen)
+		$(conf_notuser xen xen-pci-passthrough)
+		# use prebuilt keymaps, bug #759604
+		--disable-xkbcommon
+		$(conf_notuser zstd)
+	)
+
+	if [[ ! ${buildtype} == "user" ]] ; then
+		# audio options
+		local audio_opts=(
+			# Note: backend order matters here: #716202
+			# We iterate from higher-level to lower level.
+			$(usex pulseaudio pa "")
+			$(usev pipewire)
+			$(usev jack)
+			$(usev sdl)
+			$(usev alsa)
+			$(usev oss)
+		)
+		conf_opts+=(
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
+		)
+	fi
+
+	case ${buildtype} in
+	user)
+		conf_opts+=(
+			--enable-linux-user
+			--disable-system
+			--disable-tools
+			--disable-cap-ng
+			--disable-seccomp
+		)
+		local static_flag="static-user"
+		;;
+	softmmu)
+		conf_opts+=(
+			--disable-linux-user
+			--enable-system
+			--disable-tools
+			--enable-cap-ng
+			--enable-seccomp
+		)
+		local static_flag="none"
+		;;
+	tools)
+		conf_opts+=(
+			--disable-linux-user
+			--disable-system
+			--enable-tools
+			--enable-cap-ng
+		)
+		local static_flag="none"
+		;;
+	esac
+
+	local targets="${buildtype}_targets"
+	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
+
+	# Add support for SystemTap
+	use systemtap && conf_opts+=( --enable-trace-backends="dtrace" )
+
+	# We always want to attempt to build with PIE support as it results
+	# in a more secure binary. But it doesn't work with static or if
+	# the current GCC doesn't have PIE support.
+	if [[ ${static_flag} != "none" ]] && use ${static_flag}; then
+		conf_opts+=( --static --disable-pie )
+	else
+		tc-enables-pie && conf_opts+=( --enable-pie )
+	fi
+
+	# Meson will not use a cross-file unless cross_prefix is set.
+	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
+
+	# Plumb through equivalent of EXTRA_ECONF to allow experiments
+	# like bug #747928.
+	conf_opts+=( ${EXTRA_CONF_QEMU} )
+
+	echo "../configure ${conf_opts[*]}"
+	cd "${builddir}"
+	../configure "${conf_opts[@]}" || die "configure failed"
+}
+
+src_configure() {
+	local target
+
+	python_setup
+
+	softmmu_targets= softmmu_bins=()
+	user_targets= user_bins=()
+
+	for target in ${IUSE_SOFTMMU_TARGETS} ; do
+		if use "qemu_softmmu_targets_${target}"; then
+			softmmu_targets+=",${target}-softmmu"
+			softmmu_bins+=( "qemu-system-${target}" )
+		fi
+	done
+
+	for target in ${IUSE_USER_TARGETS} ; do
+		if use "qemu_user_targets_${target}"; then
+			user_targets+=",${target}-linux-user"
+			user_bins+=( "qemu-${target}" )
+		fi
+	done
+
+	softmmu_targets=${softmmu_targets#,}
+	user_targets=${user_targets#,}
+
+	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
+	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
+	qemu_src_configure "tools"
+}
+
+src_compile() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build" || die
+		default
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		default
+	fi
+
+	cd "${S}/tools-build" || die
+	default
+}
+
+src_test() {
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		pax-mark m */qemu-system-* #515550
+		emake check
+	fi
+}
+
+qemu_python_install() {
+	python_domodule "${S}/python/qemu"
+
+	python_doscript "${S}/scripts/kvm/vmxcap"
+	python_doscript "${S}/scripts/qmp/qmp-shell"
+	python_doscript "${S}/scripts/qmp/qemu-ga-client"
+}
+
+# Generate binfmt support files.
+#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
+#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
+generate_initd() {
+	local out="${T}/qemu-binfmt"
+	local out_systemd="${T}/qemu.conf"
+	local d="${T}/binfmt.d"
+
+	einfo "Generating qemu binfmt scripts and configuration files"
+
+	# Generate the debian fragments first.
+	mkdir -p "${d}"
+	"${S}"/scripts/qemu-binfmt-conf.sh \
+		--debian \
+		--exportdir "${d}" \
+		--qemu-path "${EPREFIX}/usr/bin" \
+		|| die
+	# Then turn the fragments into a shell script we can source.
+	sed -E -i \
+		-e 's:^([^ ]+) (.*)$:\1="\2":' \
+		"${d}"/* || die
+
+	# Generate the init.d script by assembling the fragments from above.
+	local f qcpu package interpreter magic mask
+	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
+	for f in "${d}"/qemu-* ; do
+		source "${f}"
+
+		# Normalize the cpu logic like we do in the init.d for the native cpu.
+		qcpu=${package#qemu-}
+		case ${qcpu} in
+		arm*)   qcpu="arm";;
+		mips*)  qcpu="mips";;
+		ppc*)   qcpu="ppc";;
+		s390*)  qcpu="s390";;
+		sh*)    qcpu="sh";;
+		sparc*) qcpu="sparc";;
+		esac
+
+		# we use 'printf' here to be portable across 'sh'
+		# implementations: #679168
+		cat <<EOF >>"${out}"
+	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
+		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
+	fi
+EOF
+
+		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
+
+	done
+	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
+}
+
+src_install() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		emake DESTDIR="${ED}" install
+
+		# Install binfmt handler init script for user targets.
+		generate_initd
+		doinitd "${T}/qemu-binfmt"
+
+		# Install binfmt/qemu.conf.
+		insinto "/usr/share/qemu/binfmt.d"
+		doins "${T}/qemu.conf"
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		emake DESTDIR="${ED}" install
+
+		# This might not exist if the test failed. #512010
+		[[ -e check-report.html ]] && dodoc check-report.html
+
+		if use kernel_linux; then
+			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
+		fi
+
+		if use python; then
+			python_foreach_impl qemu_python_install
+		fi
+	fi
+
+	cd "${S}/tools-build" || die
+	emake DESTDIR="${ED}" install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
+	fi
+
+	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
+	pushd "${ED}"/usr/bin >/dev/null || die
+	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
+	popd >/dev/null || die
+
+	# Install config file example for qemu-bridge-helper
+	insinto "/etc/qemu"
+	doins "${FILESDIR}/bridge.conf"
+
+	cd "${S}" || die
+	dodoc MAINTAINERS
+	newdoc pc-bios/README README.pc-bios
+
+	# Disallow stripping of prebuilt firmware files.
+	dostrip -x ${QA_PREBUILT}
+
+	if [[ -n ${softmmu_targets} ]]; then
+		# Remove SeaBIOS since we're using the SeaBIOS packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
+		fi
+
+		# Remove vgabios since we're using the seavgabios packaged one
+		rm "${ED}/usr/share/qemu/vgabios.bin"
+		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
+		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
+		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
+		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
+		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
+
+		# PPC/PPC64 loads vgabios-stdvga
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
+			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
+			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
+			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
+			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
+			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
+			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
+		fi
+
+		# Remove sgabios since we're using the sgabios packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
+		fi
+
+		# Remove iPXE since we're using the iPXE packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
+			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
+			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
+			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
+			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
+			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
+		fi
+	fi
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+firmware_abi_change() {
+	local pv
+	for pv in ${REPLACING_VERSIONS}; do
+		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
+			return 0
+		fi
+	done
+	return 1
+}
+
+pkg_postinst() {
+	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
+		udev_reload
+	fi
+
+	xdg_icon_cache_update
+
+	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
+		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_print_elog
+
+	if use pin-upstream-blobs && firmware_abi_change; then
+		ewarn "This version of qemu pins new versions of firmware blobs:"
+
+		if has_version 'sys-firmware/edk2-ovmf-bin'; then
+			ewarn "	$(best_version sys-firmware/edk2-ovmf-bin)"
+		else
+			ewarn " $(best_version sys-firmware/edk2-ovmf)"
+		fi
+
+		if has_version 'sys-firmware/seabios-bin'; then
+			ewarn "	$(best_version sys-firmware/seabios-bin)"
+		else
+			ewarn " $(best_version sys-firmware/seabios)"
+		fi
+
+		ewarn "	$(best_version sys-firmware/ipxe)"
+		ewarn "	$(best_version sys-firmware/sgabios)"
+		ewarn "This might break resume of hibernated guests (started with a different"
+		ewarn "firmware version) and live migration to/from qemu versions with different"
+		ewarn "firmware. Please (cold) restart all running guests. For functional"
+		ewarn "guest migration ensure that all"
+		ewarn "hosts run at least"
+		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
+	fi
+}
+
+pkg_info() {
+	echo "Using:"
+	echo "  $(best_version app-emulation/spice-protocol)"
+
+	if has_version 'sys-firmware/edk2-ovmf-bin'; then
+		echo "  $(best_version sys-firmware/edk2-ovmf-bin)"
+	else
+		echo "  $(best_version sys-firmware/edk2-ovmf)"
+	fi
+
+	if has_version 'sys-firmware/seabios-bin'; then
+		echo "  $(best_version sys-firmware/seabios-bin)"
+	else
+		echo "  $(best_version sys-firmware/seabios)"
+	fi
+
+	echo "  $(best_version sys-firmware/ipxe)"
+	echo "  $(best_version sys-firmware/sgabios)"
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.0.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.0.ebuild
new file mode 100644
index 00000000000..506c06abbbe
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.0.ebuild
@@ -0,0 +1,1006 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
+QEMU_DOCS_PREBUILT_DEV=sam
+QEMU_DOCS_VERSION=$(ver_cut 1-3)
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# bug #830088
+QEMU_DOC_USEFLAG="+doc"
+
+PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_REQ_USE="ncurses,readline"
+
+FIRMWARE_ABI_VERSION="7.2.0"
+
+inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
+		pax-utils xdg-utils
+
+if [[ ${PV} == *9999* ]]; then
+	QEMU_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
+	EGIT_SUBMODULES=()
+	inherit git-r3
+	SRC_URI=""
+	declare -A SUBPROJECTS=(
+		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
+		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
+		[berkeley-testfloat-3]="e7af9751d9f9fd3b47911f51a5cfd08af256a9ab"
+	)
+
+	for proj in "${!SUBPROJECTS[@]}"; do
+		c=${SUBPROJECTS[${proj}]}
+		SRC_URI+=" https://gitlab.com/qemu-project/${proj}/-/archive/${c}/${proj}-${c}.tar.bz2"
+	done
+else
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+
+	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
+HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
+
+LICENSE="GPL-2 LGPL-2 BSD-2"
+SLOT="0"
+
+[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
+
+IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg keyutils
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs pipewire
+	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
+	+slirp
+	smartcard snappy spice ssh static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xdp xen
+	zstd"
+
+COMMON_TARGETS="
+	aarch64
+	alpha
+	arm
+	cris
+	hppa
+	i386
+	loongarch64
+	m68k
+	microblaze
+	microblazeel
+	mips
+	mips64
+	mips64el
+	mipsel
+	or1k
+	ppc
+	ppc64
+	riscv32
+	riscv64
+	s390x
+	sh4
+	sh4eb
+	sparc
+	sparc64
+	x86_64
+	xtensa
+	xtensaeb
+"
+IUSE_SOFTMMU_TARGETS="
+	${COMMON_TARGETS}
+	avr
+	rx
+	tricore
+"
+IUSE_USER_TARGETS="
+	${COMMON_TARGETS}
+	aarch64_be
+	armeb
+	hexagon
+	mipsn32
+	mipsn32el
+	ppc64le
+	sparc32plus
+"
+
+use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
+use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
+IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
+
+RESTRICT="!test? ( test )"
+
+# Allow no targets to be built so that people can get a tools-only build.
+# Block USE flag configurations known to not work.
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	qemu_softmmu_targets_arm? ( fdt )
+	qemu_softmmu_targets_microblaze? ( fdt )
+	qemu_softmmu_targets_mips64el? ( fdt )
+	qemu_softmmu_targets_ppc64? ( fdt )
+	qemu_softmmu_targets_ppc? ( fdt )
+	qemu_softmmu_targets_riscv32? ( fdt )
+	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
+	sdl-image? ( sdl )
+	static-user? ( !plugins )
+	virgl? ( opengl )
+	virtfs? ( xattr )
+	vnc? ( gnutls )
+	vte? ( gtk )
+	multipath? ( udev )
+	plugins? ( !static-user )
+	xdp? ( bpf )
+"
+for smname in ${IUSE_SOFTMMU_TARGETS} ; do
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( kernel_linux? ( seccomp ) )"
+done
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# and user/softmmu targets (qemu-*, qemu-system-*).
+#
+# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
+#
+# The attr lib isn't always linked in (although the USE flag is always
+# respected).  This is because qemu supports using the C library's API
+# when available rather than always using the external library.
+ALL_DEPEND="
+	dev-libs/glib:2[static-libs(+)]
+	sys-libs/zlib[static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	systemtap? ( dev-debug/systemtap )
+	xattr? ( sys-apps/attr[static-libs(+)] )
+"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# softmmu targets (qemu-system-*).
+SOFTMMU_TOOLS_DEPEND="
+	>=x11-libs/pixman-0.28.0[static-libs(+)]
+	accessibility? (
+		app-accessibility/brltty[api]
+		app-accessibility/brltty[static-libs(+)]
+	)
+	aio? ( dev-libs/libaio[static-libs(+)] )
+	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
+	bzip2? ( app-arch/bzip2[static-libs(+)] )
+	capstone? ( dev-libs/capstone:=[static-libs(+)] )
+	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
+	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
+	gnutls? (
+		>=net-libs/gnutls-3.0:=[static-libs(+)]
+		dev-libs/nettle:=[static-libs(+)]
+	)
+	gtk? (
+		x11-libs/gtk+:3
+		vte? ( x11-libs/vte:2.91 )
+	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
+	iscsi? ( net-libs/libiscsi )
+	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
+	jack? ( virtual/jack )
+	jemalloc? ( dev-libs/jemalloc )
+	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	kernel_linux? ( sys-libs/libcap-ng[static-libs(+)] )
+	keyutils? ( sys-apps/keyutils[static-libs(+)] )
+	lzo? ( dev-libs/lzo:2[static-libs(+)] )
+	multipath? ( sys-fs/multipath-tools )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)]
+		sys-libs/ncurses:=[static-libs(+)]
+	)
+	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
+	numa? ( sys-process/numactl[static-libs(+)] )
+	opengl? (
+		virtual/opengl
+		media-libs/libepoxy[static-libs(+)]
+		media-libs/mesa[static-libs(+)]
+		media-libs/mesa[egl(+),gbm(+)]
+	)
+	pam? ( sys-libs/pam )
+	pipewire? ( >=media-video/pipewire-0.3.60 )
+	png? ( >=media-libs/libpng-1.6.34:=[static-libs(+)] )
+	pulseaudio? ( media-libs/libpulse )
+	rbd? ( sys-cluster/ceph )
+	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
+	sdl? (
+		media-libs/libsdl2[video]
+		media-libs/libsdl2[static-libs(+)]
+	)
+	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
+	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
+	slirp? ( net-libs/libslirp[static-libs(+)] )
+	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
+	snappy? ( app-arch/snappy:= )
+	spice? (
+		>=app-emulation/spice-protocol-0.14.0
+		>=app-emulation/spice-0.14.0[static-libs(+)]
+	)
+	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
+	udev? ( virtual/libudev:= )
+	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
+	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
+	vde? ( net-misc/vde[static-libs(+)] )
+	virgl? ( media-libs/virglrenderer[static-libs(+)] )
+	virtfs? ( sys-libs/libcap )
+	xdp? ( net-libs/xdp-tools )
+	xen? ( app-emulation/xen-tools:= )
+	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
+"
+
+EDK2_OVMF_VERSION="202202"
+SEABIOS_VERSION="1.16.3"
+
+X86_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		~sys-firmware/sgabios-0.1_pre10[binary]
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/edk2-ovmf-${EDK2_OVMF_VERSION}
+			>=sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		)
+		sys-firmware/ipxe[qemu]
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+		sys-firmware/sgabios
+	)
+"
+PPC_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+	)
+"
+
+# See bug #913084 for pip dep
+BDEPEND="
+	$(python_gen_impl_dep)
+	dev-lang/perl
+	>=dev-build/meson-0.63.0
+	app-alternatives/ninja
+	dev-python/pip[${PYTHON_USEDEP}]
+	virtual/pkgconfig
+	doc? (
+		>=dev-python/sphinx-1.6.0[${PYTHON_USEDEP}]
+		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+	)
+	gtk? ( nls? ( sys-devel/gettext ) )
+	test? (
+		dev-libs/glib[utils]
+		app-alternatives/bc
+	)
+"
+CDEPEND="
+	${ALL_DEPEND//\[static-libs(+)]}
+	${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
+	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
+"
+DEPEND="
+	${CDEPEND}
+	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
+	static-user? ( ${ALL_DEPEND} )
+"
+RDEPEND="
+	${CDEPEND}
+	acct-group/kvm
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-9.0.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-9.1.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-9.0.0-also-build-virtfs-proxy-helper.patch
+	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
+	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
+
+)
+
+QA_PREBUILT="
+	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/hppa-firmware64.img
+	usr/share/qemu/openbios-ppc
+	usr/share/qemu/openbios-sparc64
+	usr/share/qemu/openbios-sparc32
+	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
+	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
+	usr/share/qemu/palcode-clipper
+	usr/share/qemu/s390-ccw.img
+	usr/share/qemu/s390-netboot.img
+	usr/share/qemu/u-boot.e500
+"
+
+QA_WX_LOAD="
+	usr/bin/qemu-i386
+	usr/bin/qemu-x86_64
+	usr/bin/qemu-alpha
+	usr/bin/qemu-arm
+	usr/bin/qemu-cris
+	usr/bin/qemu-m68k
+	usr/bin/qemu-microblaze
+	usr/bin/qemu-microblazeel
+	usr/bin/qemu-mips
+	usr/bin/qemu-mipsel
+	usr/bin/qemu-or1k
+	usr/bin/qemu-ppc
+	usr/bin/qemu-ppc64
+	usr/bin/qemu-sh4
+	usr/bin/qemu-sh4eb
+	usr/bin/qemu-sparc
+	usr/bin/qemu-sparc64
+	usr/bin/qemu-armeb
+	usr/bin/qemu-sparc32plus
+	usr/bin/qemu-s390x
+	usr/bin/qemu-unicore32
+"
+
+DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
+kernel module loaded before running kvm. The easiest way to ensure that the
+kernel module is loaded is to load it on boot.
+	For AMD CPUs the module is called 'kvm-amd'.
+	For Intel CPUs the module is called 'kvm-intel'.
+Please review /etc/conf.d/modules for how to load these.
+
+Make sure your user is in the 'kvm' group. Just run
+	$ gpasswd -a <USER> kvm
+then have <USER> re-login.
+
+For brand new installs, the default permissions on /dev/kvm might not let
+you access it.  You can tell udev to reset ownership/perms:
+	$ udevadm trigger -c add /dev/kvm
+
+If you want to register binfmt handlers for qemu user targets:
+For openrc:
+	# rc-update add qemu-binfmt
+For systemd:
+	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
+
+pkg_pretend() {
+	if use kernel_linux && kernel_is lt 2 6 25; then
+		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
+	elif use kernel_linux; then
+		if ! linux_config_exists; then
+			eerror "Unable to check your kernel for KVM support"
+		else
+			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
+			ERROR_KVM="You must enable KVM in your kernel to continue"
+			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
+			ERROR_KVM_AMD+=" your kernel configuration."
+			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
+			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
+			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
+			ERROR_TUN+=" into your kernel or loaded as a module to use the"
+			ERROR_TUN+=" virtual network device if using -net tap."
+			ERROR_BRIDGE="You will also need support for 802.1d"
+			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
+			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
+			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
+			ERROR_VHOST_NET+=" support"
+			use test && CONFIG_CHECK+=" IP_MULTICAST"
+			ERROR_IP_MULTICAST="Test suite requires IP_MULTICAST"
+
+			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
+				if grep -q AuthenticAMD /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_AMD"
+				elif grep -q GenuineIntel /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_INTEL"
+				fi
+			fi
+
+			use python && CONFIG_CHECK+=" ~DEBUG_FS"
+			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
+
+			# Now do the actual checks setup above
+			check_extra_config
+		fi
+	fi
+
+	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
+		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
+		eerror "instances are still pointing to it.  Please update your"
+		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
+		eerror "and the right system binary (e.g. qemu-system-x86_64)."
+		die "update your virt configs to not use qemu-kvm"
+	fi
+}
+
+# Sanity check to make sure target lists are kept up-to-date.
+check_targets() {
+	local var=$1 mak=$2
+	local detected sorted
+
+	pushd "${S}"/configs/targets/ >/dev/null || die
+
+	# Force C locale until glibc is updated. #564936
+	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
+	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
+	if [[ ${sorted} != "${detected}" ]] ; then
+		eerror "The ebuild needs to be kept in sync."
+		eerror "${var}: ${sorted}"
+		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
+		die "sync ${var} to the list of targets"
+	fi
+
+	popd >/dev/null
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		for file in ${A}; do
+			unpack "${file}"
+		done
+		cd "${WORKDIR}" || die
+		for proj in "${!SUBPROJECTS[@]}"; do
+			mv "${proj}-${SUBPROJECTS[${proj}]}" "${S}/subprojects/${proj}" || die
+		done
+		cd "${S}" || die
+		meson subprojects packagefiles --apply || die
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	check_targets IUSE_SOFTMMU_TARGETS softmmu
+	check_targets IUSE_USER_TARGETS linux-user
+
+	default
+
+	# Use correct toolchain to fix cross-compiling
+	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
+	export WINDRES=${CHOST}-windres
+
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		cat >> "${S}"/configs/meson/linux.txt <<-EOF || die
+		[binaries]
+		dtrace='stap-dtrace'
+		EOF
+	fi
+
+	# Verbose builds
+	MAKEOPTS+=" V=1"
+
+	# Remove bundled modules
+	rm -r roms/*/ || die
+}
+
+##
+# configures qemu based on the build directory and the build type
+# we are using.
+#
+qemu_src_configure() {
+	debug-print-function ${FUNCNAME} "$@"
+
+	local buildtype=$1
+	local builddir="${S}/${buildtype}-build"
+
+	mkdir "${builddir}" || die
+
+	local conf_opts=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--bindir=/usr/bin
+		--libdir=/usr/$(get_libdir)
+		--datadir=/usr/share
+		--docdir=/usr/share/doc/${PF}/html
+		--mandir=/usr/share/man
+		--localstatedir=/var
+		--disable-bsd-user
+		--disable-containers # bug #732972
+		--disable-guest-agent
+		--disable-strip
+		--disable-download
+
+		# bug #746752: TCG interpreter has a few limitations:
+		# - it does not support FPU
+		# - it's generally slower on non-self-modifying code
+		# It's advantage is support for host architectures
+		# where native codegeneration is not implemented.
+		# Gentoo has qemu keyworded only on targets with
+		# native code generation available. Avoid the interpreter.
+		--disable-tcg-interpreter
+
+		--disable-werror
+		# We support gnutls/nettle for crypto operations.  It is possible
+		# to use gcrypt when gnutls/nettle are disabled (but not when they
+		# are enabled), but it's not really worth the hassle.  Disable it
+		# all the time to avoid automatically detecting it. #568856
+		--disable-gcrypt
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--objcc="$(tc-getCC)"
+		--host-cc="$(tc-getBUILD_CC)"
+
+		$(use_enable alsa)
+		$(use_enable debug debug-info)
+		$(use_enable debug debug-tcg)
+		$(use_enable jack)
+		$(use_enable nls gettext)
+		$(use_enable oss)
+		$(use_enable pipewire)
+		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
+		$(use_enable xattr attr)
+	)
+
+	# Disable options not used by user targets. This simplifies building
+	# static user targets (USE=static-user) considerably.
+	conf_notuser() {
+		if [[ ${buildtype} == "user" ]] ; then
+			echo "--disable-${2:-$1}"
+		else
+			use_enable "$@"
+		fi
+	}
+	# Enable option only for softmmu build, but not 'user' or 'tools'
+	conf_softmmu() {
+		if [[ ${buildtype} == "softmmu" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Enable option only for tools build, but not 'user' or 'softmmu'
+	conf_tools() {
+		if [[ ${buildtype} == "tools" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
+	conf_opts+=(
+		$(conf_notuser accessibility brlapi)
+		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
+		$(conf_notuser bzip2)
+		$(conf_notuser capstone)
+		$(conf_notuser curl)
+		$(conf_tools doc docs)
+		$(conf_notuser fdt)
+		$(conf_notuser fuse)
+		$(conf_notuser glusterfs)
+		$(conf_notuser gnutls)
+		$(conf_notuser gnutls nettle)
+		$(conf_notuser gtk)
+		$(conf_notuser infiniband rdma)
+		$(conf_notuser iscsi libiscsi)
+		$(conf_notuser io-uring linux-io-uring)
+		$(conf_malloc jemalloc)
+		$(conf_notuser jpeg vnc-jpeg)
+		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser keyutils libkeyutils)
+		$(conf_notuser lzo)
+		$(conf_notuser multipath mpath)
+		$(conf_notuser ncurses curses)
+		$(conf_notuser nfs libnfs)
+		$(conf_notuser numa)
+		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
+		$(conf_notuser png)
+		$(conf_notuser rbd)
+		$(conf_notuser sasl vnc-sasl)
+		$(conf_notuser sdl)
+		$(conf_softmmu sdl-image)
+		$(conf_notuser seccomp)
+		$(conf_notuser slirp)
+		$(conf_notuser smartcard)
+		$(conf_notuser snappy)
+		$(conf_notuser spice)
+		$(conf_notuser ssh libssh)
+		$(conf_notuser udev libudev)
+		$(conf_notuser usb libusb)
+		$(conf_notuser usbredir usb-redir)
+		$(conf_notuser vde)
+		$(conf_notuser vhost-net)
+		$(conf_notuser virgl virglrenderer)
+		$(conf_softmmu virtfs)
+		$(conf_notuser vnc)
+		$(conf_notuser vte)
+		$(conf_softmmu xdp af-xdp)
+		$(conf_notuser xen)
+		$(conf_notuser xen xen-pci-passthrough)
+		# use prebuilt keymaps, bug #759604
+		--disable-xkbcommon
+		$(conf_notuser zstd)
+	)
+
+	if [[ ! ${buildtype} == "user" ]] ; then
+		# audio options
+		local audio_opts=(
+			# Note: backend order matters here: #716202
+			# We iterate from higher-level to lower level.
+			$(usex pulseaudio pa "")
+			$(usev pipewire)
+			$(usev jack)
+			$(usev sdl)
+			$(usev alsa)
+			$(usev oss)
+		)
+		conf_opts+=(
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
+		)
+	fi
+
+	case ${buildtype} in
+	user)
+		conf_opts+=(
+			--enable-linux-user
+			--disable-system
+			--disable-tools
+			--disable-cap-ng
+			--disable-seccomp
+		)
+		local static_flag="static-user"
+		;;
+	softmmu)
+		conf_opts+=(
+			--disable-linux-user
+			--enable-system
+			--disable-tools
+			--enable-cap-ng
+			--enable-seccomp
+		)
+		local static_flag="none"
+		;;
+	tools)
+		conf_opts+=(
+			--disable-linux-user
+			--disable-system
+			--enable-tools
+			--enable-cap-ng
+		)
+		local static_flag="none"
+		;;
+	esac
+
+	local targets="${buildtype}_targets"
+	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
+
+	# Add support for SystemTap
+	use systemtap && conf_opts+=( --enable-trace-backends="dtrace" )
+
+	# We always want to attempt to build with PIE support as it results
+	# in a more secure binary. But it doesn't work with static or if
+	# the current GCC doesn't have PIE support.
+	if [[ ${static_flag} != "none" ]] && use ${static_flag}; then
+		conf_opts+=( --static --disable-pie )
+	else
+		tc-enables-pie && conf_opts+=( --enable-pie )
+	fi
+
+	# Meson will not use a cross-file unless cross_prefix is set.
+	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
+
+	# Plumb through equivalent of EXTRA_ECONF to allow experiments
+	# like bug #747928.
+	conf_opts+=( ${EXTRA_CONF_QEMU} )
+
+	echo "../configure ${conf_opts[*]}"
+	cd "${builddir}"
+	../configure "${conf_opts[@]}" || die "configure failed"
+}
+
+src_configure() {
+	local target
+
+	python_setup
+
+	softmmu_targets= softmmu_bins=()
+	user_targets= user_bins=()
+
+	for target in ${IUSE_SOFTMMU_TARGETS} ; do
+		if use "qemu_softmmu_targets_${target}"; then
+			softmmu_targets+=",${target}-softmmu"
+			softmmu_bins+=( "qemu-system-${target}" )
+		fi
+	done
+
+	for target in ${IUSE_USER_TARGETS} ; do
+		if use "qemu_user_targets_${target}"; then
+			user_targets+=",${target}-linux-user"
+			user_bins+=( "qemu-${target}" )
+		fi
+	done
+
+	softmmu_targets=${softmmu_targets#,}
+	user_targets=${user_targets#,}
+
+	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
+	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
+	qemu_src_configure "tools"
+}
+
+src_compile() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build" || die
+		default
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		default
+	fi
+
+	cd "${S}/tools-build" || die
+	default
+}
+
+src_test() {
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		pax-mark m */qemu-system-* #515550
+		emake check
+	fi
+}
+
+qemu_python_install() {
+	python_domodule "${S}/python/qemu"
+
+	python_doscript "${S}/scripts/kvm/vmxcap"
+	python_doscript "${S}/scripts/qmp/qmp-shell"
+	python_doscript "${S}/scripts/qmp/qemu-ga-client"
+}
+
+# Generate binfmt support files.
+#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
+#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
+generate_initd() {
+	local out="${T}/qemu-binfmt"
+	local out_systemd="${T}/qemu.conf"
+	local d="${T}/binfmt.d"
+
+	einfo "Generating qemu binfmt scripts and configuration files"
+
+	# Generate the debian fragments first.
+	mkdir -p "${d}"
+	"${S}"/scripts/qemu-binfmt-conf.sh \
+		--debian \
+		--exportdir "${d}" \
+		--qemu-path "${EPREFIX}/usr/bin" \
+		|| die
+	# Then turn the fragments into a shell script we can source.
+	sed -E -i \
+		-e 's:^([^ ]+) (.*)$:\1="\2":' \
+		"${d}"/* || die
+
+	# Generate the init.d script by assembling the fragments from above.
+	local f qcpu package interpreter magic mask
+	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
+	for f in "${d}"/qemu-* ; do
+		source "${f}"
+
+		# Normalize the cpu logic like we do in the init.d for the native cpu.
+		qcpu=${package#qemu-}
+		case ${qcpu} in
+		arm*)   qcpu="arm";;
+		mips*)  qcpu="mips";;
+		ppc*)   qcpu="ppc";;
+		s390*)  qcpu="s390";;
+		sh*)    qcpu="sh";;
+		sparc*) qcpu="sparc";;
+		esac
+
+		# we use 'printf' here to be portable across 'sh'
+		# implementations: #679168
+		cat <<EOF >>"${out}"
+	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
+		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
+	fi
+EOF
+
+		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
+
+	done
+	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
+}
+
+src_install() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		emake DESTDIR="${ED}" install
+
+		# Install binfmt handler init script for user targets.
+		generate_initd
+		doinitd "${T}/qemu-binfmt"
+
+		# Install binfmt/qemu.conf.
+		insinto "/usr/share/qemu/binfmt.d"
+		doins "${T}/qemu.conf"
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		emake DESTDIR="${ED}" install
+
+		# This might not exist if the test failed. #512010
+		[[ -e check-report.html ]] && dodoc check-report.html
+
+		if use kernel_linux; then
+			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
+		fi
+
+		if use python; then
+			python_foreach_impl qemu_python_install
+		fi
+	fi
+
+	cd "${S}/tools-build" || die
+	emake DESTDIR="${ED}" install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
+	fi
+
+	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
+	pushd "${ED}"/usr/bin >/dev/null || die
+	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
+	popd >/dev/null || die
+
+	# Install config file example for qemu-bridge-helper
+	insinto "/etc/qemu"
+	doins "${FILESDIR}/bridge.conf"
+
+	cd "${S}" || die
+	dodoc MAINTAINERS
+	newdoc pc-bios/README README.pc-bios
+
+	# Disallow stripping of prebuilt firmware files.
+	dostrip -x ${QA_PREBUILT}
+
+	if [[ -n ${softmmu_targets} ]]; then
+		# Remove SeaBIOS since we're using the SeaBIOS packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
+		fi
+
+		# Remove vgabios since we're using the seavgabios packaged one
+		rm "${ED}/usr/share/qemu/vgabios.bin"
+		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
+		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
+		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
+		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
+		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
+
+		# PPC/PPC64 loads vgabios-stdvga
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
+			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
+			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
+			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
+			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
+			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
+			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
+		fi
+
+		# Remove sgabios since we're using the sgabios packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
+		fi
+
+		# Remove iPXE since we're using the iPXE packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
+			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
+			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
+			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
+			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
+			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
+		fi
+	fi
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+firmware_abi_change() {
+	local pv
+	for pv in ${REPLACING_VERSIONS}; do
+		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
+			return 0
+		fi
+	done
+	return 1
+}
+
+pkg_postinst() {
+	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
+		udev_reload
+	fi
+
+	xdg_icon_cache_update
+
+	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
+		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_print_elog
+
+	if use pin-upstream-blobs && firmware_abi_change; then
+		ewarn "This version of qemu pins new versions of firmware blobs:"
+
+		if has_version 'sys-firmware/edk2-ovmf-bin'; then
+			ewarn "	$(best_version sys-firmware/edk2-ovmf-bin)"
+		else
+			ewarn " $(best_version sys-firmware/edk2-ovmf)"
+		fi
+
+		if has_version 'sys-firmware/seabios-bin'; then
+			ewarn "	$(best_version sys-firmware/seabios-bin)"
+		else
+			ewarn " $(best_version sys-firmware/seabios)"
+		fi
+
+		ewarn "	$(best_version sys-firmware/ipxe)"
+		ewarn "	$(best_version sys-firmware/sgabios)"
+		ewarn "This might break resume of hibernated guests (started with a different"
+		ewarn "firmware version) and live migration to/from qemu versions with different"
+		ewarn "firmware. Please (cold) restart all running guests. For functional"
+		ewarn "guest migration ensure that all"
+		ewarn "hosts run at least"
+		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
+	fi
+}
+
+pkg_info() {
+	echo "Using:"
+	echo "  $(best_version app-emulation/spice-protocol)"
+
+	if has_version 'sys-firmware/edk2-ovmf-bin'; then
+		echo "  $(best_version sys-firmware/edk2-ovmf-bin)"
+	else
+		echo "  $(best_version sys-firmware/edk2-ovmf)"
+	fi
+
+	if has_version 'sys-firmware/seabios-bin'; then
+		echo "  $(best_version sys-firmware/seabios-bin)"
+	else
+		echo "  $(best_version sys-firmware/seabios)"
+	fi
+
+	echo "  $(best_version sys-firmware/ipxe)"
+	echo "  $(best_version sys-firmware/sgabios)"
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
index 97847140353..506c06abbbe 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
@@ -6,14 +6,14 @@ EAPI=8
 # Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
 # Set to 1 if prebuilt, 0 if not
 # (the construct below is to allow overriding from env for script)
-QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-0}
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
 QEMU_DOCS_PREBUILT_DEV=sam
 QEMU_DOCS_VERSION=$(ver_cut 1-3)
 # Default to generating docs (inc. man pages) if no prebuilt; overridden later
 # bug #830088
 QEMU_DOC_USEFLAG="+doc"
 
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 PYTHON_REQ_USE="ncurses,readline"
 
 FIRMWARE_ABI_VERSION="7.2.0"
@@ -66,7 +66,7 @@ IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
 	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
 	+slirp
 	smartcard snappy spice ssh static-user systemtap test udev usb
-	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xen
+	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xdp xen
 	zstd"
 
 COMMON_TARGETS="
@@ -141,6 +141,7 @@ REQUIRED_USE="
 	vte? ( gtk )
 	multipath? ( udev )
 	plugins? ( !static-user )
+	xdp? ( bpf )
 "
 for smname in ${IUSE_SOFTMMU_TARGETS} ; do
 	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( kernel_linux? ( seccomp ) )"
@@ -235,6 +236,7 @@ SOFTMMU_TOOLS_DEPEND="
 	vde? ( net-misc/vde[static-libs(+)] )
 	virgl? ( media-libs/virglrenderer[static-libs(+)] )
 	virtfs? ( sys-libs/libcap )
+	xdp? ( net-libs/xdp-tools )
 	xen? ( app-emulation/xen-tools:= )
 	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
 "
@@ -316,7 +318,7 @@ RDEPEND="
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-9.0.0-disable-keymap.patch
-	"${FILESDIR}"/${PN}-9.0.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-9.1.0-capstone-include-path.patch
 	"${FILESDIR}"/${PN}-9.0.0-also-build-virtfs-proxy-helper.patch
 	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
 	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
@@ -633,6 +635,7 @@ qemu_src_configure() {
 		$(conf_softmmu virtfs)
 		$(conf_notuser vnc)
 		$(conf_notuser vte)
+		$(conf_softmmu xdp af-xdp)
 		$(conf_notuser xen)
 		$(conf_notuser xen xen-pci-passthrough)
 		# use prebuilt keymaps, bug #759604
diff --git a/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/Manifest b/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/Manifest
index 4a045ee193d..728eb78cac4 100644
--- a/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/Manifest
@@ -1 +1,2 @@
 DIST pax-utils-1.3.7.tar.xz 113740 BLAKE2B d801df9c426f318c871655f238fe27b53e656c2789ef8508019997c98bbc540987b611642d87e76ae9f76a95f6cce1acd0b10e3491a146d1e3b3f727a6f96bdc SHA512 f1b87a564573da838a02c4cc10e0d5f9754c3b004ecb172a6290b48a8179b30695ae556942457dfac3caf07b91dd56eb1d801475c35e9708e4d671aa507f9576
+DIST pax-utils-1.3.8.tar.xz 123556 BLAKE2B 9e658334f37bfee90d4d168cdb81bc3b4012c38b569c22c3b01688408e90f4727043636ff8908e6c049fce7be5476ba86773f07cb192e3a34721c1469f69b48d SHA512 0dde95f86802729d80b7b38af84dec636e973f6abc70600633edcb05d3d5f95c1b2861300ce478dd7f798c7a1e5eccb1011c06c53adba38e11a996b69d463656
diff --git a/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/pax-utils-1.3.8.ebuild b/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/pax-utils-1.3.8.ebuild
new file mode 100644
index 00000000000..d17a13c5a20
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/pax-utils-1.3.8.ebuild
@@ -0,0 +1,77 @@
+# Copyright 2022-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Note: if bumping pax-utils because of syscall changes in glibc, please
+# revbump glibc and update the dependency in its ebuild for the affected
+# versions.
+PYTHON_COMPAT=( python3_{10..13} )
+
+inherit meson python-single-r1
+
+DESCRIPTION="ELF utils that can check files for security relevant properties"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Hardened/PaX_Utilities"
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/pax-utils.git"
+	inherit git-r3
+else
+	SRC_URI="
+		https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz
+		https://dev.gentoo.org/~vapier/dist/${P}.tar.xz
+	"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="caps man python seccomp test"
+REQUIRED_USE="
+	python? ( ${PYTHON_REQUIRED_USE} )
+	test? ( python )
+"
+RESTRICT="!test? ( test )"
+
+MY_PYTHON_DEPS="
+	${PYTHON_DEPS}
+	$(python_gen_cond_dep '
+		dev-python/pyelftools[${PYTHON_USEDEP}]
+	')
+"
+RDEPEND="
+	caps? ( >=sys-libs/libcap-2.24 )
+	python? ( ${MY_PYTHON_DEPS} )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	caps? ( virtual/pkgconfig )
+	man? ( app-text/xmlto )
+	python? ( ${MY_PYTHON_DEPS} )
+"
+
+pkg_setup() {
+	if use test || use python; then
+		python-single-r1_pkg_setup
+	fi
+}
+
+src_configure() {
+	local emesonargs=(
+		"-Dlddtree_implementation=$(usex python python sh)"
+		$(meson_feature caps use_libcap)
+		$(meson_feature man build_manpages)
+		$(meson_use seccomp use_seccomp)
+		$(meson_use test tests)
+
+		# fuzzing is currently broken
+		-Duse_fuzzing=false
+	)
+	meson_src_configure
+}
+
+src_install() {
+	meson_src_install
+
+	use python && python_fix_shebang "${ED}"/usr/bin/lddtree
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/pax-utils-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/pax-utils-9999.ebuild
index 87d37edf2b5..55c38f7049a 100644
--- a/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/pax-utils-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/pax-utils-9999.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 # Note: if bumping pax-utils because of syscall changes in glibc, please
 # revbump glibc and update the dependency in its ebuild for the affected
 # versions.
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 
 inherit meson python-single-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/elt-patches-20240912.ebuild b/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/elt-patches-20240912.ebuild
index 3f398a3135b..b8fb5cc9a05 100644
--- a/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/elt-patches-20240912.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/elt-patches-20240912.ebuild
@@ -19,7 +19,7 @@ else
 		https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz
 	"
 
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~arm64-linux ~ppc64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~arm64-linux ~ppc64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="GPL-2"
diff --git a/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-0.97.ebuild b/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-0.97.ebuild
index c202a4f58fe..b4732052345 100644
--- a/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-0.97.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-0.97.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2025 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -13,7 +13,7 @@ if [[ ${PV} == *9999 ]]; then
 	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/portage-utils.git"
 else
 	SRC_URI="https://dev.gentoo.org/~grobian/distfiles/${P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="GPL-2"
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest b/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
index 6d641d70ec1..2eba3c0ad2b 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
@@ -24,12 +24,7 @@ DIST bash-5.2.tar.gz 10950833 BLAKE2B 51b196e710794ebad8eac28c31c93eb99ac1a7db30
 DIST bash-5.2.tar.gz.sig 95 BLAKE2B 2991b7c46ef1cdca08062f419be47fca7551f4c5d9aad8a5c1da74974f5e7707d23914b4cecf9b6c9610471146b2c49b611bb62a5d974f1c37cceb77b719851c SHA512 a161664f124f906be32709f66702f8f780e6d52e558ea45e71ec60a959c9435ff68477ee65a0a9f6c0051d5592f5044fb3b410cf3cd3ae5a8a323789b01be258
 DIST bash-5.3-alpha.tar.gz 11195025 BLAKE2B b3325f6927d7dde86aae165891317b972f0b9814e134676b3d7d3aea81ce4d4cad1a01f160e290352072153ad3568ee21701a35190ef5e6274b3c03fc95c8d42 SHA512 52354eb7cd71330192ec76fdda04bcacf758a312e89b45558db5f5345f19b0d8e54732049934958cf89786f5bd7c538d88859eb8d8d22dabfc9ec7305263d10e
 DIST bash-5.3-alpha.tar.gz.sig 95 BLAKE2B 69c8b33fe2a40498662ef084967701cff1926086785a41d6f49a3c2e2b9908499226d3d970bdb6397a74d3ccc22acb3651261ad2a421799eb135c64a78af8589 SHA512 c9587da66457e2010b0852c6dbf5949821a543b7f1b616a4d016df3477913e2a655c57289e83adeeb31b8b8afca22313e3af76cf727b93932d33a889c1263c20
-DIST bash-5.3_alpha_p20240815-cf694865de527e597de5a906643a74037341a431.tar.xz 8537760 BLAKE2B df370a28aa40af0cf108f9578c81ef53cf175e97ca9b5cdca85fa8de99df81a0f58950c20e7af0180ee420218b04b9e9f721fef42b292e6b3261aa4846cabf55 SHA512 dd552214404aa1410954f3b4e3da5e744001eda2b6a613f52177bbfdff19c094a7406673dcfc1dfa653895a221969c2edcf8362556cdeadbd0cf16a610fcd191
-DIST bash-5.3_alpha_p20240821-e327891b52513bef0b34aac625c44f8fa6811f53.tar.xz 15948864 BLAKE2B c8afaa735df7dc75bf0f3b4b07c25bf9ac0cb23d7fe10451b4a39e821d3fd308384760e16d6e2256601f938f3665a1d0cdbd2638806b63029906f2ae5d646091 SHA512 e3291af9bb0c66ba6d0c52db446e51bc628933f132ab7654eb803da02ec7bf6e57bf6d13e65a25fe1c07b518e5d68a9b3526ca4e157ba3cc3d091b3c4f1fea43
-DIST bash-5.3_alpha_p20240823-2e01122fe78eb5a42c9b9f3ca46b91f895959675.tar.xz 8541288 BLAKE2B 64cf9fc5873b925558a7aa2e2a0e76f9f326ab0606b720e8684021e540bcd992307d146b9c5d2e3f1e2779a372874753c9dd8cf7296e1013470f53e70082fc5a SHA512 3a8a5b522ac082c081ababee84cf2f1f1518c9a397a1b612de40c6e07a3104c74561eb5db75e74eec742284665667135eba5eb975d8599c3e89eeafa7383b5e4
-DIST bash-5.3_alpha_p20240828-2610d40b32301cd7256bf1dfc49c9f8bfe0dcd53.tar.xz 8542760 BLAKE2B 1d06b9837e3c1a23f34f6fcc3ec919b824d28a01301e459d602cad7bde1568299e1bc01abb94f4cade96450e19ebaf85b14a7dbb6e7d8d6b38006bae5a755c5f SHA512 eff12dbf54744c3a528cc0aa5395739221ba722b08c06b9fdf5d3f93b18b9d9e2505d91abac76510b33231075b629df7a53ddf99539e8bf3b13dc2982d532e47
-DIST bash-5.3_alpha_p20240904-5576c26da8e0ad74048203398acb493c65fd3476.tar.xz 8543756 BLAKE2B 797a97c92fcef0f675c091c4fa0d9fb12f4bed75150985ba34c99b934b77821dfa57300fc9085d606ca57fb868c3b17a04d71090eb6a0fb0f711acf5901d2fa4 SHA512 634005182fc43d752f8af6d5ff04c2612ae3e5ecd9cf5fe83a53c9242df5efead0b1c4c6142a2546566d2abd81277e7133ee8e9ca19eb179b679cf8574945403
-DIST bash-5.3_alpha_p20240911-bc5ddc8698d56df588fd99864a650b834426ccf7.tar.xz 8544476 BLAKE2B 05985908b330081485fa89f4bf89ecad01f20d94dd925dcc103b3759a35629535bee5d3ebdb8673b77b9ebba813861db2be65cabdd1b637e608cd247537f7add SHA512 c648af06d1e73eea1823d144ee269e4b05ad5d9286f18eae4cd4d2c78072e23ad2c5eaebbf619c7b9aa03e4c52676130a8a105198166a18a14d0676fce938764
+DIST bash-5.3_alpha_p20240927-254081c09767738833cdf161b4bc3feb1a51690a.tar.xz 8547936 BLAKE2B 1af25e3b7fb3760d245625b788f6a6f94985b7f1a7bf7bcf9b5dd81b8df42d8dcad078edaee9c9e744a28341e0f1199f50b9aa9cef7a327b008b64f5fde4bb9d SHA512 b6191ceebe1e9d72f50108abbd687a8d20a620a9683df98ced74d7311c3cea9388af1a39c98c13e2b7e7037622231e44dd84b9d209bed18c488d9f2550f3adae
 DIST bash205b-001 1132 BLAKE2B 0c5eef29777d54ef05957ea3d63b1556fb380bd20c238dc28993d822b37bc4e78ff4048ad069f6b8cd25da77ccdeb7aecd86c4349cb9d81e5e94c7001eeae5e6 SHA512 5ce4357468821b05e747201f3aa57225ad8f540c9e2c87051720490e039c30b478b9b662a68f14a0800fefe40184e4495e2645665200f9d75e9a115b2ac08071
 DIST bash205b-002 755 BLAKE2B 6a6ed5679d451f02f8104b345c1722d11718ce3b4043b581c17786d40d8da69a34786fb56d0c363dba277b8e9dd33f12f70c9cc73a9fc39ba4a8319406f0458d SHA512 46947b0229478d5c2cfeff68b8ebc00e4ef0c8b94e336ca12f72b4490ba3622c0240c01c17c1641c3b07adc2c64ec94d6d780365e8990768ec8888f3a9526883
 DIST bash205b-003 2356 BLAKE2B b7887d00d92fd298cd07a15e1c73b516dabd22ecd74c97091636dd97a0cd55024ed698e5cc924c4311d994dd326b1ad074bea35e7650cf9cf4e25c60d2713fa7 SHA512 74528ca5d165b812d299f1c69b47757bd677c0b22ce4217e155cd641708b02364a93c6709fb57b546b376b36da74429a61493921c7c199563da40ddcf1c1f399
@@ -444,3 +439,13 @@ DIST bash52-031 1159 BLAKE2B dac378115906e21fc754267c42e129e2374c9b63f879d1717d7
 DIST bash52-031.sig 95 BLAKE2B 50e5c0b3afb0ffc8b1863bde645316d7c7c49e8b396041ca1dcf269c50b532aaccf0c3fb5a5e64036ece9054d8ccf78f7e829ecf0fbdcf8531ba57230b129f1c SHA512 f656d8fbbe79450fbf193e5c2aebc85cfc425703495f2925aa774d5c0e742ebf523c191264673c6dd76fa6071c39d5155698687475eb634cd6553e86266f91a5
 DIST bash52-032 1529 BLAKE2B 55aab849da0fcc69ab3516d9d7ff2858b5f15cbeaddf66282f43f272b52d646c2c41c2ceef632a2ae8f13c25d92e85f49fbc6de989ed4f6ac4bb7bea7fc59a5d SHA512 9eb277d2d92b9ec49f70582e52305bc45b425b189ba2a15c51c537e07ccf9cb894c1ca44fa399b04297fe51027aff7f169f41efe2d60895ca55c421c0778ef32
 DIST bash52-032.sig 95 BLAKE2B 23a5cd003c957932d0c0192b63a5e8e7366bf939c3f54ff91b444e3729607c88677fdf4a5b435e47da4a64624b10d8696e4e950fac8fbb6932bb4c64506d1f9f SHA512 d3b08c3d0efee81a8507b530405a886259438bfc4c2ab984dbe80d30177775aacf6448a2673f0bd274fe46c938a8b8d46844d3794374bafce63f7c1d8bf4efe1
+DIST bash52-033 2131 BLAKE2B 67d334ac5874b785e449cde3b8e3999fd6fa91da847d7ee28320959ed4db5a0e841681eed29fe2fab20dbb8ff4894d86b04c44435ced1be44a67ca117bc9093e SHA512 698b7917c0c7147ef4d7a6f488013c10b4156b7f6bfda6e974010728eb17bfaae3666cfabe361afe7693fe9480bf44ec9ba6e73e7b572bf438f072d04ab6d4bc
+DIST bash52-033.sig 95 BLAKE2B 6ce2cb4678e74df48ec7e03ba95228d2d4171d5592512d55bee4c92a6b61215fb2782218ed0ca5a87f5241a71889cb32f1dbc15c50c73874f4de152996672547 SHA512 180d104cd3705cf5179ae25ad04955d9bcacd53aa2aeebf6e3b4bf9553b2e4a96ccaad776bdc92c8119911e4a834a81047bda34f33a467604745b05cb95be5bf
+DIST bash52-034 4134 BLAKE2B d01dc67397e7d85087bcbe5aeddd1a57afc3980e52f53ed8246211d8b282894650b563e52079132f8265da7370c13a76dffefd0a04bcefb7cc2a46575e50672b SHA512 4891a417a5aadb3249c89dcfce66ac6c42e06cfa9e85c86bde82472ac0b27c58e49650aa69b10333e7b7d6ff0b7f557054b72919c45359402060e0ab491a96ac
+DIST bash52-034.sig 95 BLAKE2B 124e05e5b51593a4ab56dd77d63e1bc863161eec55e99d9a954fb95e406e20a11c489dc049128a9ece6bce03124b7f6da41af925a9c188bfbcdb9f4b7a9deddc SHA512 fe32a1ce5207faa731efd25ae7ddb080852f6980f871b692dc8ff1c7671656d4bc6eaa04e435530a9ba19728686e33dd253c2843106fd15388e5c389f667d3d0
+DIST bash52-035 3413 BLAKE2B 308bdea38fc42c5267046b4e6a1603dc2379b4c92856c9c3431db655a48704887b1d405ba6a4640404d1e06ef30baffaf0fb4e55b015ec5479f9edde170e73e9 SHA512 100fa9fe308fb98b1985f915e0298d4d62ec57612af2c42acf08b86343c1f570c92890c6b6e355340ef6ed14cfd6849dbf1d3908602fcfae1369a9d52c11d4fd
+DIST bash52-035.sig 95 BLAKE2B 086e3d7250900ba783fb579481c2943092a46571eed3d848289924b3cea9a1cbdcde89282da9e123b115f849ace2bac7930b6095bb848f8c1397d41c4b176fe1 SHA512 d43f228e1515469961c99cd0cc2968ceeb6b1d59a30787a72822d37bee53546d8654deee84abfe336bfae1adffa4f24153b56abbe1a9a54c52bedfd4c3d4b4ff
+DIST bash52-036 5941 BLAKE2B e86b0df8ea7ace1ce4bc6f269de389f2f85fbe20e59e6a1e88abe99b5497382e441c9e9ba9f74c97512e0852179fc35dc781bd0da3ab664c60bed2d5d7f20f19 SHA512 d27a582172309087da82be97fab2b80163918d2c98659eda9686a13a5a567927ea260cd46daaed0cf22bde453575e94570b0545f0be9b8ea56576df8dac3b18a
+DIST bash52-036.sig 95 BLAKE2B 5ed270f26471e08456f73498ea8110c514b8e1bae424182f4cf530ab6e4f89a7946cabd3f7dd703f4f4bab7de9c73922e7be688df18df485cd64a33ce98df223 SHA512 7a26b606ab0d7a5716ac49bd1492e3b3480c3764aaec64e1763a2beda7a962c81a4066887c950b3bdd1ada317b790bd985f8b858e78c7cb8eb4a2bd02f1b07cd
+DIST bash52-037 2835 BLAKE2B 4af190d53b498d6d4403f64f39060f1add17edfe3e48b4b58a4377d1e96caa93017aed3df7011a64c99fd908af967603ed287e6bbb0380a8569d170779d8f26a SHA512 3e104dff63dabceea2f56f9dc58869d48a71ce61c3c8aff4f289d2f4a47d4325e70178d520c265a25ddb2227e0b78f08177fcd594470e5e81f4116aad282b4de
+DIST bash52-037.sig 95 BLAKE2B e3cfa89933fe59159a44dc20832406d3c42e28ac0c33674bf369a2f20a1d9de3e985bd178640f17be7b45a4fe3f96c72f80124384cec42fa263eb95586150a3b SHA512 437a69a167a4b889fca40b03eb2dcaa1ddc53db8fde924a6f8bcd21c3ac0c7629cb87b7bc08fa3b16f46b05c6a198a01dce6af3d2b761429345acd361df105dd
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240821.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37.ebuild
similarity index 92%
rename from sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240821.ebuild
rename to sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37.ebuild
index fbf88a2f037..eb04fa03166 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240821.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37.ebuild
@@ -15,22 +15,22 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()
 
-# Determine the patchlevel.
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
 case ${PV} in
+	*_p*)
+		PLEVEL=${PV##*_p}
+		;;
 	9999|*_alpha*|*_beta*|*_rc*)
 		# Set a negative patchlevel to indicate that it's a pre-release.
 		PLEVEL=-1
 		;;
-	*_p*)
-		PLEVEL=${PV##*_p}
-		;;
 	*)
 		PLEVEL=0
 esac
 
 # The version of readline this bash normally ships with. Note that we only use
 # the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_alpha"
+READLINE_VER="8.2_p1"
 
 DESCRIPTION="The standard GNU Bourne again shell"
 HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
@@ -39,15 +39,6 @@ if [[ ${PV} == 9999 ]]; then
 	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
 	EGIT_BRANCH=devel
 	inherit git-r3
-elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-	# It can be useful to have snapshots in the pre-release period once
-	# the first alpha is out, as various bugs get reported and fixed from
-	# the alpha, and the next pre-release is usually quite far away.
-	#
-	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="e327891b52513bef0b34aac625c44f8fa6811f53"
-	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.xz -> ${P}-${BASH_COMMIT}.tar.xz"
-	S=${WORKDIR}/${PN}-${BASH_COMMIT}
 else
 	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
 
@@ -61,7 +52,6 @@ else
 	done
 
 	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
-	S=${WORKDIR}/${MY_P}
 
 	unset -v my_urls my_p my_patch_idx my_patch_ver
 fi
@@ -70,10 +60,12 @@ if [[ ${GENTOO_PATCH_VER} ]]; then
 	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
 fi
 
+S=${WORKDIR}/${MY_P}
+
 LICENSE="GPL-3+"
 SLOT="0"
 if (( PLEVEL >= 0 )); then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
 
@@ -101,6 +93,11 @@ PATCHES=(
 
 	# Patches to or from Chet, posted to the bug-bash mailing list.
 	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
+	"${FILESDIR}/${PN}-5.2_p15-random-ub.patch"
+	"${FILESDIR}/${PN}-5.2_p15-configure-clang16.patch"
+	"${FILESDIR}/${PN}-5.2_p21-wpointer-to-int.patch"
+	"${FILESDIR}/${PN}-5.2_p32-memory-leaks.patch"
+	"${FILESDIR}/${PN}-5.2_p32-read-delimiter-in-invalid-mbchar.patch"
 )
 
 pkg_setup() {
@@ -122,8 +119,6 @@ src_unpack() {
 
 	if [[ ${PV} == 9999 ]]; then
 		git-r3_src_unpack
-	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-		default
 	else
 		if use verify-sig; then
 			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
@@ -179,10 +174,6 @@ src_configure() {
 	# may misbehave at runtime.
 	unset -v YACC
 
-	# wcsnwidth(), substring() issues with -Wlto-type-mismatch, reported
-	# upstream to Chet by email.
-	filter-lto
-
 	myconf=(
 		--disable-profiling
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240823.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240823.ebuild
deleted file mode 100644
index 9f651548a1b..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240823.ebuild
+++ /dev/null
@@ -1,411 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
-inherit flag-o-matic toolchain-funcs prefix verify-sig
-
-# Uncomment if we have a patchset.
-#GENTOO_PATCH_DEV="sam"
-#GENTOO_PATCH_VER="${PV}"
-
-MY_PV=${PV/_p*}
-MY_PV=${MY_PV/_/-}
-MY_P=${PN}-${MY_PV}
-MY_PATCHES=()
-
-# Determine the patchlevel.
-case ${PV} in
-	9999|*_alpha*|*_beta*|*_rc*)
-		# Set a negative patchlevel to indicate that it's a pre-release.
-		PLEVEL=-1
-		;;
-	*_p*)
-		PLEVEL=${PV##*_p}
-		;;
-	*)
-		PLEVEL=0
-esac
-
-# The version of readline this bash normally ships with. Note that we only use
-# the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_alpha"
-
-DESCRIPTION="The standard GNU Bourne again shell"
-HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
-
-if [[ ${PV} == 9999 ]]; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
-	EGIT_BRANCH=devel
-	inherit git-r3
-elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-	# It can be useful to have snapshots in the pre-release period once
-	# the first alpha is out, as various bugs get reported and fixed from
-	# the alpha, and the next pre-release is usually quite far away.
-	#
-	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="2e01122fe78eb5a42c9b9f3ca46b91f895959675"
-	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.xz -> ${P}-${BASH_COMMIT}.tar.xz"
-	S=${WORKDIR}/${PN}-${BASH_COMMIT}
-else
-	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
-
-	# bash-5.1 -> bash51
-	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
-
-	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
-		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
-		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
-		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
-	done
-
-	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
-	S=${WORKDIR}/${MY_P}
-
-	unset -v my_urls my_p my_patch_idx my_patch_ver
-fi
-
-if [[ ${GENTOO_PATCH_VER} ]]; then
-	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
-fi
-
-LICENSE="GPL-3+"
-SLOT="0"
-if (( PLEVEL >= 0 )); then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
-
-DEPEND="
-	>=sys-libs/ncurses-5.2-r2:=
-	nls? ( virtual/libintl )
-"
-if (( PLEVEL >= 0 )); then
-	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
-fi
-RDEPEND="
-	${DEPEND}
-"
-# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
-BDEPEND="
-	pgo? ( dev-util/gperf )
-	verify-sig? ( sec-keys/openpgp-keys-chetramey )
-"
-
-# EAPI 8 tries to append it but it doesn't exist here.
-QA_CONFIGURE_OPTIONS="--disable-static"
-
-PATCHES=(
-	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
-
-	# Patches to or from Chet, posted to the bug-bash mailing list.
-	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
-)
-
-pkg_setup() {
-	# bug #7332
-	if is-flag -malign-double; then
-		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
-		eerror "as it breaks LFS (struct stat64) on x86."
-		die "remove -malign-double from your CFLAGS mr ricer"
-	fi
-
-	if use bashlogger; then
-		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
-		ewarn "This will log ALL output you enter into the shell, you have been warned."
-	fi
-}
-
-src_unpack() {
-	local patch
-
-	if [[ ${PV} == 9999 ]]; then
-		git-r3_src_unpack
-	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-		default
-	else
-		if use verify-sig; then
-			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
-
-			for patch in "${MY_PATCHES[@]}"; do
-				verify-sig_verify_detached "${patch}"{,.sig}
-			done
-		fi
-
-		unpack "${MY_P}.tar.gz"
-
-		if [[ ${GENTOO_PATCH_VER} ]]; then
-			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
-		fi
-	fi
-}
-
-src_prepare() {
-	# Include official patches.
-	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
-
-	# Clean out local libs so we know we use system ones w/releases. The
-	# touch utility is invoked for the benefit of config.status.
-	if (( PLEVEL >= 0 )); then
-		rm -rf lib/{readline,termcap}/* \
-		&& touch lib/{readline,termcap}/Makefile.in \
-		&& sed -i -E 's:\$[{(](RL|HIST)_LIBSRC[)}]/[[:alpha:]_-]*\.h::g' Makefile.in \
-		|| die
-	fi
-
-	# Prefixify hardcoded path names. No-op for non-prefix.
-	hprefixify pathnames.h.in
-
-	# Avoid regenerating docs after patches, bug #407985.
-	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
-	&& touch -r . doc/* \
-	|| die
-
-	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
-	rm tests/run-jobs || die
-
-	eapply -p0 "${PATCHES[@]}"
-	eapply_user
-}
-
-src_configure() {
-	local -a myconf
-
-	# Upstream only test with Bison and require GNUisms like YYEOF and
-	# YYERRCODE. The former at least may be in POSIX soon:
-	# https://www.austingroupbugs.net/view.php?id=1269.
-	# configure warns on use of non-Bison but doesn't abort. The result
-	# may misbehave at runtime.
-	unset -v YACC
-
-	# wcsnwidth(), substring() issues with -Wlto-type-mismatch, reported
-	# upstream to Chet by email.
-	filter-lto
-
-	myconf=(
-		--disable-profiling
-
-		# Force linking with system curses ... the bundled termcap lib
-		# sucks bad compared to ncurses.  For the most part, ncurses
-		# is here because readline needs it.  But bash itself calls
-		# ncurses in one or two small places :(.
-		--with-curses
-
-		$(use_enable mem-scramble)
-		$(use_enable net net-redirections)
-		$(use_enable readline)
-		$(use_enable readline bang-history)
-		$(use_enable readline history)
-		$(use_with afs)
-		$(use_with mem-scramble bash-malloc)
-	)
-
-	# For descriptions of these, see config-top.h.
-	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
-	append-cppflags \
-		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
-		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
-		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
-		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
-		-DNON_INTERACTIVE_LOGIN_SHELLS \
-		-DSSH_SOURCE_BASHRC \
-		$(use bashlogger && echo -DSYSLOG_HISTORY)
-
-	use nls || myconf+=( --disable-nls )
-
-	if (( PLEVEL >= 0 )); then
-		# Historically, we always used the builtin readline, but since
-		# our handling of SONAME upgrades has gotten much more stable
-		# in the PM (and the readline ebuild itself preserves the old
-		# libs during upgrades), linking against the system copy should
-		# be safe.
-		# Exact cached version here doesn't really matter as long as it
-		# is at least what's in the DEPEND up above.
-		export ac_cv_rl_version=${READLINE_VER%%_*}
-
-		# Use system readline only with released versions.
-		myconf+=( --with-installed-readline=. )
-	fi
-
-	if use plugins; then
-		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
-	else
-		# Disable the plugins logic by hand since bash doesn't provide
-		# a way of doing it.
-		export ac_cv_func_dl{close,open,sym}=no \
-			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
-
-		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
-	fi
-
-	# bug #444070
-	tc-export AR
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	local -a pgo_generate_flags pgo_use_flags
-	local flag
-
-	# -fprofile-partial-training because upstream notes the test suite isn't
-	# super comprehensive.
-	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
-	if use pgo; then
-		pgo_generate_flags=(
-			-fprofile-update=atomic
-			-fprofile-dir="${T}"/pgo
-			-fprofile-generate="${T}"/pgo
-		)
-		pgo_use_flags=(
-			-fprofile-use="${T}"/pgo
-			-fprofile-dir="${T}"/pgo
-		)
-		if flag=$(test-flags-CC -fprofile-partial-training); then
-			pgo_generate_flags+=( "${flag}" )
-			pgo_use_flags+=( "${flag}" )
-		fi
-	fi
-
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
-	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
-
-	# Build Bash and run its tests to generate profiles.
-	if (( ${#pgo_generate_flags[@]} )); then
-		# Used in test suite.
-		unset -v A
-
-		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
-
-		if tc-is-clang; then
-			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
-		fi
-
-		# Rebuild Bash using the profiling data we just generated.
-		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
-		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
-	fi
-}
-
-src_test() {
-	# Used in test suite.
-	unset -v A
-
-	default
-}
-
-src_install() {
-	local d f
-
-	default
-
-	my_prefixify() {
-		while read -r; do
-			if [[ $REPLY == *$1* ]]; then
-				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
-			fi
-			printf '%s\n' "${REPLY}" || ! break
-		done < "$2" || die
-	}
-
-	dodir /bin
-	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
-	dosym bash /bin/rbash
-
-	insinto /etc/bash
-	doins "${FILESDIR}"/bash_logout
-	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
-
-	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color.bash | newins - 10-gentoo-color.bash
-	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r1.bash 10-gentoo-title.bash
-	if [[ ! ${EPREFIX} ]]; then
-		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
-	fi
-
-	insinto /etc/skel
-	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
-	done
-
-	if use plugins; then
-		exeinto "/usr/$(get_libdir)/bash"
-		set -- examples/loadables/*.o
-		doexe "${@%.o}"
-
-		insinto /usr/include/bash-plugins
-		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
-	fi
-
-	if use examples; then
-		for d in examples/{functions,misc,scripts,startup-files}; do
-			exeinto "/usr/share/doc/${PF}/${d}"
-			docinto "${d}"
-			for f in "${d}"/*; do
-				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
-					doexe "${f}"
-				else
-					dodoc "${f}"
-				fi
-			done
-		done
-	fi
-
-	# Install bash_builtins.1 and rbash.1.
-	emake -C doc DESTDIR="${D}" install_builtins
-	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
-	doman "${T}"/rbash.1
-
-	newdoc CWRU/changelog ChangeLog
-	dosym bash.info /usr/share/info/bashref.info
-}
-
-pkg_preinst() {
-	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
-		mkdir -p -- "${EROOT}"/etc/bash \
-		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
-		|| die
-	fi
-}
-
-pkg_postinst() {
-	local old_ver
-
-	# If /bin/sh does not exist, provide it.
-	if [[ ! -e ${EROOT}/bin/sh ]]; then
-		ln -sf -- bash "${EROOT}"/bin/sh || die
-	fi
-
-	read -r old_ver <<<"${REPLACING_VERSIONS}"
-	if [[ ! $old_ver ]]; then
-		:
-	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
-		return
-	fi
-
-	while read -r; do ewarn "${REPLY}"; done <<'EOF'
-Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
-
-Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
-characteristics of the operating environment, it may contain a command to set
-the terminal's window title. Those who were already choosing to customise the
-PROMPT_COMMAND variable are now advised to append their commands like so:
-
-PROMPT_COMMAND+=('custom command goes here')
-
-Gentoo no longer defaults to having bash set the window title in the case
-that the terminal is controlled by sshd(8), unless screen is launched on the
-remote side or the terminal reliably supports saving and restoring the title
-(as alacritty, foot and tmux do). Those wanting for the title to be set
-regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
-drop-in - to set PROMPT_COMMMAND like so:
-
-PROMPT_COMMAND=(genfun_set_win_title)
-
-Those who would prefer for bash never to interfere with the window title may
-now opt out of the default title setting behaviour, either with the "unset -v
-PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
-EOF
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240828.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240828.ebuild
deleted file mode 100644
index e1886c3f1cd..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240828.ebuild
+++ /dev/null
@@ -1,411 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
-inherit flag-o-matic toolchain-funcs prefix verify-sig
-
-# Uncomment if we have a patchset.
-#GENTOO_PATCH_DEV="sam"
-#GENTOO_PATCH_VER="${PV}"
-
-MY_PV=${PV/_p*}
-MY_PV=${MY_PV/_/-}
-MY_P=${PN}-${MY_PV}
-MY_PATCHES=()
-
-# Determine the patchlevel.
-case ${PV} in
-	9999|*_alpha*|*_beta*|*_rc*)
-		# Set a negative patchlevel to indicate that it's a pre-release.
-		PLEVEL=-1
-		;;
-	*_p*)
-		PLEVEL=${PV##*_p}
-		;;
-	*)
-		PLEVEL=0
-esac
-
-# The version of readline this bash normally ships with. Note that we only use
-# the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_alpha"
-
-DESCRIPTION="The standard GNU Bourne again shell"
-HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
-
-if [[ ${PV} == 9999 ]]; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
-	EGIT_BRANCH=devel
-	inherit git-r3
-elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-	# It can be useful to have snapshots in the pre-release period once
-	# the first alpha is out, as various bugs get reported and fixed from
-	# the alpha, and the next pre-release is usually quite far away.
-	#
-	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="2610d40b32301cd7256bf1dfc49c9f8bfe0dcd53"
-	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.xz -> ${P}-${BASH_COMMIT}.tar.xz"
-	S=${WORKDIR}/${PN}-${BASH_COMMIT}
-else
-	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
-
-	# bash-5.1 -> bash51
-	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
-
-	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
-		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
-		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
-		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
-	done
-
-	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
-	S=${WORKDIR}/${MY_P}
-
-	unset -v my_urls my_p my_patch_idx my_patch_ver
-fi
-
-if [[ ${GENTOO_PATCH_VER} ]]; then
-	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
-fi
-
-LICENSE="GPL-3+"
-SLOT="0"
-if (( PLEVEL >= 0 )); then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
-
-DEPEND="
-	>=sys-libs/ncurses-5.2-r2:=
-	nls? ( virtual/libintl )
-"
-if (( PLEVEL >= 0 )); then
-	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
-fi
-RDEPEND="
-	${DEPEND}
-"
-# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
-BDEPEND="
-	pgo? ( dev-util/gperf )
-	verify-sig? ( sec-keys/openpgp-keys-chetramey )
-"
-
-# EAPI 8 tries to append it but it doesn't exist here.
-QA_CONFIGURE_OPTIONS="--disable-static"
-
-PATCHES=(
-	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
-
-	# Patches to or from Chet, posted to the bug-bash mailing list.
-	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
-)
-
-pkg_setup() {
-	# bug #7332
-	if is-flag -malign-double; then
-		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
-		eerror "as it breaks LFS (struct stat64) on x86."
-		die "remove -malign-double from your CFLAGS mr ricer"
-	fi
-
-	if use bashlogger; then
-		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
-		ewarn "This will log ALL output you enter into the shell, you have been warned."
-	fi
-}
-
-src_unpack() {
-	local patch
-
-	if [[ ${PV} == 9999 ]]; then
-		git-r3_src_unpack
-	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-		default
-	else
-		if use verify-sig; then
-			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
-
-			for patch in "${MY_PATCHES[@]}"; do
-				verify-sig_verify_detached "${patch}"{,.sig}
-			done
-		fi
-
-		unpack "${MY_P}.tar.gz"
-
-		if [[ ${GENTOO_PATCH_VER} ]]; then
-			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
-		fi
-	fi
-}
-
-src_prepare() {
-	# Include official patches.
-	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
-
-	# Clean out local libs so we know we use system ones w/releases. The
-	# touch utility is invoked for the benefit of config.status.
-	if (( PLEVEL >= 0 )); then
-		rm -rf lib/{readline,termcap}/* \
-		&& touch lib/{readline,termcap}/Makefile.in \
-		&& sed -i -E 's:\$[{(](RL|HIST)_LIBSRC[)}]/[[:alpha:]_-]*\.h::g' Makefile.in \
-		|| die
-	fi
-
-	# Prefixify hardcoded path names. No-op for non-prefix.
-	hprefixify pathnames.h.in
-
-	# Avoid regenerating docs after patches, bug #407985.
-	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
-	&& touch -r . doc/* \
-	|| die
-
-	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
-	rm tests/run-jobs || die
-
-	eapply -p0 "${PATCHES[@]}"
-	eapply_user
-}
-
-src_configure() {
-	local -a myconf
-
-	# Upstream only test with Bison and require GNUisms like YYEOF and
-	# YYERRCODE. The former at least may be in POSIX soon:
-	# https://www.austingroupbugs.net/view.php?id=1269.
-	# configure warns on use of non-Bison but doesn't abort. The result
-	# may misbehave at runtime.
-	unset -v YACC
-
-	# wcsnwidth(), substring() issues with -Wlto-type-mismatch, reported
-	# upstream to Chet by email.
-	filter-lto
-
-	myconf=(
-		--disable-profiling
-
-		# Force linking with system curses ... the bundled termcap lib
-		# sucks bad compared to ncurses.  For the most part, ncurses
-		# is here because readline needs it.  But bash itself calls
-		# ncurses in one or two small places :(.
-		--with-curses
-
-		$(use_enable mem-scramble)
-		$(use_enable net net-redirections)
-		$(use_enable readline)
-		$(use_enable readline bang-history)
-		$(use_enable readline history)
-		$(use_with afs)
-		$(use_with mem-scramble bash-malloc)
-	)
-
-	# For descriptions of these, see config-top.h.
-	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
-	append-cppflags \
-		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
-		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
-		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
-		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
-		-DNON_INTERACTIVE_LOGIN_SHELLS \
-		-DSSH_SOURCE_BASHRC \
-		$(use bashlogger && echo -DSYSLOG_HISTORY)
-
-	use nls || myconf+=( --disable-nls )
-
-	if (( PLEVEL >= 0 )); then
-		# Historically, we always used the builtin readline, but since
-		# our handling of SONAME upgrades has gotten much more stable
-		# in the PM (and the readline ebuild itself preserves the old
-		# libs during upgrades), linking against the system copy should
-		# be safe.
-		# Exact cached version here doesn't really matter as long as it
-		# is at least what's in the DEPEND up above.
-		export ac_cv_rl_version=${READLINE_VER%%_*}
-
-		# Use system readline only with released versions.
-		myconf+=( --with-installed-readline=. )
-	fi
-
-	if use plugins; then
-		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
-	else
-		# Disable the plugins logic by hand since bash doesn't provide
-		# a way of doing it.
-		export ac_cv_func_dl{close,open,sym}=no \
-			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
-
-		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
-	fi
-
-	# bug #444070
-	tc-export AR
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	local -a pgo_generate_flags pgo_use_flags
-	local flag
-
-	# -fprofile-partial-training because upstream notes the test suite isn't
-	# super comprehensive.
-	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
-	if use pgo; then
-		pgo_generate_flags=(
-			-fprofile-update=atomic
-			-fprofile-dir="${T}"/pgo
-			-fprofile-generate="${T}"/pgo
-		)
-		pgo_use_flags=(
-			-fprofile-use="${T}"/pgo
-			-fprofile-dir="${T}"/pgo
-		)
-		if flag=$(test-flags-CC -fprofile-partial-training); then
-			pgo_generate_flags+=( "${flag}" )
-			pgo_use_flags+=( "${flag}" )
-		fi
-	fi
-
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
-	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
-
-	# Build Bash and run its tests to generate profiles.
-	if (( ${#pgo_generate_flags[@]} )); then
-		# Used in test suite.
-		unset -v A
-
-		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
-
-		if tc-is-clang; then
-			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
-		fi
-
-		# Rebuild Bash using the profiling data we just generated.
-		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
-		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
-	fi
-}
-
-src_test() {
-	# Used in test suite.
-	unset -v A
-
-	default
-}
-
-src_install() {
-	local d f
-
-	default
-
-	my_prefixify() {
-		while read -r; do
-			if [[ $REPLY == *$1* ]]; then
-				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
-			fi
-			printf '%s\n' "${REPLY}" || ! break
-		done < "$2" || die
-	}
-
-	dodir /bin
-	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
-	dosym bash /bin/rbash
-
-	insinto /etc/bash
-	doins "${FILESDIR}"/bash_logout
-	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
-
-	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color.bash | newins - 10-gentoo-color.bash
-	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r1.bash 10-gentoo-title.bash
-	if [[ ! ${EPREFIX} ]]; then
-		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
-	fi
-
-	insinto /etc/skel
-	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
-	done
-
-	if use plugins; then
-		exeinto "/usr/$(get_libdir)/bash"
-		set -- examples/loadables/*.o
-		doexe "${@%.o}"
-
-		insinto /usr/include/bash-plugins
-		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
-	fi
-
-	if use examples; then
-		for d in examples/{functions,misc,scripts,startup-files}; do
-			exeinto "/usr/share/doc/${PF}/${d}"
-			docinto "${d}"
-			for f in "${d}"/*; do
-				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
-					doexe "${f}"
-				else
-					dodoc "${f}"
-				fi
-			done
-		done
-	fi
-
-	# Install bash_builtins.1 and rbash.1.
-	emake -C doc DESTDIR="${D}" install_builtins
-	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
-	doman "${T}"/rbash.1
-
-	newdoc CWRU/changelog ChangeLog
-	dosym bash.info /usr/share/info/bashref.info
-}
-
-pkg_preinst() {
-	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
-		mkdir -p -- "${EROOT}"/etc/bash \
-		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
-		|| die
-	fi
-}
-
-pkg_postinst() {
-	local old_ver
-
-	# If /bin/sh does not exist, provide it.
-	if [[ ! -e ${EROOT}/bin/sh ]]; then
-		ln -sf -- bash "${EROOT}"/bin/sh || die
-	fi
-
-	read -r old_ver <<<"${REPLACING_VERSIONS}"
-	if [[ ! $old_ver ]]; then
-		:
-	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
-		return
-	fi
-
-	while read -r; do ewarn "${REPLY}"; done <<'EOF'
-Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
-
-Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
-characteristics of the operating environment, it may contain a command to set
-the terminal's window title. Those who were already choosing to customise the
-PROMPT_COMMAND variable are now advised to append their commands like so:
-
-PROMPT_COMMAND+=('custom command goes here')
-
-Gentoo no longer defaults to having bash set the window title in the case
-that the terminal is controlled by sshd(8), unless screen is launched on the
-remote side or the terminal reliably supports saving and restoring the title
-(as alacritty, foot and tmux do). Those wanting for the title to be set
-regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
-drop-in - to set PROMPT_COMMMAND like so:
-
-PROMPT_COMMAND=(genfun_set_win_title)
-
-Those who would prefer for bash never to interfere with the window title may
-now opt out of the default title setting behaviour, either with the "unset -v
-PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
-EOF
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240904.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240904.ebuild
deleted file mode 100644
index 1842c6cf14d..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240904.ebuild
+++ /dev/null
@@ -1,411 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
-inherit flag-o-matic toolchain-funcs prefix verify-sig
-
-# Uncomment if we have a patchset.
-#GENTOO_PATCH_DEV="sam"
-#GENTOO_PATCH_VER="${PV}"
-
-MY_PV=${PV/_p*}
-MY_PV=${MY_PV/_/-}
-MY_P=${PN}-${MY_PV}
-MY_PATCHES=()
-
-# Determine the patchlevel.
-case ${PV} in
-	9999|*_alpha*|*_beta*|*_rc*)
-		# Set a negative patchlevel to indicate that it's a pre-release.
-		PLEVEL=-1
-		;;
-	*_p*)
-		PLEVEL=${PV##*_p}
-		;;
-	*)
-		PLEVEL=0
-esac
-
-# The version of readline this bash normally ships with. Note that we only use
-# the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_alpha"
-
-DESCRIPTION="The standard GNU Bourne again shell"
-HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
-
-if [[ ${PV} == 9999 ]]; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
-	EGIT_BRANCH=devel
-	inherit git-r3
-elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-	# It can be useful to have snapshots in the pre-release period once
-	# the first alpha is out, as various bugs get reported and fixed from
-	# the alpha, and the next pre-release is usually quite far away.
-	#
-	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="5576c26da8e0ad74048203398acb493c65fd3476"
-	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.xz -> ${P}-${BASH_COMMIT}.tar.xz"
-	S=${WORKDIR}/${PN}-${BASH_COMMIT}
-else
-	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
-
-	# bash-5.1 -> bash51
-	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
-
-	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
-		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
-		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
-		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
-	done
-
-	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
-	S=${WORKDIR}/${MY_P}
-
-	unset -v my_urls my_p my_patch_idx my_patch_ver
-fi
-
-if [[ ${GENTOO_PATCH_VER} ]]; then
-	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
-fi
-
-LICENSE="GPL-3+"
-SLOT="0"
-if (( PLEVEL >= 0 )); then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
-
-DEPEND="
-	>=sys-libs/ncurses-5.2-r2:=
-	nls? ( virtual/libintl )
-"
-if (( PLEVEL >= 0 )); then
-	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
-fi
-RDEPEND="
-	${DEPEND}
-"
-# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
-BDEPEND="
-	pgo? ( dev-util/gperf )
-	verify-sig? ( sec-keys/openpgp-keys-chetramey )
-"
-
-# EAPI 8 tries to append it but it doesn't exist here.
-QA_CONFIGURE_OPTIONS="--disable-static"
-
-PATCHES=(
-	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
-
-	# Patches to or from Chet, posted to the bug-bash mailing list.
-	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
-)
-
-pkg_setup() {
-	# bug #7332
-	if is-flag -malign-double; then
-		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
-		eerror "as it breaks LFS (struct stat64) on x86."
-		die "remove -malign-double from your CFLAGS mr ricer"
-	fi
-
-	if use bashlogger; then
-		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
-		ewarn "This will log ALL output you enter into the shell, you have been warned."
-	fi
-}
-
-src_unpack() {
-	local patch
-
-	if [[ ${PV} == 9999 ]]; then
-		git-r3_src_unpack
-	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-		default
-	else
-		if use verify-sig; then
-			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
-
-			for patch in "${MY_PATCHES[@]}"; do
-				verify-sig_verify_detached "${patch}"{,.sig}
-			done
-		fi
-
-		unpack "${MY_P}.tar.gz"
-
-		if [[ ${GENTOO_PATCH_VER} ]]; then
-			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
-		fi
-	fi
-}
-
-src_prepare() {
-	# Include official patches.
-	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
-
-	# Clean out local libs so we know we use system ones w/releases. The
-	# touch utility is invoked for the benefit of config.status.
-	if (( PLEVEL >= 0 )); then
-		rm -rf lib/{readline,termcap}/* \
-		&& touch lib/{readline,termcap}/Makefile.in \
-		&& sed -i -E 's:\$[{(](RL|HIST)_LIBSRC[)}]/[[:alpha:]_-]*\.h::g' Makefile.in \
-		|| die
-	fi
-
-	# Prefixify hardcoded path names. No-op for non-prefix.
-	hprefixify pathnames.h.in
-
-	# Avoid regenerating docs after patches, bug #407985.
-	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
-	&& touch -r . doc/* \
-	|| die
-
-	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
-	rm tests/run-jobs || die
-
-	eapply -p0 "${PATCHES[@]}"
-	eapply_user
-}
-
-src_configure() {
-	local -a myconf
-
-	# Upstream only test with Bison and require GNUisms like YYEOF and
-	# YYERRCODE. The former at least may be in POSIX soon:
-	# https://www.austingroupbugs.net/view.php?id=1269.
-	# configure warns on use of non-Bison but doesn't abort. The result
-	# may misbehave at runtime.
-	unset -v YACC
-
-	# wcsnwidth(), substring() issues with -Wlto-type-mismatch, reported
-	# upstream to Chet by email.
-	filter-lto
-
-	myconf=(
-		--disable-profiling
-
-		# Force linking with system curses ... the bundled termcap lib
-		# sucks bad compared to ncurses.  For the most part, ncurses
-		# is here because readline needs it.  But bash itself calls
-		# ncurses in one or two small places :(.
-		--with-curses
-
-		$(use_enable mem-scramble)
-		$(use_enable net net-redirections)
-		$(use_enable readline)
-		$(use_enable readline bang-history)
-		$(use_enable readline history)
-		$(use_with afs)
-		$(use_with mem-scramble bash-malloc)
-	)
-
-	# For descriptions of these, see config-top.h.
-	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
-	append-cppflags \
-		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
-		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
-		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
-		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
-		-DNON_INTERACTIVE_LOGIN_SHELLS \
-		-DSSH_SOURCE_BASHRC \
-		$(use bashlogger && echo -DSYSLOG_HISTORY)
-
-	use nls || myconf+=( --disable-nls )
-
-	if (( PLEVEL >= 0 )); then
-		# Historically, we always used the builtin readline, but since
-		# our handling of SONAME upgrades has gotten much more stable
-		# in the PM (and the readline ebuild itself preserves the old
-		# libs during upgrades), linking against the system copy should
-		# be safe.
-		# Exact cached version here doesn't really matter as long as it
-		# is at least what's in the DEPEND up above.
-		export ac_cv_rl_version=${READLINE_VER%%_*}
-
-		# Use system readline only with released versions.
-		myconf+=( --with-installed-readline=. )
-	fi
-
-	if use plugins; then
-		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
-	else
-		# Disable the plugins logic by hand since bash doesn't provide
-		# a way of doing it.
-		export ac_cv_func_dl{close,open,sym}=no \
-			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
-
-		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
-	fi
-
-	# bug #444070
-	tc-export AR
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	local -a pgo_generate_flags pgo_use_flags
-	local flag
-
-	# -fprofile-partial-training because upstream notes the test suite isn't
-	# super comprehensive.
-	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
-	if use pgo; then
-		pgo_generate_flags=(
-			-fprofile-update=atomic
-			-fprofile-dir="${T}"/pgo
-			-fprofile-generate="${T}"/pgo
-		)
-		pgo_use_flags=(
-			-fprofile-use="${T}"/pgo
-			-fprofile-dir="${T}"/pgo
-		)
-		if flag=$(test-flags-CC -fprofile-partial-training); then
-			pgo_generate_flags+=( "${flag}" )
-			pgo_use_flags+=( "${flag}" )
-		fi
-	fi
-
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
-	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
-
-	# Build Bash and run its tests to generate profiles.
-	if (( ${#pgo_generate_flags[@]} )); then
-		# Used in test suite.
-		unset -v A
-
-		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
-
-		if tc-is-clang; then
-			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
-		fi
-
-		# Rebuild Bash using the profiling data we just generated.
-		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
-		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
-	fi
-}
-
-src_test() {
-	# Used in test suite.
-	unset -v A
-
-	default
-}
-
-src_install() {
-	local d f
-
-	default
-
-	my_prefixify() {
-		while read -r; do
-			if [[ $REPLY == *$1* ]]; then
-				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
-			fi
-			printf '%s\n' "${REPLY}" || ! break
-		done < "$2" || die
-	}
-
-	dodir /bin
-	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
-	dosym bash /bin/rbash
-
-	insinto /etc/bash
-	doins "${FILESDIR}"/bash_logout
-	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
-
-	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color.bash | newins - 10-gentoo-color.bash
-	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r1.bash 10-gentoo-title.bash
-	if [[ ! ${EPREFIX} ]]; then
-		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
-	fi
-
-	insinto /etc/skel
-	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
-	done
-
-	if use plugins; then
-		exeinto "/usr/$(get_libdir)/bash"
-		set -- examples/loadables/*.o
-		doexe "${@%.o}"
-
-		insinto /usr/include/bash-plugins
-		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
-	fi
-
-	if use examples; then
-		for d in examples/{functions,misc,scripts,startup-files}; do
-			exeinto "/usr/share/doc/${PF}/${d}"
-			docinto "${d}"
-			for f in "${d}"/*; do
-				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
-					doexe "${f}"
-				else
-					dodoc "${f}"
-				fi
-			done
-		done
-	fi
-
-	# Install bash_builtins.1 and rbash.1.
-	emake -C doc DESTDIR="${D}" install_builtins
-	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
-	doman "${T}"/rbash.1
-
-	newdoc CWRU/changelog ChangeLog
-	dosym bash.info /usr/share/info/bashref.info
-}
-
-pkg_preinst() {
-	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
-		mkdir -p -- "${EROOT}"/etc/bash \
-		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
-		|| die
-	fi
-}
-
-pkg_postinst() {
-	local old_ver
-
-	# If /bin/sh does not exist, provide it.
-	if [[ ! -e ${EROOT}/bin/sh ]]; then
-		ln -sf -- bash "${EROOT}"/bin/sh || die
-	fi
-
-	read -r old_ver <<<"${REPLACING_VERSIONS}"
-	if [[ ! $old_ver ]]; then
-		:
-	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
-		return
-	fi
-
-	while read -r; do ewarn "${REPLY}"; done <<'EOF'
-Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
-
-Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
-characteristics of the operating environment, it may contain a command to set
-the terminal's window title. Those who were already choosing to customise the
-PROMPT_COMMAND variable are now advised to append their commands like so:
-
-PROMPT_COMMAND+=('custom command goes here')
-
-Gentoo no longer defaults to having bash set the window title in the case
-that the terminal is controlled by sshd(8), unless screen is launched on the
-remote side or the terminal reliably supports saving and restoring the title
-(as alacritty, foot and tmux do). Those wanting for the title to be set
-regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
-drop-in - to set PROMPT_COMMMAND like so:
-
-PROMPT_COMMAND=(genfun_set_win_title)
-
-Those who would prefer for bash never to interfere with the window title may
-now opt out of the default title setting behaviour, either with the "unset -v
-PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
-EOF
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240911.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240911.ebuild
deleted file mode 100644
index bfce5939aa1..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240911.ebuild
+++ /dev/null
@@ -1,411 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
-inherit flag-o-matic toolchain-funcs prefix verify-sig
-
-# Uncomment if we have a patchset.
-#GENTOO_PATCH_DEV="sam"
-#GENTOO_PATCH_VER="${PV}"
-
-MY_PV=${PV/_p*}
-MY_PV=${MY_PV/_/-}
-MY_P=${PN}-${MY_PV}
-MY_PATCHES=()
-
-# Determine the patchlevel.
-case ${PV} in
-	9999|*_alpha*|*_beta*|*_rc*)
-		# Set a negative patchlevel to indicate that it's a pre-release.
-		PLEVEL=-1
-		;;
-	*_p*)
-		PLEVEL=${PV##*_p}
-		;;
-	*)
-		PLEVEL=0
-esac
-
-# The version of readline this bash normally ships with. Note that we only use
-# the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_alpha"
-
-DESCRIPTION="The standard GNU Bourne again shell"
-HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
-
-if [[ ${PV} == 9999 ]]; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
-	EGIT_BRANCH=devel
-	inherit git-r3
-elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-	# It can be useful to have snapshots in the pre-release period once
-	# the first alpha is out, as various bugs get reported and fixed from
-	# the alpha, and the next pre-release is usually quite far away.
-	#
-	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="bc5ddc8698d56df588fd99864a650b834426ccf7"
-	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.xz -> ${P}-${BASH_COMMIT}.tar.xz"
-	S=${WORKDIR}/${PN}-${BASH_COMMIT}
-else
-	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
-
-	# bash-5.1 -> bash51
-	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
-
-	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
-		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
-		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
-		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
-	done
-
-	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
-	S=${WORKDIR}/${MY_P}
-
-	unset -v my_urls my_p my_patch_idx my_patch_ver
-fi
-
-if [[ ${GENTOO_PATCH_VER} ]]; then
-	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
-fi
-
-LICENSE="GPL-3+"
-SLOT="0"
-if (( PLEVEL >= 0 )); then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
-
-DEPEND="
-	>=sys-libs/ncurses-5.2-r2:=
-	nls? ( virtual/libintl )
-"
-if (( PLEVEL >= 0 )); then
-	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
-fi
-RDEPEND="
-	${DEPEND}
-"
-# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
-BDEPEND="
-	pgo? ( dev-util/gperf )
-	verify-sig? ( sec-keys/openpgp-keys-chetramey )
-"
-
-# EAPI 8 tries to append it but it doesn't exist here.
-QA_CONFIGURE_OPTIONS="--disable-static"
-
-PATCHES=(
-	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
-
-	# Patches to or from Chet, posted to the bug-bash mailing list.
-	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
-)
-
-pkg_setup() {
-	# bug #7332
-	if is-flag -malign-double; then
-		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
-		eerror "as it breaks LFS (struct stat64) on x86."
-		die "remove -malign-double from your CFLAGS mr ricer"
-	fi
-
-	if use bashlogger; then
-		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
-		ewarn "This will log ALL output you enter into the shell, you have been warned."
-	fi
-}
-
-src_unpack() {
-	local patch
-
-	if [[ ${PV} == 9999 ]]; then
-		git-r3_src_unpack
-	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-		default
-	else
-		if use verify-sig; then
-			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
-
-			for patch in "${MY_PATCHES[@]}"; do
-				verify-sig_verify_detached "${patch}"{,.sig}
-			done
-		fi
-
-		unpack "${MY_P}.tar.gz"
-
-		if [[ ${GENTOO_PATCH_VER} ]]; then
-			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
-		fi
-	fi
-}
-
-src_prepare() {
-	# Include official patches.
-	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
-
-	# Clean out local libs so we know we use system ones w/releases. The
-	# touch utility is invoked for the benefit of config.status.
-	if (( PLEVEL >= 0 )); then
-		rm -rf lib/{readline,termcap}/* \
-		&& touch lib/{readline,termcap}/Makefile.in \
-		&& sed -i -E 's:\$[{(](RL|HIST)_LIBSRC[)}]/[[:alpha:]_-]*\.h::g' Makefile.in \
-		|| die
-	fi
-
-	# Prefixify hardcoded path names. No-op for non-prefix.
-	hprefixify pathnames.h.in
-
-	# Avoid regenerating docs after patches, bug #407985.
-	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
-	&& touch -r . doc/* \
-	|| die
-
-	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
-	rm tests/run-jobs || die
-
-	eapply -p0 "${PATCHES[@]}"
-	eapply_user
-}
-
-src_configure() {
-	local -a myconf
-
-	# Upstream only test with Bison and require GNUisms like YYEOF and
-	# YYERRCODE. The former at least may be in POSIX soon:
-	# https://www.austingroupbugs.net/view.php?id=1269.
-	# configure warns on use of non-Bison but doesn't abort. The result
-	# may misbehave at runtime.
-	unset -v YACC
-
-	# wcsnwidth(), substring() issues with -Wlto-type-mismatch, reported
-	# upstream to Chet by email.
-	filter-lto
-
-	myconf=(
-		--disable-profiling
-
-		# Force linking with system curses ... the bundled termcap lib
-		# sucks bad compared to ncurses.  For the most part, ncurses
-		# is here because readline needs it.  But bash itself calls
-		# ncurses in one or two small places :(.
-		--with-curses
-
-		$(use_enable mem-scramble)
-		$(use_enable net net-redirections)
-		$(use_enable readline)
-		$(use_enable readline bang-history)
-		$(use_enable readline history)
-		$(use_with afs)
-		$(use_with mem-scramble bash-malloc)
-	)
-
-	# For descriptions of these, see config-top.h.
-	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
-	append-cppflags \
-		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
-		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
-		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
-		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
-		-DNON_INTERACTIVE_LOGIN_SHELLS \
-		-DSSH_SOURCE_BASHRC \
-		$(use bashlogger && echo -DSYSLOG_HISTORY)
-
-	use nls || myconf+=( --disable-nls )
-
-	if (( PLEVEL >= 0 )); then
-		# Historically, we always used the builtin readline, but since
-		# our handling of SONAME upgrades has gotten much more stable
-		# in the PM (and the readline ebuild itself preserves the old
-		# libs during upgrades), linking against the system copy should
-		# be safe.
-		# Exact cached version here doesn't really matter as long as it
-		# is at least what's in the DEPEND up above.
-		export ac_cv_rl_version=${READLINE_VER%%_*}
-
-		# Use system readline only with released versions.
-		myconf+=( --with-installed-readline=. )
-	fi
-
-	if use plugins; then
-		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
-	else
-		# Disable the plugins logic by hand since bash doesn't provide
-		# a way of doing it.
-		export ac_cv_func_dl{close,open,sym}=no \
-			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
-
-		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
-	fi
-
-	# bug #444070
-	tc-export AR
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	local -a pgo_generate_flags pgo_use_flags
-	local flag
-
-	# -fprofile-partial-training because upstream notes the test suite isn't
-	# super comprehensive.
-	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
-	if use pgo; then
-		pgo_generate_flags=(
-			-fprofile-update=atomic
-			-fprofile-dir="${T}"/pgo
-			-fprofile-generate="${T}"/pgo
-		)
-		pgo_use_flags=(
-			-fprofile-use="${T}"/pgo
-			-fprofile-dir="${T}"/pgo
-		)
-		if flag=$(test-flags-CC -fprofile-partial-training); then
-			pgo_generate_flags+=( "${flag}" )
-			pgo_use_flags+=( "${flag}" )
-		fi
-	fi
-
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
-	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
-
-	# Build Bash and run its tests to generate profiles.
-	if (( ${#pgo_generate_flags[@]} )); then
-		# Used in test suite.
-		unset -v A
-
-		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
-
-		if tc-is-clang; then
-			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
-		fi
-
-		# Rebuild Bash using the profiling data we just generated.
-		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
-		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
-	fi
-}
-
-src_test() {
-	# Used in test suite.
-	unset -v A
-
-	default
-}
-
-src_install() {
-	local d f
-
-	default
-
-	my_prefixify() {
-		while read -r; do
-			if [[ $REPLY == *$1* ]]; then
-				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
-			fi
-			printf '%s\n' "${REPLY}" || ! break
-		done < "$2" || die
-	}
-
-	dodir /bin
-	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
-	dosym bash /bin/rbash
-
-	insinto /etc/bash
-	doins "${FILESDIR}"/bash_logout
-	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
-
-	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color.bash | newins - 10-gentoo-color.bash
-	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r1.bash 10-gentoo-title.bash
-	if [[ ! ${EPREFIX} ]]; then
-		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
-	fi
-
-	insinto /etc/skel
-	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
-	done
-
-	if use plugins; then
-		exeinto "/usr/$(get_libdir)/bash"
-		set -- examples/loadables/*.o
-		doexe "${@%.o}"
-
-		insinto /usr/include/bash-plugins
-		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
-	fi
-
-	if use examples; then
-		for d in examples/{functions,misc,scripts,startup-files}; do
-			exeinto "/usr/share/doc/${PF}/${d}"
-			docinto "${d}"
-			for f in "${d}"/*; do
-				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
-					doexe "${f}"
-				else
-					dodoc "${f}"
-				fi
-			done
-		done
-	fi
-
-	# Install bash_builtins.1 and rbash.1.
-	emake -C doc DESTDIR="${D}" install_builtins
-	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
-	doman "${T}"/rbash.1
-
-	newdoc CWRU/changelog ChangeLog
-	dosym bash.info /usr/share/info/bashref.info
-}
-
-pkg_preinst() {
-	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
-		mkdir -p -- "${EROOT}"/etc/bash \
-		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
-		|| die
-	fi
-}
-
-pkg_postinst() {
-	local old_ver
-
-	# If /bin/sh does not exist, provide it.
-	if [[ ! -e ${EROOT}/bin/sh ]]; then
-		ln -sf -- bash "${EROOT}"/bin/sh || die
-	fi
-
-	read -r old_ver <<<"${REPLACING_VERSIONS}"
-	if [[ ! $old_ver ]]; then
-		:
-	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
-		return
-	fi
-
-	while read -r; do ewarn "${REPLY}"; done <<'EOF'
-Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
-
-Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
-characteristics of the operating environment, it may contain a command to set
-the terminal's window title. Those who were already choosing to customise the
-PROMPT_COMMAND variable are now advised to append their commands like so:
-
-PROMPT_COMMAND+=('custom command goes here')
-
-Gentoo no longer defaults to having bash set the window title in the case
-that the terminal is controlled by sshd(8), unless screen is launched on the
-remote side or the terminal reliably supports saving and restoring the title
-(as alacritty, foot and tmux do). Those wanting for the title to be set
-regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
-drop-in - to set PROMPT_COMMMAND like so:
-
-PROMPT_COMMAND=(genfun_set_win_title)
-
-Those who would prefer for bash never to interfere with the window title may
-now opt out of the default title setting behaviour, either with the "unset -v
-PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
-EOF
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240815.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240927.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240815.ebuild
rename to sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240927.ebuild
index 62dd88eaa83..6a3636494c4 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240815.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240927.ebuild
@@ -45,7 +45,7 @@ elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
 	# the alpha, and the next pre-release is usually quite far away.
 	#
 	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="cf694865de527e597de5a906643a74037341a431"
+	BASH_COMMIT="254081c09767738833cdf161b4bc3feb1a51690a"
 	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.xz -> ${P}-${BASH_COMMIT}.tar.xz"
 	S=${WORKDIR}/${PN}-${BASH_COMMIT}
 else
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest b/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
index 5210ba7904e..e2d9905f8b3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
@@ -12,3 +12,6 @@ DIST cmake-3.30.2.tar.gz 11500719 BLAKE2B 85873311000831d2a8acb2c9d7f107e7fcef9d
 DIST cmake-3.30.3-SHA-256.txt 1646 BLAKE2B 9470d83b929f26d2ac8c1366209d78763963c981490b0ff2c959da85e3b58b72dfff3fe42c98b918089ac4ae05f302d5ec3d7254e9c061c610636d2089cf2b33 SHA512 629375ae3cdbd7b9248c92b7dc3149e109a0c93522a0d35fe458be69f70c5951781781404096f38dde09961a8d4f785866a909a2e282812be275871434f8243a
 DIST cmake-3.30.3-SHA-256.txt.asc 833 BLAKE2B 15a9cde54b0dac1006cd676c404d5a9756f005bfde9abf5ea89dcaf4ab578f474f653dce95998ba8cb247875d6d58e4b298c540f993997c3cd3326e748a5b8f3 SHA512 4c2090ecb52c74806caf720cbdc6e89a7e60b7a3daaeefb56d54c4ce77d4d1d04d7cd5e72f7c8782fb82ec55374b28d64238b7e5759c675f075eb270087790b7
 DIST cmake-3.30.3.tar.gz 11501292 BLAKE2B 8b6d989b90568b6fe42ada549f5cd766d8f919f8f5ca3cdea15b5a7b7946d3a82642c178967edc1a9d90d398a7447e25647957489436758381f91b64fa401029 SHA512 1cc0381077819f7210e3fad5fe8194ddc65210f6591044b3982ca0c600e8e978330f1a5602515780bd691264678c7c35a8d9c28d34c14ffa22ef96c7544a20d4
+DIST cmake-3.30.4-SHA-256.txt 1646 BLAKE2B 0092ca4577ad6433b4560c66a9cdaf7c4ee3bc87473533a91841d5d3759ca7bcf0dce40af1e7b122fc6cb47f98b7d61724f6c00ca5e0d5c927dcc5ff488b4345 SHA512 ef732c6ce8ecd5288d9ec6485abef7a381faa0545848337e1d31a1c7ed3191ed9f7c5edf49ce0e194ad254640b27843ae2cd668c78ccf2835730b2936c19d09d
+DIST cmake-3.30.4-SHA-256.txt.asc 833 BLAKE2B 4cd2d11bcaa1379e99d231716118034ca2bb39f27c48f590f00f8f57c6f37a874c2d4dbea816e1d3c62972b13dce5d723d837a77c56054834afdecf7d786491d SHA512 3e9c0e17f46d5e85c438d92248ab642be19a0b46b01c057ad253c1bce68cdf867296946b0709021f6bc75d555b0814b0fb1e36de0bacb650c81b59800144c1e6
+DIST cmake-3.30.4.tar.gz 11502808 BLAKE2B 591b4df9442e77116864f44eba568341ac30be6705061f33603cac56f47fb34730132537d1863ad70d890661eefb4741c0c40cf7a1a85a905300deafc22ba8de SHA512 d444fb94a56aebcda8344f48b5555d330c8d0602d5e68771800934a7df8667c97971ac44c8f0e71f7c1c0276b687fbca6fc5ac3102d5b755591dda7eddf49d0d
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.30.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.30.4.ebuild
new file mode 100644
index 00000000000..e9982cd799b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.30.4.ebuild
@@ -0,0 +1,293 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-cmake-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+: ${CMAKE_DOCS_PREBUILT:=1}
+
+CMAKE_DOCS_PREBUILT_DEV=sam
+CMAKE_DOCS_VERSION=$(ver_cut 1-2).0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# See bug #784815
+CMAKE_DOCS_USEFLAG="+doc"
+
+# TODO RunCMake.LinkWhatYouUse fails consistently w/ ninja
+# ... but seems fine as of 3.22.3?
+# TODO ... but bootstrap sometimes(?) fails with ninja now. bug #834759.
+CMAKE_MAKEFILE_GENERATOR="emake"
+CMAKE_REMOVE_MODULES_LIST=( none )
+inherit bash-completion-r1 cmake flag-o-matic multiprocessing \
+	toolchain-funcs xdg-utils
+
+MY_P="${P/_/-}"
+
+DESCRIPTION="Cross platform Make"
+HOMEPAGE="https://cmake.org/"
+if [[ ${PV} == 9999 ]] ; then
+	CMAKE_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.kitware.com/cmake/cmake.git"
+	inherit git-r3
+else
+	SRC_URI="https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}.tar.gz"
+
+	if [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${CMAKE_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${CMAKE_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	if [[ ${PV} != *_rc* ]] ; then
+		VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/bradking.asc
+		inherit verify-sig
+
+		SRC_URI+=" verify-sig? (
+			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt
+			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt.asc
+		)"
+
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+		BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-bradking-20230817 )"
+	fi
+fi
+
+[[ ${CMAKE_DOCS_PREBUILT} == 1 ]] && CMAKE_DOCS_USEFLAG="doc"
+
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="BSD"
+SLOT="0"
+IUSE="${CMAKE_DOCS_USEFLAG} dap gui ncurses qt6 test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=app-arch/libarchive-3.3.3:=
+	app-crypt/rhash:0=
+	>=dev-libs/expat-2.0.1
+	>=dev-libs/jsoncpp-1.9.2-r2:0=
+	>=dev-libs/libuv-1.10.0:=
+	>=net-misc/curl-7.21.5[ssl]
+	sys-libs/zlib
+	virtual/pkgconfig
+	dap? ( dev-cpp/cppdap )
+	gui? (
+		!qt6? (
+			dev-qt/qtcore:5
+			dev-qt/qtgui:5
+			dev-qt/qtwidgets:5
+		)
+		qt6? ( dev-qt/qtbase:6[gui,widgets] )
+	)
+	ncurses? ( sys-libs/ncurses:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND+="
+	doc? (
+		dev-python/requests
+		dev-python/sphinx
+	)
+	test? ( app-arch/libarchive[zstd] )
+"
+
+SITEFILE="50${PN}-gentoo.el"
+
+PATCHES=(
+	# Prefix
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0001-Don-t-use-.so-for-modules-on-darwin-macos.-Use-.bund.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0002-Set-some-proper-paths-to-make-cmake-find-our-tools.patch
+	# Misc
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0003-Prefer-pkgconfig-in-FindBLAS.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0004-Ensure-that-the-correct-version-of-Qt-is-always-used.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0005-Respect-Gentoo-s-Python-eclasses.patch
+	# Cuda
+	"${FILESDIR}/${PN}-3.30.3-cudahostld.patch"
+
+	# Upstream fixes (can usually be removed with a version bump)
+)
+
+cmake_src_bootstrap() {
+	# disable running of cmake in bootstrap command
+	sed -i \
+		-e '/"${cmake_bootstrap_dir}\/cmake"/s/^/#DONOTRUN /' \
+		bootstrap || die "sed failed"
+
+	# execinfo.h on Solaris isn't quite what it is on Darwin
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		sed -i -e 's/execinfo\.h/blablabla.h/' \
+			Source/kwsys/CMakeLists.txt || die
+	fi
+
+	# bootstrap script isn't exactly /bin/sh compatible
+	tc-env_build ${CONFIG_SHELL:-sh} ./bootstrap \
+		--prefix="${T}/cmakestrap/" \
+		--parallel=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)") \
+		|| die "Bootstrap failed"
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	elif [[ ${PV} == *_rc* ]] || ! use verify-sig ; then
+		default
+	else
+		cd "${DISTDIR}" || die
+
+		# See https://mgorny.pl/articles/verify-sig-by-example.html#verifying-using-a-checksum-file-with-a-detached-signature
+		verify-sig_verify_detached ${MY_P}-SHA-256.txt{,.asc}
+		verify-sig_verify_unsigned_checksums ${MY_P}-SHA-256.txt sha256 ${MY_P}.tar.gz
+
+		cd "${WORKDIR}" || die
+
+		default
+	fi
+}
+
+src_prepare() {
+	cmake_src_prepare
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# Disable Xcode hooks, bug #652134
+		sed -i -e 's/cm\(\|Global\|Local\)XCode[^.]\+\.\(cxx\|h\)//' \
+			Source/CMakeLists.txt || die
+		sed -i -e '/define CMAKE_USE_XCODE/s/XCODE/NO_XCODE/' \
+			-e '/cmGlobalXCodeGenerator.h/d' \
+			Source/cmake.cxx || die
+		# Disable system integration, bug #933744
+		sed -i -e 's/__APPLE__/__DISABLED__/' \
+			Source/cmFindProgramCommand.cxx \
+			Source/CPack/cmCPackGeneratorFactory.cxx || die
+		sed -i -e 's/__MAC_OS_X_VERSION_MIN_REQUIRED/__DISABLED__/' \
+			Source/cmMachO.cxx || die
+		sed -i -e 's:CPack/cmCPack\(Bundle\|DragNDrop\|PKG\|ProductBuild\)Generator.cxx::' \
+			Source/CMakeLists.txt || die
+
+		# Disable isysroot usage with GCC, we've properly instructed
+		# where things are via GCC configuration and ldwrapper
+		sed -i -e '/cmake_gnu_set_sysroot_flag/d' \
+			Modules/Platform/Apple-GNU-*.cmake || die
+		# Disable isysroot usage with clang as well
+		sed -i -e '/_SYSROOT_FLAG/d' \
+			Modules/Platform/Apple-Clang.cmake || die
+		# Don't set a POSIX standard, system headers don't like that, #757426
+		sed -i -e 's/^#if !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
+			Source/cmLoadCommandCommand.cxx \
+			Source/cmStandardLexer.h \
+			Source/cmSystemTools.cxx \
+			Source/cmTimestamp.cxx
+		sed -i -e 's/^#if !defined(_POSIX_C_SOURCE) && !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
+			Source/cmStandardLexer.h
+	fi
+
+	# Add gcc libs to the default link paths
+	sed -i \
+		-e "s|@GENTOO_PORTAGE_GCCLIBDIR@|${EPREFIX}/usr/${CHOST}/lib/|g" \
+		-e "$(usex prefix-guest "s|@GENTOO_HOST@||" "/@GENTOO_HOST@/d")" \
+		-e "s|@GENTOO_PORTAGE_EPREFIX@|${EPREFIX}/|g" \
+		Modules/Platform/{UnixPaths,Darwin}.cmake || die "sed failed"
+
+	## in theory we could handle these flags in src_configure, as we do in many other packages. But we *must*
+	## handle them as part of bootstrapping, sadly.
+
+	# Fix linking on Solaris
+	[[ ${CHOST} == *-solaris* ]] && append-ldflags -lsocket -lnsl
+
+	# ODR warnings, bug #858335
+	# https://gitlab.kitware.com/cmake/cmake/-/issues/20740
+	filter-lto
+
+	if ! has_version -b \>=${CATEGORY}/${PN}-3.13 || ! cmake --version &>/dev/null ; then
+		CMAKE_BINARY="${S}/Bootstrap.cmk/cmake"
+		cmake_src_bootstrap
+	fi
+}
+
+src_configure() {
+	local mycmakeargs=(
+		-DCMAKE_USE_SYSTEM_LIBRARIES=ON
+		-DCMake_ENABLE_DEBUGGER=$(usex dap)
+		-DCMAKE_DOC_DIR=/share/doc/${PF}
+		-DCMAKE_MAN_DIR=/share/man
+		-DCMAKE_DATA_DIR=/share/${PN}
+		-DSPHINX_MAN=$(usex doc)
+		-DSPHINX_HTML=$(usex doc)
+		-DBUILD_CursesDialog="$(usex ncurses)"
+		-DBUILD_TESTING=$(usex test)
+		-DBUILD_QtDialog=$(usex gui)
+	)
+
+	use gui && mycmakeargs+=( -DCMake_QT_MAJOR_VERSION=$(usex qt6 6 5) )
+
+	cmake_src_configure
+}
+
+src_test() {
+	# Fix OutDir and SelectLibraryConfigurations tests
+	# these are altered thanks to our eclass
+	sed -i -e 's:^#_cmake_modify_IGNORE ::g' \
+		"${S}"/Tests/{OutDir,CMakeOnly/SelectLibraryConfigurations}/CMakeLists.txt \
+		|| die
+
+	unset CLICOLOR CLICOLOR_FORCE CMAKE_COMPILER_COLOR_DIAGNOSTICS CMAKE_COLOR_DIAGNOSTICS
+
+	pushd "${BUILD_DIR}" > /dev/null || die
+
+	# Excluded tests:
+	#    BootstrapTest: we actualy bootstrap it every time so why test it.
+	#    BundleUtilities: bundle creation broken
+	#    CMakeOnly.AllFindModules: pthread issues
+	#    CTest.updatecvs: which fails to commit as root
+	#    Fortran: requires fortran
+	#    RunCMake.CompilerLauncher: also requires fortran
+	#    RunCMake.CPack_RPM: breaks if app-arch/rpm is installed because
+	#        debugedit binary is not in the expected location
+	#    RunCMake.CPack_DEB: breaks if app-arch/dpkg is installed because
+	#        it can't find a deb package that owns libc
+	#    TestUpload, which requires network access
+	#    RunCMake.CMP0125, known failure reported upstream (bug #829414)
+	local myctestargs=(
+		--output-on-failure
+		-E "(BootstrapTest|BundleUtilities|CMakeOnly.AllFindModules|CompileOptions|CTest.UpdateCVS|Fortran|RunCMake.CompilerLauncher|RunCMake.CPack_(DEB|RPM)|TestUpload|RunCMake.CMP0125)" \
+	)
+
+	local -x QT_QPA_PLATFORM=offscreen
+
+	cmake_src_test
+}
+
+src_install() {
+	cmake_src_install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${CMAKE_DOCS_VERSION}-docs/man*/*.[0-8]
+	fi
+
+	insinto /usr/share/vim/vimfiles/syntax
+	doins Auxiliary/vim/syntax/cmake.vim
+
+	insinto /usr/share/vim/vimfiles/indent
+	doins Auxiliary/vim/indent/cmake.vim
+
+	insinto /usr/share/vim/vimfiles/ftdetect
+	doins "${FILESDIR}/${PN}.vim"
+
+	dobashcomp Auxiliary/bash-completion/{${PN},ctest,cpack}
+}
+
+pkg_postinst() {
+	if use gui; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+		xdg_mimeinfo_database_update
+	fi
+}
+
+pkg_postrm() {
+	if use gui; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+		xdg_mimeinfo_database_update
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/libtool/Manifest b/sdk_container/src/third_party/portage-stable/dev-build/libtool/Manifest
index d6ef406bec4..ca7d3789110 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/libtool/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/libtool/Manifest
@@ -1,4 +1,2 @@
 DIST libtool-2.4.7.tar.xz 1016040 BLAKE2B 5e022586337637dd634bd40578ad944bec6e3b8de41f95d55777b90cc88cbc4badb3d76cbf0e638166ece1ea7de828e83590e1e6bac30c1e4b1c254a11a742f2 SHA512 47f4c6de40927254ff9ba452612c0702aea6f4edc7e797f0966c8c6bf0340d533598976cdba17f0bdc64545572e71cd319bbb587aa5f47cd2e7c1d96f873a3da
-DIST libtool-2.5.0.tar.xz 1032148 BLAKE2B a166423dae1000eb0a8d17f3872ed55b3338444ac61f51752f43a5886bc22fd233e060c7f4c8c7fa093bf50e589f03b755c628199534ef7b8a41935e1bf9d887 SHA512 7b426fe9550a7899de93c372d2c355867be02f7bb39f2b1de06ff30cb34c81bf89759c835bdb23081cef60bfeb39b786ed90bac43e7300956fd8ee1f7dc0a609
-DIST libtool-2.5.1.tar.xz 1043544 BLAKE2B ae1e45c9d56a94980549476ed5abb7d617491360ff23ce88da9e884630280004152a9f5a96267be710930f14917bf7b00ab212acd4c65ceba1e201d2f01809e0 SHA512 ac0a6a8570ff81099585f6c3bf5a8f94851457a068b808e505422276a22638b1912a81f94e185bc2f8661b7abe2f2b2482b1af2cf42307787cbbd71d1b1612da
-DIST libtool-2.5.2.tar.xz 1046372 BLAKE2B 12e3d1f948f64031519ad5619573593b2518ec63cb8e3d69487a4b6104f5ee385c2123d3163c036fe10ca7214ba7558b6bd7fb56d22f1e249945a50091e18862 SHA512 cd6eb8ea470dd5bbfdfcfb06f31b36c84962f09c7155ca8175bc340b0a0289ca85dc9ea6e49c02e6876630913031739ef71dae231bc76c44f0c24e1be09d8cee
+DIST libtool-2.5.3.tar.xz 1050076 BLAKE2B e7bc3421d2273851f894583b879c897239bddaef00dc335176f00ce971d3c77e4d4304ae3b1d1b97d4b6b1b4fd9859ddc0eb5dcadac2e0de959b68cae973f726 SHA512 7a2b86716b2cbefcd45bda7f65af81fcb0aaa3dce96b09f417d6b94721a4dd9e72a9552862783d998ddf785e509315bb49f65c464dbc949d58e36f0960cf9b1b
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/libtool/libtool-2.5.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/libtool/libtool-2.5.1.ebuild
deleted file mode 100644
index 88841d6cdfd..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-build/libtool/libtool-2.5.1.ebuild
+++ /dev/null
@@ -1,151 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Please bump with dev-libs/libltdl.
-
-# bug #225559
-LIBTOOLIZE="true"
-WANT_LIBTOOL="none"
-inherit autotools flag-o-matic prefix multiprocessing
-
-if [[ ${PV} == *9999 ]] ; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/git/libtool.git"
-	inherit git-r3
-elif ! [[ $(( $(ver_cut 2) % 2 )) -eq 0 ]] ; then
-	SRC_URI="https://alpha.gnu.org/gnu/${PN}/${P}.tar.xz"
-else
-	SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-DESCRIPTION="A shared library tool for developers"
-HOMEPAGE="https://www.gnu.org/software/libtool/"
-
-LICENSE="GPL-2"
-SLOT="2"
-IUSE="vanilla"
-
-# Pull in libltdl directly until we convert packages to the new dep.
-RDEPEND="
-	sys-devel/gnuconfig
-	>=dev-build/autoconf-2.69:*
-	>=dev-build/automake-1.13:*
-"
-DEPEND="${RDEPEND}"
-[[ ${PV} == *9999 ]] && BDEPEND="sys-apps/help2man"
-
-# Note that we have more patches in https://gitweb.gentoo.org/proj/elt-patches.git/
-# for package builds. The patches here are just those which are definitely fine
-# for the system-wide libtool installation as well.
-PATCHES=(
-	# bug #109105
-	"${FILESDIR}"/${PN}-2.4.3-use-linux-version-in-fbsd.patch
-	# bug #581314
-	"${FILESDIR}"/${PN}-2.4.6-ppc64le.patch
-
-	"${FILESDIR}"/${PN}-2.2.6a-darwin-module-bundle.patch
-	"${FILESDIR}"/${PN}-2.4.6-darwin-use-linux-version.patch
-)
-
-src_prepare() {
-	if [[ ${PV} == *9999 ]] ; then
-		eapply "${FILESDIR}"/${PN}-2.4.6-pthread.patch # bug #650876
-		./bootstrap || die
-	else
-		PATCHES+=(
-			"${FILESDIR}"/${PN}-2.4.6-pthread_bootstrapped.patch # bug #650876
-		)
-	fi
-
-	# WARNING: File build-aux/ltmain.sh is read-only; trying to patch anyway
-	chmod +w build-aux/ltmain.sh || die
-
-	if use vanilla ; then
-		eapply_user
-		return 0
-	else
-		default
-	fi
-
-	if use prefix ; then
-		# seems that libtool has to know about EPREFIX a little bit
-		# better, since it fails to find prefix paths to search libs
-		# from, resulting in some packages building static only, since
-		# libtool is fooled into thinking that libraries are unavailable
-		# (argh...). This could also be fixed by making the gcc wrapper
-		# return the correct result for -print-search-dirs (doesn't
-		# include prefix dirs ...).
-		eapply "${FILESDIR}"/${PN}-2.2.10-eprefix.patch
-		eprefixify m4/libtool.m4
-	fi
-
-	pushd libltdl >/dev/null || die
-	AT_NOELIBTOOLIZE=yes eautoreconf
-	popd >/dev/null || die
-	AT_NOELIBTOOLIZE=yes eautoreconf
-
-	# Make sure timestamps don't trigger a rebuild of man pages. #556512
-	if [[ ${PV} != *9999 ]] ; then
-		touch doc/*.1 || die
-		export HELP2MAN=true
-	fi
-}
-
-src_configure() {
-	# the libtool script uses bash code in it and at configure time, tries
-	# to find a bash shell.  if /bin/sh is bash, it uses that.  this can
-	# cause problems for people who switch /bin/sh on the fly to other
-	# shells, so just force libtool to use /bin/bash all the time.
-	# Do not bother hardcoding the full path to sed.
-	# Just rely on $PATH. bug #574550
-	export CONFIG_SHELL="${EPREFIX}"/bin/bash
-	export ac_cv_path_SED="sed"
-	export ac_cv_path_EGREP="grep -E"
-	export ac_cv_path_EGREP_TRADITIONAL="grep -E"
-	export ac_cv_path_FGREP="grep -F"
-	export ac_cv_path_GREP="grep"
-	export ac_cv_path_lt_DD="dd"
-
-	local myeconfargs=(
-		# Split into dev-libs/libltdl
-		--disable-ltdl-install
-
-		# Tests break otherwise (when porting to EAPI 8)
-		# https://lists.gnu.org/archive/html/bug-libtool/2014-10/msg00013.html
-		--enable-static
-	)
-
-	[[ ${CHOST} == *-darwin* ]] && myeconfargs+=( "--program-prefix=g" )
-
-	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-}
-
-src_test() {
-	(
-		# The testsuite is sensitive to warnings, expects static
-		# archives to really be archives (not compiler IR), etc.
-		strip-flags
-		filter-flags -fno-semantic-interposition
-		filter-flags '-Wstrict-aliasing=*' '-Werror=*'
-		filter-lto
-
-		emake -Onone check \
-			CFLAGS="${CFLAGS}" \
-			CXXFLAGS="${CXXFLAGS}" \
-			FFLAGS="${FFLAGS}" \
-			FCFLAGS="${FCFLAGS}" \
-			LDFLAGS="${LDFLAGS}" \
-			TESTSUITEFLAGS="--jobs=$(get_makeopts_jobs)"
-	)
-}
-
-src_install() {
-	default
-
-	local x
-	while read -d $'\0' -r x ; do
-		ln -sf "${EPREFIX}"/usr/share/gnuconfig/${x##*/} "${x}" || die
-	done < <(find "${ED}" '(' -name config.guess -o -name config.sub ')' -print0)
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/libtool/libtool-2.5.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/libtool/libtool-2.5.2.ebuild
deleted file mode 100644
index 88841d6cdfd..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-build/libtool/libtool-2.5.2.ebuild
+++ /dev/null
@@ -1,151 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Please bump with dev-libs/libltdl.
-
-# bug #225559
-LIBTOOLIZE="true"
-WANT_LIBTOOL="none"
-inherit autotools flag-o-matic prefix multiprocessing
-
-if [[ ${PV} == *9999 ]] ; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/git/libtool.git"
-	inherit git-r3
-elif ! [[ $(( $(ver_cut 2) % 2 )) -eq 0 ]] ; then
-	SRC_URI="https://alpha.gnu.org/gnu/${PN}/${P}.tar.xz"
-else
-	SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-DESCRIPTION="A shared library tool for developers"
-HOMEPAGE="https://www.gnu.org/software/libtool/"
-
-LICENSE="GPL-2"
-SLOT="2"
-IUSE="vanilla"
-
-# Pull in libltdl directly until we convert packages to the new dep.
-RDEPEND="
-	sys-devel/gnuconfig
-	>=dev-build/autoconf-2.69:*
-	>=dev-build/automake-1.13:*
-"
-DEPEND="${RDEPEND}"
-[[ ${PV} == *9999 ]] && BDEPEND="sys-apps/help2man"
-
-# Note that we have more patches in https://gitweb.gentoo.org/proj/elt-patches.git/
-# for package builds. The patches here are just those which are definitely fine
-# for the system-wide libtool installation as well.
-PATCHES=(
-	# bug #109105
-	"${FILESDIR}"/${PN}-2.4.3-use-linux-version-in-fbsd.patch
-	# bug #581314
-	"${FILESDIR}"/${PN}-2.4.6-ppc64le.patch
-
-	"${FILESDIR}"/${PN}-2.2.6a-darwin-module-bundle.patch
-	"${FILESDIR}"/${PN}-2.4.6-darwin-use-linux-version.patch
-)
-
-src_prepare() {
-	if [[ ${PV} == *9999 ]] ; then
-		eapply "${FILESDIR}"/${PN}-2.4.6-pthread.patch # bug #650876
-		./bootstrap || die
-	else
-		PATCHES+=(
-			"${FILESDIR}"/${PN}-2.4.6-pthread_bootstrapped.patch # bug #650876
-		)
-	fi
-
-	# WARNING: File build-aux/ltmain.sh is read-only; trying to patch anyway
-	chmod +w build-aux/ltmain.sh || die
-
-	if use vanilla ; then
-		eapply_user
-		return 0
-	else
-		default
-	fi
-
-	if use prefix ; then
-		# seems that libtool has to know about EPREFIX a little bit
-		# better, since it fails to find prefix paths to search libs
-		# from, resulting in some packages building static only, since
-		# libtool is fooled into thinking that libraries are unavailable
-		# (argh...). This could also be fixed by making the gcc wrapper
-		# return the correct result for -print-search-dirs (doesn't
-		# include prefix dirs ...).
-		eapply "${FILESDIR}"/${PN}-2.2.10-eprefix.patch
-		eprefixify m4/libtool.m4
-	fi
-
-	pushd libltdl >/dev/null || die
-	AT_NOELIBTOOLIZE=yes eautoreconf
-	popd >/dev/null || die
-	AT_NOELIBTOOLIZE=yes eautoreconf
-
-	# Make sure timestamps don't trigger a rebuild of man pages. #556512
-	if [[ ${PV} != *9999 ]] ; then
-		touch doc/*.1 || die
-		export HELP2MAN=true
-	fi
-}
-
-src_configure() {
-	# the libtool script uses bash code in it and at configure time, tries
-	# to find a bash shell.  if /bin/sh is bash, it uses that.  this can
-	# cause problems for people who switch /bin/sh on the fly to other
-	# shells, so just force libtool to use /bin/bash all the time.
-	# Do not bother hardcoding the full path to sed.
-	# Just rely on $PATH. bug #574550
-	export CONFIG_SHELL="${EPREFIX}"/bin/bash
-	export ac_cv_path_SED="sed"
-	export ac_cv_path_EGREP="grep -E"
-	export ac_cv_path_EGREP_TRADITIONAL="grep -E"
-	export ac_cv_path_FGREP="grep -F"
-	export ac_cv_path_GREP="grep"
-	export ac_cv_path_lt_DD="dd"
-
-	local myeconfargs=(
-		# Split into dev-libs/libltdl
-		--disable-ltdl-install
-
-		# Tests break otherwise (when porting to EAPI 8)
-		# https://lists.gnu.org/archive/html/bug-libtool/2014-10/msg00013.html
-		--enable-static
-	)
-
-	[[ ${CHOST} == *-darwin* ]] && myeconfargs+=( "--program-prefix=g" )
-
-	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-}
-
-src_test() {
-	(
-		# The testsuite is sensitive to warnings, expects static
-		# archives to really be archives (not compiler IR), etc.
-		strip-flags
-		filter-flags -fno-semantic-interposition
-		filter-flags '-Wstrict-aliasing=*' '-Werror=*'
-		filter-lto
-
-		emake -Onone check \
-			CFLAGS="${CFLAGS}" \
-			CXXFLAGS="${CXXFLAGS}" \
-			FFLAGS="${FFLAGS}" \
-			FCFLAGS="${FCFLAGS}" \
-			LDFLAGS="${LDFLAGS}" \
-			TESTSUITEFLAGS="--jobs=$(get_makeopts_jobs)"
-	)
-}
-
-src_install() {
-	default
-
-	local x
-	while read -d $'\0' -r x ; do
-		ln -sf "${EPREFIX}"/usr/share/gnuconfig/${x##*/} "${x}" || die
-	done < <(find "${ED}" '(' -name config.guess -o -name config.sub ')' -print0)
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/libtool/libtool-2.5.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/libtool/libtool-2.5.3.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/dev-build/libtool/libtool-2.5.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-build/libtool/libtool-2.5.3.ebuild
index 88841d6cdfd..3924768b1ef 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/libtool/libtool-2.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/libtool/libtool-2.5.3.ebuild
@@ -13,7 +13,7 @@ inherit autotools flag-o-matic prefix multiprocessing
 if [[ ${PV} == *9999 ]] ; then
 	EGIT_REPO_URI="https://git.savannah.gnu.org/git/libtool.git"
 	inherit git-r3
-elif ! [[ $(( $(ver_cut 2) % 2 )) -eq 0 ]] ; then
+elif false && ! [[ $(( $(ver_cut 2) % 2 )) -eq 0 ]] ; then
 	SRC_URI="https://alpha.gnu.org/gnu/${PN}/${P}.tar.xz"
 else
 	SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
@@ -27,7 +27,6 @@ LICENSE="GPL-2"
 SLOT="2"
 IUSE="vanilla"
 
-# Pull in libltdl directly until we convert packages to the new dep.
 RDEPEND="
 	sys-devel/gnuconfig
 	>=dev-build/autoconf-2.69:*
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/libtool/libtool-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/libtool/libtool-9999.ebuild
index 88841d6cdfd..fdaf9612ff8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/libtool/libtool-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/libtool/libtool-9999.ebuild
@@ -27,7 +27,6 @@ LICENSE="GPL-2"
 SLOT="2"
 IUSE="vanilla"
 
-# Pull in libltdl directly until we convert packages to the new dep.
 RDEPEND="
 	sys-devel/gnuconfig
 	>=dev-build/autoconf-2.69:*
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest b/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest
index 3b6ec88f671..4a2cce4e9fe 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest
@@ -8,5 +8,11 @@ DIST meson-1.4.2.tar.gz 2227701 BLAKE2B 11d98d8c84545390bd35b393ae02db7876a38dad
 DIST meson-1.4.2.tar.gz.asc 833 BLAKE2B 64ce1fc0fecdd6aa76bb89d88ff7497548d82afc00805c083a0bca7ce4cee41dc50be50368e333649ae7e863c03ea780fe24a48c525281fbbcab679b540f4254 SHA512 51d3245f9443cb398e2e8f225f00a853848bde1bfba02bae6334d47115e36ad96c8ec03244f6169c89d73162b86a73158a7f8d08d5bd6b3d28e8369ce7b55093
 DIST meson-1.5.1.tar.gz 2257106 BLAKE2B 3368b209444d0873217bafee2339b395dca9fa43df68adce19029a41ad5c0eca59426ef681d174ef8b6b89d4a6c5b4f189c1ae219deed78334028d44bdb23a95 SHA512 3239d6f3d64dcedddd456dc451278a37aa6c4460708b0efdff1b04b6e8844c20f5f882060de311c59a678bebd51ee09e1906c9384d4b0c85b28015fd1713ab0a
 DIST meson-1.5.1.tar.gz.asc 833 BLAKE2B c099720b102b8fff581f2043000454f5cb3593352a8b69c681cda73dae7172fb7d892dc0500e29fffe4ba7828cdcba418acea230563dc26a7a89139ab526b231 SHA512 f8210dd309a104b4169bc2eae9ff370f3ced6fe2c5dfc8f3477c9fbbed983dd6636ea05822d9345d7570e88bfe7789c6cc075e5a91d578a8376666d16ad550a3
+DIST meson-1.5.2.tar.gz 2265788 BLAKE2B bda0742cf053cb235833b347e66b8706983815fda5d62815aa6455980837e061fb0db2f7472966e6e09a199b0850477a3b448b6ad3b7db717da6b43906cbe2ac SHA512 9f601bdadaf2dae312ff02caa9dcd3fe13659a101e601417bdb908d8b91cdd4a12302433b00c188c1562287a06ada656044d79821d0beb0e0e41c63ab5d48112
+DIST meson-1.5.2.tar.gz.asc 833 BLAKE2B 0ea6af017430568b2834081a60d0153cc80cb55d835b1f570e27ae6220a163aff9f4607654fe87841df112c78763b4d45dabd45072e398cdf901762095ce52e7 SHA512 7b7c0ee2b872c83d98954079fc27665b3a9ec5464aa8decc5919ff4e1c4134d7006494bd64b901dc2ade408131ea512eefef9416f3c57d1460c9308cb6683fc8
+DIST meson-1.6.0rc1.tar.gz 2275126 BLAKE2B 0b0ff79ed21fa7b65829730dee3d246ca5012c3ef6185e58b7e4eb22aa7ea24741a7d0e1df56d32488761e504862350a505f043360695472a24a602ee6959dee SHA512 36d6015a353cefdcb26c442e78b9a3d8d69c1c505c84522c0422b956254cf5fe83dfc427442daf9999a874b378e571a2a28cbfe2fb0eb748c38a08cd24c07665
+DIST meson-1.6.0rc1.tar.gz.asc 833 BLAKE2B 06beb3d168519b6ba3adeb41eb81320b10db8684f7f8768306b96cc1ecd9cff1c8e07d489825160e4a8a493b760da60a944ea3b465529b2a860f780f6d65e8ef SHA512 cbb579d4231aeeb9aa56540dd8068a22a06e3fef82207c9860da861e319920154c4286a991efadad235ecd006041c38a3122b3850d6ce0bbaa0c8250c43d6291
 DIST meson-reference-1.4.2.3 339324 BLAKE2B 1a4fbd8c27a8cfba773777eabd2ebaa0f76ec0c61dcfe1c7b4483737b348ff9528d68f26e68d7d40b2e1875611eed5b9a31c1cf55fed8eabb42fc1e31d9ef14b SHA512 8b8ec43e812599203ec44c08805eb6818485805c45b9c69802261eaa35efc97846a96f6472c6b1ef5f6c703e7153fd957df7b805f173ca3400a2030dfbe002ca
 DIST meson-reference-1.5.1.3 341110 BLAKE2B 5267c2eea1b1281f87e63eb08aa928257dd98088b4d5c27c2785d2d8066c2c28536f7f56bf804ffe37d2f51552c91f31ff7e2729f3b2485d594a9e44a0df9ab1 SHA512 2d36e87e9bc2de0b958f4b20544b0bd9f2b0ffb646768e68fefcd5dfb8f09c24db40f27208b5f2d1f6ba02e7465f68a538ea72be118670c76e0959e090a42cf3
+DIST meson-reference-1.5.2.3 341110 BLAKE2B 0d588b796f7f2da2dcb0e7822acde6a9a461930da4bfead3cf9148fa0fac18cd0ccbc6e891f555c973836f1c16b4eae299908a838a0b6843293de8815d30fc23 SHA512 64715ce2113e362e7d67179fe13566bc8f84ce7f4e6d795b836f42455a871173fee06e3e969e2996022d7e6c9b4b5379587a4c0c3d97b4bca527fb8902d3547f
+DIST meson-reference-1.6.0rc1.3 343734 BLAKE2B 6d10d99158e2905140a7a318e780e19f5e589103657194b5b669bb48e83c4ed28e152ae9cd8dd2d65b643572012f215a339df9ca530e075c6d88d383ccd2d29e SHA512 4e298dedb829f630ed47854325c24f2c1948db91627f7e8067bf81483f33e714a9439713ce170f42dd66ee07314d7b0ad032a46241898c7e981546c772c4a26c
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.5.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.5.2.ebuild
new file mode 100644
index 00000000000..70a2f51176d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.5.2.ebuild
@@ -0,0 +1,190 @@
+# Copyright 2016-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..13} pypy3 )
+DISTUTILS_USE_PEP517=setuptools
+
+inherit bash-completion-r1 edo distutils-r1 flag-o-matic toolchain-funcs
+
+if [[ ${PV} = *9999* ]]; then
+	EGIT_REPO_URI="https://github.com/mesonbuild/meson"
+	inherit ninja-utils git-r3
+
+	BDEPEND="
+		${NINJA_DEPEND}
+		$(python_gen_any_dep 'dev-python/pyyaml[${PYTHON_USEDEP}]')
+	"
+
+else
+	inherit verify-sig
+
+	MY_PV=${PV/_/}
+	MY_P=${P/_/}
+	S=${WORKDIR}/${MY_P}
+
+	SRC_URI="
+		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz
+		verify-sig? ( https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz.asc )
+		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/meson-reference.3 -> meson-reference-${MY_PV}.3
+	"
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-jpakkane )"
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/jpakkane.gpg
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+fi
+
+DESCRIPTION="Open source build system"
+HOMEPAGE="https://mesonbuild.com/"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	test? (
+		dev-libs/glib:2
+		dev-libs/gobject-introspection
+		app-alternatives/ninja
+		dev-vcs/git
+		sys-libs/zlib[static-libs(+)]
+		virtual/pkgconfig
+	)
+"
+RDEPEND="
+	!<dev-build/muon-0.2.0-r2[man(-)]
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.2.1-python-path.patch
+)
+
+src_unpack() {
+	if [[ ${PV} = *9999* ]]; then
+		git-r3_src_unpack
+	else
+		default
+		use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.asc}
+	fi
+}
+
+python_prepare_all() {
+	local disable_unittests=(
+		# ASAN and sandbox both want control over LD_PRELOAD
+		# https://bugs.gentoo.org/673016
+		-e 's/test_generate_gir_with_address_sanitizer/_&/'
+
+		# ASAN is unsupported on some targets
+		# https://bugs.gentoo.org/692822
+		-e 's/test_pch_with_address_sanitizer/_&/'
+
+		# clippy-driver fails, but only when run via portage.
+		#
+		#   error[E0463]: can't find crate for `std`
+		#   error: requires `sized` lang_item
+		-e 's/test_rust_clippy/_&/'
+	)
+
+	sed -i "${disable_unittests[@]}" unittests/*.py || die
+
+	# Broken due to python2 script created by python_wrapper_setup
+	rm -r "test cases/frameworks/1 boost" || die
+	# nvcc breaks on essentially any LDFLAGS
+	# https://bugs.gentoo.org/936757
+	# https://github.com/mesonbuild/meson/issues/11234
+	rm -r "test cases/cuda"/* || die
+
+	distutils-r1_python_prepare_all
+}
+
+python_check_deps() {
+	if [[ ${PV} = *9999* ]]; then
+		python_has_version "dev-python/pyyaml[${PYTHON_USEDEP}]"
+	fi
+}
+
+python_configure_all() {
+	if [[ ${PV} = *9999* ]]; then
+		# We use the unsafe_yaml loader because strictyaml is not packaged. In
+		# theory they produce the same results, but pyyaml is faster and
+		# without safety checks.
+		edo ./meson.py setup \
+			--prefix "${EPREFIX}/usr" \
+			-Dhtml=false \
+			-Dunsafe_yaml=true \
+			docs/ docs/builddir
+	fi
+}
+
+python_compile_all() {
+	if [[ ${PV} = *9999* ]]; then
+		eninja -C docs/builddir
+	fi
+}
+
+src_test() {
+	tc-export PKG_CONFIG
+	if ${PKG_CONFIG} --exists Qt5Core && ! ${PKG_CONFIG} --exists Qt5Gui; then
+		ewarn "Found Qt5Core but not Qt5Gui; skipping tests"
+	else
+		distutils-r1_src_test
+	fi
+}
+
+python_test() {
+	(
+		# meson has its own tests for LTO support. We don't need to verify that
+		# all tests work when they happen to use it. And in particular, this
+		# breaks rust.
+		filter-lto
+
+		# remove unwanted python_wrapper_setup contents
+		# We actually do want to non-error if python2 is installed and tested.
+		remove="${T}/${EPYTHON}/bin:"
+		PATH=${PATH/${remove}/}
+
+		# test_meson_installed
+		unset PYTHONDONTWRITEBYTECODE
+
+		# https://bugs.gentoo.org/687792
+		unset PKG_CONFIG
+
+		# test_cross_file_system_paths
+		unset XDG_DATA_HOME
+
+		# 'test cases/unit/73 summary' expects 80 columns
+		export COLUMNS=80
+
+		# If JAVA_HOME is not set, meson looks for javac in PATH.
+		# If javac is in /usr/bin, meson assumes /usr/include is a valid
+		# JDK include path. Setting JAVA_HOME works around this broken
+		# autodetection. If no JDK is installed, we should end up with an empty
+		# value in JAVA_HOME, and the tests should get skipped.
+		export JAVA_HOME=$(java-config -O 2>/dev/null)
+
+		${EPYTHON} -u run_tests.py
+	) || die "Testing failed with ${EPYTHON}"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	insinto /usr/share/vim/vimfiles
+	doins -r data/syntax-highlighting/vim/{ftdetect,indent,syntax}
+
+	insinto /usr/share/zsh/site-functions
+	doins data/shell-completions/zsh/_meson
+
+	dobashcomp data/shell-completions/bash/meson
+
+	if [[ ${PV} = *9999* ]]; then
+		DESTDIR="${ED}" eninja -C docs/builddir install
+	else
+		newman "${DISTDIR}"/meson-reference-${MY_PV}.3 meson-reference.3
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.6.0_rc1.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.6.0_rc1.ebuild
new file mode 100644
index 00000000000..70a2f51176d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.6.0_rc1.ebuild
@@ -0,0 +1,190 @@
+# Copyright 2016-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..13} pypy3 )
+DISTUTILS_USE_PEP517=setuptools
+
+inherit bash-completion-r1 edo distutils-r1 flag-o-matic toolchain-funcs
+
+if [[ ${PV} = *9999* ]]; then
+	EGIT_REPO_URI="https://github.com/mesonbuild/meson"
+	inherit ninja-utils git-r3
+
+	BDEPEND="
+		${NINJA_DEPEND}
+		$(python_gen_any_dep 'dev-python/pyyaml[${PYTHON_USEDEP}]')
+	"
+
+else
+	inherit verify-sig
+
+	MY_PV=${PV/_/}
+	MY_P=${P/_/}
+	S=${WORKDIR}/${MY_P}
+
+	SRC_URI="
+		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz
+		verify-sig? ( https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz.asc )
+		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/meson-reference.3 -> meson-reference-${MY_PV}.3
+	"
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-jpakkane )"
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/jpakkane.gpg
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+fi
+
+DESCRIPTION="Open source build system"
+HOMEPAGE="https://mesonbuild.com/"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	test? (
+		dev-libs/glib:2
+		dev-libs/gobject-introspection
+		app-alternatives/ninja
+		dev-vcs/git
+		sys-libs/zlib[static-libs(+)]
+		virtual/pkgconfig
+	)
+"
+RDEPEND="
+	!<dev-build/muon-0.2.0-r2[man(-)]
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.2.1-python-path.patch
+)
+
+src_unpack() {
+	if [[ ${PV} = *9999* ]]; then
+		git-r3_src_unpack
+	else
+		default
+		use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.asc}
+	fi
+}
+
+python_prepare_all() {
+	local disable_unittests=(
+		# ASAN and sandbox both want control over LD_PRELOAD
+		# https://bugs.gentoo.org/673016
+		-e 's/test_generate_gir_with_address_sanitizer/_&/'
+
+		# ASAN is unsupported on some targets
+		# https://bugs.gentoo.org/692822
+		-e 's/test_pch_with_address_sanitizer/_&/'
+
+		# clippy-driver fails, but only when run via portage.
+		#
+		#   error[E0463]: can't find crate for `std`
+		#   error: requires `sized` lang_item
+		-e 's/test_rust_clippy/_&/'
+	)
+
+	sed -i "${disable_unittests[@]}" unittests/*.py || die
+
+	# Broken due to python2 script created by python_wrapper_setup
+	rm -r "test cases/frameworks/1 boost" || die
+	# nvcc breaks on essentially any LDFLAGS
+	# https://bugs.gentoo.org/936757
+	# https://github.com/mesonbuild/meson/issues/11234
+	rm -r "test cases/cuda"/* || die
+
+	distutils-r1_python_prepare_all
+}
+
+python_check_deps() {
+	if [[ ${PV} = *9999* ]]; then
+		python_has_version "dev-python/pyyaml[${PYTHON_USEDEP}]"
+	fi
+}
+
+python_configure_all() {
+	if [[ ${PV} = *9999* ]]; then
+		# We use the unsafe_yaml loader because strictyaml is not packaged. In
+		# theory they produce the same results, but pyyaml is faster and
+		# without safety checks.
+		edo ./meson.py setup \
+			--prefix "${EPREFIX}/usr" \
+			-Dhtml=false \
+			-Dunsafe_yaml=true \
+			docs/ docs/builddir
+	fi
+}
+
+python_compile_all() {
+	if [[ ${PV} = *9999* ]]; then
+		eninja -C docs/builddir
+	fi
+}
+
+src_test() {
+	tc-export PKG_CONFIG
+	if ${PKG_CONFIG} --exists Qt5Core && ! ${PKG_CONFIG} --exists Qt5Gui; then
+		ewarn "Found Qt5Core but not Qt5Gui; skipping tests"
+	else
+		distutils-r1_src_test
+	fi
+}
+
+python_test() {
+	(
+		# meson has its own tests for LTO support. We don't need to verify that
+		# all tests work when they happen to use it. And in particular, this
+		# breaks rust.
+		filter-lto
+
+		# remove unwanted python_wrapper_setup contents
+		# We actually do want to non-error if python2 is installed and tested.
+		remove="${T}/${EPYTHON}/bin:"
+		PATH=${PATH/${remove}/}
+
+		# test_meson_installed
+		unset PYTHONDONTWRITEBYTECODE
+
+		# https://bugs.gentoo.org/687792
+		unset PKG_CONFIG
+
+		# test_cross_file_system_paths
+		unset XDG_DATA_HOME
+
+		# 'test cases/unit/73 summary' expects 80 columns
+		export COLUMNS=80
+
+		# If JAVA_HOME is not set, meson looks for javac in PATH.
+		# If javac is in /usr/bin, meson assumes /usr/include is a valid
+		# JDK include path. Setting JAVA_HOME works around this broken
+		# autodetection. If no JDK is installed, we should end up with an empty
+		# value in JAVA_HOME, and the tests should get skipped.
+		export JAVA_HOME=$(java-config -O 2>/dev/null)
+
+		${EPYTHON} -u run_tests.py
+	) || die "Testing failed with ${EPYTHON}"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	insinto /usr/share/vim/vimfiles
+	doins -r data/syntax-highlighting/vim/{ftdetect,indent,syntax}
+
+	insinto /usr/share/zsh/site-functions
+	doins data/shell-completions/zsh/_meson
+
+	dobashcomp data/shell-completions/bash/meson
+
+	if [[ ${PV} = *9999* ]]; then
+		DESTDIR="${ED}" eninja -C docs/builddir install
+	else
+		newman "${DISTDIR}"/meson-reference-${MY_PV}.3 meson-reference.3
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/ninja/ninja-1.12.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/ninja/ninja-1.12.1.ebuild
index a99cd086fbe..2b708144071 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/ninja/ninja-1.12.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/ninja/ninja-1.12.1.ebuild
@@ -15,7 +15,7 @@ if [[ ${PV} == 9999 ]]; then
 	inherit git-r3
 else
 	SRC_URI="https://github.com/ninja-build/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 GTEST_VER=1.14.0
diff --git a/sdk_container/src/third_party/portage-stable/dev-cpp/abseil-cpp/abseil-cpp-20230802.0-r4.ebuild b/sdk_container/src/third_party/portage-stable/dev-cpp/abseil-cpp/abseil-cpp-20230802.0-r4.ebuild
index edc9416eea6..94183102f81 100644
--- a/sdk_container/src/third_party/portage-stable/dev-cpp/abseil-cpp/abseil-cpp-20230802.0-r4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-cpp/abseil-cpp/abseil-cpp-20230802.0-r4.ebuild
@@ -37,7 +37,7 @@ PATCHES=(
 src_prepare() {
 	cmake_src_prepare
 
-	use ppc && eapply "${FILESDIR}/${PN}-atomic-patch"
+	use ppc && eapply "${FILESDIR}/${PN}-atomic.patch"
 
 	# un-hardcode abseil compiler flags
 	sed -i \
diff --git a/sdk_container/src/third_party/portage-stable/dev-cpp/abseil-cpp/abseil-cpp-20240116.2-r4.ebuild b/sdk_container/src/third_party/portage-stable/dev-cpp/abseil-cpp/abseil-cpp-20240116.2-r4.ebuild
index 22b35c6f3d5..c51b3cdc3c0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-cpp/abseil-cpp/abseil-cpp-20240116.2-r4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-cpp/abseil-cpp/abseil-cpp-20240116.2-r4.ebuild
@@ -37,7 +37,7 @@ PATCHES=(
 src_prepare() {
 	cmake_src_prepare
 
-	use ppc && eapply "${FILESDIR}/${PN}-atomic-patch"
+	use ppc && eapply "${FILESDIR}/${PN}-atomic.patch"
 
 	# un-hardcode abseil compiler flags
 	sed -i \
diff --git a/sdk_container/src/third_party/portage-stable/dev-cpp/abseil-cpp/abseil-cpp-20240722.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-cpp/abseil-cpp/abseil-cpp-20240722.0.ebuild
index 1aadd43217a..d9479e2682e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-cpp/abseil-cpp/abseil-cpp-20240722.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-cpp/abseil-cpp/abseil-cpp-20240722.0.ebuild
@@ -38,7 +38,7 @@ PATCHES=(
 src_prepare() {
 	cmake_src_prepare
 
-	use ppc && eapply "${FILESDIR}/${PN}-atomic-patch"
+	use ppc && eapply "${FILESDIR}/${PN}-atomic.patch"
 
 	# un-hardcode abseil compiler flags
 	sed -i \
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.46.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.46.1.ebuild
index 8f146ff5c0f..8777c7d3967 100644
--- a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.46.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.46.1.ebuild
@@ -24,7 +24,7 @@ else
 	"
 	S="${WORKDIR}/${PN}-src-${SRC_PV}"
 
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="public-domain"
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/gdb/Manifest b/sdk_container/src/third_party/portage-stable/dev-debug/gdb/Manifest
index 73ec8936577..11003bdc031 100644
--- a/sdk_container/src/third_party/portage-stable/dev-debug/gdb/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/gdb/Manifest
@@ -1,3 +1,4 @@
 DIST gdb-14.2-sim-modern-c99.patch.xz 5348 BLAKE2B f8039cdf1b49d12eead0dae7db88dbfad4c47eda696ee26b0bd140605d1d62d4a88557518d4e18c86fffb3c6194782d16e459f4392df71d2ec1af271ccb2838d SHA512 f44239871c584f5d6de98db8d6a6766103a8a6fc92dada7d37f04bdc53efe635cca7dfaa778d620348559814f4784a33e5f72a8dd376dc96fba8ec27032ab389
 DIST gdb-14.2.tar.xz 24111936 BLAKE2B 65765dfd1ed08e19bb881fc7ae98d6ee4914f38a9a2bb0d0ca73bef472669664f807fe9c04e8dffd7025be98e736ac52f88ff5851ceddbb01a361885b18befc8 SHA512 7e07941f1fe661288cc571b4964012ceabc1760624fce20320db2f470c01439b2386f859b5288da13204b758e2e3b22a74c68c012178db93b9529b06f1e22ede
 DIST gdb-15.1.tar.xz 24295712 BLAKE2B e05133a9f98a1a00cbfb49294f534e3b8830b48ac9526af3312a3b9a0381e0e652bc3f5fdc8528ceb16c890529cefbd7745bed97298a1fecb64c726d09c8aacb SHA512 0217434073023a8b8316088bf3ee95d53a1b6a7897f6269095429016a8900f9a05e130c390d8d5d5550cc515c16519de1071d8eef96aa58e38056c7e37da1d8b
+DIST gdb-15.2.tar.xz 24332820 BLAKE2B 073668c21b41f12bf40160c6d3df808056453cc9df3b5b86374abe38e955d208f86467458b7e64b3c3e93d70b7f87425619778173fdb375256cd85be15419f14 SHA512 624007deceb5b15ba89c0725883d1a699fa46714ef30887f3d0165e17c5d65d634671740a135aa69e437d916218abb08cfa2a38ed309ff19d48f51da56b2a8ba
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-15.1-r100.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-15.1-r100.ebuild
new file mode 100644
index 00000000000..4d5d83a579f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-15.1-r100.ebuild
@@ -0,0 +1,325 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# See https://sourceware.org/gdb/wiki/DistroAdvice for general packaging
+# tips & notes.
+
+GUILE_COMPAT=( 2-2 3-0 )
+PYTHON_COMPAT=( python3_{10..12} )
+inherit flag-o-matic guile-single python-single-r1 strip-linguas toolchain-funcs
+
+export CTARGET=${CTARGET:-${CHOST}}
+
+if [[ ${CTARGET} == ${CHOST} ]] ; then
+	if [[ ${CATEGORY} == cross-* ]] ; then
+		export CTARGET=${CATEGORY#cross-}
+	fi
+fi
+
+is_cross() { [[ ${CHOST} != ${CTARGET} ]] ; }
+
+case ${PV} in
+	9999*)
+		# live git tree
+		EGIT_REPO_URI="https://sourceware.org/git/binutils-gdb.git"
+		inherit git-r3
+		SRC_URI=""
+		;;
+	*.*.50_p2???????|*.*.90_p2???????)
+		# Weekly snapshots
+		MY_PV="${PV/_p/.}"
+		SRC_URI="
+			https://sourceware.org/pub/gdb/snapshots/branch/gdb-weekly-${MY_PV}.tar.xz
+			https://sourceware.org/pub/gdb/snapshots/current/gdb-weekly-${MY_PV}.tar.xz
+			https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/gdb-weekly-${MY_PV}.tar.xz
+		"
+		S="${WORKDIR}/${PN}-${MY_PV}"
+
+		# e.g. 13.1.90_p20230325 is a snapshot on the stable branch, so it's fine
+		if [[ ${PV} == *.[123456789].9?_p2??????? ]] ; then
+			REGULAR_RELEASE=1
+		fi
+		;;
+	*.*.9?)
+		# Prereleases
+		MY_PV="${PV/_p/.}"
+		SRC_URI="
+			https://sourceware.org/pub/gdb/snapshots/branch/gdb-${MY_PV}.tar.xz
+			https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/gdb-${MY_PV}.tar.xz
+		"
+		S="${WORKDIR}/${PN}-${MY_PV}"
+		;;
+	*)
+		# Normal upstream release
+		SRC_URI="
+			mirror://gnu/gdb/${P}.tar.xz
+			https://sourceware.org/pub/gdb/releases/${P}.tar.xz
+		"
+
+		REGULAR_RELEASE=1
+esac
+
+PATCH_DEV=""
+PATCH_VER=""
+DESCRIPTION="GNU debugger"
+HOMEPAGE="https://sourceware.org/gdb/"
+SRC_URI="
+	${SRC_URI}
+	${PATCH_DEV:+https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${P}-patches-${PATCH_VER}.tar.xz}
+	${PATCH_VER:+mirror://gentoo/${P}-patches-${PATCH_VER}.tar.xz}
+"
+
+LICENSE="GPL-3+ LGPL-2.1+"
+SLOT="0"
+IUSE="cet debuginfod guile lzma multitarget nls +python +server sim source-highlight test vanilla xml xxhash zstd"
+if [[ -n ${REGULAR_RELEASE} ]] ; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+fi
+REQUIRED_USE="
+	guile? ( ${GUILE_REQUIRED_USE} )
+	python? ( ${PYTHON_REQUIRED_USE} )
+"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	dev-libs/mpfr:=
+	dev-libs/gmp:=
+	>=sys-libs/ncurses-5.2-r2:=
+	>=sys-libs/readline-7:=
+	sys-libs/zlib
+	elibc_glibc? ( net-libs/libnsl:= )
+	debuginfod? (
+		dev-libs/elfutils[debuginfod(-)]
+	)
+	lzma? ( app-arch/xz-utils )
+	python? ( ${PYTHON_DEPS} )
+	guile? ( ${GUILE_DEPS} )
+	xml? ( dev-libs/expat )
+	source-highlight? (
+		dev-util/source-highlight
+	)
+	xxhash? (
+		dev-libs/xxhash
+	)
+	zstd? ( app-arch/zstd:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	app-arch/xz-utils
+	sys-apps/texinfo
+	app-alternatives/yacc
+	nls? ( sys-devel/gettext )
+	source-highlight? ( virtual/pkgconfig )
+	test? ( dev-util/dejagnu )
+"
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+	MIN # gnulib FP (bug #898688)
+)
+
+QA_PREBUILT="usr/share/gdb/guile/*"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-8.3.1-verbose-build.patch
+)
+
+pkg_setup() {
+	use guile && guile-single_pkg_setup
+	use python && python-single-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	use guile && guile_bump_sources
+
+	strip-linguas -u bfd/po opcodes/po
+
+	# Avoid using ancient termcap from host on Prefix systems
+	sed -i -e 's/termcap tinfow/tinfow/g' \
+		gdb/configure{.ac,} || die
+}
+
+gdb_branding() {
+	printf "Gentoo ${PV} "
+
+	if ! use vanilla && [[ -n ${PATCH_VER} ]] ; then
+		printf "p${PATCH_VER}"
+	else
+		printf "vanilla"
+	fi
+
+	[[ -n ${EGIT_COMMIT} ]] && printf " ${EGIT_COMMIT}"
+}
+
+src_configure() {
+	strip-unsupported-flags
+
+	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
+	# Avoid really confusing logs from subconfigure spam, makes logs far
+	# more legible.
+	MAKEOPTS="--output-sync=line ${MAKEOPTS}"
+
+	local myconf=(
+		# portage's econf() does not detect presence of --d-d-t
+		# because it greps only top-level ./configure. But not
+		# libiberty's or gdb's configure.
+		--disable-dependency-tracking
+		--disable-silent-rules
+
+		--with-pkgversion="$(gdb_branding)"
+		--with-bugurl='https://bugs.gentoo.org/'
+		--disable-werror
+		# Disable modules that are in a combined binutils/gdb tree. bug #490566
+		--disable-{binutils,etc,gas,gold,gprof,gprofng,ld}
+
+		$(use_with debuginfod)
+
+		$(use_enable test unit-tests)
+
+		# Allow user to opt into CET for host libraries.
+		# Ideally we would like automagic-or-disabled here.
+		# But the check does not quite work on i686: bug #760926.
+		$(use_enable cet)
+
+		# Helps when cross-compiling. Not to be confused with --with-sysroot.
+		--with-build-sysroot="${ESYSROOT}"
+	)
+
+	is_cross && myconf+=(
+		--with-sysroot="\${prefix}/${CTARGET}"
+		--includedir="\${prefix}/include/${CTARGET}"
+		--with-gdb-datadir="\${datadir}/gdb/${CTARGET}"
+	)
+
+	# gdbserver only works for native targets (CHOST==CTARGET).
+	# it also doesn't support all targets, so rather than duplicate
+	# the target list (which changes between versions), use the
+	# "auto" value when things are turned on, which is triggered
+	# whenever no --enable or --disable is given
+	if is_cross || use !server ; then
+		myconf+=( --disable-gdbserver )
+	fi
+
+	myconf+=(
+		--enable-64-bit-bfd
+		--disable-install-libbfd
+		--disable-install-libiberty
+		--enable-obsolete
+		# This only disables building in the readline subdir.
+		# For gdb itself, it'll use the system version.
+		--disable-readline
+		--with-system-readline
+		# This only disables building in the zlib subdir.
+		# For gdb itself, it'll use the system version.
+		--without-zlib
+		--with-system-zlib
+		--with-separate-debug-dir="${EPREFIX}"/usr/lib/debug
+		$(use_with xml expat)
+		$(use_with lzma)
+		$(use_enable nls)
+		$(use_enable sim)
+		$(use_enable source-highlight)
+		$(use multitarget && echo --enable-targets=all)
+		$(use_with python python "${EPYTHON}")
+		$(use_with xxhash)
+		$(use_with guile)
+		$(use_with zstd)
+
+		# Find libraries using the toolchain sysroot rather than the configured
+		# prefix. Needed when cross-compiling.
+		#
+		# Check which libraries to apply this to with:
+		# "${S}"/gdb/configure --help | grep without-lib | sort
+		--without-lib{babeltrace,expat,gmp,iconv,ipt,lzma,mpfr,xxhash}-prefix
+	)
+
+	# source-highlight is detected with pkg-config: bug #716558
+	export ac_cv_path_pkg_config_prog_path="$(tc-getPKG_CONFIG)"
+
+	export CC_FOR_BUILD="$(tc-getBUILD_CC)"
+
+	# ensure proper compiler is detected for Clang builds: bug #831202
+	export GCC_FOR_TARGET="${CC_FOR_TARGET:-$(tc-getCC)}"
+
+	econf "${myconf[@]}"
+}
+
+src_test() {
+	# Run the unittests (nabbed invocation from Fedora's spec file) at least
+	emake -k -C gdb run GDBFLAGS='-batch -ex "maintenance selftest"'
+
+	# Too many failures
+	# In fact, gdb's test suite needs some work to get passing.
+	# See e.g. https://sourceware.org/gdb/wiki/TestingGDB.
+	# As of 11.2, on amd64: "# of unexpected failures    8600"
+	# Also, ia64 kernel crashes when gdb testsuite is running.
+	#emake -k check
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+
+	find "${ED}"/usr -name libiberty.a -delete || die
+
+	# Delete translations that conflict with binutils-libs. bug #528088
+	# Note: Should figure out how to store these in an internal gdb dir.
+	if use nls ; then
+		find "${ED}" \
+			-regextype posix-extended -regex '.*/(bfd|opcodes)[.]g?mo$' \
+			-delete || die
+	fi
+
+	# Don't install docs when building a cross-gdb
+	if [[ ${CTARGET} != ${CHOST} ]] ; then
+		rm -rf "${ED}"/usr/share/{doc,info,locale} || die
+		local f
+		for f in "${ED}"/usr/share/man/*/* ; do
+			if [[ ${f##*/} != ${CTARGET}-* ]] ; then
+				mv "${f}" "${f%/*}/${CTARGET}-${f##*/}" || die
+			fi
+		done
+		return 0
+	fi
+
+	# Install it by hand for now:
+	# https://sourceware.org/ml/gdb-patches/2011-12/msg00915.html
+	# Only install if it exists due to the twisted behavior (see
+	# notes in src_configure above).
+	[[ -e gdbserver/gdbreplay ]] && dobin gdbserver/gdbreplay
+
+	docinto gdb
+	dodoc gdb/CONTRIBUTE gdb/README gdb/MAINTAINERS \
+		gdb/NEWS gdb/PROBLEMS
+	docinto sim
+	dodoc sim/{MAINTAINERS,README-HACKING}
+
+	if use server ; then
+		docinto gdbserver
+		dodoc gdbserver/README
+	fi
+
+	# Remove shared info pages
+	rm -f "${ED}"/usr/share/info/{annotate,bfd,configure,ctf-spec,standards}.info*
+
+	use guile && guile_unstrip_ccache
+
+	if use python ; then
+		python_optimize "${ED}"/usr/share/gdb/python/gdb
+	fi
+}
+
+pkg_postinst() {
+	# Portage doesn't unmerge files in /etc
+	rm -vf "${EROOT}"/etc/skel/.gdbinit
+
+	if use prefix && [[ ${CHOST} == *-darwin* ]] ; then
+		ewarn "gdb is unable to get a mach task port when installed by Prefix"
+		ewarn "Portage, unprivileged.  To make gdb fully functional you'll"
+		ewarn "have to perform the following steps:"
+		ewarn "  % sudo chgrp procmod ${EPREFIX}/usr/bin/gdb"
+		ewarn "  % sudo chmod g+s ${EPREFIX}/usr/bin/gdb"
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-15.2-r100.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-15.2-r100.ebuild
new file mode 100644
index 00000000000..7cb1e790e32
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-15.2-r100.ebuild
@@ -0,0 +1,325 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# See https://sourceware.org/gdb/wiki/DistroAdvice for general packaging
+# tips & notes.
+
+GUILE_COMPAT=( 2-2 3-0 )
+PYTHON_COMPAT=( python3_{10..13} )
+inherit flag-o-matic guile-single python-single-r1 strip-linguas toolchain-funcs
+
+export CTARGET=${CTARGET:-${CHOST}}
+
+if [[ ${CTARGET} == ${CHOST} ]] ; then
+	if [[ ${CATEGORY} == cross-* ]] ; then
+		export CTARGET=${CATEGORY#cross-}
+	fi
+fi
+
+is_cross() { [[ ${CHOST} != ${CTARGET} ]] ; }
+
+case ${PV} in
+	9999*)
+		# live git tree
+		EGIT_REPO_URI="https://sourceware.org/git/binutils-gdb.git"
+		inherit git-r3
+		SRC_URI=""
+		;;
+	*.*.50_p2???????|*.*.90_p2???????)
+		# Weekly snapshots
+		MY_PV="${PV/_p/.}"
+		SRC_URI="
+			https://sourceware.org/pub/gdb/snapshots/branch/gdb-weekly-${MY_PV}.tar.xz
+			https://sourceware.org/pub/gdb/snapshots/current/gdb-weekly-${MY_PV}.tar.xz
+			https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/gdb-weekly-${MY_PV}.tar.xz
+		"
+		S="${WORKDIR}/${PN}-${MY_PV}"
+
+		# e.g. 13.1.90_p20230325 is a snapshot on the stable branch, so it's fine
+		if [[ ${PV} == *.[123456789].9?_p2??????? ]] ; then
+			REGULAR_RELEASE=1
+		fi
+		;;
+	*.*.9?)
+		# Prereleases
+		MY_PV="${PV/_p/.}"
+		SRC_URI="
+			https://sourceware.org/pub/gdb/snapshots/branch/gdb-${MY_PV}.tar.xz
+			https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/gdb-${MY_PV}.tar.xz
+		"
+		S="${WORKDIR}/${PN}-${MY_PV}"
+		;;
+	*)
+		# Normal upstream release
+		SRC_URI="
+			mirror://gnu/gdb/${P}.tar.xz
+			https://sourceware.org/pub/gdb/releases/${P}.tar.xz
+		"
+
+		REGULAR_RELEASE=1
+esac
+
+PATCH_DEV=""
+PATCH_VER=""
+DESCRIPTION="GNU debugger"
+HOMEPAGE="https://sourceware.org/gdb/"
+SRC_URI="
+	${SRC_URI}
+	${PATCH_DEV:+https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${P}-patches-${PATCH_VER}.tar.xz}
+	${PATCH_VER:+mirror://gentoo/${P}-patches-${PATCH_VER}.tar.xz}
+"
+
+LICENSE="GPL-3+ LGPL-2.1+"
+SLOT="0"
+IUSE="cet debuginfod guile lzma multitarget nls +python +server sim source-highlight test vanilla xml xxhash zstd"
+if [[ -n ${REGULAR_RELEASE} ]] ; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+fi
+REQUIRED_USE="
+	guile? ( ${GUILE_REQUIRED_USE} )
+	python? ( ${PYTHON_REQUIRED_USE} )
+"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	dev-libs/mpfr:=
+	dev-libs/gmp:=
+	>=sys-libs/ncurses-5.2-r2:=
+	>=sys-libs/readline-7:=
+	sys-libs/zlib
+	elibc_glibc? ( net-libs/libnsl:= )
+	debuginfod? (
+		dev-libs/elfutils[debuginfod(-)]
+	)
+	lzma? ( app-arch/xz-utils )
+	python? ( ${PYTHON_DEPS} )
+	guile? ( ${GUILE_DEPS} )
+	xml? ( dev-libs/expat )
+	source-highlight? (
+		dev-util/source-highlight
+	)
+	xxhash? (
+		dev-libs/xxhash
+	)
+	zstd? ( app-arch/zstd:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	app-arch/xz-utils
+	sys-apps/texinfo
+	app-alternatives/yacc
+	nls? ( sys-devel/gettext )
+	source-highlight? ( virtual/pkgconfig )
+	test? ( dev-util/dejagnu )
+"
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+	MIN # gnulib FP (bug #898688)
+)
+
+QA_PREBUILT="usr/share/gdb/guile/*"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-8.3.1-verbose-build.patch
+)
+
+pkg_setup() {
+	use guile && guile-single_pkg_setup
+	use python && python-single-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	use guile && guile_bump_sources
+
+	strip-linguas -u bfd/po opcodes/po
+
+	# Avoid using ancient termcap from host on Prefix systems
+	sed -i -e 's/termcap tinfow/tinfow/g' \
+		gdb/configure{.ac,} || die
+}
+
+gdb_branding() {
+	printf "Gentoo ${PV} "
+
+	if ! use vanilla && [[ -n ${PATCH_VER} ]] ; then
+		printf "p${PATCH_VER}"
+	else
+		printf "vanilla"
+	fi
+
+	[[ -n ${EGIT_COMMIT} ]] && printf " ${EGIT_COMMIT}"
+}
+
+src_configure() {
+	strip-unsupported-flags
+
+	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
+	# Avoid really confusing logs from subconfigure spam, makes logs far
+	# more legible.
+	MAKEOPTS="--output-sync=line ${MAKEOPTS}"
+
+	local myconf=(
+		# portage's econf() does not detect presence of --d-d-t
+		# because it greps only top-level ./configure. But not
+		# libiberty's or gdb's configure.
+		--disable-dependency-tracking
+		--disable-silent-rules
+
+		--with-pkgversion="$(gdb_branding)"
+		--with-bugurl='https://bugs.gentoo.org/'
+		--disable-werror
+		# Disable modules that are in a combined binutils/gdb tree. bug #490566
+		--disable-{binutils,etc,gas,gold,gprof,gprofng,ld}
+
+		$(use_with debuginfod)
+
+		$(use_enable test unit-tests)
+
+		# Allow user to opt into CET for host libraries.
+		# Ideally we would like automagic-or-disabled here.
+		# But the check does not quite work on i686: bug #760926.
+		$(use_enable cet)
+
+		# Helps when cross-compiling. Not to be confused with --with-sysroot.
+		--with-build-sysroot="${ESYSROOT}"
+	)
+
+	is_cross && myconf+=(
+		--with-sysroot="\${prefix}/${CTARGET}"
+		--includedir="\${prefix}/include/${CTARGET}"
+		--with-gdb-datadir="\${datadir}/gdb/${CTARGET}"
+	)
+
+	# gdbserver only works for native targets (CHOST==CTARGET).
+	# it also doesn't support all targets, so rather than duplicate
+	# the target list (which changes between versions), use the
+	# "auto" value when things are turned on, which is triggered
+	# whenever no --enable or --disable is given
+	if is_cross || use !server ; then
+		myconf+=( --disable-gdbserver )
+	fi
+
+	myconf+=(
+		--enable-64-bit-bfd
+		--disable-install-libbfd
+		--disable-install-libiberty
+		--enable-obsolete
+		# This only disables building in the readline subdir.
+		# For gdb itself, it'll use the system version.
+		--disable-readline
+		--with-system-readline
+		# This only disables building in the zlib subdir.
+		# For gdb itself, it'll use the system version.
+		--without-zlib
+		--with-system-zlib
+		--with-separate-debug-dir="${EPREFIX}"/usr/lib/debug
+		$(use_with xml expat)
+		$(use_with lzma)
+		$(use_enable nls)
+		$(use_enable sim)
+		$(use_enable source-highlight)
+		$(use multitarget && echo --enable-targets=all)
+		$(use_with python python "${EPYTHON}")
+		$(use_with xxhash)
+		$(use_with guile)
+		$(use_with zstd)
+
+		# Find libraries using the toolchain sysroot rather than the configured
+		# prefix. Needed when cross-compiling.
+		#
+		# Check which libraries to apply this to with:
+		# "${S}"/gdb/configure --help | grep without-lib | sort
+		--without-lib{babeltrace,expat,gmp,iconv,ipt,lzma,mpfr,xxhash}-prefix
+	)
+
+	# source-highlight is detected with pkg-config: bug #716558
+	export ac_cv_path_pkg_config_prog_path="$(tc-getPKG_CONFIG)"
+
+	export CC_FOR_BUILD="$(tc-getBUILD_CC)"
+
+	# ensure proper compiler is detected for Clang builds: bug #831202
+	export GCC_FOR_TARGET="${CC_FOR_TARGET:-$(tc-getCC)}"
+
+	econf "${myconf[@]}"
+}
+
+src_test() {
+	# Run the unittests (nabbed invocation from Fedora's spec file) at least
+	emake -k -C gdb run GDBFLAGS='-batch -ex "maintenance selftest"'
+
+	# Too many failures
+	# In fact, gdb's test suite needs some work to get passing.
+	# See e.g. https://sourceware.org/gdb/wiki/TestingGDB.
+	# As of 11.2, on amd64: "# of unexpected failures    8600"
+	# Also, ia64 kernel crashes when gdb testsuite is running.
+	#emake -k check
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+
+	find "${ED}"/usr -name libiberty.a -delete || die
+
+	# Delete translations that conflict with binutils-libs. bug #528088
+	# Note: Should figure out how to store these in an internal gdb dir.
+	if use nls ; then
+		find "${ED}" \
+			-regextype posix-extended -regex '.*/(bfd|opcodes)[.]g?mo$' \
+			-delete || die
+	fi
+
+	# Don't install docs when building a cross-gdb
+	if [[ ${CTARGET} != ${CHOST} ]] ; then
+		rm -rf "${ED}"/usr/share/{doc,info,locale} || die
+		local f
+		for f in "${ED}"/usr/share/man/*/* ; do
+			if [[ ${f##*/} != ${CTARGET}-* ]] ; then
+				mv "${f}" "${f%/*}/${CTARGET}-${f##*/}" || die
+			fi
+		done
+		return 0
+	fi
+
+	# Install it by hand for now:
+	# https://sourceware.org/ml/gdb-patches/2011-12/msg00915.html
+	# Only install if it exists due to the twisted behavior (see
+	# notes in src_configure above).
+	[[ -e gdbserver/gdbreplay ]] && dobin gdbserver/gdbreplay
+
+	docinto gdb
+	dodoc gdb/CONTRIBUTE gdb/README gdb/MAINTAINERS \
+		gdb/NEWS gdb/PROBLEMS
+	docinto sim
+	dodoc sim/{MAINTAINERS,README-HACKING}
+
+	if use server ; then
+		docinto gdbserver
+		dodoc gdbserver/README
+	fi
+
+	# Remove shared info pages
+	rm -f "${ED}"/usr/share/info/{annotate,bfd,configure,ctf-spec,standards}.info*
+
+	use guile && guile_unstrip_ccache
+
+	if use python ; then
+		python_optimize "${ED}"/usr/share/gdb/python/gdb
+	fi
+}
+
+pkg_postinst() {
+	# Portage doesn't unmerge files in /etc
+	rm -vf "${EROOT}"/etc/skel/.gdbinit
+
+	if use prefix && [[ ${CHOST} == *-darwin* ]] ; then
+		ewarn "gdb is unable to get a mach task port when installed by Prefix"
+		ewarn "Portage, unprivileged.  To make gdb fully functional you'll"
+		ewarn "have to perform the following steps:"
+		ewarn "  % sudo chgrp procmod ${EPREFIX}/usr/bin/gdb"
+		ewarn "  % sudo chmod g+s ${EPREFIX}/usr/bin/gdb"
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-15.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-15.2.ebuild
new file mode 100644
index 00000000000..77231a3d5a7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-15.2.ebuild
@@ -0,0 +1,314 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# See https://sourceware.org/gdb/wiki/DistroAdvice for general packaging
+# tips & notes.
+
+PYTHON_COMPAT=( python3_{10..13} )
+inherit flag-o-matic python-single-r1 strip-linguas toolchain-funcs
+
+export CTARGET=${CTARGET:-${CHOST}}
+
+if [[ ${CTARGET} == ${CHOST} ]] ; then
+	if [[ ${CATEGORY} == cross-* ]] ; then
+		export CTARGET=${CATEGORY#cross-}
+	fi
+fi
+
+is_cross() { [[ ${CHOST} != ${CTARGET} ]] ; }
+
+case ${PV} in
+	9999*)
+		# live git tree
+		EGIT_REPO_URI="https://sourceware.org/git/binutils-gdb.git"
+		inherit git-r3
+		SRC_URI=""
+		;;
+	*.*.50_p2???????|*.*.90_p2???????)
+		# Weekly snapshots
+		MY_PV="${PV/_p/.}"
+		SRC_URI="
+			https://sourceware.org/pub/gdb/snapshots/branch/gdb-weekly-${MY_PV}.tar.xz
+			https://sourceware.org/pub/gdb/snapshots/current/gdb-weekly-${MY_PV}.tar.xz
+			https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/gdb-weekly-${MY_PV}.tar.xz
+		"
+		S="${WORKDIR}/${PN}-${MY_PV}"
+
+		# e.g. 13.1.90_p20230325 is a snapshot on the stable branch, so it's fine
+		if [[ ${PV} == *.[123456789].9?_p2??????? ]] ; then
+			REGULAR_RELEASE=1
+		fi
+		;;
+	*.*.9?)
+		# Prereleases
+		MY_PV="${PV/_p/.}"
+		SRC_URI="
+			https://sourceware.org/pub/gdb/snapshots/branch/gdb-${MY_PV}.tar.xz
+			https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/gdb-${MY_PV}.tar.xz
+		"
+		S="${WORKDIR}/${PN}-${MY_PV}"
+		;;
+	*)
+		# Normal upstream release
+		SRC_URI="
+			mirror://gnu/gdb/${P}.tar.xz
+			https://sourceware.org/pub/gdb/releases/${P}.tar.xz
+		"
+
+		REGULAR_RELEASE=1
+esac
+
+PATCH_DEV=""
+PATCH_VER=""
+DESCRIPTION="GNU debugger"
+HOMEPAGE="https://sourceware.org/gdb/"
+SRC_URI="
+	${SRC_URI}
+	${PATCH_DEV:+https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${P}-patches-${PATCH_VER}.tar.xz}
+	${PATCH_VER:+mirror://gentoo/${P}-patches-${PATCH_VER}.tar.xz}
+"
+
+LICENSE="GPL-3+ LGPL-2.1+"
+SLOT="0"
+IUSE="cet debuginfod guile lzma multitarget nls +python +server sim source-highlight test vanilla xml xxhash zstd"
+if [[ -n ${REGULAR_RELEASE} ]] ; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+fi
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	dev-libs/mpfr:=
+	dev-libs/gmp:=
+	>=sys-libs/ncurses-5.2-r2:=
+	>=sys-libs/readline-7:=
+	sys-libs/zlib
+	elibc_glibc? ( net-libs/libnsl:= )
+	debuginfod? (
+		dev-libs/elfutils[debuginfod(-)]
+	)
+	lzma? ( app-arch/xz-utils )
+	python? ( ${PYTHON_DEPS} )
+	guile? ( >=dev-scheme/guile-2.0 )
+	xml? ( dev-libs/expat )
+	source-highlight? (
+		dev-util/source-highlight
+	)
+	xxhash? (
+		dev-libs/xxhash
+	)
+	zstd? ( app-arch/zstd:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	app-arch/xz-utils
+	sys-apps/texinfo
+	app-alternatives/yacc
+	nls? ( sys-devel/gettext )
+	source-highlight? ( virtual/pkgconfig )
+	test? ( dev-util/dejagnu )
+"
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+	MIN # gnulib FP (bug #898688)
+)
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-8.3.1-verbose-build.patch
+)
+
+pkg_setup() {
+	use python && python-single-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	strip-linguas -u bfd/po opcodes/po
+
+	# Avoid using ancient termcap from host on Prefix systems
+	sed -i -e 's/termcap tinfow/tinfow/g' \
+		gdb/configure{.ac,} || die
+}
+
+gdb_branding() {
+	printf "Gentoo ${PV} "
+
+	if ! use vanilla && [[ -n ${PATCH_VER} ]] ; then
+		printf "p${PATCH_VER}"
+	else
+		printf "vanilla"
+	fi
+
+	[[ -n ${EGIT_COMMIT} ]] && printf " ${EGIT_COMMIT}"
+}
+
+src_configure() {
+	strip-unsupported-flags
+
+	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
+	# Avoid really confusing logs from subconfigure spam, makes logs far
+	# more legible.
+	MAKEOPTS="--output-sync=line ${MAKEOPTS}"
+
+	local myconf=(
+		# portage's econf() does not detect presence of --d-d-t
+		# because it greps only top-level ./configure. But not
+		# libiberty's or gdb's configure.
+		--disable-dependency-tracking
+		--disable-silent-rules
+
+		--with-pkgversion="$(gdb_branding)"
+		--with-bugurl='https://bugs.gentoo.org/'
+		--disable-werror
+		# Disable modules that are in a combined binutils/gdb tree. bug #490566
+		--disable-{binutils,etc,gas,gold,gprof,gprofng,ld}
+
+		$(use_with debuginfod)
+
+		$(use_enable test unit-tests)
+
+		# Allow user to opt into CET for host libraries.
+		# Ideally we would like automagic-or-disabled here.
+		# But the check does not quite work on i686: bug #760926.
+		$(use_enable cet)
+
+		# Helps when cross-compiling. Not to be confused with --with-sysroot.
+		--with-build-sysroot="${ESYSROOT}"
+	)
+
+	is_cross && myconf+=(
+		--with-sysroot="\${prefix}/${CTARGET}"
+		--includedir="\${prefix}/include/${CTARGET}"
+		--with-gdb-datadir="\${datadir}/gdb/${CTARGET}"
+	)
+
+	# gdbserver only works for native targets (CHOST==CTARGET).
+	# it also doesn't support all targets, so rather than duplicate
+	# the target list (which changes between versions), use the
+	# "auto" value when things are turned on, which is triggered
+	# whenever no --enable or --disable is given
+	if is_cross || use !server ; then
+		myconf+=( --disable-gdbserver )
+	fi
+
+	myconf+=(
+		--enable-64-bit-bfd
+		--disable-install-libbfd
+		--disable-install-libiberty
+		--enable-obsolete
+		# This only disables building in the readline subdir.
+		# For gdb itself, it'll use the system version.
+		--disable-readline
+		--with-system-readline
+		# This only disables building in the zlib subdir.
+		# For gdb itself, it'll use the system version.
+		--without-zlib
+		--with-system-zlib
+		--with-separate-debug-dir="${EPREFIX}"/usr/lib/debug
+		$(use_with xml expat)
+		$(use_with lzma)
+		$(use_enable nls)
+		$(use_enable sim)
+		$(use_enable source-highlight)
+		$(use multitarget && echo --enable-targets=all)
+		$(use_with python python "${EPYTHON}")
+		$(use_with xxhash)
+		$(use_with guile)
+		$(use_with zstd)
+
+		# Find libraries using the toolchain sysroot rather than the configured
+		# prefix. Needed when cross-compiling.
+		#
+		# Check which libraries to apply this to with:
+		# "${S}"/gdb/configure --help | grep without-lib | sort
+		--without-lib{babeltrace,expat,gmp,iconv,ipt,lzma,mpfr,xxhash}-prefix
+	)
+
+	# source-highlight is detected with pkg-config: bug #716558
+	export ac_cv_path_pkg_config_prog_path="$(tc-getPKG_CONFIG)"
+
+	export CC_FOR_BUILD="$(tc-getBUILD_CC)"
+
+	# ensure proper compiler is detected for Clang builds: bug #831202
+	export GCC_FOR_TARGET="${CC_FOR_TARGET:-$(tc-getCC)}"
+
+	econf "${myconf[@]}"
+}
+
+src_test() {
+	# Run the unittests (nabbed invocation from Fedora's spec file) at least
+	emake -k -C gdb run GDBFLAGS='-batch -ex "maintenance selftest"'
+
+	# Too many failures
+	# In fact, gdb's test suite needs some work to get passing.
+	# See e.g. https://sourceware.org/gdb/wiki/TestingGDB.
+	# As of 11.2, on amd64: "# of unexpected failures    8600"
+	# Also, ia64 kernel crashes when gdb testsuite is running.
+	#emake -k check
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+
+	find "${ED}"/usr -name libiberty.a -delete || die
+
+	# Delete translations that conflict with binutils-libs. bug #528088
+	# Note: Should figure out how to store these in an internal gdb dir.
+	if use nls ; then
+		find "${ED}" \
+			-regextype posix-extended -regex '.*/(bfd|opcodes)[.]g?mo$' \
+			-delete || die
+	fi
+
+	# Don't install docs when building a cross-gdb
+	if [[ ${CTARGET} != ${CHOST} ]] ; then
+		rm -rf "${ED}"/usr/share/{doc,info,locale} || die
+		local f
+		for f in "${ED}"/usr/share/man/*/* ; do
+			if [[ ${f##*/} != ${CTARGET}-* ]] ; then
+				mv "${f}" "${f%/*}/${CTARGET}-${f##*/}" || die
+			fi
+		done
+		return 0
+	fi
+
+	# Install it by hand for now:
+	# https://sourceware.org/ml/gdb-patches/2011-12/msg00915.html
+	# Only install if it exists due to the twisted behavior (see
+	# notes in src_configure above).
+	[[ -e gdbserver/gdbreplay ]] && dobin gdbserver/gdbreplay
+
+	docinto gdb
+	dodoc gdb/CONTRIBUTE gdb/README gdb/MAINTAINERS \
+		gdb/NEWS gdb/PROBLEMS
+	docinto sim
+	dodoc sim/{MAINTAINERS,README-HACKING}
+
+	if use server ; then
+		docinto gdbserver
+		dodoc gdbserver/README
+	fi
+
+	# Remove shared info pages
+	rm -f "${ED}"/usr/share/info/{annotate,bfd,configure,ctf-spec,standards}.info*
+
+	if use python ; then
+		python_optimize "${ED}"/usr/share/gdb/python/gdb
+	fi
+}
+
+pkg_postinst() {
+	# Portage doesn't unmerge files in /etc
+	rm -vf "${EROOT}"/etc/skel/.gdbinit
+
+	if use prefix && [[ ${CHOST} == *-darwin* ]] ; then
+		ewarn "gdb is unable to get a mach task port when installed by Prefix"
+		ewarn "Portage, unprivileged.  To make gdb fully functional you'll"
+		ewarn "have to perform the following steps:"
+		ewarn "  % sudo chgrp procmod ${EPREFIX}/usr/bin/gdb"
+		ewarn "  % sudo chmod g+s ${EPREFIX}/usr/bin/gdb"
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-9999.ebuild
index c35dad1f342..02518991189 100644
--- a/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-9999.ebuild
@@ -6,8 +6,9 @@ EAPI=8
 # See https://sourceware.org/gdb/wiki/DistroAdvice for general packaging
 # tips & notes.
 
-PYTHON_COMPAT=( python3_{10..12} )
-inherit flag-o-matic python-single-r1 strip-linguas toolchain-funcs
+GUILE_COMPAT=( 2-2 3-0 )
+PYTHON_COMPAT=( python3_{10..13} )
+inherit flag-o-matic guile-single python-single-r1 strip-linguas toolchain-funcs
 
 export CTARGET=${CTARGET:-${CHOST}}
 
@@ -76,7 +77,10 @@ IUSE="cet debuginfod guile lzma multitarget nls +python +server sim source-highl
 if [[ -n ${REGULAR_RELEASE} ]] ; then
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
 fi
-REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+REQUIRED_USE="
+	guile? ( ${GUILE_REQUIRED_USE} )
+	python? ( ${PYTHON_REQUIRED_USE} )
+"
 RESTRICT="!test? ( test )"
 
 RDEPEND="
@@ -91,7 +95,7 @@ RDEPEND="
 	)
 	lzma? ( app-arch/xz-utils )
 	python? ( ${PYTHON_DEPS} )
-	guile? ( >=dev-scheme/guile-2.0 )
+	guile? ( ${GUILE_DEPS} )
 	xml? ( dev-libs/expat )
 	source-highlight? (
 		dev-util/source-highlight
@@ -115,17 +119,22 @@ QA_CONFIG_IMPL_DECL_SKIP=(
 	MIN # gnulib FP (bug #898688)
 )
 
+QA_PREBUILT="usr/share/gdb/guile/*"
+
 PATCHES=(
 	"${FILESDIR}"/${PN}-8.3.1-verbose-build.patch
 )
 
 pkg_setup() {
+	use guile && guile-single_pkg_setup
 	use python && python-single-r1_pkg_setup
 }
 
 src_prepare() {
 	default
 
+	use guile && guile_bump_sources
+
 	strip-linguas -u bfd/po opcodes/po
 
 	# Avoid using ancient termcap from host on Prefix systems
@@ -303,6 +312,8 @@ src_install() {
 	# Remove shared info pages
 	rm -f "${ED}"/usr/share/info/{annotate,bfd,configure,ctf-spec,standards}.info*
 
+	use guile && guile_unstrip_ccache
+
 	if use python ; then
 		python_optimize "${ED}"/usr/share/gdb/python/gdb
 	fi
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/strace/Manifest b/sdk_container/src/third_party/portage-stable/dev-debug/strace/Manifest
index eb0dbf1c861..ee9bc1b7055 100644
--- a/sdk_container/src/third_party/portage-stable/dev-debug/strace/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/strace/Manifest
@@ -1,5 +1,12 @@
 DIST strace-6.10.tar.xz 2600864 BLAKE2B acb26ed66fbfcb1bc6403441b632df2f7af018345e52120b8715e2bbfa578fc80af8e3844cba3e131601285f9e72b15c8b4ea56025c5efae846d2d36960f6c04 SHA512 0d7dafaa50fbcfebc37f37e53c2961972efd66ce0d71628fbcd2a8b871cb7e90bb3aebca14258a5a3115ae1e00cbe242b6d2f887d45f44e7321985720968f972
+DIST strace-6.10.tar.xz.asc 801 BLAKE2B 81b0bc033c5c8a34835b9fec8ab043879a1a2ba3a557fb3309b53254a92ab5abffac32b4d97b45aedbc045a882b69d7f26b186c6e9413599583976080f788e17 SHA512 058672503e8ae2444271e5c220a3bd29450c1badb06ec1a6e06e0f1f4d609af3730bc2a71e7f9cefeeed936e89d4d37e439f41da353388b885d49a204887fb91
+DIST strace-6.11.tar.xz 2610440 BLAKE2B 5ea511cd0d2f287ec4c979af7306b29ca39975a4a08f6a1123ae562db5331f7ebb1f23ff2a24ce01fd96c000d094c4d810f2b4bca3ce8adac26fbee57da7f92c SHA512 c639ae7097d418f8b815bd008de9423079dad70829a5eb392d3c5def81243b8a9133c10251a7c00a4991f580cff5b62466f8b53b4b8e425a009548fb3582bdb0
+DIST strace-6.11.tar.xz.asc 801 BLAKE2B bc60367dafb08551510bf64c384315aadc3027ed256fbfa5a6e23139800ad01f12b7ebdc09e7845b202260ec38b4a5de70e5701abd9dddc0c5f3c4c32bd6c97b SHA512 bdb86f8fa9b168240b892814037660456ee7beed547e6f5bbcb61431e6fd8d6544b8b169cc794e084c3c11f2f62aff36de410294c609c0a9ea8781fa1ddf57aa
 DIST strace-6.6.tar.xz 2420364 BLAKE2B f1465fec58ac20ccce6a88441a34b1402e5c51f0bb4b7963f69b5ab5019a8c8722e3406c6f93c10c1eea11d17de7f9874895d6f4df24cf9ec42a18f36267687b SHA512 77ea45c72e513f6c07026cd9b2cc1a84696a5a35cdd3b06dd4a360fb9f9196958e3f6133b4a9c91e091c24066ba29e0330b6459d18a9c390caae2dba97ab399b
+DIST strace-6.6.tar.xz.asc 801 BLAKE2B 1bd72fc586f4338da1ae31181d28103ff3168322c07508699261b5ec4627ed3bdf7e20b4557182a258f22e83537712f20413aa9c5c4b335c75f3772e71888478 SHA512 b9eb6fc5c2f3bd8fced37fb81435087df95d9f23f0697afab8a3e359709c95238e50aafe2a3ba8cd698aeae75a4f8e28b6dce49a26878a961c2c06790458d228
 DIST strace-6.7.tar.xz 2434880 BLAKE2B 249c149a9140fc79be1365e4e8697b46f6558334eefac11b51c96d2d2e67bb82cb2eac3c38c2fa31f40fc5e0ad3c52967e15a034c01c12ed041d51f006a194ae SHA512 da28fd9fb987044782e6fd6f5e90e2cea2ab8e536cbd3893ef4c9b11c9b3185f073ca3d8ca0eade49e9a2af8efbda8c2b66b8988be7ebc463dc45e8f48ca1256
+DIST strace-6.7.tar.xz.asc 801 BLAKE2B 3a87561c04e82bbb745e59343cf79c25abf2c6cbd7a82f8d116a3cf6fd00797636037b620529979bce6e814fcf84aa42d94d0678afa86aedaf829d48118339df SHA512 9ea90089ec0af3f2471c4e03fe95f09e16260c04f5083dde17ea28a94b62578a90319ccd4987ed50459318c4ef3174dfe42ea158cf45d11c8e21e7133113a1ae
 DIST strace-6.8.tar.xz 2457948 BLAKE2B 0897aedc6a1ed162b8967a56d54dd0bc589ce027321c1219e5fc23e6a44103576e0f363f79a03def365a05989173271eb6096a9c48b16cdf8c54033ec6bd6f2a SHA512 c477724a77112a74a5236a38b7dbaa9b6199622a1d21cc6253cac80dc4ddea78aeaf8cddf4a51ee4119e00e1adaf95f64f64e20d9775ec3edd77cd82c8f7b30e
+DIST strace-6.8.tar.xz.asc 801 BLAKE2B 544f9a59824f5bd2e682b4df0106c85c90be8eba8fe99fa5a5b6ccc69bd9ced176f4ce3a02253e16a51290dae452426da3827e653d4c38f44eaf06427007e5a5 SHA512 4bcbf6b01440cd94ae2e05cc13220a141a0cc7c3a974d92947e09217fa4c77d7f7c272aaf32107c8974e140da25fd78e45f9f48731406b4dfd4d5a955e663daa
 DIST strace-6.9.tar.xz 2466252 BLAKE2B 2da51f253ea18f27b5fabafaebdc54805aeca5b750bec6169c269dbcadb98cf76a47bf92dd619458ca86d46ec7a03710e16e0ac4973d89a86edc2d0b853714c8 SHA512 aa80b9b6ec41082f1710f2327f7a22003cdce6d95ab0e5083ada9c5b7b40b8f7cbc7dc6c017878dc0e42c52e405e98ed1488c51d17bc3538989ff4be2c2411e1
+DIST strace-6.9.tar.xz.asc 801 BLAKE2B ccb3d026a272bc02d351fd15f8b18a50a8653cda247ea9baa938820fb3c870e1803562d7e17eac3d4f1842911a4e904bc88ba267cb74aeac869185e30cd89d48 SHA512 577a3f5d0bdd51b995755a76b58e6bdf6a0a173966bb1d95ebba0a59df8a8e828eb5eca4cda55c9faf7e31053652911541134107199c073ec24fa877cec393bd
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.10.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.10.ebuild
index 976615abb15..3b7b6412119 100644
--- a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.10.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit autotools edo flag-o-matic toolchain-funcs
+inherit autotools edo flag-o-matic toolchain-funcs verify-sig
 
 DESCRIPTION="Useful diagnostic, instructional, and debugging tool"
 HOMEPAGE="https://strace.io/"
@@ -12,17 +12,25 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/strace/strace.git"
 	inherit git-r3
 else
-	SRC_URI="https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz"
+	SRC_URI="
+		https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz
+		verify-sig? ( https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz.asc )
+	"
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
 fi
 
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/strace.asc
+
 LICENSE="LGPL-2.1+ test? ( GPL-2+ )"
 SLOT="0"
 IUSE="aio perl selinux static test unwind elfutils"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="?? ( unwind elfutils )"
 
-BDEPEND="virtual/pkgconfig"
+BDEPEND="
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-strace-20151021 )
+"
 LIB_DEPEND="
 	unwind? ( sys-libs/libunwind[static-libs(+)] )
 	elfutils? ( dev-libs/elfutils[static-libs(+)] )
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.11.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.11.ebuild
new file mode 100644
index 00000000000..3b7b6412119
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.11.ebuild
@@ -0,0 +1,117 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools edo flag-o-matic toolchain-funcs verify-sig
+
+DESCRIPTION="Useful diagnostic, instructional, and debugging tool"
+HOMEPAGE="https://strace.io/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/strace/strace.git"
+	inherit git-r3
+else
+	SRC_URI="
+		https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz
+		verify-sig? ( https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz.asc )
+	"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/strace.asc
+
+LICENSE="LGPL-2.1+ test? ( GPL-2+ )"
+SLOT="0"
+IUSE="aio perl selinux static test unwind elfutils"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="?? ( unwind elfutils )"
+
+BDEPEND="
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-strace-20151021 )
+"
+LIB_DEPEND="
+	unwind? ( sys-libs/libunwind[static-libs(+)] )
+	elfutils? ( dev-libs/elfutils[static-libs(+)] )
+	selinux? ( sys-libs/libselinux[static-libs(+)] )
+"
+# strace only uses the header from libaio to decode structs
+DEPEND="
+	static? ( ${LIB_DEPEND} )
+	aio? ( >=dev-libs/libaio-0.3.106 )
+	sys-kernel/linux-headers
+"
+RDEPEND="
+	!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+	perl? ( dev-lang/perl )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-6.5-static.patch"
+)
+
+src_prepare() {
+	default
+
+	if [[ ! -e configure ]] ; then
+		# git generation
+		sed /autoreconf/d -i bootstrap || die
+		edo ./bootstrap
+		[[ ! -e CREDITS ]] && cp CREDITS{.in,}
+	fi
+
+	eautoreconf
+
+	# Stub out the -k test since it's known to be flaky. bug #545812
+	sed -i '1iexit 77' tests*/strace-k.test || die
+}
+
+src_configure() {
+	# Set up the default build settings, and then use the names strace expects.
+	tc-export_build_env BUILD_{CC,CPP}
+	local v bv
+	for v in CC CPP {C,CPP,LD}FLAGS ; do
+		bv="BUILD_${v}"
+		export "${v}_FOR_BUILD=${!bv}"
+	done
+
+	filter-lfs-flags # configure handles this sanely
+
+	export ac_cv_header_libaio_h=$(usex aio)
+	use elibc_musl && export ac_cv_header_stdc=no
+
+	local myeconfargs=(
+		--disable-gcc-Werror
+
+		# Don't require mpers support on non-multilib systems. #649560
+		--enable-mpers=check
+
+		$(use_enable static)
+		$(use_with unwind libunwind)
+		$(use_with elfutils libdw)
+		$(use_with selinux libselinux)
+	)
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	if has usersandbox ${FEATURES} ; then
+		# bug #643044
+		ewarn "Test suite is known to fail with FEATURES=usersandbox -- skipping ..."
+		return 0
+	fi
+
+	default
+}
+
+src_install() {
+	default
+
+	if use perl ; then
+		exeinto /usr/bin
+		doexe src/strace-graph
+	fi
+
+	dodoc CREDITS
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.6.ebuild
index c380af2dcd2..7c8d69f65cc 100644
--- a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.6.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit autotools edo flag-o-matic toolchain-funcs
+inherit autotools edo flag-o-matic toolchain-funcs verify-sig
 
 DESCRIPTION="Useful diagnostic, instructional, and debugging tool"
 HOMEPAGE="https://strace.io/"
@@ -12,17 +12,25 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/strace/strace.git"
 	inherit git-r3
 else
-	SRC_URI="https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz"
+	SRC_URI="
+		https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz
+		verify-sig? ( https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz.asc )
+	"
 	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 fi
 
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/strace.asc
+
 LICENSE="LGPL-2.1+ test? ( GPL-2+ )"
 SLOT="0"
 IUSE="aio perl selinux static test unwind elfutils"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="?? ( unwind elfutils )"
 
-BDEPEND="virtual/pkgconfig"
+BDEPEND="
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-strace-20151021 )
+"
 LIB_DEPEND="
 	unwind? ( sys-libs/libunwind[static-libs(+)] )
 	elfutils? ( dev-libs/elfutils[static-libs(+)] )
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.7.ebuild
index c380af2dcd2..7c8d69f65cc 100644
--- a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.7.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit autotools edo flag-o-matic toolchain-funcs
+inherit autotools edo flag-o-matic toolchain-funcs verify-sig
 
 DESCRIPTION="Useful diagnostic, instructional, and debugging tool"
 HOMEPAGE="https://strace.io/"
@@ -12,17 +12,25 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/strace/strace.git"
 	inherit git-r3
 else
-	SRC_URI="https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz"
+	SRC_URI="
+		https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz
+		verify-sig? ( https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz.asc )
+	"
 	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 fi
 
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/strace.asc
+
 LICENSE="LGPL-2.1+ test? ( GPL-2+ )"
 SLOT="0"
 IUSE="aio perl selinux static test unwind elfutils"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="?? ( unwind elfutils )"
 
-BDEPEND="virtual/pkgconfig"
+BDEPEND="
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-strace-20151021 )
+"
 LIB_DEPEND="
 	unwind? ( sys-libs/libunwind[static-libs(+)] )
 	elfutils? ( dev-libs/elfutils[static-libs(+)] )
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.8.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.8.ebuild
index c380af2dcd2..7c8d69f65cc 100644
--- a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.8.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.8.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit autotools edo flag-o-matic toolchain-funcs
+inherit autotools edo flag-o-matic toolchain-funcs verify-sig
 
 DESCRIPTION="Useful diagnostic, instructional, and debugging tool"
 HOMEPAGE="https://strace.io/"
@@ -12,17 +12,25 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/strace/strace.git"
 	inherit git-r3
 else
-	SRC_URI="https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz"
+	SRC_URI="
+		https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz
+		verify-sig? ( https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz.asc )
+	"
 	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 fi
 
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/strace.asc
+
 LICENSE="LGPL-2.1+ test? ( GPL-2+ )"
 SLOT="0"
 IUSE="aio perl selinux static test unwind elfutils"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="?? ( unwind elfutils )"
 
-BDEPEND="virtual/pkgconfig"
+BDEPEND="
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-strace-20151021 )
+"
 LIB_DEPEND="
 	unwind? ( sys-libs/libunwind[static-libs(+)] )
 	elfutils? ( dev-libs/elfutils[static-libs(+)] )
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.9.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.9.ebuild
index a28843ec66a..f6f02d67126 100644
--- a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.9.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit autotools edo flag-o-matic toolchain-funcs
+inherit autotools edo flag-o-matic toolchain-funcs verify-sig
 
 DESCRIPTION="Useful diagnostic, instructional, and debugging tool"
 HOMEPAGE="https://strace.io/"
@@ -12,17 +12,25 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/strace/strace.git"
 	inherit git-r3
 else
-	SRC_URI="https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz"
+	SRC_URI="
+		https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz
+		verify-sig? ( https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz.asc )
+	"
 	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 fi
 
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/strace.asc
+
 LICENSE="LGPL-2.1+ test? ( GPL-2+ )"
 SLOT="0"
 IUSE="aio perl selinux static test unwind elfutils"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="?? ( unwind elfutils )"
 
-BDEPEND="virtual/pkgconfig"
+BDEPEND="
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-strace-20151021 )
+"
 LIB_DEPEND="
 	unwind? ( sys-libs/libunwind[static-libs(+)] )
 	elfutils? ( dev-libs/elfutils[static-libs(+)] )
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-9999.ebuild
index 976615abb15..3b7b6412119 100644
--- a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-9999.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit autotools edo flag-o-matic toolchain-funcs
+inherit autotools edo flag-o-matic toolchain-funcs verify-sig
 
 DESCRIPTION="Useful diagnostic, instructional, and debugging tool"
 HOMEPAGE="https://strace.io/"
@@ -12,17 +12,25 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/strace/strace.git"
 	inherit git-r3
 else
-	SRC_URI="https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz"
+	SRC_URI="
+		https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz
+		verify-sig? ( https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz.asc )
+	"
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
 fi
 
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/strace.asc
+
 LICENSE="LGPL-2.1+ test? ( GPL-2+ )"
 SLOT="0"
 IUSE="aio perl selinux static test unwind elfutils"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="?? ( unwind elfutils )"
 
-BDEPEND="virtual/pkgconfig"
+BDEPEND="
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-strace-20151021 )
+"
 LIB_DEPEND="
 	unwind? ( sys-libs/libunwind[static-libs(+)] )
 	elfutils? ( dev-libs/elfutils[static-libs(+)] )
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.40.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.40.0.ebuild
index 0a6d5010c8e..d96ec3ecfea 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.40.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.40.0.ebuild
@@ -55,7 +55,7 @@ LICENSE="|| ( Artistic GPL-1+ )"
 SLOT="0/${SUBSLOT}"
 
 if [[ "${PV##*.}" != "9999" ]] && [[ "${PV/rc//}" == "${PV}" ]] ; then
-	KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 IUSE="berkdb perl_features_debug doc gdbm perl_features_ithreads minimal perl_features_quadmath"
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
index 1450f8797ac..80f91768cab 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
@@ -1,55 +1,25 @@
 DIST Python-2.7.18.tar.xz 12854736 BLAKE2B 060a621c91dd8e3d321aec99d44c17aa67381998256a1a002d316b38288349884d5960de35c49352d03129ed0bae599e641ec2225898158ebce50a7a2fd74d2c SHA512 a7bb62b51f48ff0b6df0b18f5b0312a523e3110f49c3237936bfe56ed0e26838c0274ff5401bda6fc21bf24337477ccac49e8026c5d651e4b4cafb5eb5086f6c
 DIST Python-2.7.18.tar.xz.asc 833 BLAKE2B 1d98770e46171971fb99994508d238c01d2755281d2f94353314014d9e83e0ec5f0b3e3950ea1fdf5fce9ba6b8f55312355845c2a3fc4291c27ee56fe6215448 SHA512 c2a5f5a52f47dec52460ad3275758d4e5de6e7075c3def4353c988d74d563a39b42cae2d5eb24e2a23a6247cef69100f91620b11a49c2359fbf99b203c9cbda8
-DIST Python-3.10.14.tar.xz 19600188 BLAKE2B a9e65fff590d56848f55f2d93d8a1c631bb8135617112997fbaea9fc45db1d5e2ce39f00cb29c9428542e523fdf48064bdb9aea144acb7aa7cfe71990b8e949e SHA512 adee638aeca898743da4b8245c0fa1e9b94b516f22e716e60c99038f0bb3dcbf726317aa86656404be1719b5a7c58eb09533720ebc0badbb04bd9a534dd48fef
-DIST Python-3.10.14.tar.xz.asc 833 BLAKE2B 945ada655532d578beba9fdd882cc9cc247e24f7efd68ce172766a8adcb3c8d76bc1f229402405e607004ae0f9bb8e55e4b01867ca712700106d8ec42212cb2c SHA512 450f910a91dd0fb66f99245828983a9234c4a67ea7e653404efa06ce5da1c6667a46329a2d1e276c5a956d2c32d8ae6d8c497a1892102f4a360dae33b135c372
 DIST Python-3.10.15.tar.xz 19596540 BLAKE2B fe62f7c7377136576e73a59b5f0b3c9729f9c958da5c8dd1771e88121fdd1928686166066351fc8ae98c9f97295a85feb7ec44c39317f93ae414244aed8a8f66 SHA512 3c0396b2dae1521315a9b5ce9ad4ab6ede385447922fceb00ea3df75bfd79cb547b9380e936d83c9c1b964e38e16d70e34aec39f4c292853a032407bb6a58063
 DIST Python-3.10.15.tar.xz.asc 833 BLAKE2B 31858fe2d3c8d868417eea66de1cf0b2fc7880e73ea7770b50191b8088bbd1c78485c64d94f6f005d18cef559d7e8e0906cb2a30aa1472d90f5af4cca045970b SHA512 0cac9b78649330a2a35a835d45e4a8a111db45943cc0ae0d24f5d9e03a058b4b739fe43d6cd1aee481dcd415a57820bf875996fa60b81d4d5911588db5adad70
 DIST Python-3.11.10.tar.xz 20067656 BLAKE2B aba211a09e4c083d71574c7537ba98474476ebf7092ddda815f8d355d01605456868a89f0bcc6a9e747f71f914fa0129547de2ae70d8b579c6458fdeeafd23f0 SHA512 6ce77cced1ce90bb5eea38504dfc1bc19c872149a5a63fdd8353ac8c772c54ab7a42176e141c7f6f898d31761bf93e1739b238920fbeefbedd6016ad033c1de0
 DIST Python-3.11.10.tar.xz.asc 833 BLAKE2B a1cbe57e568367fbc5817c983696619f515263a9b37662ca536c4d1132ad336959285bbe3076a251778016966f030d1e259f48accdb0df67c116af0e335acb8f SHA512 3a9efe1dd39fd6883ae3fc8dd7f6e25af7e06c6e6049cf9a31a1a82e6d7c84f85ac838d2a71127977d93ce77233a8bbff86a10a80d24fcee85a4e70fcbd1db19
-DIST Python-3.11.9.tar.xz 20175816 BLAKE2B 4e7cd2c42ee39b5ef9624ebd1798320957e948cb4f23f17fd1530814c60126dbf988846928d4d7d4b9d2174029ab8d4dbaf19e6203da237da4c3212ddebd5803 SHA512 2b0a1d936b4ef8376f9655797aece8ffdff75031ad7bfa840f330cac2aed189aecc80c163edc12ea772851d7a011f3fc1960470a73d9d4290cf3ab8ad6ed7e6a
-DIST Python-3.11.9.tar.xz.asc 833 BLAKE2B fa29f632bae0bee7db946038ee3529bc3bfbe1b2e755b21394f67a3c80911ce8079aaab43a16d88e614a8bfc01fb5105ce3f61c59a5ca44470b0f59787c707b3 SHA512 b18b50e7168b2ca5376a1fa75e50e8baae2026d4f11d4cf613d758f3f17df4610fe4653fb2ac0c5c4ec0f6e630dc6490ad1ff32a2fd0ebd60f9f3bd136207ffc
-DIST Python-3.12.3.tar.xz 20625068 BLAKE2B fc4f57ae50183db4c8cb37d94c37a7e58da5d031e03866841a678b986f01bbb8afdefb38124ba82b0a4988445b647214be43338dea13b0f063d3c2bf81c48c0b SHA512 4a2213b108e7f1f1525baa8348e68b2a2336d925e60d0a59f0225fc470768a2c8031edafc0b8243f94dbae18afda335ee5adf2785328c2218fd64cbb439f13a4
-DIST Python-3.12.3.tar.xz.asc 963 BLAKE2B f9668dde210793f8da0e0bb026b8ec3e0b4bc3abc58e72732f8faf356b19ca88a59b9d89b4b10f77b3602d9a967f0f2f44a0f091d698bc28ba9bad8049e5e006 SHA512 c291ec5b5e4f8deba867cc517624dd9a174745f04061ef737e58f3d52b9b30318264aec350e339fe88ccb493809ca1a90a378e86d86b8ec4a4f578b1a5843624
-DIST Python-3.12.4.tar.xz 20659356 BLAKE2B 4255171ef8ee1777bab829be7bbaf28a9d5073985b3b1309a41694dda5f6b4ad599df4534a1ce83ec65b357d42416cc18722ca94b4227a45ebd90e2c1df90945 SHA512 750132ee6369196096130a924f4ddb78b9a55804133e5d136a70b9280928822974d1aa559d844486df02e89155fb0d8117871e1ac532abc18174309ca4b08369
-DIST Python-3.12.4.tar.xz.asc 963 BLAKE2B d4f62dca1de5f4e4b2581fc49ca55b1d87abe7c4ceb2c9087efe4b92d9e9b3bdd25949bbf82fd771b4b60bc3690be982c2f25b810d87592665f0728fbe08be9d SHA512 1102b17f395e0ec5de5368d04a4dceb8cc98dd408b68b53998071cf129eb9a6c259316a416128f1dfa37a739f86e599507502a98430348da2272442ce1b7059e
-DIST Python-3.12.5.tar.xz 20422396 BLAKE2B f127d1e12d12be84d5837282757787be8a0cf702adce29b93622f91f45ba2d8cc0f5db2e8277c86b098623951b302015febd28bdabaff66b30cb06a5ef2b4a24 SHA512 7a1c30d798434fe24697bc253f6010d75145e7650f66803328425c8525331b9fa6b63d12a652687582db205f8d4c8279c8f73c338168592481517b063351c921
-DIST Python-3.12.5.tar.xz.asc 963 BLAKE2B 238167f6b4012136bc4274eee0dd4d958c4ee02d2505f9f64e5bcad15e84a9e9e12a9fc907651083543f1fce93579b752d4ccdf60c8cc421cb43e9034877bf1c SHA512 65ce92272a38cc6bf8bf56fa2a99a830cf5b33b811b1788508e7b6f8b5d3e93e0b143412f829271be40cbb4e7c154f84499239b3e8ab63b2ccf0a5a22d2f84ee
 DIST Python-3.12.6.tar.xz 20434028 BLAKE2B 527fafdbfd0c1784ff72a93cdeb3f49666bae7d9343b6d1e4ef773fc52bd397081b41bec3ee9ed5b7652f28f09f29a1b553424cef26aebfa6c2e13499870bf2b SHA512 e658b0d59b5cfdc591d626e8282b9945759f27ee6fbc8bcb8670737db32ffc11fb832dfed9b0e80188fb5f7f3f39fe6dd6191ab7736376453c9e248321e9b063
 DIST Python-3.12.6.tar.xz.asc 963 BLAKE2B d5f9e4c5053610a1a53769278e69d8a25e2fb047afb2a55dfee67917d8d200ebc159e614327ac87f34a4a9718cb3436b55190322ee231116b26074a78bb72642 SHA512 91a15bb7e8dd26616a2cdabe69c3ee81668cc67cb55a88b2be20433d24c9f8ae41c8f93f67aff2fa5858cd5b94600409cd472bd437a2fd33153483734ecd863f
-DIST Python-3.13.0rc1.tar.xz 20881016 BLAKE2B 3971a233e9c3c782973e0276740f00f8f2072eeda914663cdf7fa6c5de2437c60c441184344a64e25cab5c71a02c47cf4602dd08f127f310c885386cd887fec4 SHA512 fce7664f3298cfd191a7dc20b7b47acafdc50d058a2814312c94c30b65291395957d701e4661b9bb760417942acb5d27e5b8bb479bcda9a82cf29f53772a2daf
-DIST Python-3.13.0rc1.tar.xz.asc 963 BLAKE2B 1c292362cd133dbbb1df1e0cf440e8adde2bc8db9174e550d5b76a09e80d0dbc11a0250e6f041e54fe58f25dc05f071c7af1aa910ae56ece5eb430502a2ba67c SHA512 3613829d9631f46b1b1ce11bfe5bb7fbfa49d97b639bb883c86737ea6ae8d15c24c526083cafb916011bd6d0b3b5fab2b17afd367edbdce99b32e0b4b845fd22
-DIST Python-3.13.0rc2.tar.xz 21055084 BLAKE2B 017ac82c1938d1fea0a501efb9d1848115648f0472b7cbaa4eac65cf085c3c6410ea83aab2e935952ca1b415d603f4c5680fec7a15ce5b40794b2fdcef662666 SHA512 85e6e6e80970ca38119e4f95880fb12e2d1548e6d60235cfcd7f6aaf08588c483469e43dda0f004b95455c2fb88ca736c313b22ae37eb0d4e6460ef521855c8d
-DIST Python-3.13.0rc2.tar.xz.asc 963 BLAKE2B bb75db12c424b7a05c8c0082f79c1ab6e2ad04440a27d2c964edc073fbdc1c0ac442b0b2a0719a33f8058bc7bc9097eb22e031299f8de5b6d88b74e4e5ece8a8 SHA512 6d80d089b55910628744d21b0382b6441d0550c139dbee71d68a7cd9e494bff1c8235a2a894f3c7a52f9af312480a4001f333e04c9054f32db7eefd2a7d39263
-DIST Python-3.8.19.tar.xz 18975156 BLAKE2B 57b241aeb8f99a8c30590dcb9402abbcf573f00d06e807846bc9135c0a8a4af896c4d772d34abc3c292339953f4974a203bff61a78641d91b1826770226cd7e9 SHA512 1d2a57fa15ccdaec8cdca508ba2ffb01e1ae053a3446ac709bc334480f8e913070899f01ed680cce6dc7ddfddcb27ef402fe206562249fa4c4e87be21ece0625
-DIST Python-3.8.19.tar.xz.asc 833 BLAKE2B a11705011e9ea2bd6cbabc2b4c896ba94675341188eb483b881c2cb25c932e9ff25f9f589f930605b0442ff93a1f54532608b111c8ace715a406ce10809af671 SHA512 efdaae5462badcf4b98625ce8ab0e34756acea9539416e6ec428725b04539f8c38c1978de346510d669e93bbeef3ae20b1534e4c6582f89c7dc56a04c7cae140
+DIST Python-3.12.7.tar.xz 20444032 BLAKE2B eed8744261cab3b401963ec5187a8b814adb9a18f8d0a6a3d59c027a83cf8408524af9b20204b0a0861d173cc33c45ae37bb1542a1ace3344dc59c649087ff1f SHA512 4a363d3f852ad8f4fd1484aa4cec35494a3811be48ef67fadb2bdf2e2489ed07dc78fad6ab475257db503ddd64d39f9800f23a1c94b6bbd15b7f632cff0c90ae
+DIST Python-3.12.7.tar.xz.asc 963 BLAKE2B 8c7db3d1971d93a10c611a2e6dd3679d0b331b48df87b5fe410b089061e48753d98af67084d4f051a31ae803fce3aa3c7af7cba9c692640f50068bd1e46f40e6 SHA512 4d0a7a0da2c81888e93d8ff89ca2ed4bb85a7b0bd00f0d54a14e2c201affac2677ef3984d2b5aea253e624f6465548d9032eefdd9033c1eb3864d82cfd8d3df0
+DIST Python-3.13.0rc3.tar.xz 22527884 BLAKE2B 9c6423e9871b30af70ece10598e798da443b40b3e40cae86ec59d396184df005627a5edeedf34d31c7953f972850e41d1cc708edd8e39c1327d319b0f6973049 SHA512 152e5b6d64048c1779612e66d5999c424ca7c61c8a0f4973f7b3019629d6a7923b422aec0bee30e7bc2d589a807d87e15a19b8fb4446bcf082eb663885a49b36
+DIST Python-3.13.0rc3.tar.xz.asc 963 BLAKE2B e03d902eee320939cb77094e1b64e0101d0172ebdcc502255da1c0fc84476f43fafe900321c78cd78248a751b3a3921572ba4f305ed77ed78f175184b21f667f SHA512 c8f80b12f5e3021a11fc3ef5ce84572db9de7165ce89a03206cb0727b54f90ca2e444a16df064e6423e15b7bf2364db088b0c9315967dd340e735eabf7b892ce
 DIST Python-3.8.20.tar.xz 18962788 BLAKE2B 715c75e0c0a3d3b77af7f07478311bb0554b80aac72915be703aa2d0dd6459a972e5669808e64da14a0b91bb183e00655055c1726f302dc3ccd8721e3b4ae3e6 SHA512 3c9341ee1fd33cb687958dcf2b7c0c7700489726c4d530c3e9d9537d46a6ab534541a4b312232d8505bea395a07e4518c42d75fb7571103e6b266f8f44115c61
 DIST Python-3.8.20.tar.xz.asc 833 BLAKE2B 5c86c15a1090b42e42bb7512565b1a7ad9d2137d59e9fd1ab0f83fdfc37dfcf184389418d6703db809e9c8c04a169af292665a2b58bf5dc61b7724ecbb4132d9 SHA512 a751ae0407a593d97acac4d5f8a0456580c753efa12a7d960125c219b4897fdb26fc1ffd43d8ea33ad1449162dd3b2904c16b6c51c57561ba73de3ffa62e0eed
-DIST Python-3.9.19.tar.xz 19682840 BLAKE2B a12256663f0ff3b799c2193c5877aa89a434340dfa01e655f790abea70af0709b54577e1c2590add241308a8581fd6f45a22aed450bd5db2bf9fa35c4a9d619b SHA512 5577830c734e63a70bbc62cd33d263b9aa87c4381b49cb694c3559067c4c682a55506b65ec5514a8e0a5abf6294dc728e909385d449ae1c388e62f83cea9bb89
-DIST Python-3.9.19.tar.xz.asc 833 BLAKE2B b48b58b8ccf4d6ba8d0d7120f04bebf59f843ffecf5fde4c3989fd9c26e3d3d1ccf4e5688f7024ae94775c8731e9ffa56799fca8596289edf93e4aac5480aaad SHA512 f7f4946243dfc56de2c84f50276b088d347f17054f50e3331d1e312e2a8e2c6ed1b4b4a807202b51137fd2af3fc9218cafa42ed348a954ace896d9a432e2defd
 DIST Python-3.9.20.tar.xz 19648968 BLAKE2B 80a337ff406130599b8320068d11bc275d23473cedd7c85fcb9e40134f0f2d533be6e712139e788a6423cdc74cea938f306aa37c2a5099e3051f3e390159279c SHA512 c828f33edf1704e3149499d6d34e89264cb5cdb2b09ff05561641b359716d7996f0fe928629e09f006b1fd7850fdaf937275919c7fdd83f5efc32707c64d814b
 DIST Python-3.9.20.tar.xz.asc 833 BLAKE2B bcd5a612281bf8e057e19db9105b199cb7e44050441b19832843e8149088d277f4b625421099b09d4ed6fac5578505f46dbfea13b041d157d695eaf668c3a7de SHA512 f21c012f4f642542479ba329da9654589e5a7f7305c39fb1b6f136b578316bdb115cef9773c9a9fe4e195677af01cb80af05780613cca83f42fae131862a9584
 DIST python-gentoo-patches-2.7.18_p16.tar.xz 35448 BLAKE2B 0139c0944f62f9cdd236f6a8557e0ed19704c7d72869af1cb7d8bd3e646a746cd4a0201e1b44232a5e78ef49f254db20b0d0271bf744fbfd4fe0f1e99b8f3e6c SHA512 810be590d0e06fab4b2165e6852ca49662f09dcd7e20b47a29f613ad7653252c8dfac3f0eb228d77c8a914efa7c08788b2fbd552a4b47504f5fd0ec17450c48f
-DIST python-gentoo-patches-3.10.14_p1.tar.xz 15836 BLAKE2B a850e4ad4f025fa9d38ccba937f1b3ee8443ed186c22ede58b4c7324a8541cf724590686671a9aa9194662303ce75bc80aac8ee6f9da34b793876817b6f593ff SHA512 5d969f5e5126ee675a062924a5f403de142fc5bfe4a931fd3576bcc6298a855419d305d4b1ffedacb429783a05324b36eef4c45c861c47bada0bdd840de2bca3
-DIST python-gentoo-patches-3.10.14_p2.tar.xz 19564 BLAKE2B 2ad1398e0679e73028a0614e8c4ef6bc76928f6c1d0e93c39c3bf2c23201904ee677377abb120444995154bda4251cb8f0aabafca5e6c82601a6270d0e62bf67 SHA512 6d4194b85a176a1a0f7acc3eab48829d504e66381f3008821a9a433e63f5188b444321192ad536d8219a1c3ca56dbdb5c39439401cbbb30f35a606e2b6617624
-DIST python-gentoo-patches-3.10.14_p3.tar.xz 22080 BLAKE2B f45ebe4df3dc39a842c93d741ef66fd0f9f7d1c6453d499d59b62eda41f01bc17e109205fedc506963d1f21eb3fbf9478564ff5e1a11c10336f855069a642ceb SHA512 db268f1482e5c46a71ce3aef2c2ab6d458cc5263aec360e61c6aff97f119f4f100becefbb575156b1b0239e591a496cb62a136597fadae8a5b630c7233c0040a
-DIST python-gentoo-patches-3.10.15.tar.xz 15896 BLAKE2B f908b409dbcedeb4e2fa7255d9dedfb8f86f39b9b12612d45662d2305012692753874befa5377e1bcb2e8fc04b54bf206948e12eb7bc357a764c1b1e496e5997 SHA512 a647882ede8d7b97e301e472e91f4573dce9f8bf4e408449444625fdf79859a54fd828daa60c7960721f34c3d6d82e2e45db2c55f2fc093097a0db42f7363b8c
-DIST python-gentoo-patches-3.11.10.tar.xz 8484 BLAKE2B 844aa7a855e3ab5a6307c6bfac9d58faad249ce550d21e8526125dc56b9665dc6fa00530a60efe8f851397d368057400851906e59fec10f6325bd83a51e39317 SHA512 bb602b80eed62ca8477b05665267ec3729fd9a85d9b709f844ad729f496d008a529d05d2ebfe8acb5db5ccb99005260bfe458f6ce0d9d358530670e0970e415e
-DIST python-gentoo-patches-3.11.9.tar.xz 8456 BLAKE2B 4e62837f17c1d056460df417b056a79ad78dbcdd3454761c7cda68ffe6faf8f4d4f04d5539e0ba94332fe19a751f7d5ff2c35ff969a6aa09a2c72d2ce5efbff1 SHA512 a288aa8d1d15e906e0f1762602a2122f9dc91bbd6b72123ac5d00ce55b3af324a4e8280b600fc0fb630e489e57ee1547d7595a4ede7a70e4b26d6686a8414997
-DIST python-gentoo-patches-3.11.9_p1.tar.xz 12348 BLAKE2B 885c18eb52d299c8da43fe48106a2464ce594822e8ed362150c98f749065447b7438741cacf82a71db102434a5b2a2e91778aca8609fd7ede7898f9e57a82d49 SHA512 2ed8a97692a8980e565038ad095dad8ed3daf1f8c5c5e042a0bc278c320e099962ad13b5ff919ae334674a4828c5e8f3b9c3af6b3c37e93a42374284f5ea2243
-DIST python-gentoo-patches-3.11.9_p2.tar.xz 14916 BLAKE2B a910eae412fc1ce3657272c3c2ea9ef95b8d5711ed4c85b93a35f4ab757b1134bff0f8c8a0071e8e06aac784d0b51e36cd9271f892098cba272da4a4e73317d1 SHA512 5c055186b3a8376f4f602ec5d1f8e7bf0f067bc67295c1cdaa68ce1fb6fb21cda75e22705b8a5a2a6525af67f3b36a82fde5ba6ae9b097a5914ab79a2f1a0fad
-DIST python-gentoo-patches-3.12.3.tar.xz 6028 BLAKE2B 7953a48a1d95a6a33bd88060fbcac463a5469371aa0c882c3945f1fea64a63c4d45fca8451f51f4eaeea00a04267ad2e54e4cc720c95e8bb5a3477e00263b80a SHA512 4779bab2b24e59e4a77987ce3e9611d99e87c9c4d016309758c26a65fe2e11ef04d48d5af628c02b1552dc1f31b768f87448f8e19e716b4fe372941e6dacac3f
-DIST python-gentoo-patches-3.12.4_p3.tar.xz 14796 BLAKE2B 68f5235ef434f9db16e7bc635ff51b6607cfb9be713fdc3c0ef624ec0f513345f6e02e27b8ebc2b3c8a5fcd4f4f5161024407ae364bdffd3b22a7a9d3a509b30 SHA512 8e337a7234b8ad64dd82435dcda0ef4e90c21214bd7b13a83fe9ba700d5b07ce11fb33b7d34d808132120b4a077fde26278b87116bb02ccef50470c046a66d2b
-DIST python-gentoo-patches-3.12.5.tar.xz 6056 BLAKE2B d9b85d98a75f6365c63ddabb8f25db3be11e7e4de22ec9426bb24160efcca25c75e3e19beec9fc2f8f8fe273c145f825c6f27ece2fca83d44cf2dbdfacae918d SHA512 72949ae8a1c796cb57e8b43d259037a723482b5a3849823c1cdc58acc012177a0ec836a4dd6ad656fe57ee1d84491c03ed9109667a953aa52bf5df7640de969f
-DIST python-gentoo-patches-3.12.5_p1.tar.xz 8632 BLAKE2B 13570bb465002cea3590b06d055b936ac0fcc68f6f258aca99a67f02f0b1cd28396424b686c5e080f593a74a744ff449e7220f51f167a858b2313be4c8b64b19 SHA512 eb9fb2d48236a9f7941fb8938310cc32d216eb01e19277175223b8b1fe1bfd606bde9a3c8bc66ad2e494fb87ce23b0d1acd359c375e4a11a5caae25450c11360
-DIST python-gentoo-patches-3.12.6.tar.xz 6048 BLAKE2B 577032d7aa4bab423781bffad8e64f56b492dc31fbd20acd91f3d28356bd697603dfd47a3a9051538dde2af942ae513727ecea415d82f5082a992bd22b8cb2dd SHA512 6f1037e97bb362a3d04c3ec080dc062c5de6e4b779cda0d88f684422d757acd6fc6f971c7004a3f50bbc0161dd28c3146672f74e0e598066f9a8ba4e0eb2627e
-DIST python-gentoo-patches-3.13.0rc1_p2.tar.xz 12748 BLAKE2B 851d16e16d2a98fde62c38054d9bedf3538d88a59e19dcfd8ee7d86f3f67a3b66105664da9181dbfb9ad16aa0042815ccf469225348fb0ba8854337b0a736d33 SHA512 8264aa65bf71e97a4afe47a9fba58815163bc950ea70ff708c5f265722c5b4b8af19fbbe8a9c3673957a6de3af8307a9ba0ed9f4e42472ca24c5ed930682a038
-DIST python-gentoo-patches-3.13.0rc1_p3.tar.xz 15148 BLAKE2B 668060644372e8ddf2d9686796ec304ae7689f5c10ecbc6862f054f96504c418b0e4df28675e4fbb610889f9a665a7a54f23633036b0df35f19f40ef8e6bab32 SHA512 c0cbdf9e0fe2ad29175302e548ebfda1d2af42af0ffeb363eb8b0dc53e1059f5abd7dcd02fd8e9eb9ba7bef2b34b7693633f0a62dc1ab933f43077feacf00fbc
-DIST python-gentoo-patches-3.13.0rc2.tar.xz 5696 BLAKE2B 4e716d1d6225e811b598d029ef1dbdc413df614ef00ab8051ea697e633477a0114a3660cae037bdf4142f76c9f2efdefc25b604af11c31eb77d6d98d8f932cff SHA512 c20b53772bd7d305562657722aec70de78fffbf8ab7939f59d496e06c21b31fcd7b4a92573b1000d3bee4d90fd8b7422543f9cfdad15d60bc9a7ecf2a2259599
-DIST python-gentoo-patches-3.8.19_p2.tar.xz 35524 BLAKE2B a6b81e6ae907b60eea676cb65a9c693e62453dc44616baaadb294c5782a195c20eff6c2869b38ea110fe06e9e511468f4ab0c3d1811b16e0ab2833f9dc09b25b SHA512 9944c330b6062c2ac6e13fcfbc1c8835dfd078f6744cdfbc03ba787ae97c08bdae559cefadafe9dfe9be9c31f8c15ee895599b266d870f73c06a2f4b15c78dc3
-DIST python-gentoo-patches-3.8.19_p3.tar.xz 39392 BLAKE2B 451765c7546831c35f52e2772b8b43b6515f66cace2d13ed473228bf2d2b18f49b938a61d4cdf1be0fecbebfac1fc8d3d95f7597eb9d877c0b2ce495e8d419c1 SHA512 76e405ddfd3ee98dbd077f6ec83ae93d0506ddbc3b2b8884a0f38c6269ea982b635b0eb7820f6f9b2f81eb0ef514b93a5eb10437414cde4de2bfb7ea37764b3c
-DIST python-gentoo-patches-3.8.19_p4.tar.xz 41888 BLAKE2B 8f5fcf8b6d925c9f668a1f8ac22d4b8c2ff7b4d90103606afc37eef735d5ed0fe7288469fb18e08bc31165c16c9877977610e5a6af9e385518028baed34fde2f SHA512 4440725419af3bc5c4f1719dd39605df28e2bca625c3a822082e4541db9479dc6fcf8c2d6fc777292b75f70669ab7e010df105b2b580865a442df76c0f83ebbc
-DIST python-gentoo-patches-3.8.20.tar.xz 34380 BLAKE2B 1fea8e65f7db809a716376a3062a730321f68e711837c400fecffc27273754bb9aef3ed98651bce412596d35674f0b0813f7a722c1e2fe22954922c17846de37 SHA512 3070a0b3cb91129ffcada6052e50d779ea6b5480a3b4edc3e3f1c9d3b683ec1866168255db84b86f0a4dedb4a23949cda8f474d320db34d7511e9ede9a0342d9
-DIST python-gentoo-patches-3.9.19_p3.tar.xz 28240 BLAKE2B 35c70b1f9a590abe9a74795f478ab788cd72c96e9d84f2756685e61324dc4203148e71b00a236bb4af8fb8315e3582ecec255b39749a653e0511d4a9f9fef725 SHA512 6b8f4dab4aa7d4d646ee4091b5cf76bbc8896d4299a3623660a2c5fec06c0cf56c0a50ac87604885cd155141bc85e0e80acdbedb7b34a813901aad021b9b8ab2
-DIST python-gentoo-patches-3.9.19_p4.tar.xz 32048 BLAKE2B 9595d508304baf36a2c8daa2ae15d3596fdfb5fed5c531fc379ee347d5b165885ade1842f094184fb7bd81a6385e45f9b77ba7bfa4334ea30292c0bc59b373e2 SHA512 5713c69ee3745246a570e0f05ac8f45baa8f9fa8a2154c930f1ddcf827a2a790cb5e308f5ff9452d3ffda5d60c167a02429af773eebf13dcb6463793cd448500
-DIST python-gentoo-patches-3.9.19_p5.tar.xz 34548 BLAKE2B 6ad49bba626932b3ba1b781fe5762882aa90b552bedc0f1b8fe0921c7e4ad1bd67ddbc2c11c969fae53fd2b6189dd1b1506da87c123c055ec3df023950bd1938 SHA512 d66a2d6012d98edde4a9eb52cd8a06f0338a25f44e299713abd970884c7b1d457c6a09a1e27035841eae3a4844bbec1b4d2a4b691bbf519867a6ed58f251e633
-DIST python-gentoo-patches-3.9.20.tar.xz 26992 BLAKE2B d77861cb99c5b0f76482c7250d45ab0726e9745929a2098724ba528034b7787e12be2505c3d2479f3b5e1760b8e4046d89ad6d5e4af200c4116c348c663792ba SHA512 132f1d731b671fbddf89a3af49c6887f3f8414f0f0df6769f243eab056e214ef3b2427075de10384cc4f6df2fd3140fb6321ad3e271539da9cb6846ba26e935e
+DIST python-gentoo-patches-3.10.15_p1.tar.xz 24048 BLAKE2B 191c28ad9bc781d6f3077870e8d40ff98a47a64009ecfbbd10fe2b3c5330692181837fd3e9b336fd01f936a39160fc12761b2ef9bc00843248ab978cda2e2767 SHA512 4461e351c991694415e2812e558d6c3d3f79295358623dc955bc0839691a170d95a3efd31c0bf9f0d6191e4184d7b55fdb485b948d591782fef5b060d7660cce
+DIST python-gentoo-patches-3.11.10_p1.tar.xz 10592 BLAKE2B 1cc02d22b55cb76beba133c37e6db3b9ba12b11cd8776acb064f14431842405cbc9efb5a06319cff1c73d9178ddbbe2e340829d4628c88a9589aa2fc1d308f80 SHA512 7ddb08e4d8a9173a26fa18de687a4c85c3d460e2bc595da6f4b15cfe3be264ccdc7d61d5fed1e7a82f256d21caf3ea7de87f774fde61a9d37bed15f86f546adb
+DIST python-gentoo-patches-3.12.6_p2.tar.xz 8144 BLAKE2B 2f36ce972e0b3e2884c9df629e3aeb1af05e4c77dffb866ff28e08a0a7df3c7cf36a9de250d148d909c07fd5bad483c95b3267818657c04e7d0d6fe512e21f9a SHA512 caa86c6cf693f9293b3aa8944452d117b78c1c3f8d6a6aa658cb5c2d2ffb0cecc6cf14b293872bd2101766ee7167ba88183904b2814090f8cbc64c1fa3b771be
+DIST python-gentoo-patches-3.12.6_p4-r1.tar.xz 9072 BLAKE2B 831f6c4284035832e0536ad3211d10c078e6c356e1fa593dd45984b29253deaf703bcb71e1b488508992dd37d5a140591c9193f1620bb966e39b048e4d5c6746 SHA512 9c61e0396c98fb45f3dccad9165e3f2b7bbeabd4a6fe88cc6e05a9d3012e39068571e63527dc831efaf24cb0e8fee75f60454481b2d1a0a44bedba69a7ed5c95
+DIST python-gentoo-patches-3.12.7_p1-r1.tar.xz 10552 BLAKE2B c71ffbbaa4dccd012fced7979c54f2b895ac207a892fd4b0118ab9ef678931c5449f6205855bf5fab9bc7fb5e5af0fc7c5b89bab608e5539855db571bb9d3aa4 SHA512 62207e2eb44e4eeb464ba4bdcefe15b3e03793793cbd033c153cdbf1c9a861779f3bb7259dc09e786c183450123ea283583d9870eca9d6c7b25e5f3dba6f89d6
+DIST python-gentoo-patches-3.13.0rc3-r1.tar.xz 8324 BLAKE2B 8a8124bf2c8bcb93113e7a17394dd83087c7f7d49e56e6878947029c496dcf8f6acb1da62124c73ee4121639fbaa6c3cbea13032c786c8b57bbbc379386394cf SHA512 cdfdd0f744f87438863432880791c611ae14f6169fdce08bfc22deb1e5b1f62aeb87044e6f7b15524b26bef8383ca1641d9b2861558bba597a74551e3ef478a7
+DIST python-gentoo-patches-3.8.20_p2.tar.xz 42296 BLAKE2B c0f2c4d0adcb6c10eb68342b911016666cb68308717a5ca1369100a39229ce16c6e9dfdf9e1b4cffe0191d03ca5ee7d9568cd24885fd0f4f32f14e2e8c0a96a3 SHA512 cb9e98c0dd823b6e4f8a60e9095ab58e596cd9411b675678a0d4adefc92b37e14cecc7cecb82e287ac34a9ce1d4595f261b0736bcc9fc62c43c7d8c0b3be70e7
+DIST python-gentoo-patches-3.9.20_p1.tar.xz 34944 BLAKE2B 332454661adc03033c7e8a5fcc91081b7d405826e9bf89bb2c2e178a0795e4415c9e87ae923756470ee973441f242e194b397354964b8f43dadd4965d210a4f4 SHA512 19bf7227535526a733633723b75d49786dfd8738595c1115b4e05665bc13a1ea70cbf0cc62cb27e81c75f5db2aa56ab985eaa5abde6243697caccb2cb5288005
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.14_p1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.14_p1-r1.ebuild
deleted file mode 100644
index 2271609fb5e..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.14_p1-r1.ebuild
+++ /dev/null
@@ -1,542 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
-inherit prefix python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm libedit
-	+ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-wheels )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	valgrind? ( dev-debug/valgrind )
-	test? ( app-arch/xz-utils )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( sec-keys/openpgp-keys-python )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-}
-
-pkg_setup() {
-	use test && check-reqs_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	rm -r Modules/expat || die
-	rm -r Modules/_ctypes/libffi* || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# https://bugs.gentoo.org/850151
-	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	local jobs=$(makeopts_jobs)
-	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
-	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910 and bug #864911.
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross.
-		--without-lto
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
-	# libdir correctly for cross.
-	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
-		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Avoid as many dependencies as possible for the cross build.
-	cat >> Makefile <<-EOF || die
-		MODULE_NIS=disabled
-		MODULE__DBM=disabled
-		MODULE__GDBM=disabled
-		MODULE__DBM=disabled
-		MODULE__SQLITE3=disabled
-		MODULE__HASHLIB=disabled
-		MODULE__SSL=disabled
-		MODULE__CURSES=disabled
-		MODULE__CURSES_PANEL=disabled
-		MODULE_READLINE=disabled
-		MODULE__TKINTER=disabled
-		MODULE_PYEXPAT=disabled
-		MODULE_ZLIB=disabled
-	EOF
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the Python it was pointed to
-	# immediately.
-	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-	local disable
-	use gdbm      || disable+=" gdbm"
-	use ncurses   || disable+=" _curses _curses_panel"
-	use readline  || disable+=" readline"
-	use sqlite    || disable+=" _sqlite3"
-	use ssl       || export PYTHON_DISABLE_SSL="1"
-	use tk        || disable+=" _tkinter"
-	export PYTHON_DISABLE_MODULES="${disable}"
-
-	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
-		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			-x test_gdb
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_concurrent_futures
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-		)
-
-		# musl-specific skips
-		use elibc_musl && profile_task_flags+=(
-			# various musl locale deficiencies
-			-x test__locale
-			-x test_c_locale_coercion
-			-x test_locale
-			-x test_re
-
-			# known issues with find_library on musl
-			# https://bugs.python.org/issue21622
-			-x test_ctypes
-
-			# fpathconf, ttyname errno values
-			-x test_os
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-ffi
-		--with-system-libmpdec
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with debug assertions)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		# Point the imminent CHOST build to the Python we just
-		# built for CBUILD.
-		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	hprefixify setup.py
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	# Prevent using distutils bundled by setuptools.
-	# https://bugs.gentoo.org/823728
-	export SETUPTOOLS_USE_DISTUTILS=stdlib
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	local test_opts=(
-		-u-network
-		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# musl-specific skips
-	use elibc_musl && test_opts+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	# workaround https://bugs.gentoo.org/775416
-	addwrite "/usr/lib/python${PYVER}/site-packages"
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	rm Lib/docutils.py || die
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	emake DESTDIR="${D}" altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.14_p2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.14_p2.ebuild
deleted file mode 100644
index aeb4a5a2579..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.14_p2.ebuild
+++ /dev/null
@@ -1,542 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
-inherit prefix python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm libedit
-	+ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-wheels )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	valgrind? ( dev-debug/valgrind )
-	test? ( app-arch/xz-utils )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( sec-keys/openpgp-keys-python )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-}
-
-pkg_setup() {
-	use test && check-reqs_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	rm -r Modules/expat || die
-	rm -r Modules/_ctypes/libffi* || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# https://bugs.gentoo.org/850151
-	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	local jobs=$(makeopts_jobs)
-	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
-	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910 and bug #864911.
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross.
-		--without-lto
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
-	# libdir correctly for cross.
-	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
-		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Avoid as many dependencies as possible for the cross build.
-	cat >> Makefile <<-EOF || die
-		MODULE_NIS=disabled
-		MODULE__DBM=disabled
-		MODULE__GDBM=disabled
-		MODULE__DBM=disabled
-		MODULE__SQLITE3=disabled
-		MODULE__HASHLIB=disabled
-		MODULE__SSL=disabled
-		MODULE__CURSES=disabled
-		MODULE__CURSES_PANEL=disabled
-		MODULE_READLINE=disabled
-		MODULE__TKINTER=disabled
-		MODULE_PYEXPAT=disabled
-		MODULE_ZLIB=disabled
-	EOF
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the Python it was pointed to
-	# immediately.
-	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-	local disable
-	use gdbm      || disable+=" gdbm"
-	use ncurses   || disable+=" _curses _curses_panel"
-	use readline  || disable+=" readline"
-	use sqlite    || disable+=" _sqlite3"
-	use ssl       || export PYTHON_DISABLE_SSL="1"
-	use tk        || disable+=" _tkinter"
-	export PYTHON_DISABLE_MODULES="${disable}"
-
-	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
-		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			-x test_gdb
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_concurrent_futures
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-		)
-
-		# musl-specific skips
-		use elibc_musl && profile_task_flags+=(
-			# various musl locale deficiencies
-			-x test__locale
-			-x test_c_locale_coercion
-			-x test_locale
-			-x test_re
-
-			# known issues with find_library on musl
-			# https://bugs.python.org/issue21622
-			-x test_ctypes
-
-			# fpathconf, ttyname errno values
-			-x test_os
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-ffi
-		--with-system-libmpdec
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with debug assertions)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		# Point the imminent CHOST build to the Python we just
-		# built for CBUILD.
-		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	hprefixify setup.py
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	# Prevent using distutils bundled by setuptools.
-	# https://bugs.gentoo.org/823728
-	export SETUPTOOLS_USE_DISTUTILS=stdlib
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	local test_opts=(
-		-u-network
-		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# musl-specific skips
-	use elibc_musl && test_opts+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	# workaround https://bugs.gentoo.org/775416
-	addwrite "/usr/lib/python${PYVER}/site-packages"
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	rm Lib/docutils.py || die
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	emake DESTDIR="${D}" altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.14_p3-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.14_p3-r1.ebuild
deleted file mode 100644
index 5798604c8b1..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.14_p3-r1.ebuild
+++ /dev/null
@@ -1,542 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
-inherit prefix python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm libedit
-	+ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-wheels )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	valgrind? ( dev-debug/valgrind )
-	test? ( app-arch/xz-utils )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( sec-keys/openpgp-keys-python )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-}
-
-pkg_setup() {
-	use test && check-reqs_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	rm -r Modules/expat || die
-	rm -r Modules/_ctypes/libffi* || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# https://bugs.gentoo.org/850151
-	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	local jobs=$(makeopts_jobs)
-	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
-	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910 and bug #864911.
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross.
-		--without-lto
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
-	# libdir correctly for cross.
-	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
-		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Avoid as many dependencies as possible for the cross build.
-	cat >> Makefile <<-EOF || die
-		MODULE_NIS=disabled
-		MODULE__DBM=disabled
-		MODULE__GDBM=disabled
-		MODULE__DBM=disabled
-		MODULE__SQLITE3=disabled
-		MODULE__HASHLIB=disabled
-		MODULE__SSL=disabled
-		MODULE__CURSES=disabled
-		MODULE__CURSES_PANEL=disabled
-		MODULE_READLINE=disabled
-		MODULE__TKINTER=disabled
-		MODULE_PYEXPAT=disabled
-		MODULE_ZLIB=disabled
-	EOF
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the Python it was pointed to
-	# immediately.
-	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-	local disable
-	use gdbm      || disable+=" gdbm"
-	use ncurses   || disable+=" _curses _curses_panel"
-	use readline  || disable+=" readline"
-	use sqlite    || disable+=" _sqlite3"
-	use ssl       || export PYTHON_DISABLE_SSL="1"
-	use tk        || disable+=" _tkinter"
-	export PYTHON_DISABLE_MODULES="${disable}"
-
-	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
-		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			-x test_gdb
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_concurrent_futures
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-		)
-
-		# musl-specific skips
-		use elibc_musl && profile_task_flags+=(
-			# various musl locale deficiencies
-			-x test__locale
-			-x test_c_locale_coercion
-			-x test_locale
-			-x test_re
-
-			# known issues with find_library on musl
-			# https://bugs.python.org/issue21622
-			-x test_ctypes
-
-			# fpathconf, ttyname errno values
-			-x test_os
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-ffi
-		--with-system-libmpdec
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with debug assertions)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		# Point the imminent CHOST build to the Python we just
-		# built for CBUILD.
-		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	hprefixify setup.py
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	# Prevent using distutils bundled by setuptools.
-	# https://bugs.gentoo.org/823728
-	export SETUPTOOLS_USE_DISTUTILS=stdlib
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	local test_opts=(
-		-u-network
-		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# musl-specific skips
-	use elibc_musl && test_opts+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	# workaround https://bugs.gentoo.org/775416
-	addwrite "/usr/lib/python${PYVER}/site-packages"
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	rm Lib/docutils.py || die
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	emake DESTDIR="${D}" TEST_MODULES=no altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.14_p3.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.14_p3.ebuild
deleted file mode 100644
index 8e0941d197c..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.14_p3.ebuild
+++ /dev/null
@@ -1,542 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
-inherit prefix python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm libedit
-	+ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-wheels )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	valgrind? ( dev-debug/valgrind )
-	test? ( app-arch/xz-utils )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( sec-keys/openpgp-keys-python )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-}
-
-pkg_setup() {
-	use test && check-reqs_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	rm -r Modules/expat || die
-	rm -r Modules/_ctypes/libffi* || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# https://bugs.gentoo.org/850151
-	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	local jobs=$(makeopts_jobs)
-	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
-	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910 and bug #864911.
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross.
-		--without-lto
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
-	# libdir correctly for cross.
-	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
-		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Avoid as many dependencies as possible for the cross build.
-	cat >> Makefile <<-EOF || die
-		MODULE_NIS=disabled
-		MODULE__DBM=disabled
-		MODULE__GDBM=disabled
-		MODULE__DBM=disabled
-		MODULE__SQLITE3=disabled
-		MODULE__HASHLIB=disabled
-		MODULE__SSL=disabled
-		MODULE__CURSES=disabled
-		MODULE__CURSES_PANEL=disabled
-		MODULE_READLINE=disabled
-		MODULE__TKINTER=disabled
-		MODULE_PYEXPAT=disabled
-		MODULE_ZLIB=disabled
-	EOF
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the Python it was pointed to
-	# immediately.
-	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-	local disable
-	use gdbm      || disable+=" gdbm"
-	use ncurses   || disable+=" _curses _curses_panel"
-	use readline  || disable+=" readline"
-	use sqlite    || disable+=" _sqlite3"
-	use ssl       || export PYTHON_DISABLE_SSL="1"
-	use tk        || disable+=" _tkinter"
-	export PYTHON_DISABLE_MODULES="${disable}"
-
-	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
-		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			-x test_gdb
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_concurrent_futures
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-		)
-
-		# musl-specific skips
-		use elibc_musl && profile_task_flags+=(
-			# various musl locale deficiencies
-			-x test__locale
-			-x test_c_locale_coercion
-			-x test_locale
-			-x test_re
-
-			# known issues with find_library on musl
-			# https://bugs.python.org/issue21622
-			-x test_ctypes
-
-			# fpathconf, ttyname errno values
-			-x test_os
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-ffi
-		--with-system-libmpdec
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with debug assertions)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		# Point the imminent CHOST build to the Python we just
-		# built for CBUILD.
-		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	hprefixify setup.py
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	# Prevent using distutils bundled by setuptools.
-	# https://bugs.gentoo.org/823728
-	export SETUPTOOLS_USE_DISTUTILS=stdlib
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	local test_opts=(
-		-u-network
-		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# musl-specific skips
-	use elibc_musl && test_opts+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	# workaround https://bugs.gentoo.org/775416
-	addwrite "/usr/lib/python${PYVER}/site-packages"
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	rm Lib/docutils.py || die
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	emake DESTDIR="${D}" altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.15.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.15_p1.ebuild
similarity index 89%
rename from sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.15.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.15_p1.ebuild
index ef880e7786f..d17f9d37903 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.15.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.15_p1.ebuild
@@ -28,7 +28,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="PSF-2"
 SLOT="${PYVER}"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="
 	bluetooth build debug +ensurepip examples gdbm libedit
 	+ncurses pgo +readline +sqlite +ssl test tk valgrind
@@ -230,6 +230,77 @@ src_configure() {
 		dbmliborder+="${dbmliborder:+:}gdbm"
 	fi
 
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		-x test_gdb
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
 	if use pgo; then
 		local profile_task_flags=(
 			-m test
@@ -241,7 +312,8 @@ src_configure() {
 			# here. It also matches the default upstream PROFILE_TASK.
 			--timeout 1200
 
-			-x test_gdb
+			"${COMMON_TEST_SKIPS[@]}"
+
 			-x test_dtrace
 
 			# All of these seem to occasionally hang for PGO inconsistently
@@ -260,21 +332,33 @@ src_configure() {
 			-x test_tools
 		)
 
-		# musl-specific skips
-		use elibc_musl && profile_task_flags+=(
-			# various musl locale deficiencies
-			-x test__locale
-			-x test_c_locale_coercion
-			-x test_locale
-			-x test_re
-
-			# known issues with find_library on musl
-			# https://bugs.python.org/issue21622
-			-x test_ctypes
-
-			# fpathconf, ttyname errno values
-			-x test_os
-		)
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
 
 		if has_version "app-arch/rpm" ; then
 			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
@@ -368,12 +452,13 @@ src_compile() {
 	# bug #831897
 	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
 
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
 	if use pgo ; then
 		# bug 660358
 		local -x COLUMNS=80
 		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
 	fi
 
 	# also need to clear the flags explicitly here or they end up
@@ -399,55 +484,20 @@ src_test() {
 	fi
 
 	local test_opts=(
+		--verbose3
 		-u-network
 		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
+		"${COMMON_TEST_SKIPS[@]}"
 	)
 
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# musl-specific skips
-	use elibc_musl && test_opts+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
 	# bug 660358
 	local -x COLUMNS=80
 	local -x PYTHONDONTWRITEBYTECODE=
-	# workaround https://bugs.gentoo.org/775416
-	addwrite "/usr/lib/python${PYVER}/site-packages"
 
 	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
 		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
 	local ret=${?}
 
-	rm Lib/docutils.py || die
-
 	[[ ${ret} -eq 0 ]] || die "emake test failed"
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.10.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.10.ebuild
deleted file mode 100644
index db00ed95046..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.10.ebuild
+++ /dev/null
@@ -1,573 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
-inherit prefix python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm libedit
-	+ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-wheels )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? ( app-arch/xz-utils )
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( sec-keys/openpgp-keys-python )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-}
-
-pkg_setup() {
-	use test && check-reqs_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	rm -r Modules/expat || die
-	rm -r Modules/_ctypes/libffi* || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# https://bugs.gentoo.org/850151
-	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	local jobs=$(makeopts_jobs)
-	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
-	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross to satisfy --with-build-python.
-		--without-lto
-		--without-readline
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
-	# libdir correctly for cross.
-	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
-		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Avoid as many dependencies as possible for the cross build.
-	cat >> Makefile <<-EOF || die
-		MODULE_NIS_STATE=disabled
-		MODULE__DBM_STATE=disabled
-		MODULE__GDBM_STATE=disabled
-		MODULE__DBM_STATE=disabled
-		MODULE__SQLITE3_STATE=disabled
-		MODULE__HASHLIB_STATE=disabled
-		MODULE__SSL_STATE=disabled
-		MODULE__CURSES_STATE=disabled
-		MODULE__CURSES_PANEL_STATE=disabled
-		MODULE_READLINE_STATE=disabled
-		MODULE__TKINTER_STATE=disabled
-		MODULE_PYEXPAT_STATE=disabled
-		MODULE_ZLIB_STATE=disabled
-	EOF
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the --with-build-python value
-	# immediately.
-	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			-x test_gdb
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_concurrent_futures
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-		)
-
-		# musl-specific skips
-		use elibc_musl && profile_task_flags+=(
-			# various musl locale deficiencies
-			-x test__locale
-			-x test_c_locale_coercion
-			-x test_locale
-			-x test_re
-
-			# known issues with find_library on musl
-			# https://bugs.python.org/issue21622
-			-x test_ctypes
-
-			# fpathconf, ttyname errno values
-			-x test_os
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-ffi
-		--with-system-libmpdec
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with debug assertions)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	hprefixify setup.py
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# force-disable modules we don't want built
-	local disable_modules=( NIS )
-	use gdbm || disable_modules+=( _GDBM _DBM )
-	use sqlite || disable_modules+=( _SQLITE3 )
-	use ssl || disable_modules+=( _HASHLIB _SSL )
-	use ncurses || disable_modules+=( _CURSES _CURSES_PANEL )
-	use readline || disable_modules+=( READLINE )
-	use tk || disable_modules+=( _TKINTER )
-
-	local mod
-	for mod in "${disable_modules[@]}"; do
-		echo "MODULE_${mod}_STATE=disabled"
-	done >> Makefile || die
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	# Prevent using distutils bundled by setuptools.
-	# https://bugs.gentoo.org/823728
-	export SETUPTOOLS_USE_DISTUTILS=stdlib
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		-u-network
-		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# musl-specific skips
-	use elibc_musl && test_opts+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	# workaround https://bugs.gentoo.org/775416
-	addwrite "/usr/lib/python${PYVER}/site-packages"
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	rm Lib/docutils.py || die
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
-
-pkg_postinst() {
-	local v
-	for v in ${REPLACING_VERSIONS}; do
-		if ver_test "${v}" -lt 3.11.0_beta4-r2; then
-			ewarn "Python 3.11.0b4 has changed its module ABI.  The .pyc files"
-			ewarn "installed previously are no longer valid and will be regenerated"
-			ewarn "(or ignored) on the next import.  This may cause sandbox failures"
-			ewarn "when installing some packages and checksum mismatches when removing"
-			ewarn "old versions.  To actively prevent this, rebuild all packages"
-			ewarn "installing Python 3.11 modules, e.g. using:"
-			ewarn
-			ewarn "  emerge -1v /usr/lib/python3.11/site-packages"
-		fi
-	done
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9_p2-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.10_p1.ebuild
similarity index 89%
rename from sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9_p2-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.10_p1.ebuild
index 948adca1f20..7e4af08d8e2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9_p2-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.10_p1.ebuild
@@ -28,7 +28,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="PSF-2"
 SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="
 	bluetooth build debug +ensurepip examples gdbm libedit
 	+ncurses pgo +readline +sqlite +ssl test tk valgrind
@@ -220,6 +220,78 @@ src_configure() {
 		dbmliborder+="${dbmliborder:+:}gdbm"
 	fi
 
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
 	if use pgo; then
 		local profile_task_flags=(
 			-m test
@@ -231,7 +303,8 @@ src_configure() {
 			# here. It also matches the default upstream PROFILE_TASK.
 			--timeout 1200
 
-			-x test_gdb
+			"${COMMON_TEST_SKIPS[@]}"
+
 			-x test_dtrace
 
 			# All of these seem to occasionally hang for PGO inconsistently
@@ -250,21 +323,33 @@ src_configure() {
 			-x test_tools
 		)
 
-		# musl-specific skips
-		use elibc_musl && profile_task_flags+=(
-			# various musl locale deficiencies
-			-x test__locale
-			-x test_c_locale_coercion
-			-x test_locale
-			-x test_re
-
-			# known issues with find_library on musl
-			# https://bugs.python.org/issue21622
-			-x test_ctypes
-
-			# fpathconf, ttyname errno values
-			-x test_os
-		)
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
 
 		if has_version "app-arch/rpm" ; then
 			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
@@ -377,12 +462,13 @@ src_compile() {
 	# bug #831897
 	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
 
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
 	if use pgo ; then
 		# bug 660358
 		local -x COLUMNS=80
 		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
 	fi
 
 	# also need to clear the flags explicitly here or they end up
@@ -413,55 +499,20 @@ src_test() {
 	local -x LOGNAME=buildbot
 
 	local test_opts=(
+		--verbose3
 		-u-network
 		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# musl-specific skips
-	use elibc_musl && test_opts+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
+		"${COMMON_TEST_SKIPS[@]}"
 	)
 
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
 	# bug 660358
 	local -x COLUMNS=80
 	local -x PYTHONDONTWRITEBYTECODE=
-	# workaround https://bugs.gentoo.org/775416
-	addwrite "/usr/lib/python${PYVER}/site-packages"
 
 	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
 		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
 	local ret=${?}
 
-	rm Lib/docutils.py || die
-
 	[[ ${ret} -eq 0 ]] || die "emake test failed"
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9-r1.ebuild
deleted file mode 100644
index 0a940dbae58..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9-r1.ebuild
+++ /dev/null
@@ -1,573 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
-inherit prefix python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm libedit
-	+ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-wheels )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? ( app-arch/xz-utils )
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( sec-keys/openpgp-keys-python )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-}
-
-pkg_setup() {
-	use test && check-reqs_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	rm -r Modules/expat || die
-	rm -r Modules/_ctypes/libffi* || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# https://bugs.gentoo.org/850151
-	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	local jobs=$(makeopts_jobs)
-	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
-	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross to satisfy --with-build-python.
-		--without-lto
-		--without-readline
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
-	# libdir correctly for cross.
-	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
-		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Avoid as many dependencies as possible for the cross build.
-	cat >> Makefile <<-EOF || die
-		MODULE_NIS_STATE=disabled
-		MODULE__DBM_STATE=disabled
-		MODULE__GDBM_STATE=disabled
-		MODULE__DBM_STATE=disabled
-		MODULE__SQLITE3_STATE=disabled
-		MODULE__HASHLIB_STATE=disabled
-		MODULE__SSL_STATE=disabled
-		MODULE__CURSES_STATE=disabled
-		MODULE__CURSES_PANEL_STATE=disabled
-		MODULE_READLINE_STATE=disabled
-		MODULE__TKINTER_STATE=disabled
-		MODULE_PYEXPAT_STATE=disabled
-		MODULE_ZLIB_STATE=disabled
-	EOF
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the --with-build-python value
-	# immediately.
-	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			-x test_gdb
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_concurrent_futures
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-		)
-
-		# musl-specific skips
-		use elibc_musl && profile_task_flags+=(
-			# various musl locale deficiencies
-			-x test__locale
-			-x test_c_locale_coercion
-			-x test_locale
-			-x test_re
-
-			# known issues with find_library on musl
-			# https://bugs.python.org/issue21622
-			-x test_ctypes
-
-			# fpathconf, ttyname errno values
-			-x test_os
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-ffi
-		--with-system-libmpdec
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with debug assertions)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	hprefixify setup.py
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# force-disable modules we don't want built
-	local disable_modules=( NIS )
-	use gdbm || disable_modules+=( _GDBM _DBM )
-	use sqlite || disable_modules+=( _SQLITE3 )
-	use ssl || disable_modules+=( _HASHLIB _SSL )
-	use ncurses || disable_modules+=( _CURSES _CURSES_PANEL )
-	use readline || disable_modules+=( READLINE )
-	use tk || disable_modules+=( _TKINTER )
-
-	local mod
-	for mod in "${disable_modules[@]}"; do
-		echo "MODULE_${mod}_STATE=disabled"
-	done >> Makefile || die
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	# Prevent using distutils bundled by setuptools.
-	# https://bugs.gentoo.org/823728
-	export SETUPTOOLS_USE_DISTUTILS=stdlib
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		-u-network
-		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# musl-specific skips
-	use elibc_musl && test_opts+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	# workaround https://bugs.gentoo.org/775416
-	addwrite "/usr/lib/python${PYVER}/site-packages"
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	rm Lib/docutils.py || die
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
-
-pkg_postinst() {
-	local v
-	for v in ${REPLACING_VERSIONS}; do
-		if ver_test "${v}" -lt 3.11.0_beta4-r2; then
-			ewarn "Python 3.11.0b4 has changed its module ABI.  The .pyc files"
-			ewarn "installed previously are no longer valid and will be regenerated"
-			ewarn "(or ignored) on the next import.  This may cause sandbox failures"
-			ewarn "when installing some packages and checksum mismatches when removing"
-			ewarn "old versions.  To actively prevent this, rebuild all packages"
-			ewarn "installing Python 3.11 modules, e.g. using:"
-			ewarn
-			ewarn "  emerge -1v /usr/lib/python3.11/site-packages"
-		fi
-	done
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9_p1.ebuild
deleted file mode 100644
index c86e59be624..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9_p1.ebuild
+++ /dev/null
@@ -1,573 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
-inherit prefix python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm libedit
-	+ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-wheels )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? ( app-arch/xz-utils )
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( sec-keys/openpgp-keys-python )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-}
-
-pkg_setup() {
-	use test && check-reqs_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	rm -r Modules/expat || die
-	rm -r Modules/_ctypes/libffi* || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# https://bugs.gentoo.org/850151
-	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	local jobs=$(makeopts_jobs)
-	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
-	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross to satisfy --with-build-python.
-		--without-lto
-		--without-readline
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
-	# libdir correctly for cross.
-	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
-		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Avoid as many dependencies as possible for the cross build.
-	cat >> Makefile <<-EOF || die
-		MODULE_NIS_STATE=disabled
-		MODULE__DBM_STATE=disabled
-		MODULE__GDBM_STATE=disabled
-		MODULE__DBM_STATE=disabled
-		MODULE__SQLITE3_STATE=disabled
-		MODULE__HASHLIB_STATE=disabled
-		MODULE__SSL_STATE=disabled
-		MODULE__CURSES_STATE=disabled
-		MODULE__CURSES_PANEL_STATE=disabled
-		MODULE_READLINE_STATE=disabled
-		MODULE__TKINTER_STATE=disabled
-		MODULE_PYEXPAT_STATE=disabled
-		MODULE_ZLIB_STATE=disabled
-	EOF
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the --with-build-python value
-	# immediately.
-	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			-x test_gdb
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_concurrent_futures
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-		)
-
-		# musl-specific skips
-		use elibc_musl && profile_task_flags+=(
-			# various musl locale deficiencies
-			-x test__locale
-			-x test_c_locale_coercion
-			-x test_locale
-			-x test_re
-
-			# known issues with find_library on musl
-			# https://bugs.python.org/issue21622
-			-x test_ctypes
-
-			# fpathconf, ttyname errno values
-			-x test_os
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-ffi
-		--with-system-libmpdec
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with debug assertions)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	hprefixify setup.py
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# force-disable modules we don't want built
-	local disable_modules=( NIS )
-	use gdbm || disable_modules+=( _GDBM _DBM )
-	use sqlite || disable_modules+=( _SQLITE3 )
-	use ssl || disable_modules+=( _HASHLIB _SSL )
-	use ncurses || disable_modules+=( _CURSES _CURSES_PANEL )
-	use readline || disable_modules+=( READLINE )
-	use tk || disable_modules+=( _TKINTER )
-
-	local mod
-	for mod in "${disable_modules[@]}"; do
-		echo "MODULE_${mod}_STATE=disabled"
-	done >> Makefile || die
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	# Prevent using distutils bundled by setuptools.
-	# https://bugs.gentoo.org/823728
-	export SETUPTOOLS_USE_DISTUTILS=stdlib
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		-u-network
-		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# musl-specific skips
-	use elibc_musl && test_opts+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	# workaround https://bugs.gentoo.org/775416
-	addwrite "/usr/lib/python${PYVER}/site-packages"
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	rm Lib/docutils.py || die
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
-
-pkg_postinst() {
-	local v
-	for v in ${REPLACING_VERSIONS}; do
-		if ver_test "${v}" -lt 3.11.0_beta4-r2; then
-			ewarn "Python 3.11.0b4 has changed its module ABI.  The .pyc files"
-			ewarn "installed previously are no longer valid and will be regenerated"
-			ewarn "(or ignored) on the next import.  This may cause sandbox failures"
-			ewarn "when installing some packages and checksum mismatches when removing"
-			ewarn "old versions.  To actively prevent this, rebuild all packages"
-			ewarn "installing Python 3.11 modules, e.g. using:"
-			ewarn
-			ewarn "  emerge -1v /usr/lib/python3.11/site-packages"
-		fi
-	done
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9_p2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9_p2.ebuild
deleted file mode 100644
index d36974cc3ec..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9_p2.ebuild
+++ /dev/null
@@ -1,573 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
-inherit prefix python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha amd64 ~arm arm64 hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc ~x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm libedit
-	+ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-wheels )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? ( app-arch/xz-utils )
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( sec-keys/openpgp-keys-python )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-}
-
-pkg_setup() {
-	use test && check-reqs_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	rm -r Modules/expat || die
-	rm -r Modules/_ctypes/libffi* || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# https://bugs.gentoo.org/850151
-	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	local jobs=$(makeopts_jobs)
-	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
-	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross to satisfy --with-build-python.
-		--without-lto
-		--without-readline
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
-	# libdir correctly for cross.
-	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
-		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Avoid as many dependencies as possible for the cross build.
-	cat >> Makefile <<-EOF || die
-		MODULE_NIS_STATE=disabled
-		MODULE__DBM_STATE=disabled
-		MODULE__GDBM_STATE=disabled
-		MODULE__DBM_STATE=disabled
-		MODULE__SQLITE3_STATE=disabled
-		MODULE__HASHLIB_STATE=disabled
-		MODULE__SSL_STATE=disabled
-		MODULE__CURSES_STATE=disabled
-		MODULE__CURSES_PANEL_STATE=disabled
-		MODULE_READLINE_STATE=disabled
-		MODULE__TKINTER_STATE=disabled
-		MODULE_PYEXPAT_STATE=disabled
-		MODULE_ZLIB_STATE=disabled
-	EOF
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the --with-build-python value
-	# immediately.
-	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			-x test_gdb
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_concurrent_futures
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-		)
-
-		# musl-specific skips
-		use elibc_musl && profile_task_flags+=(
-			# various musl locale deficiencies
-			-x test__locale
-			-x test_c_locale_coercion
-			-x test_locale
-			-x test_re
-
-			# known issues with find_library on musl
-			# https://bugs.python.org/issue21622
-			-x test_ctypes
-
-			# fpathconf, ttyname errno values
-			-x test_os
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-ffi
-		--with-system-libmpdec
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with debug assertions)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	hprefixify setup.py
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# force-disable modules we don't want built
-	local disable_modules=( NIS )
-	use gdbm || disable_modules+=( _GDBM _DBM )
-	use sqlite || disable_modules+=( _SQLITE3 )
-	use ssl || disable_modules+=( _HASHLIB _SSL )
-	use ncurses || disable_modules+=( _CURSES _CURSES_PANEL )
-	use readline || disable_modules+=( READLINE )
-	use tk || disable_modules+=( _TKINTER )
-
-	local mod
-	for mod in "${disable_modules[@]}"; do
-		echo "MODULE_${mod}_STATE=disabled"
-	done >> Makefile || die
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	# Prevent using distutils bundled by setuptools.
-	# https://bugs.gentoo.org/823728
-	export SETUPTOOLS_USE_DISTUTILS=stdlib
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		-u-network
-		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# musl-specific skips
-	use elibc_musl && test_opts+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	# workaround https://bugs.gentoo.org/775416
-	addwrite "/usr/lib/python${PYVER}/site-packages"
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	rm Lib/docutils.py || die
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
-
-pkg_postinst() {
-	local v
-	for v in ${REPLACING_VERSIONS}; do
-		if ver_test "${v}" -lt 3.11.0_beta4-r2; then
-			ewarn "Python 3.11.0b4 has changed its module ABI.  The .pyc files"
-			ewarn "installed previously are no longer valid and will be regenerated"
-			ewarn "(or ignored) on the next import.  This may cause sandbox failures"
-			ewarn "when installing some packages and checksum mismatches when removing"
-			ewarn "old versions.  To actively prevent this, rebuild all packages"
-			ewarn "installing Python 3.11 modules, e.g. using:"
-			ewarn
-			ewarn "  emerge -1v /usr/lib/python3.11/site-packages"
-		fi
-	done
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.3-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.3-r1.ebuild
deleted file mode 100644
index 675a1871777..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.3-r1.ebuild
+++ /dev/null
@@ -1,571 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
-inherit python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm libedit
-	+ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-pip )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? (
-		app-arch/xz-utils
-		dev-python/ensurepip-pip
-		dev-python/ensurepip-setuptools
-		dev-python/ensurepip-wheel
-	)
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-}
-
-pkg_setup() {
-	use test && check-reqs_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	# TODO: Makefile has annoying deps on expat headers
-	#rm -r Modules/expat || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross to satisfy --with-build-python.
-		--without-lto
-		--without-readline
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-
-	# Avoid as many dependencies as possible for the cross build.
-	mkdir Modules || die
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		_dbm _gdbm
-		_sqlite3
-		_hashlib _ssl
-		_curses _curses_panel
-		readline
-		_tkinter
-		pyexpat
-		zlib
-		# We disabled these for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
-		# and uncommented if needed.
-		#_ctypes _crypt
-	EOF
-
-	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the --with-build-python value
-	# immediately.
-	emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			-x test_gdb
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_concurrent_futures
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-		)
-
-		# musl-specific skips
-		use elibc_musl && profile_task_flags+=(
-			# various musl locale deficiencies
-			-x test__locale
-			-x test_c_locale_coercion
-			-x test_locale
-			-x test_re
-
-			# known issues with find_library on musl
-			# https://bugs.python.org/issue21622
-			-x test_ctypes
-
-			# fpathconf, ttyname errno values
-			-x test_os
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-libmpdec
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with debug assertions)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	# Force-disable modules we don't want built.
-	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		$(usev !gdbm '_gdbm _dbm')
-		$(usev !sqlite '_sqlite3')
-		$(usev !ssl '_hashlib _ssl')
-		$(usev !ncurses '_curses _curses_panel')
-		$(usev !readline 'readline')
-		$(usev !tk '_tkinter')
-	EOF
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		-u-network
-		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# musl-specific skips
-	use elibc_musl && test_opts+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	# workaround https://bugs.gentoo.org/775416
-	addwrite "/usr/lib/python${PYVER}/site-packages"
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	rm Lib/docutils.py || die
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# the Makefile rules are broken
-	# https://github.com/python/cpython/issues/100221
-	mkdir -p "${libdir}"/lib-dynload || die
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
-
-pkg_postinst() {
-	local v
-	for v in ${REPLACING_VERSIONS}; do
-		if ver_test "${v}" -lt 3.11.0_beta4-r2; then
-			ewarn "Python 3.11.0b4 has changed its module ABI.  The .pyc files"
-			ewarn "installed previously are no longer valid and will be regenerated"
-			ewarn "(or ignored) on the next import.  This may cause sandbox failures"
-			ewarn "when installing some packages and checksum mismatches when removing"
-			ewarn "old versions.  To actively prevent this, rebuild all packages"
-			ewarn "installing Python 3.11 modules, e.g. using:"
-			ewarn
-			ewarn "  emerge -1v /usr/lib/python3.11/site-packages"
-		fi
-	done
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.4_p3.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.4_p3.ebuild
deleted file mode 100644
index da4b6d5cd00..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.4_p3.ebuild
+++ /dev/null
@@ -1,558 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
-inherit python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm libedit
-	+ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-pip )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? (
-		app-arch/xz-utils
-		dev-python/ensurepip-pip
-		dev-python/ensurepip-setuptools
-		dev-python/ensurepip-wheel
-	)
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-}
-
-pkg_setup() {
-	use test && check-reqs_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	# TODO: Makefile has annoying deps on expat headers
-	#rm -r Modules/expat || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
-
-	# breaks tests when using --with-wheel-pkg-dir
-	rm -r Lib/test/wheeldata || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross to satisfy --with-build-python.
-		--without-lto
-		--without-readline
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-
-	# Avoid as many dependencies as possible for the cross build.
-	mkdir Modules || die
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		_dbm _gdbm
-		_sqlite3
-		_hashlib _ssl
-		_curses _curses_panel
-		readline
-		_tkinter
-		pyexpat
-		zlib
-		# We disabled these for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
-		# and uncommented if needed.
-		#_ctypes _crypt
-	EOF
-
-	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the --with-build-python value
-	# immediately.
-	emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			-x test_gdb
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_concurrent_futures
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-		)
-
-		# musl-specific skips
-		use elibc_musl && profile_task_flags+=(
-			# various musl locale deficiencies
-			-x test__locale
-			-x test_c_locale_coercion
-			-x test_locale
-			-x test_re
-
-			# known issues with find_library on musl
-			# https://bugs.python.org/issue21622
-			-x test_ctypes
-
-			# fpathconf, ttyname errno values
-			-x test_os
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-libmpdec
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with debug assertions)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	# Force-disable modules we don't want built.
-	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		$(usev !gdbm '_gdbm _dbm')
-		$(usev !sqlite '_sqlite3')
-		$(usev !ssl '_hashlib _ssl')
-		$(usev !ncurses '_curses _curses_panel')
-		$(usev !readline 'readline')
-		$(usev !tk '_tkinter')
-	EOF
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		-u-network
-		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# musl-specific skips
-	use elibc_musl && test_opts+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	# workaround https://bugs.gentoo.org/775416
-	addwrite "/usr/lib/python${PYVER}/site-packages"
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	rm Lib/docutils.py || die
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# the Makefile rules are broken
-	# https://github.com/python/cpython/issues/100221
-	mkdir -p "${libdir}"/lib-dynload || die
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.5_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.5_p1.ebuild
deleted file mode 100644
index 263ee2d5a07..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.5_p1.ebuild
+++ /dev/null
@@ -1,558 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
-inherit python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm arm64 hppa ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm libedit
-	+ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-pip )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? (
-		app-arch/xz-utils
-		dev-python/ensurepip-pip
-		dev-python/ensurepip-setuptools
-		dev-python/ensurepip-wheel
-	)
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-}
-
-pkg_setup() {
-	use test && check-reqs_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	# TODO: Makefile has annoying deps on expat headers
-	#rm -r Modules/expat || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
-
-	# breaks tests when using --with-wheel-pkg-dir
-	rm -r Lib/test/wheeldata || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross to satisfy --with-build-python.
-		--without-lto
-		--without-readline
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-
-	# Avoid as many dependencies as possible for the cross build.
-	mkdir Modules || die
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		_dbm _gdbm
-		_sqlite3
-		_hashlib _ssl
-		_curses _curses_panel
-		readline
-		_tkinter
-		pyexpat
-		zlib
-		# We disabled these for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
-		# and uncommented if needed.
-		#_ctypes _crypt
-	EOF
-
-	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the --with-build-python value
-	# immediately.
-	emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			-x test_gdb
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_concurrent_futures
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-		)
-
-		# musl-specific skips
-		use elibc_musl && profile_task_flags+=(
-			# various musl locale deficiencies
-			-x test__locale
-			-x test_c_locale_coercion
-			-x test_locale
-			-x test_re
-
-			# known issues with find_library on musl
-			# https://bugs.python.org/issue21622
-			-x test_ctypes
-
-			# fpathconf, ttyname errno values
-			-x test_os
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-libmpdec
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with debug assertions)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	# Force-disable modules we don't want built.
-	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		$(usev !gdbm '_gdbm _dbm')
-		$(usev !sqlite '_sqlite3')
-		$(usev !ssl '_hashlib _ssl')
-		$(usev !ncurses '_curses _curses_panel')
-		$(usev !readline 'readline')
-		$(usev !tk '_tkinter')
-	EOF
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		-u-network
-		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# musl-specific skips
-	use elibc_musl && test_opts+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	# workaround https://bugs.gentoo.org/775416
-	addwrite "/usr/lib/python${PYVER}/site-packages"
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	rm Lib/docutils.py || die
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# the Makefile rules are broken
-	# https://github.com/python/cpython/issues/100221
-	mkdir -p "${libdir}"/lib-dynload || die
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.6_p2.ebuild
similarity index 88%
rename from sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.6.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.6_p2.ebuild
index c5954b8b4a6..b348f707d26 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.6_p2.ebuild
@@ -28,7 +28,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="PSF-2"
 SLOT="${PYVER}"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="
 	bluetooth build debug +ensurepip examples gdbm libedit
 	+ncurses pgo +readline +sqlite +ssl test tk valgrind
@@ -223,6 +223,78 @@ src_configure() {
 		dbmliborder+="${dbmliborder:+:}gdbm"
 	fi
 
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
 	if use pgo; then
 		local profile_task_flags=(
 			-m test
@@ -234,7 +306,8 @@ src_configure() {
 			# here. It also matches the default upstream PROFILE_TASK.
 			--timeout 1200
 
-			-x test_gdb
+			"${COMMON_TEST_SKIPS[@]}"
+
 			-x test_dtrace
 
 			# All of these seem to occasionally hang for PGO inconsistently
@@ -253,21 +326,33 @@ src_configure() {
 			-x test_tools
 		)
 
-		# musl-specific skips
-		use elibc_musl && profile_task_flags+=(
-			# various musl locale deficiencies
-			-x test__locale
-			-x test_c_locale_coercion
-			-x test_locale
-			-x test_re
-
-			# known issues with find_library on musl
-			# https://bugs.python.org/issue21622
-			-x test_ctypes
-
-			# fpathconf, ttyname errno values
-			-x test_os
-		)
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
 
 		if has_version "app-arch/rpm" ; then
 			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
@@ -374,12 +459,13 @@ src_compile() {
 	# bug #831897
 	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
 
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
 	if use pgo ; then
 		# bug 660358
 		local -x COLUMNS=80
 		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
 	fi
 
 	# also need to clear the flags explicitly here or they end up
@@ -410,55 +496,20 @@ src_test() {
 	local -x LOGNAME=buildbot
 
 	local test_opts=(
+		--verbose3
 		-u-network
 		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# musl-specific skips
-	use elibc_musl && test_opts+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
+		"${COMMON_TEST_SKIPS[@]}"
 	)
 
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
 	# bug 660358
 	local -x COLUMNS=80
 	local -x PYTHONDONTWRITEBYTECODE=
-	# workaround https://bugs.gentoo.org/775416
-	addwrite "/usr/lib/python${PYVER}/site-packages"
 
 	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
 		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
 	local ret=${?}
 
-	rm Lib/docutils.py || die
-
 	[[ ${ret} -eq 0 ]] || die "emake test failed"
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.6_p4.ebuild
similarity index 87%
rename from sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.5.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.6_p4.ebuild
index e259ddc1be8..ad09b6d91c1 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.6_p4.ebuild
@@ -10,7 +10,7 @@ inherit python-utils-r1 toolchain-funcs verify-sig
 MY_PV=${PV/_rc/rc}
 MY_P="Python-${MY_PV%_p*}"
 PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
+PATCHSET="python-gentoo-patches-${MY_PV}-r1"
 
 DESCRIPTION="An interpreted, interactive, object-oriented programming language"
 HOMEPAGE="
@@ -28,7 +28,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="PSF-2"
 SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm ~arm64 hppa ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 sparc x86"
 IUSE="
 	bluetooth build debug +ensurepip examples gdbm libedit
 	+ncurses pgo +readline +sqlite +ssl test tk valgrind
@@ -223,6 +223,78 @@ src_configure() {
 		dbmliborder+="${dbmliborder:+:}gdbm"
 	fi
 
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
 	if use pgo; then
 		local profile_task_flags=(
 			-m test
@@ -234,7 +306,8 @@ src_configure() {
 			# here. It also matches the default upstream PROFILE_TASK.
 			--timeout 1200
 
-			-x test_gdb
+			"${COMMON_TEST_SKIPS[@]}"
+
 			-x test_dtrace
 
 			# All of these seem to occasionally hang for PGO inconsistently
@@ -253,21 +326,33 @@ src_configure() {
 			-x test_tools
 		)
 
-		# musl-specific skips
-		use elibc_musl && profile_task_flags+=(
-			# various musl locale deficiencies
-			-x test__locale
-			-x test_c_locale_coercion
-			-x test_locale
-			-x test_re
-
-			# known issues with find_library on musl
-			# https://bugs.python.org/issue21622
-			-x test_ctypes
-
-			# fpathconf, ttyname errno values
-			-x test_os
-		)
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
 
 		if has_version "app-arch/rpm" ; then
 			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
@@ -374,12 +459,13 @@ src_compile() {
 	# bug #831897
 	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
 
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
 	if use pgo ; then
 		# bug 660358
 		local -x COLUMNS=80
 		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
 	fi
 
 	# also need to clear the flags explicitly here or they end up
@@ -410,55 +496,20 @@ src_test() {
 	local -x LOGNAME=buildbot
 
 	local test_opts=(
+		--verbose3
 		-u-network
 		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# musl-specific skips
-	use elibc_musl && test_opts+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
+		"${COMMON_TEST_SKIPS[@]}"
 	)
 
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
 	# bug 660358
 	local -x COLUMNS=80
 	local -x PYTHONDONTWRITEBYTECODE=
-	# workaround https://bugs.gentoo.org/775416
-	addwrite "/usr/lib/python${PYVER}/site-packages"
 
 	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
 		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
 	local ret=${?}
 
-	rm Lib/docutils.py || die
-
 	[[ ${ret} -eq 0 ]] || die "emake test failed"
 }
 
@@ -470,7 +521,7 @@ src_install() {
 	mkdir -p "${libdir}"/lib-dynload || die
 
 	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" altinstall
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
 
 	# Fix collisions between different slots of Python.
 	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
@@ -496,15 +547,12 @@ src_install() {
 	fi
 
 	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
 	if ! use sqlite; then
 		rm -r "${libdir}/"sqlite3 || die
 	fi
 	if ! use tk; then
 		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
 	fi
 
 	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.5_p1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.7_p1.ebuild
similarity index 89%
rename from sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.5_p1-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.7_p1.ebuild
index 1b6cd347e51..16691eb29ce 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.5_p1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.7_p1.ebuild
@@ -10,7 +10,7 @@ inherit python-utils-r1 toolchain-funcs verify-sig
 MY_PV=${PV/_rc/rc}
 MY_P="Python-${MY_PV%_p*}"
 PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
+PATCHSET="python-gentoo-patches-${MY_PV}-r1"
 
 DESCRIPTION="An interpreted, interactive, object-oriented programming language"
 HOMEPAGE="
@@ -223,6 +223,78 @@ src_configure() {
 		dbmliborder+="${dbmliborder:+:}gdbm"
 	fi
 
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
 	if use pgo; then
 		local profile_task_flags=(
 			-m test
@@ -234,7 +306,8 @@ src_configure() {
 			# here. It also matches the default upstream PROFILE_TASK.
 			--timeout 1200
 
-			-x test_gdb
+			"${COMMON_TEST_SKIPS[@]}"
+
 			-x test_dtrace
 
 			# All of these seem to occasionally hang for PGO inconsistently
@@ -253,21 +326,33 @@ src_configure() {
 			-x test_tools
 		)
 
-		# musl-specific skips
-		use elibc_musl && profile_task_flags+=(
-			# various musl locale deficiencies
-			-x test__locale
-			-x test_c_locale_coercion
-			-x test_locale
-			-x test_re
-
-			# known issues with find_library on musl
-			# https://bugs.python.org/issue21622
-			-x test_ctypes
-
-			# fpathconf, ttyname errno values
-			-x test_os
-		)
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
 
 		if has_version "app-arch/rpm" ; then
 			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
@@ -374,12 +459,13 @@ src_compile() {
 	# bug #831897
 	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
 
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
 	if use pgo ; then
 		# bug 660358
 		local -x COLUMNS=80
 		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
 	fi
 
 	# also need to clear the flags explicitly here or they end up
@@ -410,55 +496,20 @@ src_test() {
 	local -x LOGNAME=buildbot
 
 	local test_opts=(
+		--verbose3
 		-u-network
 		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# musl-specific skips
-	use elibc_musl && test_opts+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
+		"${COMMON_TEST_SKIPS[@]}"
 	)
 
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
 	# bug 660358
 	local -x COLUMNS=80
 	local -x PYTHONDONTWRITEBYTECODE=
-	# workaround https://bugs.gentoo.org/775416
-	addwrite "/usr/lib/python${PYVER}/site-packages"
 
 	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
 		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
 	local ret=${?}
 
-	rm Lib/docutils.py || die
-
 	[[ ${ret} -eq 0 ]] || die "emake test failed"
 }
 
@@ -496,9 +547,6 @@ src_install() {
 	fi
 
 	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
 	if ! use sqlite; then
 		rm -r "${libdir}/"sqlite3 || die
 	fi
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0_rc1_p2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0_rc1_p2.ebuild
deleted file mode 100644
index c6436649ac9..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0_rc1_p2.ebuild
+++ /dev/null
@@ -1,649 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-
-LLVM_COMPAT=( 18 )
-LLVM_OPTIONAL=1
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic llvm-r1 multiprocessing
-inherit pax-utils python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-IUSE="
-	bluetooth build +debug +ensurepip examples gdbm +gil jit
-	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-pip )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? (
-		app-arch/xz-utils
-		dev-python/ensurepip-pip
-		dev-python/ensurepip-setuptools
-		dev-python/ensurepip-wheel
-	)
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	jit? (
-		$(llvm_gen_dep '
-			sys-devel/clang:${LLVM_SLOT}
-			sys-devel/llvm:${LLVM_SLOT}
-		')
-	)
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-
-	if ! use gil || use jit; then
-		ewarn "USE=-gil and USE=jit flags are considered experimental upstream.  Using"
-		ewarn "them could lead to unexpected breakage, including race conditions"
-		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
-		ewarn "you can reproduce the problem with dev-lang/python[gil,-jit].  Instead,"
-		ewarn "please consider reporting freethreading / JIT problems upstream."
-	fi
-}
-
-pkg_setup() {
-	use jit && llvm-r1_pkg_setup
-	use test && check-reqs_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	# TODO: Makefile has annoying deps on expat headers
-	#rm -r Modules/expat || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
-
-	# breaks tests when using --with-wheel-pkg-dir
-	rm -r Lib/test/wheeldata || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross to satisfy --with-build-python.
-		--without-lto
-		--without-readline
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-
-	# Avoid as many dependencies as possible for the cross build.
-	mkdir Modules || die
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		_dbm _gdbm
-		_sqlite3
-		_hashlib _ssl
-		_curses _curses_panel
-		readline
-		_tkinter
-		pyexpat
-		zlib
-		# We disabled these for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
-		# and uncommented if needed.
-		#_ctypes _crypt
-	EOF
-
-	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the --with-build-python value
-	# immediately.
-	emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	# Set baseline test skip flags.
-	COMMON_TEST_SKIPS=(
-		# failures
-		-x test_concurrent_futures
-		-x test_gdb
-		# flaky: https://github.com/python/cpython/issues/121973
-		-x test_pyrepl
-		# flaky: https://github.com/python/cpython/issues/122136 (bug #936314)
-		-x test_asyncio
-	)
-
-	# Arch-specific skips.  See #931888 for a collection of these.
-	case ${CHOST} in
-		alpha*)
-			COMMON_TEST_SKIPS+=(
-				-x test_builtin
-				-x test_capi
-				-x test_cmath
-				-x test_float
-				# timeout
-				-x test_free_threading
-				-x test_math
-				-x test_numeric_tower
-				-x test_random
-				-x test_statistics
-				# bug 653850
-				-x test_resource
-				-x test_strtod
-			)
-			;;
-		mips*)
-			COMMON_TEST_SKIPS+=(
-				-x test_ctypes
-				-x test_external_inspection
-				-x test_statistics
-			)
-			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_descr
-			)
-			;;
-		riscv*)
-			COMMON_TEST_SKIPS+=(
-				-x test_urllib2
-			)
-			;;
-		sparc*)
-			COMMON_TEST_SKIPS+=(
-				# bug 788022
-				-x test_multiprocessing_fork
-				-x test_multiprocessing_forkserver
-
-				-x test_ctypes
-				-x test_descr
-				# bug 931908
-				-x test_exceptions
-			)
-			;;
-	esac
-
-	# musl-specific skips
-	use elibc_musl && COMMON_TEST_SKIPS+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			--verbose3
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			"${COMMON_TEST_SKIPS[@]}"
-
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-
-			# Fails in profiling run, passes in src_test().
-			-x test_capi
-		)
-
-		# Arch-specific skips.  See #931888 for a collection of these.
-		case ${CHOST} in
-			alpha*)
-				profile_task_flags+=(
-					-x test_os
-				)
-				;;
-			hppa*)
-				profile_task_flags+=(
-					-x test_descr
-					# bug 931908
-					-x test_exceptions
-					-x test_os
-				)
-				;;
-			powerpc64-*) # big endian
-				profile_task_flags+=(
-					# bug 931908
-					-x test_exceptions
-				)
-				;;
-			riscv*)
-				profile_task_flags+=(
-					-x test_statistics
-				)
-				;;
-		esac
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-libmpdec
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with debug assertions)
-		$(use_enable gil)
-		$(use_enable jit experimental-jit)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	# Force-disable modules we don't want built.
-	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		$(usev !gdbm '_gdbm _dbm')
-		$(usev !sqlite '_sqlite3')
-		$(usev !ssl '_hashlib _ssl')
-		$(usev !ncurses '_curses _curses_panel')
-		$(usev !readline 'readline')
-		$(usev !tk '_tkinter')
-	EOF
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	# Gentoo hack to disable accessing system site-packages
-	export GENTOO_CPYTHON_BUILD=1
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		--verbose3
-		-u-network
-		-j "$(makeopts_jobs)"
-		"${COMMON_TEST_SKIPS[@]}"
-	)
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# pydoc
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
-
-pkg_postinst() {
-	local v
-	for v in ${REPLACING_VERSIONS}; do
-		if ver_test "${v}" -lt 3.13.0_beta2; then
-			ewarn "Python 3.13.0b2 has changed its module ABI.  The .pyc files"
-			ewarn "installed previously are no longer valid and will be regenerated"
-			ewarn "(or ignored) on the next import.  This may cause sandbox failures"
-			ewarn "when installing some packages and checksum mismatches when removing"
-			ewarn "old versions.  To actively prevent this, rebuild all packages"
-			ewarn "installing Python 3.13 modules, e.g. using:"
-			ewarn
-			ewarn "  emerge -1v /usr/lib/python3.13/site-packages"
-		fi
-	done
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0_rc1_p3-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0_rc1_p3-r1.ebuild
deleted file mode 100644
index a08c2b73c8f..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0_rc1_p3-r1.ebuild
+++ /dev/null
@@ -1,649 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-
-LLVM_COMPAT=( 18 )
-LLVM_OPTIONAL=1
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic llvm-r1 multiprocessing
-inherit pax-utils python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-IUSE="
-	bluetooth build +debug +ensurepip examples gdbm +gil jit
-	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-pip )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? (
-		app-arch/xz-utils
-		dev-python/ensurepip-pip
-		dev-python/ensurepip-setuptools
-		dev-python/ensurepip-wheel
-	)
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	jit? (
-		$(llvm_gen_dep '
-			sys-devel/clang:${LLVM_SLOT}
-			sys-devel/llvm:${LLVM_SLOT}
-		')
-	)
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-
-	if ! use gil || use jit; then
-		ewarn "USE=-gil and USE=jit flags are considered experimental upstream.  Using"
-		ewarn "them could lead to unexpected breakage, including race conditions"
-		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
-		ewarn "you can reproduce the problem with dev-lang/python[gil,-jit].  Instead,"
-		ewarn "please consider reporting freethreading / JIT problems upstream."
-	fi
-}
-
-pkg_setup() {
-	use jit && llvm-r1_pkg_setup
-	use test && check-reqs_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	# TODO: Makefile has annoying deps on expat headers
-	#rm -r Modules/expat || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
-
-	# breaks tests when using --with-wheel-pkg-dir
-	rm -r Lib/test/wheeldata || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross to satisfy --with-build-python.
-		--without-lto
-		--without-readline
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-
-	# Avoid as many dependencies as possible for the cross build.
-	mkdir Modules || die
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		_dbm _gdbm
-		_sqlite3
-		_hashlib _ssl
-		_curses _curses_panel
-		readline
-		_tkinter
-		pyexpat
-		zlib
-		# We disabled these for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
-		# and uncommented if needed.
-		#_ctypes _crypt
-	EOF
-
-	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the --with-build-python value
-	# immediately.
-	emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	# Set baseline test skip flags.
-	COMMON_TEST_SKIPS=(
-		# failures
-		-x test_concurrent_futures
-		-x test_gdb
-		# flaky: https://github.com/python/cpython/issues/121973
-		-x test_pyrepl
-		# flaky: https://github.com/python/cpython/issues/122136 (bug #936314)
-		-x test_asyncio
-	)
-
-	# Arch-specific skips.  See #931888 for a collection of these.
-	case ${CHOST} in
-		alpha*)
-			COMMON_TEST_SKIPS+=(
-				-x test_builtin
-				-x test_capi
-				-x test_cmath
-				-x test_float
-				# timeout
-				-x test_free_threading
-				-x test_math
-				-x test_numeric_tower
-				-x test_random
-				-x test_statistics
-				# bug 653850
-				-x test_resource
-				-x test_strtod
-			)
-			;;
-		mips*)
-			COMMON_TEST_SKIPS+=(
-				-x test_ctypes
-				-x test_external_inspection
-				-x test_statistics
-			)
-			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_descr
-			)
-			;;
-		riscv*)
-			COMMON_TEST_SKIPS+=(
-				-x test_urllib2
-			)
-			;;
-		sparc*)
-			COMMON_TEST_SKIPS+=(
-				# bug 788022
-				-x test_multiprocessing_fork
-				-x test_multiprocessing_forkserver
-
-				-x test_ctypes
-				-x test_descr
-				# bug 931908
-				-x test_exceptions
-			)
-			;;
-	esac
-
-	# musl-specific skips
-	use elibc_musl && COMMON_TEST_SKIPS+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			--verbose3
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			"${COMMON_TEST_SKIPS[@]}"
-
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-
-			# Fails in profiling run, passes in src_test().
-			-x test_capi
-		)
-
-		# Arch-specific skips.  See #931888 for a collection of these.
-		case ${CHOST} in
-			alpha*)
-				profile_task_flags+=(
-					-x test_os
-				)
-				;;
-			hppa*)
-				profile_task_flags+=(
-					-x test_descr
-					# bug 931908
-					-x test_exceptions
-					-x test_os
-				)
-				;;
-			powerpc64-*) # big endian
-				profile_task_flags+=(
-					# bug 931908
-					-x test_exceptions
-				)
-				;;
-			riscv*)
-				profile_task_flags+=(
-					-x test_statistics
-				)
-				;;
-		esac
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-libmpdec
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with debug assertions)
-		$(use_enable gil)
-		$(use_enable jit experimental-jit)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	# Force-disable modules we don't want built.
-	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		$(usev !gdbm '_gdbm _dbm')
-		$(usev !sqlite '_sqlite3')
-		$(usev !ssl '_hashlib _ssl')
-		$(usev !ncurses '_curses _curses_panel')
-		$(usev !readline 'readline')
-		$(usev !tk '_tkinter')
-	EOF
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	# Gentoo hack to disable accessing system site-packages
-	export GENTOO_CPYTHON_BUILD=1
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		--verbose3
-		-u-network
-		-j "$(makeopts_jobs)"
-		"${COMMON_TEST_SKIPS[@]}"
-	)
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# pydoc
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
-
-pkg_postinst() {
-	local v
-	for v in ${REPLACING_VERSIONS}; do
-		if ver_test "${v}" -lt 3.13.0_beta2; then
-			ewarn "Python 3.13.0b2 has changed its module ABI.  The .pyc files"
-			ewarn "installed previously are no longer valid and will be regenerated"
-			ewarn "(or ignored) on the next import.  This may cause sandbox failures"
-			ewarn "when installing some packages and checksum mismatches when removing"
-			ewarn "old versions.  To actively prevent this, rebuild all packages"
-			ewarn "installing Python 3.13 modules, e.g. using:"
-			ewarn
-			ewarn "  emerge -1v /usr/lib/python3.13/site-packages"
-		fi
-	done
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0_rc1_p3.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0_rc1_p3.ebuild
deleted file mode 100644
index c6436649ac9..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0_rc1_p3.ebuild
+++ /dev/null
@@ -1,649 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-
-LLVM_COMPAT=( 18 )
-LLVM_OPTIONAL=1
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic llvm-r1 multiprocessing
-inherit pax-utils python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-IUSE="
-	bluetooth build +debug +ensurepip examples gdbm +gil jit
-	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-pip )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? (
-		app-arch/xz-utils
-		dev-python/ensurepip-pip
-		dev-python/ensurepip-setuptools
-		dev-python/ensurepip-wheel
-	)
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	jit? (
-		$(llvm_gen_dep '
-			sys-devel/clang:${LLVM_SLOT}
-			sys-devel/llvm:${LLVM_SLOT}
-		')
-	)
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-
-	if ! use gil || use jit; then
-		ewarn "USE=-gil and USE=jit flags are considered experimental upstream.  Using"
-		ewarn "them could lead to unexpected breakage, including race conditions"
-		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
-		ewarn "you can reproduce the problem with dev-lang/python[gil,-jit].  Instead,"
-		ewarn "please consider reporting freethreading / JIT problems upstream."
-	fi
-}
-
-pkg_setup() {
-	use jit && llvm-r1_pkg_setup
-	use test && check-reqs_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	# TODO: Makefile has annoying deps on expat headers
-	#rm -r Modules/expat || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
-
-	# breaks tests when using --with-wheel-pkg-dir
-	rm -r Lib/test/wheeldata || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross to satisfy --with-build-python.
-		--without-lto
-		--without-readline
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-
-	# Avoid as many dependencies as possible for the cross build.
-	mkdir Modules || die
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		_dbm _gdbm
-		_sqlite3
-		_hashlib _ssl
-		_curses _curses_panel
-		readline
-		_tkinter
-		pyexpat
-		zlib
-		# We disabled these for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
-		# and uncommented if needed.
-		#_ctypes _crypt
-	EOF
-
-	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the --with-build-python value
-	# immediately.
-	emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	# Set baseline test skip flags.
-	COMMON_TEST_SKIPS=(
-		# failures
-		-x test_concurrent_futures
-		-x test_gdb
-		# flaky: https://github.com/python/cpython/issues/121973
-		-x test_pyrepl
-		# flaky: https://github.com/python/cpython/issues/122136 (bug #936314)
-		-x test_asyncio
-	)
-
-	# Arch-specific skips.  See #931888 for a collection of these.
-	case ${CHOST} in
-		alpha*)
-			COMMON_TEST_SKIPS+=(
-				-x test_builtin
-				-x test_capi
-				-x test_cmath
-				-x test_float
-				# timeout
-				-x test_free_threading
-				-x test_math
-				-x test_numeric_tower
-				-x test_random
-				-x test_statistics
-				# bug 653850
-				-x test_resource
-				-x test_strtod
-			)
-			;;
-		mips*)
-			COMMON_TEST_SKIPS+=(
-				-x test_ctypes
-				-x test_external_inspection
-				-x test_statistics
-			)
-			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_descr
-			)
-			;;
-		riscv*)
-			COMMON_TEST_SKIPS+=(
-				-x test_urllib2
-			)
-			;;
-		sparc*)
-			COMMON_TEST_SKIPS+=(
-				# bug 788022
-				-x test_multiprocessing_fork
-				-x test_multiprocessing_forkserver
-
-				-x test_ctypes
-				-x test_descr
-				# bug 931908
-				-x test_exceptions
-			)
-			;;
-	esac
-
-	# musl-specific skips
-	use elibc_musl && COMMON_TEST_SKIPS+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			--verbose3
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			"${COMMON_TEST_SKIPS[@]}"
-
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-
-			# Fails in profiling run, passes in src_test().
-			-x test_capi
-		)
-
-		# Arch-specific skips.  See #931888 for a collection of these.
-		case ${CHOST} in
-			alpha*)
-				profile_task_flags+=(
-					-x test_os
-				)
-				;;
-			hppa*)
-				profile_task_flags+=(
-					-x test_descr
-					# bug 931908
-					-x test_exceptions
-					-x test_os
-				)
-				;;
-			powerpc64-*) # big endian
-				profile_task_flags+=(
-					# bug 931908
-					-x test_exceptions
-				)
-				;;
-			riscv*)
-				profile_task_flags+=(
-					-x test_statistics
-				)
-				;;
-		esac
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-libmpdec
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with debug assertions)
-		$(use_enable gil)
-		$(use_enable jit experimental-jit)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	# Force-disable modules we don't want built.
-	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		$(usev !gdbm '_gdbm _dbm')
-		$(usev !sqlite '_sqlite3')
-		$(usev !ssl '_hashlib _ssl')
-		$(usev !ncurses '_curses _curses_panel')
-		$(usev !readline 'readline')
-		$(usev !tk '_tkinter')
-	EOF
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	# Gentoo hack to disable accessing system site-packages
-	export GENTOO_CPYTHON_BUILD=1
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		--verbose3
-		-u-network
-		-j "$(makeopts_jobs)"
-		"${COMMON_TEST_SKIPS[@]}"
-	)
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# pydoc
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
-
-pkg_postinst() {
-	local v
-	for v in ${REPLACING_VERSIONS}; do
-		if ver_test "${v}" -lt 3.13.0_beta2; then
-			ewarn "Python 3.13.0b2 has changed its module ABI.  The .pyc files"
-			ewarn "installed previously are no longer valid and will be regenerated"
-			ewarn "(or ignored) on the next import.  This may cause sandbox failures"
-			ewarn "when installing some packages and checksum mismatches when removing"
-			ewarn "old versions.  To actively prevent this, rebuild all packages"
-			ewarn "installing Python 3.13 modules, e.g. using:"
-			ewarn
-			ewarn "  emerge -1v /usr/lib/python3.13/site-packages"
-		fi
-	done
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0_rc2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0_rc3.ebuild
similarity index 94%
rename from sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0_rc2.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0_rc3.ebuild
index d9dbd33759a..c71af747136 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0_rc2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0_rc3.ebuild
@@ -7,13 +7,14 @@ LLVM_COMPAT=( 18 )
 LLVM_OPTIONAL=1
 WANT_LIBTOOL="none"
 
-inherit autotools check-reqs flag-o-matic llvm-r1 multiprocessing
-inherit pax-utils python-utils-r1 toolchain-funcs verify-sig
+inherit autotools check-reqs flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
 
 MY_PV=${PV/_}
 MY_P="Python-${MY_PV%_p*}"
 PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
+PATCHSET="python-gentoo-patches-${MY_PV}-r1"
 
 DESCRIPTION="An interpreted, interactive, object-oriented programming language"
 HOMEPAGE="
@@ -76,7 +77,6 @@ DEPEND="
 	${RDEPEND}
 	bluetooth? ( net-wireless/bluez )
 	test? (
-		app-arch/xz-utils
 		dev-python/ensurepip-pip
 		dev-python/ensurepip-setuptools
 		dev-python/ensurepip-wheel
@@ -114,8 +114,15 @@ QA_PKGCONFIG_VERSION=${PYVER}
 # false positives -- functions specific to *BSD
 QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
 
+declare -rA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
 pkg_pretend() {
-	use test && check-reqs_pkg_pretend
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
 
 	if ! use gil || use jit; then
 		ewarn "USE=-gil and USE=jit flags are considered experimental upstream.  Using"
@@ -127,8 +134,18 @@ pkg_pretend() {
 }
 
 pkg_setup() {
-	use jit && llvm-r1_pkg_setup
-	use test && check-reqs_pkg_setup
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
 }
 
 src_unpack() {
@@ -243,13 +260,8 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
-		# failures
-		-x test_concurrent_futures
-		-x test_gdb
-		# flaky: https://github.com/python/cpython/issues/121973
-		-x test_pyrepl
-		# flaky: https://github.com/python/cpython/issues/122136 (bug #936314)
-		-x test_asyncio
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
 	)
 
 	# Arch-specific skips.  See #931888 for a collection of these.
@@ -302,6 +314,14 @@ src_configure() {
 			;;
 	esac
 
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
 	# musl-specific skips
 	use elibc_musl && COMMON_TEST_SKIPS+=(
 		# various musl locale deficiencies
@@ -571,9 +591,6 @@ src_install() {
 	fi
 
 	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
 	if ! use sqlite; then
 		rm -r "${libdir}/"sqlite3 || die
 	fi
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.19_p3.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.19_p3.ebuild
deleted file mode 100644
index afc95ee15c0..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.19_p3.ebuild
+++ /dev/null
@@ -1,432 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-WANT_LIBTOOL="none"
-
-inherit autotools flag-o-matic multiprocessing pax-utils
-inherit prefix python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc ~x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm +ncurses pgo
-	+readline +sqlite +ssl test tk valgrind
-"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-wheels )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? ( >=sys-libs/readline-4.1:= )
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? ( app-arch/xz-utils )
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( sec-keys/openpgp-keys-python )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	rm -r Modules/expat || die
-	rm -r Modules/_ctypes/libffi* || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# https://bugs.gentoo.org/850151
-	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	local jobs=$(makeopts_jobs)
-	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
-	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
-
-	rm Lib/distutils/command/wininst*.exe || die
-
-	eautoreconf
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-	local disable
-	use gdbm      || disable+=" gdbm"
-	use ncurses   || disable+=" _curses _curses_panel"
-	use readline  || disable+=" readline"
-	use sqlite    || disable+=" _sqlite3"
-	use ssl       || export PYTHON_DISABLE_SSL="1"
-	use tk        || disable+=" _tkinter"
-	export PYTHON_DISABLE_MODULES="${disable}"
-
-	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
-		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-ffi
-		--with-system-libmpdec
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with debug assertions)
-		$(use_with valgrind)
-	)
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	if tc-is-cross-compiler ; then
-		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-		# propagated to sysconfig for built extensions
-		#
-		# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-		local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-		local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-		local -x CFLAGS= LDFLAGS=
-		local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-		local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-		# We need to build our own Python on CBUILD first, and feed it in.
-		# bug #847910 and bug #864911.
-		local myeconfargs_cbuild=(
-			"${myeconfargs[@]}"
-
-			--libdir="${cbuild_libdir:2}"
-
-			# Avoid needing to load the right libpython.so.
-			--disable-shared
-
-			# As minimal as possible for the mini CBUILD Python
-			# we build just for cross.
-			--without-lto
-			--disable-optimizations
-		)
-
-		# Point the imminent CHOST build to the Python we just
-		# built for CBUILD.
-		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
-
-		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
-			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-		# Avoid as many dependencies as possible for the cross build.
-		cat >> Makefile <<-EOF || die
-			MODULE_NIS=disabled
-			MODULE__DBM=disabled
-			MODULE__GDBM=disabled
-			MODULE__DBM=disabled
-			MODULE__SQLITE3=disabled
-			MODULE__HASHLIB=disabled
-			MODULE__SSL=disabled
-			MODULE__CURSES=disabled
-			MODULE__CURSES_PANEL=disabled
-			MODULE_READLINE=disabled
-			MODULE__TKINTER=disabled
-			MODULE_PYEXPAT=disabled
-			MODULE_ZLIB=disabled
-		EOF
-
-		# Unfortunately, we do have to build this immediately, and
-		# not in src_compile, because CHOST configure for Python
-		# will check the existence of the Python it was pointed to
-		# immediately.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
-		popd &> /dev/null || die
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	hprefixify setup.py
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	# Prevent using distutils bundled by setuptools.
-	# https://bugs.gentoo.org/823728
-	export SETUPTOOLS_USE_DISTUTILS=stdlib
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	local test_opts=(
-		-u-network
-		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	rm Lib/docutils.py || die
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	emake DESTDIR="${D}" altinstall
-
-	# Remove static library
-	rm "${ED}"/usr/$(get_libdir)/libpython*.a || die
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.19_p4.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.19_p4.ebuild
deleted file mode 100644
index 288c72fdff4..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.19_p4.ebuild
+++ /dev/null
@@ -1,432 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-WANT_LIBTOOL="none"
-
-inherit autotools flag-o-matic multiprocessing pax-utils
-inherit prefix python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm +ncurses pgo
-	+readline +sqlite +ssl test tk valgrind
-"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-wheels )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? ( >=sys-libs/readline-4.1:= )
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? ( app-arch/xz-utils )
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( sec-keys/openpgp-keys-python )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	rm -r Modules/expat || die
-	rm -r Modules/_ctypes/libffi* || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# https://bugs.gentoo.org/850151
-	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	local jobs=$(makeopts_jobs)
-	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
-	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
-
-	rm Lib/distutils/command/wininst*.exe || die
-
-	eautoreconf
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-	local disable
-	use gdbm      || disable+=" gdbm"
-	use ncurses   || disable+=" _curses _curses_panel"
-	use readline  || disable+=" readline"
-	use sqlite    || disable+=" _sqlite3"
-	use ssl       || export PYTHON_DISABLE_SSL="1"
-	use tk        || disable+=" _tkinter"
-	export PYTHON_DISABLE_MODULES="${disable}"
-
-	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
-		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-ffi
-		--with-system-libmpdec
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with debug assertions)
-		$(use_with valgrind)
-	)
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	if tc-is-cross-compiler ; then
-		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-		# propagated to sysconfig for built extensions
-		#
-		# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-		local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-		local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-		local -x CFLAGS= LDFLAGS=
-		local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-		local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-		# We need to build our own Python on CBUILD first, and feed it in.
-		# bug #847910 and bug #864911.
-		local myeconfargs_cbuild=(
-			"${myeconfargs[@]}"
-
-			--libdir="${cbuild_libdir:2}"
-
-			# Avoid needing to load the right libpython.so.
-			--disable-shared
-
-			# As minimal as possible for the mini CBUILD Python
-			# we build just for cross.
-			--without-lto
-			--disable-optimizations
-		)
-
-		# Point the imminent CHOST build to the Python we just
-		# built for CBUILD.
-		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
-
-		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
-			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-		# Avoid as many dependencies as possible for the cross build.
-		cat >> Makefile <<-EOF || die
-			MODULE_NIS=disabled
-			MODULE__DBM=disabled
-			MODULE__GDBM=disabled
-			MODULE__DBM=disabled
-			MODULE__SQLITE3=disabled
-			MODULE__HASHLIB=disabled
-			MODULE__SSL=disabled
-			MODULE__CURSES=disabled
-			MODULE__CURSES_PANEL=disabled
-			MODULE_READLINE=disabled
-			MODULE__TKINTER=disabled
-			MODULE_PYEXPAT=disabled
-			MODULE_ZLIB=disabled
-		EOF
-
-		# Unfortunately, we do have to build this immediately, and
-		# not in src_compile, because CHOST configure for Python
-		# will check the existence of the Python it was pointed to
-		# immediately.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
-		popd &> /dev/null || die
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	hprefixify setup.py
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	# Prevent using distutils bundled by setuptools.
-	# https://bugs.gentoo.org/823728
-	export SETUPTOOLS_USE_DISTUTILS=stdlib
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	local test_opts=(
-		-u-network
-		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	rm Lib/docutils.py || die
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	emake DESTDIR="${D}" altinstall
-
-	# Remove static library
-	rm "${ED}"/usr/$(get_libdir)/libpython*.a || die
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20.ebuild
deleted file mode 100644
index ee794ad3c95..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20.ebuild
+++ /dev/null
@@ -1,432 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-WANT_LIBTOOL="none"
-
-inherit autotools flag-o-matic multiprocessing pax-utils
-inherit prefix python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm +ncurses pgo
-	+readline +sqlite +ssl test tk valgrind
-"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-wheels )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? ( >=sys-libs/readline-4.1:= )
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? ( app-arch/xz-utils )
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( sec-keys/openpgp-keys-python )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	rm -r Modules/expat || die
-	rm -r Modules/_ctypes/libffi* || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# https://bugs.gentoo.org/850151
-	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	local jobs=$(makeopts_jobs)
-	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
-	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
-
-	rm Lib/distutils/command/wininst*.exe || die
-
-	eautoreconf
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-	local disable
-	use gdbm      || disable+=" gdbm"
-	use ncurses   || disable+=" _curses _curses_panel"
-	use readline  || disable+=" readline"
-	use sqlite    || disable+=" _sqlite3"
-	use ssl       || export PYTHON_DISABLE_SSL="1"
-	use tk        || disable+=" _tkinter"
-	export PYTHON_DISABLE_MODULES="${disable}"
-
-	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
-		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-ffi
-		--with-system-libmpdec
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with debug assertions)
-		$(use_with valgrind)
-	)
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	if tc-is-cross-compiler ; then
-		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-		# propagated to sysconfig for built extensions
-		#
-		# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-		local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-		local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-		local -x CFLAGS= LDFLAGS=
-		local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-		local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-		# We need to build our own Python on CBUILD first, and feed it in.
-		# bug #847910 and bug #864911.
-		local myeconfargs_cbuild=(
-			"${myeconfargs[@]}"
-
-			--libdir="${cbuild_libdir:2}"
-
-			# Avoid needing to load the right libpython.so.
-			--disable-shared
-
-			# As minimal as possible for the mini CBUILD Python
-			# we build just for cross.
-			--without-lto
-			--disable-optimizations
-		)
-
-		# Point the imminent CHOST build to the Python we just
-		# built for CBUILD.
-		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
-
-		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
-			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-		# Avoid as many dependencies as possible for the cross build.
-		cat >> Makefile <<-EOF || die
-			MODULE_NIS=disabled
-			MODULE__DBM=disabled
-			MODULE__GDBM=disabled
-			MODULE__DBM=disabled
-			MODULE__SQLITE3=disabled
-			MODULE__HASHLIB=disabled
-			MODULE__SSL=disabled
-			MODULE__CURSES=disabled
-			MODULE__CURSES_PANEL=disabled
-			MODULE_READLINE=disabled
-			MODULE__TKINTER=disabled
-			MODULE_PYEXPAT=disabled
-			MODULE_ZLIB=disabled
-		EOF
-
-		# Unfortunately, we do have to build this immediately, and
-		# not in src_compile, because CHOST configure for Python
-		# will check the existence of the Python it was pointed to
-		# immediately.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
-		popd &> /dev/null || die
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	hprefixify setup.py
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	# Prevent using distutils bundled by setuptools.
-	# https://bugs.gentoo.org/823728
-	export SETUPTOOLS_USE_DISTUTILS=stdlib
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	local test_opts=(
-		-u-network
-		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	rm Lib/docutils.py || die
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	emake DESTDIR="${D}" altinstall
-
-	# Remove static library
-	rm "${ED}"/usr/$(get_libdir)/libpython*.a || die
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.19_p2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20_p2.ebuild
similarity index 89%
rename from sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.19_p2.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20_p2.ebuild
index 36cdf5e7347..3d8191354d8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.19_p2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20_p2.ebuild
@@ -150,6 +150,77 @@ src_configure() {
 		dbmliborder+="${dbmliborder:+:}gdbm"
 	fi
 
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		-x test_gdb
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
 	local myeconfargs=(
 		# glibc-2.30 removes it; since we can't cleanly force-rebuild
 		# Python on glibc upgrade, remove it proactively to give
@@ -284,6 +355,9 @@ src_compile() {
 	# https://bugs.gentoo.org/823728
 	export SETUPTOOLS_USE_DISTUTILS=stdlib
 
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
 	# also need to clear the flags explicitly here or they end up
 	# in _sysconfigdata*
 	emake CPPFLAGS= CFLAGS= LDFLAGS=
@@ -304,27 +378,12 @@ src_test() {
 	fi
 
 	local test_opts=(
+		--verbose3
 		-u-network
 		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
+		"${COMMON_TEST_SKIPS[@]}"
 	)
 
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
 	# bug 660358
 	local -x COLUMNS=80
 	local -x PYTHONDONTWRITEBYTECODE=
@@ -333,8 +392,6 @@ src_test() {
 		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
 	local ret=${?}
 
-	rm Lib/docutils.py || die
-
 	[[ ${ret} -eq 0 ]] || die "emake test failed"
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.19_p4.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.19_p4.ebuild
deleted file mode 100644
index 655f7719d8b..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.19_p4.ebuild
+++ /dev/null
@@ -1,492 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
-inherit prefix python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc ~x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm +ncurses pgo
-	+readline +sqlite +ssl test tk valgrind
-"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-wheels )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? ( >=sys-libs/readline-4.1:= )
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? ( app-arch/xz-utils )
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( sec-keys/openpgp-keys-python )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-}
-
-pkg_setup() {
-	use test && check-reqs_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	rm -r Modules/expat || die
-	rm -r Modules/_ctypes/libffi* || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# https://bugs.gentoo.org/850151
-	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	local jobs=$(makeopts_jobs)
-	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
-	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
-
-	eautoreconf
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-	local disable
-	use gdbm      || disable+=" gdbm"
-	use ncurses   || disable+=" _curses _curses_panel"
-	use readline  || disable+=" readline"
-	use sqlite    || disable+=" _sqlite3"
-	use ssl       || export PYTHON_DISABLE_SSL="1"
-	use tk        || disable+=" _tkinter"
-	export PYTHON_DISABLE_MODULES="${disable}"
-
-	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
-		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			-x test_gdb
-			-x test_dtrace
-			-u-network
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_concurrent_futures
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-ffi
-		--with-system-libmpdec
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with debug assertions)
-		$(use_enable pgo optimizations)
-		$(use_with valgrind)
-	)
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	if tc-is-cross-compiler ; then
-		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-		# propagated to sysconfig for built extensions
-		#
-		# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-		local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-		local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-		local -x CFLAGS= LDFLAGS=
-		local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-		local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-		# We need to build our own Python on CBUILD first, and feed it in.
-		# bug #847910 and bug #864911.
-		local myeconfargs_cbuild=(
-			"${myeconfargs[@]}"
-
-			--libdir="${cbuild_libdir:2}"
-
-			# Avoid needing to load the right libpython.so.
-			--disable-shared
-
-			# As minimal as possible for the mini CBUILD Python
-			# we build just for cross.
-			--without-lto
-			--disable-optimizations
-		)
-
-		# Point the imminent CHOST build to the Python we just
-		# built for CBUILD.
-		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
-
-		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
-			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-		# Avoid as many dependencies as possible for the cross build.
-		cat >> Makefile <<-EOF || die
-			MODULE_NIS=disabled
-			MODULE__DBM=disabled
-			MODULE__GDBM=disabled
-			MODULE__DBM=disabled
-			MODULE__SQLITE3=disabled
-			MODULE__HASHLIB=disabled
-			MODULE__SSL=disabled
-			MODULE__CURSES=disabled
-			MODULE__CURSES_PANEL=disabled
-			MODULE_READLINE=disabled
-			MODULE__TKINTER=disabled
-			MODULE_PYEXPAT=disabled
-			MODULE_ZLIB=disabled
-		EOF
-
-		# Unfortunately, we do have to build this immediately, and
-		# not in src_compile, because CHOST configure for Python
-		# will check the existence of the Python it was pointed to
-		# immediately.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
-		popd &> /dev/null || die
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	hprefixify setup.py
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	# Prevent using distutils bundled by setuptools.
-	# https://bugs.gentoo.org/823728
-	export SETUPTOOLS_USE_DISTUTILS=stdlib
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	local test_opts=(
-		-u-network
-		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	rm Lib/docutils.py || die
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	emake DESTDIR="${D}" altinstall
-
-	# Remove static library
-	rm "${ED}"/usr/$(get_libdir)/libpython*.a || die
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.19_p5.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.19_p5.ebuild
deleted file mode 100644
index 75f1df5001c..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.19_p5.ebuild
+++ /dev/null
@@ -1,492 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
-inherit prefix python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm +ncurses pgo
-	+readline +sqlite +ssl test tk valgrind
-"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-wheels )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? ( >=sys-libs/readline-4.1:= )
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? ( app-arch/xz-utils )
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( sec-keys/openpgp-keys-python )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-}
-
-pkg_setup() {
-	use test && check-reqs_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	rm -r Modules/expat || die
-	rm -r Modules/_ctypes/libffi* || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# https://bugs.gentoo.org/850151
-	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	local jobs=$(makeopts_jobs)
-	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
-	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
-
-	eautoreconf
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-	local disable
-	use gdbm      || disable+=" gdbm"
-	use ncurses   || disable+=" _curses _curses_panel"
-	use readline  || disable+=" readline"
-	use sqlite    || disable+=" _sqlite3"
-	use ssl       || export PYTHON_DISABLE_SSL="1"
-	use tk        || disable+=" _tkinter"
-	export PYTHON_DISABLE_MODULES="${disable}"
-
-	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
-		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			-x test_gdb
-			-x test_dtrace
-			-u-network
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_concurrent_futures
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-ffi
-		--with-system-libmpdec
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with debug assertions)
-		$(use_enable pgo optimizations)
-		$(use_with valgrind)
-	)
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	if tc-is-cross-compiler ; then
-		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-		# propagated to sysconfig for built extensions
-		#
-		# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-		local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-		local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-		local -x CFLAGS= LDFLAGS=
-		local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-		local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-		# We need to build our own Python on CBUILD first, and feed it in.
-		# bug #847910 and bug #864911.
-		local myeconfargs_cbuild=(
-			"${myeconfargs[@]}"
-
-			--libdir="${cbuild_libdir:2}"
-
-			# Avoid needing to load the right libpython.so.
-			--disable-shared
-
-			# As minimal as possible for the mini CBUILD Python
-			# we build just for cross.
-			--without-lto
-			--disable-optimizations
-		)
-
-		# Point the imminent CHOST build to the Python we just
-		# built for CBUILD.
-		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
-
-		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
-			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-		# Avoid as many dependencies as possible for the cross build.
-		cat >> Makefile <<-EOF || die
-			MODULE_NIS=disabled
-			MODULE__DBM=disabled
-			MODULE__GDBM=disabled
-			MODULE__DBM=disabled
-			MODULE__SQLITE3=disabled
-			MODULE__HASHLIB=disabled
-			MODULE__SSL=disabled
-			MODULE__CURSES=disabled
-			MODULE__CURSES_PANEL=disabled
-			MODULE_READLINE=disabled
-			MODULE__TKINTER=disabled
-			MODULE_PYEXPAT=disabled
-			MODULE_ZLIB=disabled
-		EOF
-
-		# Unfortunately, we do have to build this immediately, and
-		# not in src_compile, because CHOST configure for Python
-		# will check the existence of the Python it was pointed to
-		# immediately.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
-		popd &> /dev/null || die
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	hprefixify setup.py
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	# Prevent using distutils bundled by setuptools.
-	# https://bugs.gentoo.org/823728
-	export SETUPTOOLS_USE_DISTUTILS=stdlib
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	local test_opts=(
-		-u-network
-		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	rm Lib/docutils.py || die
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	emake DESTDIR="${D}" altinstall
-
-	# Remove static library
-	rm "${ED}"/usr/$(get_libdir)/libpython*.a || die
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.20.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.20.ebuild
deleted file mode 100644
index 7bc136ed813..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.20.ebuild
+++ /dev/null
@@ -1,492 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
-inherit prefix python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm +ncurses pgo
-	+readline +sqlite +ssl test tk valgrind
-"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-wheels )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? ( >=sys-libs/readline-4.1:= )
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? ( app-arch/xz-utils )
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( sec-keys/openpgp-keys-python )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-}
-
-pkg_setup() {
-	use test && check-reqs_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	rm -r Modules/expat || die
-	rm -r Modules/_ctypes/libffi* || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# https://bugs.gentoo.org/850151
-	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	local jobs=$(makeopts_jobs)
-	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
-	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
-
-	eautoreconf
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-	local disable
-	use gdbm      || disable+=" gdbm"
-	use ncurses   || disable+=" _curses _curses_panel"
-	use readline  || disable+=" readline"
-	use sqlite    || disable+=" _sqlite3"
-	use ssl       || export PYTHON_DISABLE_SSL="1"
-	use tk        || disable+=" _tkinter"
-	export PYTHON_DISABLE_MODULES="${disable}"
-
-	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
-		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			-x test_gdb
-			-x test_dtrace
-			-u-network
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_concurrent_futures
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-ffi
-		--with-system-libmpdec
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with debug assertions)
-		$(use_enable pgo optimizations)
-		$(use_with valgrind)
-	)
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	if tc-is-cross-compiler ; then
-		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-		# propagated to sysconfig for built extensions
-		#
-		# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-		local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-		local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-		local -x CFLAGS= LDFLAGS=
-		local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-		local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-		# We need to build our own Python on CBUILD first, and feed it in.
-		# bug #847910 and bug #864911.
-		local myeconfargs_cbuild=(
-			"${myeconfargs[@]}"
-
-			--libdir="${cbuild_libdir:2}"
-
-			# Avoid needing to load the right libpython.so.
-			--disable-shared
-
-			# As minimal as possible for the mini CBUILD Python
-			# we build just for cross.
-			--without-lto
-			--disable-optimizations
-		)
-
-		# Point the imminent CHOST build to the Python we just
-		# built for CBUILD.
-		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
-
-		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
-			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-		# Avoid as many dependencies as possible for the cross build.
-		cat >> Makefile <<-EOF || die
-			MODULE_NIS=disabled
-			MODULE__DBM=disabled
-			MODULE__GDBM=disabled
-			MODULE__DBM=disabled
-			MODULE__SQLITE3=disabled
-			MODULE__HASHLIB=disabled
-			MODULE__SSL=disabled
-			MODULE__CURSES=disabled
-			MODULE__CURSES_PANEL=disabled
-			MODULE_READLINE=disabled
-			MODULE__TKINTER=disabled
-			MODULE_PYEXPAT=disabled
-			MODULE_ZLIB=disabled
-		EOF
-
-		# Unfortunately, we do have to build this immediately, and
-		# not in src_compile, because CHOST configure for Python
-		# will check the existence of the Python it was pointed to
-		# immediately.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
-		popd &> /dev/null || die
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	hprefixify setup.py
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	# Prevent using distutils bundled by setuptools.
-	# https://bugs.gentoo.org/823728
-	export SETUPTOOLS_USE_DISTUTILS=stdlib
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	local test_opts=(
-		-u-network
-		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	rm Lib/docutils.py || die
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	emake DESTDIR="${D}" altinstall
-
-	# Remove static library
-	rm "${ED}"/usr/$(get_libdir)/libpython*.a || die
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.19_p3.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.20_p1.ebuild
similarity index 86%
rename from sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.19_p3.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.20_p1.ebuild
index a9aa37ab89f..8ef53f8d24d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.19_p3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.20_p1.ebuild
@@ -159,15 +159,92 @@ src_configure() {
 		dbmliborder+="${dbmliborder:+:}gdbm"
 	fi
 
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		-x test_gdb
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
 	if use pgo; then
 		local profile_task_flags=(
 			-m test
 			"-j$(makeopts_jobs)"
 			--pgo-extended
-			-x test_gdb
-			-x test_dtrace
 			-u-network
 
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
 			# All of these seem to occasionally hang for PGO inconsistently
 			# They'll even hang here but be fine in src_test sometimes.
 			# bug #828535 (and related: bug #788022)
@@ -184,6 +261,34 @@ src_configure() {
 			-x test_tools
 		)
 
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
 		if has_version "app-arch/rpm" ; then
 			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
 			profile_task_flags+=(
@@ -333,12 +438,13 @@ src_compile() {
 	# bug #831897
 	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
 
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
 	if use pgo ; then
 		# bug 660358
 		local -x COLUMNS=80
 		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
 	fi
 
 	# also need to clear the flags explicitly here or they end up
@@ -364,27 +470,12 @@ src_test() {
 	fi
 
 	local test_opts=(
+		--verbose3
 		-u-network
 		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_concurrent_futures
-		-x test_gdb
+		"${COMMON_TEST_SKIPS[@]}"
 	)
 
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
 	# bug 660358
 	local -x COLUMNS=80
 	local -x PYTHONDONTWRITEBYTECODE=
@@ -393,8 +484,6 @@ src_test() {
 		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
 	local ret=${?}
 
-	rm Lib/docutils.py || die
-
 	[[ ${ret} -eq 0 ]] || die "emake test failed"
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.81.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.81.0.ebuild
index b6837f265a6..5634139adde 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.81.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.81.0.ebuild
@@ -342,7 +342,6 @@ src_configure() {
 	local tools='"cargo","rustdoc"'
 	use clippy && tools+=',"clippy"'
 	use miri && tools+=',"miri"'
-	use profiler && tools+=',"rust-demangler"'
 	use rustfmt && tools+=',"rustfmt"'
 	use rust-analyzer && tools+=',"rust-analyzer","rust-analyzer-proc-macro-srv"'
 	use rust-src && tools+=',"src"'
@@ -685,7 +684,6 @@ src_install() {
 
 	use clippy && symlinks+=( clippy-driver cargo-clippy )
 	use miri && symlinks+=( miri cargo-miri )
-	use profiler && symlinks+=( rust-demangler )
 	use rustfmt && symlinks+=( rustfmt cargo-fmt )
 	use rust-analyzer && symlinks+=( rust-analyzer )
 
@@ -744,9 +742,6 @@ src_install() {
 		echo /usr/bin/miri >> "${T}/provider-${P}"
 		echo /usr/bin/cargo-miri >> "${T}/provider-${P}"
 	fi
-	if use profiler; then
-		echo /usr/bin/rust-demangler >> "${T}/provider-${P}"
-	fi
 	if use rustfmt; then
 		echo /usr/bin/rustfmt >> "${T}/provider-${P}"
 		echo /usr/bin/cargo-fmt >> "${T}/provider-${P}"
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/swig/swig-4.2.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/swig/swig-4.2.1.ebuild
index 1375557b544..4e11cb8a2fc 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/swig/swig-4.2.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/swig/swig-4.2.1.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://downloads.sourceforge.net/${PN}/${P}.tar.gz"
 
 LICENSE="GPL-3+ BSD BSD-2"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="ccache doc pcre test"
 RESTRICT="!test? ( test )"
 
@@ -27,6 +27,13 @@ BDEPEND="virtual/pkgconfig"
 
 DOCS=( ANNOUNCE CHANGES CHANGES.current README TODO )
 
+src_prepare() {
+	default
+
+	# Delete after 4.2.1 (bug #900769, bug #935318)
+	sed -i -e 's:fpic:fPIC:' configure.ac configure || die
+}
+
 src_configure() {
 	# TODO: add USE for various langs? (https://bugs.gentoo.org/921504#c3)
 	econf \
@@ -36,10 +43,22 @@ src_configure() {
 		$(use_with pcre)
 }
 
+src_compile() {
+	# Override these variables per Makefile.in to get verbose logs
+	emake FLAGS="-k" RUNPIPE=""
+}
+
 src_test() {
 	# The tests won't get run w/o an explicit call, broken Makefiles?
 	# java skipped for bug #921504
-	emake skip-java=true check
+	# *-sections for bug #935318
+	emake check \
+		skip-java=true \
+		FLAGS="-k" \
+		RUNPIPE="" \
+		CFLAGS="${CFLAGS} -ffunction-sections -fdata-sections" \
+		CXXFLAGS="${CXXFLAGS} -ffunction-sections -fdata-sections" \
+		LDFLAGS="${LDFLAGS}"
 }
 
 src_install() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/tcl/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/tcl/Manifest
index 68931da00ce..5a0bdf43e79 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/tcl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/tcl/Manifest
@@ -1,4 +1,3 @@
-DIST tcl-core8.6.11-src.tar.gz 6041050 BLAKE2B 9c41d5ae5d22627b903d18c5ca607d4a2647d7af65d3029a463cf571d3fbe0bd48e15fef643e81de94296777985a36530a83718d4eb7befca4bc107ab860cc0d SHA512 fe3556c37305e3856743e9a202a320d44b1b3cbc926a1b7a4449ae5baf2f8df92214a9aa06f0a87645d032857fb71458fc864ff007fd73da60463ae5001f2d3f
-DIST tcl-core8.6.12-src.tar.gz 6064625 BLAKE2B 30dc780562aa6955e2c417798cc96fabd23e947cee81146dc192156598e3c43f588864aab4392d62901b8964cf59bedb6cad1f064e32b03dd9733b3a0a7b5c8a SHA512 7144a50d19d3855edbda14b538cc94fe26c0dd357b979676c3fe02d599dab61ba777bf14f6aaebb63e238aeff1d0bad25ea7b0ff31b2398468f67fc0a305b9f3
 DIST tcl-core8.6.13-src.tar.gz 6370805 BLAKE2B f5af3c0fa2d52c09ab16578c9147cb5ac4a06b81882c49f1ef23642bed32adccbe2a5acbddc5d18bd1757e1991daf864707d842e675f92c6de70be6f4275b95e SHA512 c1c953ac0f9a530d8256514c0cb78f166d0063db725b87fa19272716a955cd390ff8f1c5f17e791cf463284d88bb136d61194779a913a6a78f46146d485c71ee
 DIST tcl-core8.6.14-src.tar.gz 7081644 BLAKE2B 7148c889954d78774c4352ceae5d814498a1670423a2b3ed288786dce97b87d42395b817ef92fc6561358d84736619ef03d1c2e2c502433c4b3f5eb7c80a62e8 SHA512 495b13af817c68d81533c45345d003efd711ddbc5c1a3d1fbbdb10452fa62d91e649f77835239e547355ade84abfea6ae843d2e76de6108532054170a672ddc0
+DIST tcl-core8.6.15-src.tar.gz 7019390 BLAKE2B e88b974c005e3acd680f672a13b76bd736730f13c4af1c4538390c0d624b1cd752c8305ac2f6d7f7df5d2fbb43b08614b715c7688ea61184d552cd77117d8533 SHA512 9ca62941405ea2bca3099bf65f03a87071f3d88ff23367ab8af80bba7692caca5f63ec4d9c2282b7ba3433124c5f952578a763888e0a9ba9205e52248539e9e7
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/tcl/files/tcl-8.6.12-configure-clang16.patch b/sdk_container/src/third_party/portage-stable/dev-lang/tcl/files/tcl-8.6.12-configure-clang16.patch
deleted file mode 100644
index 8714faccbe1..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/tcl/files/tcl-8.6.12-configure-clang16.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-https://github.com/tcltk/tcl/commit/5eb33c5c7e9d6b703275b680f337691ecfe38f2a
-
-From 5eb33c5c7e9d6b703275b680f337691ecfe38f2a Mon Sep 17 00:00:00 2001
-From: "jan.nijtmans" <nijtmans@users.sourceforge.net>
-Date: Sun, 7 Nov 2021 21:34:08 +0000
-Subject: [PATCH] Fix [15845d9fd8]: unix/tcl.m4: implicit declaration of exit()
- in timezone variable checks
-
---- a/unix/tcl.m4
-+++ b/unix/tcl.m4
-@@ -2349,7 +2349,8 @@ AC_DEFUN([SC_TIME_HANDLER], [
-     # (like convex) have timezone functions, etc.
-     #
-     AC_CACHE_CHECK([long timezone variable], tcl_cv_timezone_long, [
--	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <time.h>]],
-+	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <time.h>
-+#include <stdlib.h>]],
- 	[[extern long timezone;
- 	    timezone += 1;
- 	    exit (0);]])],
-@@ -2361,7 +2362,8 @@ AC_DEFUN([SC_TIME_HANDLER], [
- 	# On some systems (eg IRIX 6.2), timezone is a time_t and not a long.
- 	#
- 	AC_CACHE_CHECK([time_t timezone variable], tcl_cv_timezone_time, [
--	    AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <time.h>]],
-+	    AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <time.h>
-+#include <stdlib.h>]],
- 	    [[extern time_t timezone;
- 		timezone += 1;
- 		exit (0);]])],
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/tcl/tcl-8.6.11.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/tcl/tcl-8.6.11.ebuild
deleted file mode 100644
index 5559e621dea..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/tcl/tcl-8.6.11.ebuild
+++ /dev/null
@@ -1,136 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit autotools flag-o-matic multilib-minimal multilib toolchain-funcs
-
-MY_P="${PN}${PV}"
-
-DESCRIPTION="Tool Command Language"
-HOMEPAGE="http://www.tcl.tk/"
-SRC_URI="https://downloads.sourceforge.net/tcl/${PN}-core${PV}-src.tar.gz"
-
-LICENSE="tcltk"
-SLOT="0/8.6"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="debug +threads"
-
-RDEPEND=">=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}]"
-DEPEND="${RDEPEND}"
-
-SPARENT="${WORKDIR}/${MY_P}"
-S="${SPARENT}"/unix
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-8.6.10-multilib.patch
-	"${FILESDIR}"/${PN}-8.6.8-conf.patch # Bug 125971
-	"${FILESDIR}"/${PN}-8.6.9-include-spec.patch # Bug 731120
-)
-
-src_prepare() {
-	find \
-		"${SPARENT}"/compat/* \
-		"${SPARENT}"/doc/try.n \
-		-delete || die
-
-	pushd "${SPARENT}" &>/dev/null || die
-	default
-	popd &>/dev/null || die
-
-	# httpold tests require netowk
-	rm ../tests/httpold.test \
-		../tests/env.test \
-		../tests/http.test \
-		|| die
-
-	# workaround stack check issues, bug #280934
-	use hppa && append-cflags "-DTCL_NO_STACK_CHECK=1"
-
-	tc-export CC
-
-	sed \
-		-e '/chmod/s:555:755:g' \
-		-i Makefile.in || die
-
-	sed \
-		-e 's:-O[2s]\?::g' \
-		-i tcl.m4 || die
-
-	mv configure.{in,ac} || die
-
-	eautoconf
-
-	multilib_copy_sources
-}
-
-multilib_src_configure() {
-	# We went ahead and deleted the whole compat/ subdir which means
-	# the configure tests to detect broken versions need to pass (else
-	# we'll fail to build).  This comes up when cross-compiling, but
-	# might as well get a minor configure speed up normally.
-	export ac_cv_func_memcmp_working="yes"
-	export tcl_cv_str{str,toul,tod}_unbroken="ok"
-	export tcl_cv_strtod_buggy="no"
-
-	econf \
-		$(use_enable threads) \
-		$(use_enable debug symbols)
-}
-
-multilib_src_install() {
-	#short version number
-	local v1=$(ver_cut 1-2)
-	local mylibdir=$(get_libdir)
-
-	S= default
-	# fix the tclConfig.sh to eliminate refs to the build directory
-	# and drop unnecessary -L inclusion to default system libdir
-
-	sed \
-		-e "/^TCL_BUILD_LIB_SPEC=/s:-L$(pwd) *::g" \
-		-e "/^TCL_LIB_SPEC=/s:-L${EPREFIX}/usr/${mylibdir} *::g" \
-		-e "/^TCL_SRC_DIR=/s:${SPARENT}:${EPREFIX}/usr/${mylibdir}/tcl${v1}/include:g" \
-		-e "/^TCL_BUILD_STUB_LIB_SPEC=/s:-L$(pwd) *::g" \
-		-e "/^TCL_STUB_LIB_SPEC=/s:-L${EPREFIX}/usr/${mylibdir} *::g" \
-		-e "/^TCL_BUILD_STUB_LIB_PATH=/s:$(pwd):${EPREFIX}/usr/${mylibdir}:g" \
-		-e "/^TCL_LIBW_FILE=/s:'libtcl${v1}..TCL_DBGX..so':\"libtcl${v1}\$\{TCL_DBGX\}.so\":g" \
-		-i "${ED}"/usr/${mylibdir}/tclConfig.sh || die
-	if use prefix && [[ ${CHOST} != *-darwin* ]] ; then
-		sed \
-			-e "/^TCL_CC_SEARCH_FLAGS=/s|'$|:${EPREFIX}/usr/${mylibdir}'|g" \
-			-e "/^TCL_LD_SEARCH_FLAGS=/s|'$|:${EPREFIX}/usr/${mylibdir}'|" \
-			-i "${ED}"/usr/${mylibdir}/tclConfig.sh || die
-	fi
-
-	# install private headers
-	insinto /usr/${mylibdir}/tcl${v1}/include/unix
-	doins *.h
-	insinto /usr/${mylibdir}/tcl${v1}/include/generic
-	doins "${SPARENT}"/generic/*.h
-	rm -f "${ED}"/usr/${mylibdir}/tcl${v1}/include/generic/{tcl,tclDecls,tclPlatDecls}.h || die
-
-	# install symlink for libraries
-	dosym libtcl${v1}$(get_libname) /usr/${mylibdir}/libtcl$(get_libname)
-	dosym libtclstub${v1}.a /usr/${mylibdir}/libtclstub.a
-
-	if multilib_is_native_abi; then
-		dosym tclsh${v1} /usr/bin/tclsh
-		dodoc "${SPARENT}"/{ChangeLog*,README.md,changes}
-	fi
-}
-
-pkg_postinst() {
-	for version in ${REPLACING_VERSIONS}; do
-		if ver_test 8.6 -lt ${version}; then
-			echo
-			ewarn "You're upgrading from <${P}, you must recompile the other"
-			ewarn "packages on your system that link with tcl after the upgrade"
-			ewarn "completes. To perform this action, please run revdep-rebuild"
-			ewarn "in package app-portage/gentoolkit."
-			ewarn "If you have dev-lang/tk and dev-tcltk/tclx installed you should"
-			ewarn "upgrade them before this recompilation, too,"
-			echo
-		fi
-	done
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/tcl/tcl-8.6.14.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/tcl/tcl-8.6.14.ebuild
index e86defe78fa..f9854fb642a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/tcl/tcl-8.6.14.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/tcl/tcl-8.6.14.ebuild
@@ -15,7 +15,7 @@ SRC_URI="https://downloads.sourceforge.net/tcl/${PN}-core${PV}-src.tar.gz"
 
 LICENSE="tcltk Spencer-99"
 SLOT="0/8.6"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="debug +threads"
 
 RDEPEND=">=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}]"
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/tcl/tcl-8.6.12-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/tcl/tcl-8.6.15.ebuild
similarity index 86%
rename from sdk_container/src/third_party/portage-stable/dev-lang/tcl/tcl-8.6.12-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/tcl/tcl-8.6.15.ebuild
index 2e250c4ff06..304efcfe01f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/tcl/tcl-8.6.12-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/tcl/tcl-8.6.15.ebuild
@@ -1,7 +1,7 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 # Please bump with dev-lang/tk!
 
@@ -13,30 +13,41 @@ DESCRIPTION="Tool Command Language"
 HOMEPAGE="http://www.tcl.tk/"
 SRC_URI="https://downloads.sourceforge.net/tcl/${PN}-core${PV}-src.tar.gz"
 
-LICENSE="tcltk"
+SPARENT="${WORKDIR}/${MY_P}"
+S="${SPARENT}"/unix
+
+LICENSE="tcltk Spencer-99"
 SLOT="0/8.6"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="debug +threads"
 
 RDEPEND=">=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}]"
 DEPEND="${RDEPEND}"
 
-SPARENT="${WORKDIR}/${MY_P}"
-S="${SPARENT}"/unix
-
 PATCHES=(
 	"${FILESDIR}"/${PN}-8.6.10-multilib.patch
 	"${FILESDIR}"/${PN}-8.6.8-conf.patch # Bug 125971
 	"${FILESDIR}"/${PN}-8.6.9-include-spec.patch # Bug 731120
-	"${FILESDIR}"/${P}-configure-clang16.patch
+)
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+	stat64 opendir64 rewinddir64 closedir64 # used to test for Large File Support
 )
 
 src_prepare() {
+	# By dropping the compat directory a lot of licensing and attribution burden
+	# (BSD-3, zlib,...) is lifted from the user
 	find \
 		"${SPARENT}"/compat/* \
 		"${SPARENT}"/doc/try.n \
 		-delete || die
 
+	# Drop -Werror
+	sed -i \
+		-e "s: -Werror::g" \
+		dltest/Makefile.in \
+		|| die
+
 	pushd "${SPARENT}" &>/dev/null || die
 	default
 	popd &>/dev/null || die
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.6.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.6.3.ebuild
index f3d1a9a1a4d..1ed4e7d7dbe 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.6.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.6.3.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/libexpat/libexpat/releases/download/R_${PV//\./_}/ex
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="examples static-libs test unicode"
 RESTRICT="!test? ( test )"
 BDEPEND="unicode? ( ${AUTOTOOLS_DEPEND} )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/jansson/jansson-2.14-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/jansson/jansson-2.14-r2.ebuild
index 65f1087aad2..d8bb80467aa 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/jansson/jansson-2.14-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/jansson/jansson-2.14-r2.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/akheron/jansson/releases/download/v${PV}/${P}.tar.bz
 
 LICENSE="MIT"
 SLOT="0/4"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-macos"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-macos"
 IUSE="doc static-libs"
 
 BDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/json-c/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/json-c/Manifest
index 31bdc97c185..9d148cfa4f3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/json-c/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/json-c/Manifest
@@ -1 +1,2 @@
 DIST json-c-0.17.tar.gz 390045 BLAKE2B 26be25141447f2b652fa09d7096141a8bf7992469bcc53b275c1bc0108fc36a8898a8185c381218d3146d00fa03bdd0b837be073410fc93af943b5f083dbaa69 SHA512 4cbedd559502bf9014cfcd1d0bb8bb80d2abac4e969d95d4170123cd9cbafb0756b913fdbb83f666d14f674d6539a60ed1c5d0eb03c36b8037a2e00dc1636e19
+DIST json-c-0.18.tar.gz 401788 BLAKE2B d39bab289976cb2f76bcf3ad8254f7f5b4d11e2aa4dedebd60dc7d131a3f6ec57beacdc575aeeb191cf449d16c549d424172e78464731eeb66305f47f72371c2 SHA512 4763f2352414dac3599bc2183b4fa57dbfaac0ca24de890097bd7d0bdda93c91efa280f6566e949e6d94212ef39a63fc76c5f9d0c54ff3d04b13c859717dba5a
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/json-c/json-c-0.18.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/json-c/json-c-0.18.ebuild
new file mode 100644
index 00000000000..582ba35e41c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/json-c/json-c-0.18.ebuild
@@ -0,0 +1,68 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit cmake-multilib
+
+DESCRIPTION="A JSON implementation in C"
+HOMEPAGE="https://github.com/json-c/json-c/wiki"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/json-c/json-c.git"
+	inherit git-r3
+else
+	SRC_URI="https://s3.amazonaws.com/json-c_releases/releases/${P}.tar.gz"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos"
+fi
+
+LICENSE="MIT"
+# .1 is a fudge factor for 0.18 fixing compat w/ 0.16, drop on next
+# SONAME change.
+SLOT="0/5.1"
+IUSE="cpu_flags_x86_rdrand doc static-libs threads"
+
+BDEPEND="doc? ( >=app-text/doxygen-1.8.13 )"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/json-c/config.h
+)
+
+multilib_src_configure() {
+	# Tests use Valgrind automagically otherwise (bug #927027)
+	export USE_VALGRIND=0
+
+	local mycmakeargs=(
+		# apps are not installed, so disable unconditionally.
+		# https://github.com/json-c/json-c/blob/json-c-0.17-20230812/apps/CMakeLists.txt#L119...L121
+		-DBUILD_APPS=OFF
+		-DBUILD_STATIC_LIBS=$(usex static-libs)
+		-DDISABLE_EXTRA_LIBS=ON
+		-DDISABLE_WERROR=ON
+		-DENABLE_RDRAND=$(usex cpu_flags_x86_rdrand)
+		-DENABLE_THREADING=$(usex threads)
+	)
+
+	cmake_src_configure
+}
+
+multilib_src_compile() {
+	cmake_src_compile
+	if use doc && multilib_is_native_abi; then
+		cmake_build doc
+	fi
+}
+
+multilib_src_test() {
+	multilib_is_native_abi && cmake_src_test
+}
+
+multilib_src_install() {
+	cmake_src_install
+
+	if multilib_is_native_abi; then
+		use doc && HTML_DOCS=( "${BUILD_DIR}"/doc/html/. )
+		einstalldocs
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/json-c/json-c-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/json-c/json-c-9999.ebuild
index 2ee46fcafda..582ba35e41c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/json-c/json-c-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/json-c/json-c-9999.ebuild
@@ -3,14 +3,24 @@
 
 EAPI=8
 
-inherit cmake-multilib git-r3 multibuild
+inherit cmake-multilib
 
 DESCRIPTION="A JSON implementation in C"
 HOMEPAGE="https://github.com/json-c/json-c/wiki"
-EGIT_REPO_URI="https://github.com/json-c/json-c.git"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/json-c/json-c.git"
+	inherit git-r3
+else
+	SRC_URI="https://s3.amazonaws.com/json-c_releases/releases/${P}.tar.gz"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos"
+fi
 
 LICENSE="MIT"
-SLOT="0/5"
+# .1 is a fudge factor for 0.18 fixing compat w/ 0.16, drop on next
+# SONAME change.
+SLOT="0/5.1"
 IUSE="cpu_flags_x86_rdrand doc static-libs threads"
 
 BDEPEND="doc? ( >=app-text/doxygen-1.8.13 )"
@@ -49,6 +59,8 @@ multilib_src_test() {
 }
 
 multilib_src_install() {
+	cmake_src_install
+
 	if multilib_is_native_abi; then
 		use doc && HTML_DOCS=( "${BUILD_DIR}"/doc/html/. )
 		einstalldocs
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/jsoncpp/files/jsoncpp-1.9.6-cmake.patch b/sdk_container/src/third_party/portage-stable/dev-libs/jsoncpp/files/jsoncpp-1.9.6-cmake.patch
new file mode 100644
index 00000000000..9e24533ae9f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/jsoncpp/files/jsoncpp-1.9.6-cmake.patch
@@ -0,0 +1,21 @@
+From 8d9109992e34cdacd3f2750ada5c2460d346898f Mon Sep 17 00:00:00 2001
+From: Rui Chen <rui@chenrui.dev>
+Date: Thu, 19 Sep 2024 15:10:21 -0400
+Subject: [PATCH] fix(build): remove `check_required_components` for meson
+ build
+
+Signed-off-by: Rui Chen <rui@chenrui.dev>
+---
+ jsoncppConfig.cmake.meson.in | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/jsoncppConfig.cmake.meson.in b/jsoncppConfig.cmake.meson.in
+index 0f4866d6d..be8852d0c 100644
+--- a/jsoncppConfig.cmake.meson.in
++++ b/jsoncppConfig.cmake.meson.in
+@@ -4,5 +4,3 @@
+ @MESON_STATIC_TARGET@
+ 
+ include ( "${CMAKE_CURRENT_LIST_DIR}/jsoncpp-namespaced-targets.cmake" )
+-
+-check_required_components(JsonCpp)
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/jsoncpp/jsoncpp-1.9.6-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/jsoncpp/jsoncpp-1.9.6-r1.ebuild
new file mode 100644
index 00000000000..6f29211cc90
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/jsoncpp/jsoncpp-1.9.6-r1.ebuild
@@ -0,0 +1,56 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..13} )
+
+inherit meson-multilib python-any-r1
+
+DESCRIPTION="C++ JSON reader and writer"
+HOMEPAGE="https://github.com/open-source-parsers/jsoncpp/"
+SRC_URI="
+	https://github.com/open-source-parsers/${PN}/archive/${PV}.tar.gz
+		-> ${P}.tar.gz
+"
+
+LICENSE="|| ( public-domain MIT )"
+SLOT="0/26"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="doc test"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	${PYTHON_DEPS}
+	doc? ( app-text/doxygen )
+"
+
+PATCHES=(
+	# https://github.com/open-source-parsers/jsoncpp/pull/1570
+	"${FILESDIR}/${P}-cmake.patch"
+)
+
+multilib_src_configure() {
+	local emesonargs=(
+		# Follow Debian, Ubuntu, Arch convention for headers location
+		# bug #452234
+		--includedir include/jsoncpp
+		-Dtests=$(usex test true false)
+	)
+	meson_src_configure
+}
+
+src_compile() {
+	meson-multilib_src_compile
+
+	if use doc; then
+		echo "${PV}" > version || die
+		"${EPYTHON}" doxybuild.py --doxygen="${EPREFIX}"/usr/bin/doxygen || die
+		HTML_DOCS=( dist/doxygen/jsoncpp*/. )
+	fi
+}
+
+multilib_src_test() {
+	# increase test timeout due to failures on slower hardware
+	meson_src_test -t 2
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/jsoncpp/jsoncpp-1.9.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/jsoncpp/jsoncpp-1.9.6.ebuild
index dbb44061aa5..92c06cb15f0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/jsoncpp/jsoncpp-1.9.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/jsoncpp/jsoncpp-1.9.6.ebuild
@@ -16,7 +16,7 @@ SRC_URI="
 
 LICENSE="|| ( public-domain MIT )"
 SLOT="0/26"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="doc test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libassuan/libassuan-3.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libassuan/libassuan-3.0.0.ebuild
index b72b5c50a91..4cf73882467 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libassuan/libassuan-3.0.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libassuan/libassuan-3.0.0.ebuild
@@ -19,7 +19,7 @@ SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
 
 LICENSE="GPL-3 LGPL-2.1"
 SLOT="0/$(ver_cut 1-2)"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 # Note: On each bump, update dep bounds on each version from configure.ac!
 RDEPEND=">=dev-libs/libgpg-error-1.33"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libbytesize/libbytesize-2.11.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libbytesize/libbytesize-2.11.ebuild
index 87fa8741c50..542e5d4113d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libbytesize/libbytesize-2.11.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libbytesize/libbytesize-2.11.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 
 inherit autotools python-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libdnet/libdnet-1.18.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libdnet/libdnet-1.18.0-r1.ebuild
index cc426cbea29..bc1c711434b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libdnet/libdnet-1.18.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libdnet/libdnet-1.18.0-r1.ebuild
@@ -17,7 +17,7 @@ S="${WORKDIR}/${PN}-${P}"
 
 LICENSE="LGPL-2"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~mips ppc ppc64 ~riscv sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~mips ppc ppc64 ~riscv sparc x86"
 IUSE="python test"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libgpg-error/libgpg-error-1.50.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libgpg-error/libgpg-error-1.50.ebuild
index b44ca9cacae..a3acc0ec5fd 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libgpg-error/libgpg-error-1.50.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libgpg-error/libgpg-error-1.50.ebuild
@@ -19,7 +19,7 @@ SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
 
 LICENSE="GPL-2 LGPL-2.1"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="common-lisp nls static-libs test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libltdl/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libltdl/Manifest
index d6ef406bec4..ca7d3789110 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libltdl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libltdl/Manifest
@@ -1,4 +1,2 @@
 DIST libtool-2.4.7.tar.xz 1016040 BLAKE2B 5e022586337637dd634bd40578ad944bec6e3b8de41f95d55777b90cc88cbc4badb3d76cbf0e638166ece1ea7de828e83590e1e6bac30c1e4b1c254a11a742f2 SHA512 47f4c6de40927254ff9ba452612c0702aea6f4edc7e797f0966c8c6bf0340d533598976cdba17f0bdc64545572e71cd319bbb587aa5f47cd2e7c1d96f873a3da
-DIST libtool-2.5.0.tar.xz 1032148 BLAKE2B a166423dae1000eb0a8d17f3872ed55b3338444ac61f51752f43a5886bc22fd233e060c7f4c8c7fa093bf50e589f03b755c628199534ef7b8a41935e1bf9d887 SHA512 7b426fe9550a7899de93c372d2c355867be02f7bb39f2b1de06ff30cb34c81bf89759c835bdb23081cef60bfeb39b786ed90bac43e7300956fd8ee1f7dc0a609
-DIST libtool-2.5.1.tar.xz 1043544 BLAKE2B ae1e45c9d56a94980549476ed5abb7d617491360ff23ce88da9e884630280004152a9f5a96267be710930f14917bf7b00ab212acd4c65ceba1e201d2f01809e0 SHA512 ac0a6a8570ff81099585f6c3bf5a8f94851457a068b808e505422276a22638b1912a81f94e185bc2f8661b7abe2f2b2482b1af2cf42307787cbbd71d1b1612da
-DIST libtool-2.5.2.tar.xz 1046372 BLAKE2B 12e3d1f948f64031519ad5619573593b2518ec63cb8e3d69487a4b6104f5ee385c2123d3163c036fe10ca7214ba7558b6bd7fb56d22f1e249945a50091e18862 SHA512 cd6eb8ea470dd5bbfdfcfb06f31b36c84962f09c7155ca8175bc340b0a0289ca85dc9ea6e49c02e6876630913031739ef71dae231bc76c44f0c24e1be09d8cee
+DIST libtool-2.5.3.tar.xz 1050076 BLAKE2B e7bc3421d2273851f894583b879c897239bddaef00dc335176f00ce971d3c77e4d4304ae3b1d1b97d4b6b1b4fd9859ddc0eb5dcadac2e0de959b68cae973f726 SHA512 7a2b86716b2cbefcd45bda7f65af81fcb0aaa3dce96b09f417d6b94721a4dd9e72a9552862783d998ddf785e509315bb49f65c464dbc949d58e36f0960cf9b1b
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libltdl/libltdl-2.5.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libltdl/libltdl-2.5.0.ebuild
deleted file mode 100644
index c17b19fe13c..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libltdl/libltdl-2.5.0.ebuild
+++ /dev/null
@@ -1,48 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Please bump with dev-build/libtool.
-
-inherit multilib-minimal flag-o-matic
-
-MY_P="libtool-${PV}"
-
-DESCRIPTION="A shared library tool for developers"
-HOMEPAGE="https://www.gnu.org/software/libtool/"
-if ! [[ $(( $(ver_cut 2) % 2 )) -eq 0 ]] ; then
-	SRC_URI="https://alpha.gnu.org/gnu/libtool/${MY_P}.tar.xz"
-else
-	SRC_URI="mirror://gnu/libtool/${MY_P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-S="${WORKDIR}"/${MY_P}/libltdl
-
-LICENSE="GPL-2"
-SLOT="0"
-IUSE="static-libs"
-# libltdl doesn't have a testsuite.  Don't bother trying.
-RESTRICT="test"
-
-BDEPEND="app-arch/xz-utils"
-
-multilib_src_configure() {
-	# bug #907427
-	filter-lto
-
-	append-lfs-flags
-	ECONF_SOURCE="${S}" \
-	econf \
-		--enable-ltdl-install \
-		$(use_enable static-libs static)
-}
-
-multilib_src_install() {
-	emake DESTDIR="${D}" install
-
-	# While the libltdl.la file is not used directly, the m4 ltdl logic
-	# keys off of its existence when searching for ltdl support. # bug #293921
-	#use static-libs || find "${D}" -name libltdl.la -delete
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libltdl/libltdl-2.5.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libltdl/libltdl-2.5.2.ebuild
deleted file mode 100644
index c17b19fe13c..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libltdl/libltdl-2.5.2.ebuild
+++ /dev/null
@@ -1,48 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Please bump with dev-build/libtool.
-
-inherit multilib-minimal flag-o-matic
-
-MY_P="libtool-${PV}"
-
-DESCRIPTION="A shared library tool for developers"
-HOMEPAGE="https://www.gnu.org/software/libtool/"
-if ! [[ $(( $(ver_cut 2) % 2 )) -eq 0 ]] ; then
-	SRC_URI="https://alpha.gnu.org/gnu/libtool/${MY_P}.tar.xz"
-else
-	SRC_URI="mirror://gnu/libtool/${MY_P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-S="${WORKDIR}"/${MY_P}/libltdl
-
-LICENSE="GPL-2"
-SLOT="0"
-IUSE="static-libs"
-# libltdl doesn't have a testsuite.  Don't bother trying.
-RESTRICT="test"
-
-BDEPEND="app-arch/xz-utils"
-
-multilib_src_configure() {
-	# bug #907427
-	filter-lto
-
-	append-lfs-flags
-	ECONF_SOURCE="${S}" \
-	econf \
-		--enable-ltdl-install \
-		$(use_enable static-libs static)
-}
-
-multilib_src_install() {
-	emake DESTDIR="${D}" install
-
-	# While the libltdl.la file is not used directly, the m4 ltdl logic
-	# keys off of its existence when searching for ltdl support. # bug #293921
-	#use static-libs || find "${D}" -name libltdl.la -delete
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libltdl/libltdl-2.5.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libltdl/libltdl-2.5.3.ebuild
similarity index 95%
rename from sdk_container/src/third_party/portage-stable/dev-libs/libltdl/libltdl-2.5.1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-libs/libltdl/libltdl-2.5.3.ebuild
index c17b19fe13c..b367c10d5e4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libltdl/libltdl-2.5.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libltdl/libltdl-2.5.3.ebuild
@@ -11,7 +11,7 @@ MY_P="libtool-${PV}"
 
 DESCRIPTION="A shared library tool for developers"
 HOMEPAGE="https://www.gnu.org/software/libtool/"
-if ! [[ $(( $(ver_cut 2) % 2 )) -eq 0 ]] ; then
+if false && ! [[ $(( $(ver_cut 2) % 2 )) -eq 0 ]] ; then
 	SRC_URI="https://alpha.gnu.org/gnu/libtool/${MY_P}.tar.xz"
 else
 	SRC_URI="mirror://gnu/libtool/${MY_P}.tar.xz"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/Manifest
index 8bde9da8b8e..2a74fd84ee6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/Manifest
@@ -1,2 +1,2 @@
 DIST libmspack-0.10.1alpha.tar.gz 963274 BLAKE2B 39bcb3b7ea419d6d00850b70c217c802a2095dd4398038e594ae7c01ca12e71508218c1cfca5ae8b102636ab9517b13d55c1e411b31e87d28aa46331cd0127e6 SHA512 a7b5f7caa49190c5021f3e768b92f2e51cc0ce685c9ab6ed6fb36de885c73231b58d47a8a3b5c5aa5c9ac56c25c500eb683d84dbf11f09f97f6cb4fff5adc245
-DIST libmspack-0.11alpha.tar.gz 509478 BLAKE2B 7e386ab5ae160000bab9e5523f2ebf3907a5cb564fb7cc8945ca15daf5c8ff2563f6680383c52f6de95d1aa992d6616e2f80133740c8329390a8e5c76ba84301 SHA512 40c487e5b4e2f63a6cada26d29db51f605e8c29525a1cb088566d02cf2b1cc9dba263f80e2101d7f8e9d69cf7684a15bcaf791fb4891ad013a56afc7256dfa62
+DIST libmspack-1.11.tar.gz 408982 BLAKE2B fd0c197cf222effa79366e7a763765c7a7eabf7a71319d0544a525b8062ea0ad64291351b2a285c5f3b6d7059a54fd60f20f75b019040d138ae8204fb426397e SHA512 f53a253375584d815ba9249bf36b5f08906c37d7ac7fc9e44040ec5600380f830b2e6774e4493d6fa8024409ae9cf8afe782da52fc8f670debe3aaa4ae6b7306
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/libmspack-0.10.1_alpha-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/libmspack-0.10.1_alpha-r1.ebuild
index d65d111ee2e..c18e9719869 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/libmspack-0.10.1_alpha-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/libmspack-0.10.1_alpha-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -19,12 +19,12 @@ fi
 DESCRIPTION="A library for Microsoft compression formats"
 HOMEPAGE="https://www.cabextract.org.uk/libmspack/"
 
+S="${WORKDIR}/${MY_P}"
+
 LICENSE="LGPL-2.1"
 SLOT="0"
 IUSE="debug doc"
 
-S="${WORKDIR}/${MY_P}"
-
 src_prepare() {
 	if [[ ${PV} == *9999 ]] ; then
 		# Re-create file layout from release tarball
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/libmspack-0.11_alpha.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/libmspack-1.11.ebuild
similarity index 67%
rename from sdk_container/src/third_party/portage-stable/dev-libs/libmspack/libmspack-0.11_alpha.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-libs/libmspack/libmspack-1.11.ebuild
index bb3b310af2e..06410b74183 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/libmspack-0.11_alpha.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/libmspack-1.11.ebuild
@@ -8,35 +8,21 @@ inherit autotools
 if [[ ${PV} == *9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/kyz/libmspack.git"
 	inherit git-r3
-	MY_P="${PN}-9999"
 else
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
-	MY_PV="${PV/_alpha/alpha}"
-	MY_P="${PN}-${MY_PV}"
-	SRC_URI="https://www.cabextract.org.uk/libmspack/libmspack-${MY_PV}.tar.gz"
+	SRC_URI="https://github.com/kyz/${PN}/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
 fi
 
 DESCRIPTION="A library for Microsoft compression formats"
 HOMEPAGE="https://www.cabextract.org.uk/libmspack/"
 
+S="${WORKDIR}/${P}/${PN}"
+
 LICENSE="LGPL-2.1"
 SLOT="0"
 IUSE="debug doc"
 
-S="${WORKDIR}/${MY_P}"
-
 src_prepare() {
-	if [[ ${PV} == *9999 ]] ; then
-		# Re-create file layout from release tarball
-		pushd "${WORKDIR}" > /dev/null || die
-
-		cp -aL "${S}"/${PN} "${WORKDIR}"/${PN}-source || die
-		rm -r "${S}" || die
-		mv "${WORKDIR}"/${PN}-source "${S}" || die
-
-		popd > /dev/null || die
-	fi
-
 	default
 
 	eautoreconf
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/libmspack-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/libmspack-9999.ebuild
index 86307877dbb..06410b74183 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/libmspack-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/libmspack-9999.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -8,35 +8,21 @@ inherit autotools
 if [[ ${PV} == *9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/kyz/libmspack.git"
 	inherit git-r3
-	MY_P="${PN}-9999"
 else
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
-	MY_PV="${PV/_alpha/alpha}"
-	MY_P="${PN}-${MY_PV}"
-	SRC_URI="https://www.cabextract.org.uk/libmspack/libmspack-${MY_PV}.tar.gz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+	SRC_URI="https://github.com/kyz/${PN}/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
 fi
 
 DESCRIPTION="A library for Microsoft compression formats"
 HOMEPAGE="https://www.cabextract.org.uk/libmspack/"
 
+S="${WORKDIR}/${P}/${PN}"
+
 LICENSE="LGPL-2.1"
 SLOT="0"
 IUSE="debug doc"
 
-S="${WORKDIR}/${MY_P}"
-
 src_prepare() {
-	if [[ ${PV} == *9999 ]] ; then
-		# Re-create file layout from release tarball
-		pushd "${WORKDIR}" > /dev/null || die
-
-		cp -aL "${S}"/${PN} "${WORKDIR}"/${PN}-source || die
-		rm -r "${S}" || die
-		mv "${WORKDIR}"/${PN}-source "${S}" || die
-
-		popd > /dev/null || die
-	fi
-
 	default
 
 	eautoreconf
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/Manifest
index b5d2df84aae..607685adfd2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/Manifest
@@ -1,4 +1,3 @@
 DIST libnl-3.10.0.tar.gz 1116186 BLAKE2B 13383c4ef49be3bcf89122b24d1d5dc9834353aa7128f04f50993203add14aa7f97a4500164982ddcb82f481f7324a26efc2375036d5a23bfa62b15c4fe07473 SHA512 c95e79fba69308c63a08d0c576503b4398710ea9cd1d0097851500a7fbc5fbe87fb32ac281cf42bbfe57eab07b110055e6bc9b95d82244bba3df8a31fe562962
-DIST libnl-3.7.0.tar.gz 1000913 BLAKE2B 22c418ea520416d79ee4552ab6bc5ba99239b29e074c840d31b0ec4171a0403ea9d2c1afcbf1b3428564dd371cadd99bc062ae7540e7496f970c4fb98f967e84 SHA512 80fbbc079299c90afd2a5eda62e4d4f98bf4ef23958c3ce5101f4ed4d81d783af733213bb3bab15f218555d8460bc2394898f909f4ac024fc27281faec86a041
 DIST libnl-3.8.0.tar.gz 1071113 BLAKE2B ff90d52e9b617ad8a53e4d42f43bee065b331ed919a3effc4a0f38c8e15b46f86c1eb153816499ed77dd99063500b1dc52951891034475a5bb81da1ad8004594 SHA512 a8da7e8464c5cab2807cd86f83fca53bc77f7c3bdefe43880db7be9caf5ba6bfca1b7e778b906c12fda1cf7e6f413f88cc7ad1dcc42fe8c050a8d28a6e656c02
 DIST libnl-3.9.0.tar.gz 1074117 BLAKE2B 56a39aad9aa15992ff02fe35732abbc5ed5d107b814587e02b914631489877899989d49c7aeee1ecb461ad5f525c7cd7c045c9770864d83b0a58490293441193 SHA512 b6f3633d1920e61645c97f4c4c4419444e7fd66aa3b67b0a73bc29df24cf27065542a62a9c2581f90d0c153247922ce5c649b7da51c0fead6afceaf4d0361dce
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.10.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.10.0.ebuild
index b828b0d10a1..466c1b29883 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.10.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.10.0.ebuild
@@ -22,7 +22,7 @@ if [[ ${PV} == 9999 ]] ; then
 	inherit git-r3
 else
 	SRC_URI="https://github.com/thom311/${PN}/releases/download/${PN}${LIBNL_DIR}/${P/_rc/-rc}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+	KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
 
 	S="${WORKDIR}/${LIBNL_P}"
 fi
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.7.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.7.0.ebuild
deleted file mode 100644
index dd9df5c922c..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.7.0.ebuild
+++ /dev/null
@@ -1,115 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_OPTIONAL=1
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{9..11} )
-inherit autotools distutils-r1 multilib-minimal
-
-LIBNL_P=${P/_/-}
-LIBNL_DIR=${PV/_/}
-LIBNL_DIR=${LIBNL_DIR//./_}
-
-DESCRIPTION="Libraries providing APIs to netlink protocol based Linux kernel interfaces"
-HOMEPAGE="https://www.infradead.org/~tgr/libnl/ https://github.com/thom311/libnl"
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://github.com/thom311/libnl"
-	inherit git-r3
-else
-	SRC_URI="https://github.com/thom311/${PN}/releases/download/${PN}${LIBNL_DIR}/${P/_rc/-rc}.tar.gz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
-
-	S="${WORKDIR}/${LIBNL_P}"
-fi
-
-LICENSE="LGPL-2.1 utils? ( GPL-2 )"
-SLOT="3"
-IUSE="+debug python test utils"
-# Tests fail w/ sandboxes
-# https://github.com/thom311/libnl/issues/361
-RESTRICT="!test? ( test ) test"
-
-RDEPEND="python? ( ${PYTHON_DEPS} )"
-DEPEND="${RDEPEND}"
-BDEPEND="${RDEPEND}
-	sys-devel/bison
-	sys-devel/flex
-	python? (
-		${DISTUTILS_DEPS}
-		dev-lang/swig
-	)
-	test? ( dev-libs/check )"
-REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
-
-MULTILIB_WRAPPED_HEADERS=(
-	# we do not install CLI stuff for non-native
-	/usr/include/libnl3/netlink/cli/addr.h
-	/usr/include/libnl3/netlink/cli/class.h
-	/usr/include/libnl3/netlink/cli/cls.h
-	/usr/include/libnl3/netlink/cli/ct.h
-	/usr/include/libnl3/netlink/cli/exp.h
-	/usr/include/libnl3/netlink/cli/link.h
-	/usr/include/libnl3/netlink/cli/mdb.h
-	/usr/include/libnl3/netlink/cli/neigh.h
-	/usr/include/libnl3/netlink/cli/qdisc.h
-	/usr/include/libnl3/netlink/cli/route.h
-	/usr/include/libnl3/netlink/cli/rule.h
-	/usr/include/libnl3/netlink/cli/tc.h
-	/usr/include/libnl3/netlink/cli/utils.h
-)
-
-src_prepare() {
-	default
-
-	eautoreconf
-
-	if use python; then
-		pushd "${S}"/python > /dev/null || die
-		distutils-r1_src_prepare
-		popd > /dev/null || die
-	fi
-}
-
-multilib_src_configure() {
-	# bug #884277
-	export YACC=yacc.bison
-
-	ECONF_SOURCE="${S}" econf \
-		$(multilib_native_use_enable utils cli) \
-		$(use_enable debug)
-}
-
-multilib_src_compile() {
-	default
-
-	if multilib_is_native_abi && use python ; then
-		pushd python > /dev/null || die
-		distutils-r1_src_compile
-		popd > /dev/null || die
-	fi
-}
-
-multilib_src_install() {
-	default
-
-	if multilib_is_native_abi && use python ; then
-		# Unset DOCS= since distutils-r1.eclass interferes
-		local DOCS=()
-
-		pushd python > /dev/null || die
-
-		distutils-r1_src_install
-
-		popd > /dev/null || die
-	fi
-}
-
-multilib_src_install_all() {
-	DOCS=( ChangeLog )
-
-	einstalldocs
-
-	find "${ED}" -name '*.la' -delete || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libpipeline/libpipeline-1.5.8.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libpipeline/libpipeline-1.5.8.ebuild
index 3461f867625..47b85a54c22 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libpipeline/libpipeline-1.5.8.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libpipeline/libpipeline-1.5.8.ebuild
@@ -9,7 +9,7 @@ SRC_URI="mirror://nongnu/${PN}/${P}.tar.gz"
 
 LICENSE="GPL-3"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libuv/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libuv/Manifest
index 1c5d46d282d..db4f3f532f5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libuv/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libuv/Manifest
@@ -1,2 +1,4 @@
 DIST libuv-1.48.0.tar.gz 1314877 BLAKE2B 7595797ab732109516ce280fa2efa3474e82e78890087408c7f5b1457ce8f44e53878581bb8d473795e298d7390dd8a269dd2e8970e10b50a2c0bbe1cce187cc SHA512 7ae3a4c02f654a26056db1541e52ccc4c54aaea39c33585f0cf6949af997d0a0a29f30a294c8df6e92f6f6af7ce64c2766b1a2cc67f342e3e139cd55b7326c94
 DIST libuv-1.48.0.tar.gz.sig 833 BLAKE2B f0982f7723fa81afe3fe668fc4497fb182a6093f38b185aba4f7359a3248062e7953acaba3f7fd739c9ff5b590664e4b7b81ee138442ffccd46c989c0a10345b SHA512 3a6441bb250badb7bb54a102dd7a1cf47ee4e0ed93ff0369c5b6a4b1e5440e613d85530f19c9ebdc586a97dfe1e06af09e2f90c13448e875dbaee1c703efa955
+DIST libuv-1.49.0.tar.gz 1331420 BLAKE2B f939df07e7e120cdb5c489a6146b220d9d85aa511342c1d2c143b6754eeeea8435e9410891bd281c6ddccdcb5921239cac0950e5fb7c0dc7f258ed7fdc096187 SHA512 36da82ff3f9b54ebfc8bdbf668ef2ae8845591a9fd01daf4f1ea4d1ac4db93c3f7877f6fc5f0a542eb4ff1eade5fd747a0905d98fe1c55a6effabc1f4131d59d
+DIST libuv-1.49.0.tar.gz.sig 833 BLAKE2B aa37c82779d2e904b5b1cdac802573fe30a570f83a818f94eed87d4b7a45a83e6fa02f0f2a06e24a8b01561bbe1b647bc931670c78af79301ba0aa08e6c0c708 SHA512 ad86a158179f5b8961aba701f0fdc16906383158cceb1ab2e23a7d5caa31ee4d87e9260ba6d04aa16719254e9b8d9e85066e2352d02006d231f4898235525fe6
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libuv/libuv-1.49.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libuv/libuv-1.49.0.ebuild
new file mode 100644
index 00000000000..859c1fae34d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libuv/libuv-1.49.0.ebuild
@@ -0,0 +1,62 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/libuv.asc
+inherit autotools verify-sig
+
+DESCRIPTION="Cross-platform asychronous I/O"
+HOMEPAGE="https://github.com/libuv/libuv"
+
+if [[ ${PV} = 9999* ]]; then
+	EGIT_REPO_URI="https://github.com/libuv/libuv.git"
+	inherit git-r3
+else
+	SRC_URI="
+		https://dist.libuv.org/dist/v${PV}/libuv-v${PV}.tar.gz -> ${P}.tar.gz
+		verify-sig? ( https://dist.libuv.org/dist/v${PV}/libuv-v${PV}.tar.gz.sign -> ${P}.tar.gz.sig )
+	"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	S="${WORKDIR}/${PN}-v${PV}"
+fi
+
+LICENSE="BSD BSD-2 ISC MIT"
+SLOT="0/1"
+
+BDEPEND="
+	dev-build/libtool
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-libuv )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.48.0-test-thread-priority-portage.patch
+)
+
+src_prepare() {
+	default
+
+	if [[ ${CHOST} == *-darwin* && ${CHOST##*darwin} -le 9 ]] ; then
+		eapply "${FILESDIR}"/${PN}-1.41.0-darwin.patch
+	fi
+
+	# Upstream fails to ship a configure script and has missing m4 file.
+	echo "m4_define([UV_EXTRA_AUTOMAKE_FLAGS], [serial-tests])" \
+		> m4/libuv-extra-automake-flags.m4 || die
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		cc_cv_cflags__g=no
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	find "${ED}" -name '*.la' -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/Manifest
index 3b8132a4cb8..2f2ec937501 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/Manifest
@@ -1,7 +1,4 @@
-DIST libxml2-2.11.7.tar.xz 2628860 BLAKE2B 9aa553b09ec20fe01272ceafb59bf76b480f3cfc57084a527d09797dc39987e59635f8f7b1591060ef6a27adfcc07d8c8e8a907ee7ed04da0a108aae1517cd52 SHA512 202b0523d982eb5269dcb4644d8ab2ea31404771069462cdd6c5cd7e6672e0e50371ceb334133bb8f2c0a42f133e8f40c3f582bba5fc71ab168a2b18d4cfd81d
 DIST libxml2-2.11.8.tar.xz 2628212 BLAKE2B 7a9f62b9e6628e71462b0ae2a43947e398c8b948d57280ee5ac64a7cd0a13d39aa4cc55148421f999e5a04e19ca1ae2cb84884f85f3e22559cb45d8a7fca7d45 SHA512 b8c38365172b9f46e2da4dd696f5df4f917d05cc33456079d3d042578543c0f951da207361958ba8699a9f7256889f063737ba80dba8bb9720c8434be1ca723f
-DIST libxml2-2.12.5.tar.xz 2643452 BLAKE2B b63ade8b18d98701e95b79ac2199bfc4ca89c6085c48c3d0970945ae526558ee2137622ee8b4af5391f86e663a3f06a7e1aaad5f57eb639fc9da74704e2280f3 SHA512 da5c5afb95db80342d78d4371d029bf10ce5cd601b24b294272d9996f82357bd5262a15a2b44b0904a14471c8ff0c9fd9c796f164246551f02ee19a8f083f926
-DIST libxml2-2.12.6.tar.xz 2643124 BLAKE2B 677589cf063b109018aafc04a1564242ba1a9d88b2c511f583d4aa511c13aff15254a9d5f6ea2c294902338b0c0207ff59c51298e128981d57f86367ddc1a803 SHA512 19d6901c0f189813e8bd20ffdfbb29d8545ca30154d1f3cc82624d64e4db3cfbe8eef7e8ccc1e195289f1bf94bb50fefcf11a95badb0ddeb845b4e4ea5a819ac
 DIST libxml2-2.12.7.tar.xz 2641980 BLAKE2B 19abc2a7824212b1de3ceb1e8e3bbb39cb5feb31f8f6e1b1701a8255f34aadbbd01631e8011fd1207d2e711372a893034a99cb4aaa779a1df22d49d339dbfc76 SHA512 88b5f3e0a7c6704926e662a46ba0606d901efbcd70a36bd39fe034e29ee42d66d7296358761e04272c9696192a1380bda55852b2a0b14a05a7a083a08e125f5f
 DIST libxml2-2.12.8.tar.xz 2643728 BLAKE2B d26fe61e913e73c923eb8140a9080d6b70078ce45e94fe61d1ca1b8919d5b86feb7f14156f5a8b06ea06a03a96a242ce3a32e8d61169cfa8bde587888438627b SHA512 59baac9a82a734045112be6da12bbbe80a71575145424c2225e4bd9f8d54e53c674dcbc9576eb55f646632335702e7f0b1928f96a851159ace9b26f677fd3d77
 DIST libxml2-2.13.1.tar.xz 2579424 BLAKE2B 93cbd3943b0a7a7a07036a3ce01740c37049b44c20f43aaee96ef9a36e86bc108914950d7532740be87995b8eb5c1e6fbb4464c6af0a20233c8a1a206b9a5b83 SHA512 28d280eb5e2f3af9df5adcccced730602e6951fd181b8d00256dbb2138abfe32a4b145fdc00ed8c77a6d322e0929bcb3d5128ad4622877d7f8a059d4b6e011a6
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.11.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.11.7.ebuild
deleted file mode 100644
index e4810b5b930..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.11.7.ebuild
+++ /dev/null
@@ -1,200 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Note: Please bump in sync with dev-libs/libxslt
-
-PYTHON_COMPAT=( python3_{10..12} )
-PYTHON_REQ_USE="xml(+)"
-inherit flag-o-matic python-r1 multilib-minimal
-
-XSTS_HOME="http://www.w3.org/XML/2004/xml-schema-test-suite"
-XSTS_NAME_1="xmlschema2002-01-16"
-XSTS_NAME_2="xmlschema2004-01-14"
-XSTS_TARBALL_1="xsts-2002-01-16.tar.gz"
-XSTS_TARBALL_2="xsts-2004-01-14.tar.gz"
-XMLCONF_TARBALL="xmlts20130923.tar.gz"
-
-DESCRIPTION="XML C parser and toolkit"
-HOMEPAGE="https://gitlab.gnome.org/GNOME/libxml2/-/wikis/home"
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://gitlab.gnome.org/GNOME/libxml2"
-	inherit autotools git-r3
-else
-	inherit gnome.org libtool
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-SRC_URI+="
-	test? (
-		${XSTS_HOME}/${XSTS_NAME_1}/${XSTS_TARBALL_1}
-		${XSTS_HOME}/${XSTS_NAME_2}/${XSTS_TARBALL_2}
-		https://www.w3.org/XML/Test/${XMLCONF_TARBALL}
-	)
-"
-S="${WORKDIR}/${PN}-${PV%_rc*}"
-
-LICENSE="MIT"
-SLOT="2"
-IUSE="debug examples +ftp icu lzma +python readline static-libs test"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
-
-RDEPEND="
-	virtual/libiconv
-	>=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}]
-	icu? ( >=dev-libs/icu-51.2-r1:=[${MULTILIB_USEDEP}] )
-	lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[${MULTILIB_USEDEP}] )
-	python? ( ${PYTHON_DEPS} )
-	readline? ( sys-libs/readline:= )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="virtual/pkgconfig"
-
-if [[ ${PV} == 9999 ]] ; then
-	BDEPEND+=" dev-build/gtk-doc-am"
-fi
-
-MULTILIB_CHOST_TOOLS=(
-	/usr/bin/xml2-config
-)
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-2.11.5-CVE-2023-45322.patch
-)
-
-src_unpack() {
-	if [[ ${PV} == 9999 ]] ; then
-		git-r3_src_unpack
-	else
-		local tarname=${P/_rc/-rc}.tar.xz
-
-		# ${A} isn't used to avoid unpacking of test tarballs into ${WORKDIR},
-		# as they are needed as tarballs in ${S}/xstc instead and not unpacked
-		unpack ${tarname}
-
-		if [[ -n ${PATCHSET_VERSION} ]] ; then
-			unpack ${PN}-${PATCHSET_VERSION}.tar.xz
-		fi
-	fi
-
-	cd "${S}" || die
-
-	if use test ; then
-		cp "${DISTDIR}/${XSTS_TARBALL_1}" \
-			"${DISTDIR}/${XSTS_TARBALL_2}" \
-			"${S}"/xstc/ \
-			|| die "Failed to install test tarballs"
-		unpack ${XMLCONF_TARBALL}
-	fi
-}
-
-src_prepare() {
-	default
-
-	if [[ ${PV} == 9999 ]] ; then
-		eautoreconf
-	else
-		# Please do not remove, as else we get references to PORTAGE_TMPDIR
-		# in /usr/lib/python?.?/site-packages/libxml2mod.la among things.
-		elibtoolize
-	fi
-}
-
-multilib_src_configure() {
-	# Filter seemingly problematic CFLAGS (bug #26320)
-	filter-flags -fprefetch-loop-arrays -funroll-loops
-
-	# Notes:
-	# The meaning of the 'debug' USE flag does not apply to the --with-debug
-	# switch (enabling the libxml2 debug module). See bug #100898.
-	libxml2_configure() {
-		ECONF_SOURCE="${S}" econf \
-			--enable-ipv6 \
-			$(use_with ftp) \
-			$(use_with debug run-debug) \
-			$(use_with icu) \
-			$(use_with lzma) \
-			$(use_enable static-libs static) \
-			$(multilib_native_use_with readline) \
-			$(multilib_native_use_with readline history) \
-			"$@"
-	}
-
-	# Build python bindings separately
-	libxml2_configure --without-python
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_configure --with-python
-}
-
-libxml2_py_emake() {
-	pushd "${BUILD_DIR}"/python >/dev/null || die
-
-	emake top_builddir="${NATIVE_BUILD_DIR}" "$@"
-
-	popd >/dev/null || die
-}
-
-multilib_src_compile() {
-	default
-
-	if multilib_is_native_abi && use python ; then
-		NATIVE_BUILD_DIR="${BUILD_DIR}"
-		python_foreach_impl run_in_build_dir libxml2_py_emake all
-	fi
-}
-
-multilib_src_test() {
-	ln -s "${S}"/xmlconf || die
-
-	emake check
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_py_emake check
-}
-
-multilib_src_install() {
-	emake DESTDIR="${D}" install
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_py_emake DESTDIR="${D}" install
-
-	# Hack until automake release is made for the optimise fix
-	# https://git.savannah.gnu.org/cgit/automake.git/commit/?id=bde43d0481ff540418271ac37012a574a4fcf097
-	multilib_is_native_abi && use python && python_foreach_impl python_optimize
-}
-
-multilib_src_install_all() {
-	einstalldocs
-
-	if ! use examples ; then
-		rm -rf "${ED}"/usr/share/doc/${PF}/examples || die
-		rm -rf "${ED}"/usr/share/doc/${PF}/python/examples || die
-	fi
-
-	rm -rf "${ED}"/usr/share/doc/${PN}-python-${PVR} || die
-
-	find "${ED}" -name '*.la' -delete || die
-}
-
-pkg_postinst() {
-	# We don't want to do the xmlcatalog during stage1, as xmlcatalog will not
-	# be in / and stage1 builds to ROOT=/tmp/stage1root. This fixes bug #208887.
-	if [[ -n "${ROOT}" ]]; then
-		elog "Skipping XML catalog creation for stage building (bug #208887)."
-	else
-		# Need an XML catalog, so no-one writes to a non-existent one
-		CATALOG="${EROOT}/etc/xml/catalog"
-
-		# We don't want to clobber an existing catalog though,
-		# only ensure that one is there
-		# <obz@gentoo.org>
-		if [[ ! -e "${CATALOG}" ]]; then
-			[[ -d "${EROOT}/etc/xml" ]] || mkdir -p "${EROOT}/etc/xml"
-			"${EPREFIX}"/usr/bin/xmlcatalog --create > "${CATALOG}"
-			einfo "Created XML catalog in ${CATALOG}"
-		fi
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.12.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.12.5.ebuild
deleted file mode 100644
index ce389d00577..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.12.5.ebuild
+++ /dev/null
@@ -1,196 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Note: Please bump in sync with dev-libs/libxslt
-
-PYTHON_COMPAT=( python3_{10..12} )
-PYTHON_REQ_USE="xml(+)"
-inherit flag-o-matic python-r1 multilib-minimal
-
-XSTS_HOME="http://www.w3.org/XML/2004/xml-schema-test-suite"
-XSTS_NAME_1="xmlschema2002-01-16"
-XSTS_NAME_2="xmlschema2004-01-14"
-XSTS_TARBALL_1="xsts-2002-01-16.tar.gz"
-XSTS_TARBALL_2="xsts-2004-01-14.tar.gz"
-XMLCONF_TARBALL="xmlts20130923.tar.gz"
-
-DESCRIPTION="XML C parser and toolkit"
-HOMEPAGE="https://gitlab.gnome.org/GNOME/libxml2/-/wikis/home"
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://gitlab.gnome.org/GNOME/libxml2"
-	inherit autotools git-r3
-else
-	inherit gnome.org libtool
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-SRC_URI+="
-	test? (
-		${XSTS_HOME}/${XSTS_NAME_1}/${XSTS_TARBALL_1}
-		${XSTS_HOME}/${XSTS_NAME_2}/${XSTS_TARBALL_2}
-		https://www.w3.org/XML/Test/${XMLCONF_TARBALL}
-	)
-"
-S="${WORKDIR}/${PN}-${PV%_rc*}"
-
-LICENSE="MIT"
-SLOT="2"
-IUSE="debug examples +ftp icu lzma +python readline static-libs test"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
-
-RDEPEND="
-	virtual/libiconv
-	>=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}]
-	icu? ( >=dev-libs/icu-51.2-r1:=[${MULTILIB_USEDEP}] )
-	lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[${MULTILIB_USEDEP}] )
-	python? ( ${PYTHON_DEPS} )
-	readline? ( sys-libs/readline:= )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="virtual/pkgconfig"
-
-if [[ ${PV} == 9999 ]] ; then
-	BDEPEND+=" dev-build/gtk-doc-am"
-fi
-
-MULTILIB_CHOST_TOOLS=(
-	/usr/bin/xml2-config
-)
-
-src_unpack() {
-	if [[ ${PV} == 9999 ]] ; then
-		git-r3_src_unpack
-	else
-		local tarname=${P/_rc/-rc}.tar.xz
-
-		# ${A} isn't used to avoid unpacking of test tarballs into ${WORKDIR},
-		# as they are needed as tarballs in ${S}/xstc instead and not unpacked
-		unpack ${tarname}
-
-		if [[ -n ${PATCHSET_VERSION} ]] ; then
-			unpack ${PN}-${PATCHSET_VERSION}.tar.xz
-		fi
-	fi
-
-	cd "${S}" || die
-
-	if use test ; then
-		cp "${DISTDIR}/${XSTS_TARBALL_1}" \
-			"${DISTDIR}/${XSTS_TARBALL_2}" \
-			"${S}"/xstc/ \
-			|| die "Failed to install test tarballs"
-		unpack ${XMLCONF_TARBALL}
-	fi
-}
-
-src_prepare() {
-	default
-
-	if [[ ${PV} == 9999 ]] ; then
-		eautoreconf
-	else
-		# Please do not remove, as else we get references to PORTAGE_TMPDIR
-		# in /usr/lib/python?.?/site-packages/libxml2mod.la among things.
-		elibtoolize
-	fi
-}
-
-multilib_src_configure() {
-	# Filter seemingly problematic CFLAGS (bug #26320)
-	filter-flags -fprefetch-loop-arrays -funroll-loops
-
-	# Notes:
-	# The meaning of the 'debug' USE flag does not apply to the --with-debug
-	# switch (enabling the libxml2 debug module). See bug #100898.
-	libxml2_configure() {
-		ECONF_SOURCE="${S}" econf \
-			--enable-ipv6 \
-			$(use_with ftp) \
-			$(use_with debug run-debug) \
-			$(use_with icu) \
-			$(use_with lzma) \
-			$(use_enable static-libs static) \
-			$(multilib_native_use_with readline) \
-			$(multilib_native_use_with readline history) \
-			"$@"
-	}
-
-	# Build python bindings separately
-	libxml2_configure --without-python
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_configure --with-python
-}
-
-libxml2_py_emake() {
-	pushd "${BUILD_DIR}"/python >/dev/null || die
-
-	emake top_builddir="${NATIVE_BUILD_DIR}" "$@"
-
-	popd >/dev/null || die
-}
-
-multilib_src_compile() {
-	default
-
-	if multilib_is_native_abi && use python ; then
-		NATIVE_BUILD_DIR="${BUILD_DIR}"
-		python_foreach_impl run_in_build_dir libxml2_py_emake all
-	fi
-}
-
-multilib_src_test() {
-	ln -s "${S}"/xmlconf || die
-
-	emake check
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_py_emake check
-}
-
-multilib_src_install() {
-	emake DESTDIR="${D}" install
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_py_emake DESTDIR="${D}" install
-
-	# Hack until automake release is made for the optimise fix
-	# https://git.savannah.gnu.org/cgit/automake.git/commit/?id=bde43d0481ff540418271ac37012a574a4fcf097
-	multilib_is_native_abi && use python && python_foreach_impl python_optimize
-}
-
-multilib_src_install_all() {
-	einstalldocs
-
-	if ! use examples ; then
-		rm -rf "${ED}"/usr/share/doc/${PF}/examples || die
-		rm -rf "${ED}"/usr/share/doc/${PF}/python/examples || die
-	fi
-
-	rm -rf "${ED}"/usr/share/doc/${PN}-python-${PVR} || die
-
-	find "${ED}" -name '*.la' -delete || die
-}
-
-pkg_postinst() {
-	# We don't want to do the xmlcatalog during stage1, as xmlcatalog will not
-	# be in / and stage1 builds to ROOT=/tmp/stage1root. This fixes bug #208887.
-	if [[ -n "${ROOT}" ]]; then
-		elog "Skipping XML catalog creation for stage building (bug #208887)."
-	else
-		# Need an XML catalog, so no-one writes to a non-existent one
-		CATALOG="${EROOT}/etc/xml/catalog"
-
-		# We don't want to clobber an existing catalog though,
-		# only ensure that one is there
-		# <obz@gentoo.org>
-		if [[ ! -e "${CATALOG}" ]]; then
-			[[ -d "${EROOT}/etc/xml" ]] || mkdir -p "${EROOT}/etc/xml"
-			"${EPREFIX}"/usr/bin/xmlcatalog --create > "${CATALOG}"
-			einfo "Created XML catalog in ${CATALOG}"
-		fi
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.12.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.12.6.ebuild
deleted file mode 100644
index ce389d00577..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.12.6.ebuild
+++ /dev/null
@@ -1,196 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Note: Please bump in sync with dev-libs/libxslt
-
-PYTHON_COMPAT=( python3_{10..12} )
-PYTHON_REQ_USE="xml(+)"
-inherit flag-o-matic python-r1 multilib-minimal
-
-XSTS_HOME="http://www.w3.org/XML/2004/xml-schema-test-suite"
-XSTS_NAME_1="xmlschema2002-01-16"
-XSTS_NAME_2="xmlschema2004-01-14"
-XSTS_TARBALL_1="xsts-2002-01-16.tar.gz"
-XSTS_TARBALL_2="xsts-2004-01-14.tar.gz"
-XMLCONF_TARBALL="xmlts20130923.tar.gz"
-
-DESCRIPTION="XML C parser and toolkit"
-HOMEPAGE="https://gitlab.gnome.org/GNOME/libxml2/-/wikis/home"
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://gitlab.gnome.org/GNOME/libxml2"
-	inherit autotools git-r3
-else
-	inherit gnome.org libtool
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-SRC_URI+="
-	test? (
-		${XSTS_HOME}/${XSTS_NAME_1}/${XSTS_TARBALL_1}
-		${XSTS_HOME}/${XSTS_NAME_2}/${XSTS_TARBALL_2}
-		https://www.w3.org/XML/Test/${XMLCONF_TARBALL}
-	)
-"
-S="${WORKDIR}/${PN}-${PV%_rc*}"
-
-LICENSE="MIT"
-SLOT="2"
-IUSE="debug examples +ftp icu lzma +python readline static-libs test"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
-
-RDEPEND="
-	virtual/libiconv
-	>=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}]
-	icu? ( >=dev-libs/icu-51.2-r1:=[${MULTILIB_USEDEP}] )
-	lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[${MULTILIB_USEDEP}] )
-	python? ( ${PYTHON_DEPS} )
-	readline? ( sys-libs/readline:= )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="virtual/pkgconfig"
-
-if [[ ${PV} == 9999 ]] ; then
-	BDEPEND+=" dev-build/gtk-doc-am"
-fi
-
-MULTILIB_CHOST_TOOLS=(
-	/usr/bin/xml2-config
-)
-
-src_unpack() {
-	if [[ ${PV} == 9999 ]] ; then
-		git-r3_src_unpack
-	else
-		local tarname=${P/_rc/-rc}.tar.xz
-
-		# ${A} isn't used to avoid unpacking of test tarballs into ${WORKDIR},
-		# as they are needed as tarballs in ${S}/xstc instead and not unpacked
-		unpack ${tarname}
-
-		if [[ -n ${PATCHSET_VERSION} ]] ; then
-			unpack ${PN}-${PATCHSET_VERSION}.tar.xz
-		fi
-	fi
-
-	cd "${S}" || die
-
-	if use test ; then
-		cp "${DISTDIR}/${XSTS_TARBALL_1}" \
-			"${DISTDIR}/${XSTS_TARBALL_2}" \
-			"${S}"/xstc/ \
-			|| die "Failed to install test tarballs"
-		unpack ${XMLCONF_TARBALL}
-	fi
-}
-
-src_prepare() {
-	default
-
-	if [[ ${PV} == 9999 ]] ; then
-		eautoreconf
-	else
-		# Please do not remove, as else we get references to PORTAGE_TMPDIR
-		# in /usr/lib/python?.?/site-packages/libxml2mod.la among things.
-		elibtoolize
-	fi
-}
-
-multilib_src_configure() {
-	# Filter seemingly problematic CFLAGS (bug #26320)
-	filter-flags -fprefetch-loop-arrays -funroll-loops
-
-	# Notes:
-	# The meaning of the 'debug' USE flag does not apply to the --with-debug
-	# switch (enabling the libxml2 debug module). See bug #100898.
-	libxml2_configure() {
-		ECONF_SOURCE="${S}" econf \
-			--enable-ipv6 \
-			$(use_with ftp) \
-			$(use_with debug run-debug) \
-			$(use_with icu) \
-			$(use_with lzma) \
-			$(use_enable static-libs static) \
-			$(multilib_native_use_with readline) \
-			$(multilib_native_use_with readline history) \
-			"$@"
-	}
-
-	# Build python bindings separately
-	libxml2_configure --without-python
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_configure --with-python
-}
-
-libxml2_py_emake() {
-	pushd "${BUILD_DIR}"/python >/dev/null || die
-
-	emake top_builddir="${NATIVE_BUILD_DIR}" "$@"
-
-	popd >/dev/null || die
-}
-
-multilib_src_compile() {
-	default
-
-	if multilib_is_native_abi && use python ; then
-		NATIVE_BUILD_DIR="${BUILD_DIR}"
-		python_foreach_impl run_in_build_dir libxml2_py_emake all
-	fi
-}
-
-multilib_src_test() {
-	ln -s "${S}"/xmlconf || die
-
-	emake check
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_py_emake check
-}
-
-multilib_src_install() {
-	emake DESTDIR="${D}" install
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_py_emake DESTDIR="${D}" install
-
-	# Hack until automake release is made for the optimise fix
-	# https://git.savannah.gnu.org/cgit/automake.git/commit/?id=bde43d0481ff540418271ac37012a574a4fcf097
-	multilib_is_native_abi && use python && python_foreach_impl python_optimize
-}
-
-multilib_src_install_all() {
-	einstalldocs
-
-	if ! use examples ; then
-		rm -rf "${ED}"/usr/share/doc/${PF}/examples || die
-		rm -rf "${ED}"/usr/share/doc/${PF}/python/examples || die
-	fi
-
-	rm -rf "${ED}"/usr/share/doc/${PN}-python-${PVR} || die
-
-	find "${ED}" -name '*.la' -delete || die
-}
-
-pkg_postinst() {
-	# We don't want to do the xmlcatalog during stage1, as xmlcatalog will not
-	# be in / and stage1 builds to ROOT=/tmp/stage1root. This fixes bug #208887.
-	if [[ -n "${ROOT}" ]]; then
-		elog "Skipping XML catalog creation for stage building (bug #208887)."
-	else
-		# Need an XML catalog, so no-one writes to a non-existent one
-		CATALOG="${EROOT}/etc/xml/catalog"
-
-		# We don't want to clobber an existing catalog though,
-		# only ensure that one is there
-		# <obz@gentoo.org>
-		if [[ ! -e "${CATALOG}" ]]; then
-			[[ -d "${EROOT}/etc/xml" ]] || mkdir -p "${EROOT}/etc/xml"
-			"${EPREFIX}"/usr/bin/xmlcatalog --create > "${CATALOG}"
-			einfo "Created XML catalog in ${CATALOG}"
-		fi
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/lzo/lzo-2.10.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/lzo/lzo-2.10.ebuild
index 88bb951351b..b61a5547b17 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/lzo/lzo-2.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/lzo/lzo-2.10.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -21,6 +21,10 @@ multilib_src_configure() {
 		$(use_enable static-libs static)
 }
 
+multilib_src_test() {
+	emake test
+}
+
 multilib_src_install() {
 	emake DESTDIR="${D}" install
 	gen_usr_ldscript -a lzo2
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/nettle/nettle-3.10.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/nettle/nettle-3.10.ebuild
index d0eea58e455..4e64fde80d4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/nettle/nettle-3.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/nettle/nettle-3.10.ebuild
@@ -14,7 +14,7 @@ SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.gz.sig )"
 LICENSE="|| ( LGPL-3 LGPL-2.1 )"
 # Subslot = libnettle - libhogweed soname version
 SLOT="0/8-6"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="+asm doc +gmp static-libs cpu_flags_arm_neon cpu_flags_arm_aes cpu_flags_arm_sha1 cpu_flags_arm_sha2 cpu_flags_ppc_altivec cpu_flags_ppc_vsx2 cpu_flags_ppc_vsx3 cpu_flags_x86_aes cpu_flags_x86_sha cpu_flags_x86_pclmul"
 # The arm64 crypto option controls AES, SHA1, and SHA2 usage.
 REQUIRED_USE="
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/oniguruma/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-libs/oniguruma/metadata.xml
index 31f46b9f96b..85054beb09c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/oniguruma/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/oniguruma/metadata.xml
@@ -18,6 +18,7 @@
 		<flag name="crnl-as-line-terminator">Enable CR+NL as line terminator</flag>
 	</use>
 	<upstream>
+		<remote-id type="cpe">cpe:/a:oniguruma_project:oniguruma</remote-id>
 		<remote-id type="github">kkos/oniguruma</remote-id>
 	</upstream>
 </pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/oniguruma/oniguruma-6.9.9.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/oniguruma/oniguruma-6.9.9.ebuild
index 340ca851229..206260295b4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/oniguruma/oniguruma-6.9.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/oniguruma/oniguruma-6.9.9.ebuild
@@ -1,4 +1,4 @@
-# Copyright 2003-2023 Gentoo Authors
+# Copyright 2003-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI="8"
@@ -21,7 +21,7 @@ fi
 
 LICENSE="BSD-2"
 SLOT="0/5"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="crnl-as-line-terminator static-libs"
 
 BDEPEND=""
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter-bash/tree-sitter-bash-0.23.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter-bash/tree-sitter-bash-0.23.1.ebuild
index e0e9314f6ec..0214e1ff67a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter-bash/tree-sitter-bash-0.23.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter-bash/tree-sitter-bash-0.23.1.ebuild
@@ -12,4 +12,4 @@ HOMEPAGE="https://github.com/tree-sitter/tree-sitter-bash"
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-macos"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/Manifest
index 16408268927..c5e8ef516e9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/Manifest
@@ -1,2 +1,3 @@
 DIST tree-sitter-0.22.6.tar.gz 3036954 BLAKE2B f109a738214882e63a721e8db384fa42a624af78d42ceb9ab7a45135b36cf3bbbd2554f470ca5038404365f5b9dbf9979c4d26309e123a9d9533feb1f0a3f724 SHA512 bf0b87bb9ce16b049824e53933986ac451a7b7f432df39ee9d4546627d740ae689af9e838a53cc50e29d66d6d85d51dab7490d66a429a14bcc9d0b8e2935a63a
 DIST tree-sitter-0.23.0.tar.gz 2977346 BLAKE2B e10846d5bd0a6aa1ecac362e2ab2ccf0f0bdb17c5fde796d8d65f8bc84a6e054d86c18a42e66e8effef865f95013c38ff6bd6ab5498a680ae172d7d57020604e SHA512 ab821be564ac7223cc4f9659c08922a78016af9dd3bd69166706fb6a889ac175ba2712a337a1303aceb8f44beaf58640a183e77dddc2c57e35da23079d0cd7b9
+DIST tree-sitter-0.23.2.tar.gz 2980520 BLAKE2B 54b4ad96948fc3ec6142da998306f9385ce9107a7c330915bbb733c5886a0baa869a675602be99aa4a491c58a1121d30f654856ce0f2dee0eff4c4fcce370f24 SHA512 393fa62fe6bce51ff5498f977bbb357fd896aaf98d80f08d4faed6dcf8fd5d41012a7489816c662c1873595108c30d0c18d7721a535c69d9904b2220fef8f858
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.23.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.23.0.ebuild
index 765a16ffae3..990c74971db 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.23.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.23.0.ebuild
@@ -12,7 +12,7 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://github.com/${PN}/${PN}"
 else
 	SRC_URI="https://github.com/${PN}/${PN}/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-macos"
 fi
 
 LICENSE="MIT"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.23.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.23.2.ebuild
new file mode 100644
index 00000000000..765a16ffae3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.23.2.ebuild
@@ -0,0 +1,50 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit optfeature toolchain-funcs
+
+DESCRIPTION="Tree-sitter is a parser generator tool and an incremental parsing library"
+HOMEPAGE="https://github.com/tree-sitter/tree-sitter"
+
+if [[ ${PV} == *9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/${PN}/${PN}"
+else
+	SRC_URI="https://github.com/${PN}/${PN}/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
+fi
+
+LICENSE="MIT"
+# ABI is not stable. Revisit after tree-sitter-1.0.
+# https://bugs.gentoo.org/930039
+# https://github.com/tree-sitter/tree-sitter/pull/3302
+SLOT="0/${PV}"
+RESTRICT="test" # tests are for CLI and not the lib
+
+PATCHES=(
+	"${FILESDIR}/${PN}-0.22.2-no-static.patch"
+)
+
+src_prepare() {
+	default
+	tc-export CC
+}
+
+src_compile() {
+	emake \
+		PREFIX="${EPREFIX}/usr" \
+		LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
+		STRIP="" # bug 930020
+}
+
+src_install() {
+	emake DESTDIR="${D}" \
+		  PREFIX="${EPREFIX}/usr" \
+		  LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
+		  install
+}
+
+pkg_postinst() {
+	optfeature "building and testing grammars" dev-util/tree-sitter-cli
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/userspace-rcu/userspace-rcu-0.14.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/userspace-rcu/userspace-rcu-0.14.1.ebuild
index 22a62b57a7a..be348b0ee57 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/userspace-rcu/userspace-rcu-0.14.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/userspace-rcu/userspace-rcu-0.14.1.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://lttng.org/files/urcu/${P}.tar.bz2"
 
 LICENSE="LGPL-2.1"
 SLOT="0/8" # subslot = soname version
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86"
 IUSE="static-libs test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/Manifest
index 1a4adea1809..978a522f6f4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/Manifest
@@ -1,6 +1,2 @@
-DIST xmlsec1-1.2.37.tar.gz 2009175 BLAKE2B 19f43ba6bf6eb49428b9c5563baecbab21476f326cceee13785ae16769afa258f100732831c0f3f7d160543bd075cdcfdc5cbf11b7406637ee6c2f0e27c07f30 SHA512 99220cb28a346ffac0023f9f177d6a7be3ddcea04bea434b7dc926c1f0aaa5564d75f74f92896ac100179c04d77e001f688ddf46fed4e0a0b4f20b7b87c24900
-DIST xmlsec1-1.2.38.tar.gz 2036578 BLAKE2B 03f7e1b5e659793bf1984c5a59582d9459089ce913620d5cc1e5a5d0eb65557580cd23fa190db277298fd7cc55bd41563b93cf61a37c8b7521a4690cd2ca3489 SHA512 724089777caae95db27e67f24381c066eaae23a9d64819a18bb04837c1ab1b380d19be2c7ee25659ca481d9eab96fcbe8027a430a0ac1630ad3b073cddd20fac
-DIST xmlsec1-1.2.39.tar.gz 2036905 BLAKE2B c1844f2068f6afe8dff3bf3fcf45a7180f09cae3418812b49b5c86b5387c795900a9ebd2077691d51d778c081f4282a54fdc11e7a54e6b8d969ef2871c2f5bb8 SHA512 bc8457bca8ada87c12d3be685bf8ad805f102b4ac1265e257ba12137e0430783973f27d22bfcb7559be5e89cb4c01b3556488fa641fc7c9d8f403972fdc8f2f7
-DIST xmlsec1-1.3.1.tar.gz 2432943 BLAKE2B 1dafdffd959579add5c579e3fa9c9f9ddc73ce4aadc6fc2139506e6e64ffcd1bbe7298786e414900eb9f33f93b0a47da64e686c499e48d4c80d81b256db6692e SHA512 7f30c15c3edcafe70fa5febaa0ba39f73f8d30525ee102b5961a658dd2842fbc58e63f7595f15b150d71bf735bfa7688c3694a191b0d475776ca26902d90d25f
-DIST xmlsec1-1.3.3.tar.gz 2435741 BLAKE2B 1b0e44a8a5185d67b8f97ec72cd8e215fe79a988eb7ade0d2890be662b693d511857b24670ec692f9452bf95ad8c53ff80c250ecbcd167742477a83e0b72fda0 SHA512 1535b6f878259914ab9574892d05c927fbcd548986cf7bcf91e435acb2cb74eb11e58163f797038ee13a11444882814b2b4318cd677053fbe52557a2e4acf68a
 DIST xmlsec1-1.3.4.tar.gz 2435656 BLAKE2B b398f970e5b201971419b537125e9a7430c8d7c1c57e193b2592ee3f01ce797993607a210e87ad44e99bc0ef49ac4c350492268a3ac3bedbb81d937d99837468 SHA512 959a97ed7d7cbdc3e5ef037b2cb4f05bda299274c09ed3dfe24f7203d97e3dfc13bf480e15a2d15bcc7893569d341204884de58cc9b462b6c29306b67672e9c7
+DIST xmlsec1-1.3.5.tar.gz 2451506 BLAKE2B 4a265793a7499c4f6421c6d60552bd2ea18f06e3c28435520188c0a7c36a4de8aa40f20658949b93d826a8f6fb20bd8f2be1a78e6d103ae573e6353a2a5380a7 SHA512 69e9f18e2bc6b1b9acaf475a534a666965a561eec6a5a152185d264a4110d97d233af302153577a414e232a8880c6afc66b563118d889e670204d93819fcfdb5
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/files/xmlsec-1.2.37-libressl.patch b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/files/xmlsec-1.2.37-libressl.patch
deleted file mode 100644
index acdb535ba55..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/files/xmlsec-1.2.37-libressl.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-https://github.com/lsh123/xmlsec/pull/456
-https://github.com/lsh123/xmlsec/commit/c5469cfc8443c57a25a8783f0bd669f71e29bb04
-https://github.com/lsh123/xmlsec/pull/654
-https://github.com/lsh123/xmlsec/commit/dfdf981f3522e4059170b504fb6fd40b37c9d70f
-
-From c5469cfc8443c57a25a8783f0bd669f71e29bb04 Mon Sep 17 00:00:00 2001
-From: lsh123 <aleksey@aleksey.com>
-Date: Mon, 12 Dec 2022 10:34:56 -0500
-Subject: [PATCH] fix libressl (#456)
-
----
- src/openssl/openssl_compat.h | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-From d113d1e6355c4841fd03c6aa797d33bde1d064f3 Mon Sep 17 00:00:00 2001
-From: orbea <orbea@riseup.net>
-Date: Mon, 29 May 2023 07:46:58 -0700
-Subject: [PATCH] openssl_compat.h: Update LibreSSL UI_null() compat
-
-LibreSSL added UI_null() in 3.7.1.
----
- src/openssl/openssl_compat.h | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/src/openssl/openssl_compat.h
-+++ b/src/openssl/openssl_compat.h
-@@ -123,6 +123,13 @@ static inline int xmlSecOpenSSLCompatRand(unsigned char *buf, xmlSecSize size) {
-  * LibreSSL 2.7 compatibility (implements most of OpenSSL 1.1 API)
-  *
-  *****************************************************************************/
-+#if defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x3070200fL)
-+
-+/* Needed for Engine initialization */
-+#define UI_null()                          NULL
-+
-+#endif /* defined(LIBRESSL_VERSION_NUMBER) */
-+
- #if defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30500000L) && defined(XMLSEC_OPENSSL_API_110)
- /* EVP_CIPHER_CTX stuff */
- #define EVP_CIPHER_CTX_encrypting(x)       ((x)->encrypt)
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/files/xmlsec-1.3.3-slibtool.patch b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/files/xmlsec-1.3.3-slibtool.patch
deleted file mode 100644
index ed4c9e0397b..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/files/xmlsec-1.3.3-slibtool.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-https://github.com/lsh123/xmlsec/pull/756
-https://github.com/lsh123/xmlsec/commit/de5251a8064231fbe6b9bccc669228cab4ab4ec7
-
-From de5251a8064231fbe6b9bccc669228cab4ab4ec7 Mon Sep 17 00:00:00 2001
-From: orbea <orbea@riseup.net>
-Date: Tue, 30 Jan 2024 18:57:19 -0800
-Subject: [PATCH] configure.ac: fix the build with slibtool (#756)
-
-When building with LibreSSL or BoringSSL the build will try to link the
-$OPENSSL_LIBS with -Wl,-Bstatic, but this will fail when using slibtool
-if only dynamic libssl and libcrypto libraries are installed.
-
-  ld: cannot find -lssl: No such file or directory
-  ld: cannot find -lcrypto: No such file or directory
-
-With GNU libtool it will "helpfully" rearrange the linker output to
-obscure the issue.
-
-  -lssl -lcrypto -lxslt -lxml2 ../.libs/libxmlsec1.so -g -O2 -O -Wl,-Bstatic -Wl,-Bdynamic
-
-While with slibtool it will do as instructed and produce a build
-failure.
-
-  -Wl,-Bstatic -lssl -lcrypto -Wl,-Bdynamic -lxslt
----
- configure.ac | 2 --
- 1 file changed, 2 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index ce8a278c..25e70b24 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -806,7 +806,6 @@ if test "z$OPENSSL_FOUND" = "zyes" ; then
-             #endif
-         ],[
-             OPENSSL_VERSION="LibreSSL >= 3.5"
--            OPENSSL_LIBS="-Wl,-Bstatic $OPENSSL_LIBS -Wl,-Bdynamic"
-             enable_dh=no
-         ],[
-             OPENSSL_VERSION=""
-@@ -824,7 +823,6 @@ if test "z$OPENSSL_FOUND" = "zyes" ; then
-             #endif
-         ],[
-             OPENSSL_VERSION="BoringSSL >= 1.1.1"
--            OPENSSL_LIBS="-Wl,-Bstatic $OPENSSL_LIBS -Wl,-Bdynamic"
-             enable_ripemd160=no
-             enable_dsa=no
-             enable_dh=no
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/files/xmlsec-1.3.3-typo-fix.patch b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/files/xmlsec-1.3.3-typo-fix.patch
deleted file mode 100644
index db3eae6c484..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/files/xmlsec-1.3.3-typo-fix.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-https://github.com/lsh123/xmlsec/commit/8262167fbc56bce353949b9b18e01af7f7331e76
-
-From 8262167fbc56bce353949b9b18e01af7f7331e76 Mon Sep 17 00:00:00 2001
-From: Antoine Martin <dev@ayakael.net>
-Date: Sun, 14 Jan 2024 09:13:11 -0500
-Subject: [PATCH] Fix typo with xmlSecKeyDataEcGetKlass in app.h include (#755)
-
----
- include/xmlsec/app.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/xmlsec/app.h b/include/xmlsec/app.h
-index 4fe2a744..324561b9 100644
---- a/include/xmlsec/app.h
-+++ b/include/xmlsec/app.h
-@@ -85,7 +85,7 @@ XMLSEC_EXPORT xmlSecKeyDataId                   xmlSecKeyDataDsaGetKlass(void);
-  *
-  * The EC key klass.
-  */
--#define xmlSecKeyDataEcId                       xmlSecKeyDataEcetKlass()
-+#define xmlSecKeyDataEcId                       xmlSecKeyDataEcGetKlass()
- XMLSEC_EXPORT xmlSecKeyDataId                   xmlSecKeyDataEcGetKlass(void);
- /**
-  * xmlSecKeyDataGost2001Id:
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.2.37.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.2.37.ebuild
deleted file mode 100644
index 65dfdf2c4a4..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.2.37.ebuild
+++ /dev/null
@@ -1,62 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DESCRIPTION="Command line tool for signing, verifying, encrypting and decrypting XML"
-HOMEPAGE="https://www.aleksey.com/xmlsec"
-SRC_URI="https://www.aleksey.com/xmlsec/download/${PN}1-${PV}.tar.gz"
-S="${WORKDIR}/${PN}1-${PV}"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="amd64 arm arm64 ~loong ppc ppc64 ~riscv ~sparc x86"
-IUSE="doc gcrypt gnutls nss +openssl static-libs test"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="|| ( gcrypt gnutls nss openssl )
-	gnutls? ( gcrypt )"
-
-RDEPEND=">=dev-libs/libxml2-2.7.4[ftp(+)]
-	>=dev-libs/libxslt-1.0.20
-	dev-libs/libltdl
-	gcrypt? ( >=dev-libs/libgcrypt-1.4.0:= )
-	gnutls? ( >=net-libs/gnutls-2.8.0:= )
-	nss? (
-		>=dev-libs/nspr-4.4.1
-		>=dev-libs/nss-3.9
-	)
-	openssl? (
-		dev-libs/openssl:=
-	)"
-DEPEND="${RDEPEND}"
-BDEPEND="virtual/pkgconfig
-	test? (
-		nss? (
-			>=dev-libs/nss-3.9[utils]
-		)
-	)"
-
-src_configure() {
-	# Bash because of bug #721128
-	CONFIG_SHELL="${BROOT}"/bin/bash econf \
-		$(use_enable doc docs) \
-		$(use_enable static-libs static) \
-		$(use_with gcrypt) \
-		$(use_with gnutls) \
-		$(use_with nss nspr) \
-		$(use_with nss) \
-		$(use_with openssl) \
-		--enable-mans \
-		--enable-pkgconfig
-}
-
-src_test() {
-	# See https://github.com/lsh123/xmlsec/issues/280 for TZ=UTC
-	TZ=UTC SHELL="${BROOT}"/bin/bash emake TMPFOLDER="${T}" check
-}
-
-src_install() {
-	default
-
-	find "${ED}" -name '*.la' -delete || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.2.38.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.2.38.ebuild
deleted file mode 100644
index 7db6d541822..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.2.38.ebuild
+++ /dev/null
@@ -1,72 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DESCRIPTION="Command line tool for signing, verifying, encrypting and decrypting XML"
-HOMEPAGE="https://www.aleksey.com/xmlsec"
-SRC_URI="https://www.aleksey.com/xmlsec/download/${PN}1-${PV}.tar.gz"
-S="${WORKDIR}/${PN}1-${PV}"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~sparc ~x86"
-IUSE="doc gcrypt gnutls nss +openssl static-libs test"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="
-	|| ( gcrypt gnutls nss openssl )
-	gnutls? ( gcrypt )
-"
-
-RDEPEND="
-	>=dev-libs/libxml2-2.7.4[ftp(+)]
-	>=dev-libs/libxslt-1.0.20
-	dev-libs/libltdl
-	gcrypt? ( >=dev-libs/libgcrypt-1.4.0:= )
-	gnutls? ( >=net-libs/gnutls-2.8.0:= )
-	nss? (
-		>=dev-libs/nspr-4.4.1
-		>=dev-libs/nss-3.9
-	)
-	openssl? (
-		dev-libs/openssl:=
-	)
-"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	virtual/pkgconfig
-	test? (
-		nss? (
-			>=dev-libs/nss-3.9[utils]
-		)
-	)
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-1.2.37-libressl.patch # bug #903001
-)
-
-src_configure() {
-	# Bash because of bug #721128
-	CONFIG_SHELL="${BROOT}"/bin/bash econf \
-		$(use_enable doc docs) \
-		$(use_enable static-libs static) \
-		$(use_with gcrypt) \
-		$(use_with gnutls) \
-		$(use_with nss nspr) \
-		$(use_with nss) \
-		$(use_with openssl) \
-		--enable-mans \
-		--enable-pkgconfig
-}
-
-src_test() {
-	# See https://github.com/lsh123/xmlsec/issues/280 for TZ=UTC
-	TZ=UTC SHELL="${BROOT}"/bin/bash emake TMPFOLDER="${T}" check
-}
-
-src_install() {
-	default
-
-	find "${ED}" -name '*.la' -delete || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.2.39.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.2.39.ebuild
deleted file mode 100644
index 5fcdd6b380d..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.2.39.ebuild
+++ /dev/null
@@ -1,72 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DESCRIPTION="Command line tool for signing, verifying, encrypting and decrypting XML"
-HOMEPAGE="https://www.aleksey.com/xmlsec"
-SRC_URI="https://www.aleksey.com/xmlsec/download/${PN}1-${PV}.tar.gz"
-S="${WORKDIR}/${PN}1-${PV}"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~sparc ~x86"
-IUSE="doc gcrypt gnutls nss +openssl static-libs test"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="
-	|| ( gcrypt gnutls nss openssl )
-	gnutls? ( gcrypt )
-"
-
-RDEPEND="
-	>=dev-libs/libxml2-2.7.4[ftp(+)]
-	>=dev-libs/libxslt-1.0.20
-	dev-libs/libltdl
-	gcrypt? ( >=dev-libs/libgcrypt-1.4.0:= )
-	gnutls? ( >=net-libs/gnutls-2.8.0:= )
-	nss? (
-		>=dev-libs/nspr-4.4.1
-		>=dev-libs/nss-3.9
-	)
-	openssl? (
-		dev-libs/openssl:=
-	)
-"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	virtual/pkgconfig
-	test? (
-		nss? (
-			>=dev-libs/nss-3.9[utils]
-		)
-	)
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-1.2.37-libressl.patch # bug #903001
-)
-
-src_configure() {
-	# Bash because of bug #721128
-	CONFIG_SHELL="${BROOT}"/bin/bash econf \
-		$(use_enable doc docs) \
-		$(use_enable static-libs static) \
-		$(use_with gcrypt) \
-		$(use_with gnutls) \
-		$(use_with nss nspr) \
-		$(use_with nss) \
-		$(use_with openssl) \
-		--enable-mans \
-		--enable-pkgconfig
-}
-
-src_test() {
-	# See https://github.com/lsh123/xmlsec/issues/280 for TZ=UTC
-	TZ=UTC SHELL="${BROOT}"/bin/bash emake TMPFOLDER="${T}" check
-}
-
-src_install() {
-	default
-
-	find "${ED}" -name '*.la' -delete || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.3-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.3-r1.ebuild
deleted file mode 100644
index 079d34a4be6..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.3-r1.ebuild
+++ /dev/null
@@ -1,95 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit autotools
-
-DESCRIPTION="Command line tool for signing, verifying, encrypting and decrypting XML"
-HOMEPAGE="https://www.aleksey.com/xmlsec"
-SRC_URI="https://www.aleksey.com/xmlsec/download/${PN}1-${PV}.tar.gz"
-S="${WORKDIR}/${PN}1-${PV}"
-
-LICENSE="MIT"
-# Upstream consider major version bumps to be changes in either X or Y in X.Y.Z
-SLOT="0/$(ver_cut 1-2)"
-KEYWORDS="amd64 ~arm arm64 ~loong ~ppc ppc64 ~riscv ~sparc x86"
-IUSE="doc gcrypt gnutls http nss +openssl static-libs test"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="
-	|| ( gnutls nss openssl )
-"
-
-RDEPEND="
-	>=dev-libs/libxml2-2.7.4
-	>=dev-libs/libxslt-1.0.20
-	dev-libs/libltdl
-	gcrypt? ( >=dev-libs/libgcrypt-1.4.0:= )
-	gnutls? ( >=net-libs/gnutls-3.6.13:= )
-	nss? (
-		>=dev-libs/nspr-4.4.1
-		>=dev-libs/nss-3.9
-	)
-	openssl? ( dev-libs/openssl:= )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	virtual/pkgconfig
-	test? (
-		nss? (
-			>=dev-libs/nss-3.9[utils]
-		)
-	)
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-1.3.0-optimisation.patch
-	"${FILESDIR}"/${PN}-1.3.3-typo-fix.patch
-	"${FILESDIR}"/${PN}-1.3.3-slibtool.patch
-)
-
-src_prepare() {
-	default
-
-	eautoreconf
-}
-
-src_configure() {
-	local myeconfargs=(
-		$(use_enable doc docs)
-		$(use_enable static-libs static)
-		$(use_with gcrypt)
-		$(use_with gnutls)
-		$(use_with nss nspr)
-		$(use_with nss)
-		$(use_with openssl)
-
-		--disable-werror
-		--enable-mans
-		--enable-pkgconfig
-
-		--enable-concatkdf
-		--enable-pbkdf2
-		--enable-ec
-		--enable-dh
-		--enable-sha3
-
-		--enable-files
-		$(use_enable http)
-		--disable-ftp
-	)
-
-	# Bash because of bug #721128
-	CONFIG_SHELL="${BROOT}"/bin/bash econf "${myeconfargs[@]}"
-}
-
-src_test() {
-	# See https://github.com/lsh123/xmlsec/issues/280 for TZ=UTC
-	TZ=UTC SHELL="${BROOT}"/bin/bash emake TMPFOLDER="${T}" check
-}
-
-src_install() {
-	default
-
-	find "${ED}" -name '*.la' -delete || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.4.ebuild
index f0324bc0861..819741295b9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.4.ebuild
@@ -13,7 +13,7 @@ S="${WORKDIR}/${PN}1-${PV}"
 LICENSE="MIT"
 # Upstream consider major version bumps to be changes in either X or Y in X.Y.Z
 SLOT="0/$(ver_cut 1-2)"
-KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~sparc ~x86"
+KEYWORDS="amd64 arm arm64 ~loong ppc ppc64 ~riscv ~sparc x86"
 IUSE="doc gcrypt gnutls http nss +openssl static-libs test"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.5.ebuild
similarity index 94%
rename from sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.5.ebuild
index 1508b3b8def..f0324bc0861 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.5.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -13,7 +13,7 @@ S="${WORKDIR}/${PN}1-${PV}"
 LICENSE="MIT"
 # Upstream consider major version bumps to be changes in either X or Y in X.Y.Z
 SLOT="0/$(ver_cut 1-2)"
-KEYWORDS="amd64 arm arm64 ~loong ppc ppc64 ~riscv ~sparc x86"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~sparc ~x86"
 IUSE="doc gcrypt gnutls http nss +openssl static-libs test"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/yajl/yajl-2.1.0-r5.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/yajl/yajl-2.1.0-r5.ebuild
index 342971765b5..71bb3701e7c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/yajl/yajl-2.1.0-r5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/yajl/yajl-2.1.0-r5.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/lloyd/yajl/archive/refs/tags/${PV}.tar.gz -> ${P}-r5
 
 LICENSE="ISC"
 SLOT="0/2"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE=""
 
 PATCHES=(
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest
index ab18e2732d0..68d0cfe1e3e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest
@@ -1,4 +1,3 @@
 DIST setuptools-73.0.1-py3-none-any.whl 2346588 BLAKE2B 74c84539d1c3592aca5678ecf3c7c71c57fffa877fc5dcc42701c7b2f58613d3767ca10b190c37b30dc24ca9a6b67b76e1e70f63b188d9228f1b73b17f4a3198 SHA512 cef43928c8eebc673ca1befb1df1dc230eab8cf10fc66b06f02a0d459e78701457b8024bdc4ac33082e85e07dd5a63e031fcbf13e0b94d6bc9ccc90931060841
-DIST setuptools-74.1.2-py3-none-any.whl 1262071 BLAKE2B 4cee06ae5a71241deda83ecdd3a6ee806d67dddac56cc3f19cf58e6b7e9e5c9e441187a82d17674fa91d172496291ad9482e1b458e1f0968cb62ece3f62278bd SHA512 90eaf02616d82b22a69310d772f6737f4ba807ad7d53e371235fcf4f21c4034ea78d4a5ff0e2e93fd0623b0adc43208f427df91551d4a9bb3c94e08d1ae8394f
 DIST setuptools-74.1.3-py3-none-any.whl 1262070 BLAKE2B 967e581556dee96b068a762605e340a7dbdb7eedb62fc2224fa3cbff8c29c6dd8966831bf4d2c4714401c8beca6ff81ba64823ec55ce592ff3bf10ddee370975 SHA512 8dd7f782ccbfcef04462904f3211569a2ca0be7f370a75cd1d77b77c1f38fcfbea8fd401646bbf436c093ad4573e32f0a0eef030644df48817fde43ae59ce0aa
-DIST setuptools-75.0.0-py3-none-any.whl 1248237 BLAKE2B 379ad1a71a93bd4f8eb11fa590d64ab33b2f779facf803ac7ef385ad6730e464702a437bcb9abcf57948ab6f9285faf57f7e3776478030888c0380e54ebcff7a SHA512 088ac23b7da60859cc518bb625e5dc92df233e2d5c2b9e7b7ae961a01cede7e0c3cd5289868242e1b8026b1644e6149bb9efece108bdea61dfbf2c64258c7884
+DIST setuptools-75.1.0-py3-none-any.whl 1248506 BLAKE2B b26751d6594b8772d269d7e6cf299002eb7e8609e9048136c3d00aca1dff05b5dc89f6170deab337891f26a1d5d6ff585319f7767f2f93f3ccbb5af7e76cb608 SHA512 952385f4185068fd01b54c496686e4d03bc3f8674eba7fca909c2df0e674706bc8a1607cf0684c8a0202921a0c5c939a6a305068cade00b5af78c82ad7949712
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-75.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-75.0.0.ebuild
deleted file mode 100644
index c48c6a133f1..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-75.0.0.ebuild
+++ /dev/null
@@ -1,24 +0,0 @@
-# Copyright 2022-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit pypi
-
-DESCRIPTION="Shared setuptools wheel for ensurepip Python module"
-HOMEPAGE="https://pypi.org/project/setuptools/"
-SRC_URI="$(pypi_wheel_url "${PN#ensurepip-}")"
-S=${DISTDIR}
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-RDEPEND="
-	!<dev-python/ensurepip-wheels-100
-"
-
-src_install() {
-	insinto /usr/lib/python/ensurepip
-	doins "${A}"
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-74.1.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-75.1.0.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-74.1.2.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-75.1.0.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/Manifest
new file mode 100644
index 00000000000..217ef9dd646
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/Manifest
@@ -0,0 +1 @@
+DIST hatch-vcs-0.4.0.gh.tar.gz 10822 BLAKE2B 92b1ad1181a6bae815a6d01045836976b8767086f2a7001de9ad97f0d61737895da9a411419e28c5b2d830fca606d7d9c21265210965bc7691670f92aeab1b22 SHA512 bf40cc371c8d8e120fce83e5986fc2bdc2087fa5a4ac4a407d32617e98205ded79dcb29a00c7638ba68dd5ce09f31e84b34176627a6a34dfb7708031f4c4519a
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/hatch-vcs-0.4.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/hatch-vcs-0.4.0.ebuild
new file mode 100644
index 00000000000..a814774845f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/hatch-vcs-0.4.0.ebuild
@@ -0,0 +1,34 @@
+# Copyright 2022-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=hatchling
+PYTHON_COMPAT=( pypy3 python3_{10..13} )
+
+inherit distutils-r1
+
+DESCRIPTION="Hatch plugin for versioning with your preferred VCS"
+HOMEPAGE="
+	https://pypi.org/project/hatch-vcs/
+	https://github.com/ofek/hatch-vcs/
+"
+SRC_URI="
+	https://github.com/ofek/hatch-vcs/archive/v${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos"
+
+RDEPEND="
+	>=dev-python/setuptools-scm-6.4.0[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	test? (
+		dev-vcs/git
+	)
+"
+
+distutils_enable_tests pytest
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/metadata.xml
new file mode 100644
index 00000000000..1287ed7ca15
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/metadata.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>python@gentoo.org</email>
+	</maintainer>
+	<stabilize-allarches/>
+	<upstream>
+		<remote-id type="github">ofek/hatch-vcs</remote-id>
+		<remote-id type="pypi">hatch-vcs</remote-id>
+	</upstream>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/idna/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/idna/Manifest
index 3965bf89bd9..7b80a83a5ec 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/idna/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/idna/Manifest
@@ -1,2 +1 @@
 DIST idna-3.10.tar.gz 190490 BLAKE2B 887d92fd54b2f55b33856fcb9af3d6541a8cb28b9d49d1ee621dac7e1597ad5d2370000d6bfd895d5e515b4b6837949b5085fb391f283c375ffe4529072a8dd6 SHA512 bdc00fb42c48a34ec3df91b0592fe41785061f891a252ce82f168d99089a52e8e5bc7a823794f61e7915c0f691d911ed8b3bf7aecf3e2aeb3fc85da4ef35f47e
-DIST idna-3.8.tar.gz 189467 BLAKE2B e70c754f3a76807d2df9df09b19ec9ea8e98de19f81741dfbb2f828ebd0ac6385e2c0d2fab83206b4c592b40f0b785ed0078eafc0d0339cd9ff53440051c511d SHA512 5ea57a0e21621722375b8b3b90831c1e367f738d7d96d27143990d25ef26d374bcd306956a785ebe6283445642c39b8f655ab4de4b407055e350d11012acdb62
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/idna/idna-3.10.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/idna/idna-3.10.ebuild
index 2e79cc47216..4fbcb33e749 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/idna/idna-3.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/idna/idna-3.10.ebuild
@@ -17,6 +17,6 @@ HOMEPAGE="
 
 LICENSE="BSD"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 distutils_enable_tests unittest
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/idna/idna-3.8.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/idna/idna-3.8.ebuild
deleted file mode 100644
index 4fbcb33e749..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/idna/idna-3.8.ebuild
+++ /dev/null
@@ -1,22 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} pypy3 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Internationalized Domain Names in Applications (IDNA)"
-HOMEPAGE="
-	https://github.com/kjd/idna/
-	https://pypi.org/project/idna/
-"
-
-LICENSE="BSD"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-distutils_enable_tests unittest
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/Manifest
index 68aabc137b6..efcf71446cd 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/Manifest
@@ -1 +1,2 @@
 DIST jaraco_functools-4.0.2.tar.gz 18319 BLAKE2B d7a9e56c5fb2a6a7648bbbf5d8c7d8e6ba9d62ad26fe101d91975eec601ba9532c458458d2cf1fe21eef2c81aac0eab352197d5942c84ec0bef2c89213963e38 SHA512 8571982839ca340aaf5482f7f88afd1aac6472a176f4e37be1febae83d92073d31975e465ec7018d906f764ad47c98b3b6191948d6cbfa42a37845cda81351c2
+DIST jaraco_functools-4.1.0.tar.gz 19159 BLAKE2B 07c240152845cb8ec7c69bc1105b652499da1e62a1b6d7a246910cf22b543784946965e4cc4608c2de8f4c082904242e90bfc5c5c60ee252382308a02f35be19 SHA512 e893533830e176a7ac0a2da3c1b3fa3c53103e7aa163f9ab7c49635040ea845e19348dbf2628252de3c2952330682f5649a8113a6242db72e05995cca6919dfd
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/jaraco-functools-4.1.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/jaraco-functools-4.1.0.ebuild
new file mode 100644
index 00000000000..e4e184ad980
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/jaraco-functools-4.1.0.ebuild
@@ -0,0 +1,55 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYPI_PN=${PN/-/.}
+PYTHON_COMPAT=( pypy3 python3_{10..13} )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Additional functions used by other projects by developer jaraco"
+HOMEPAGE="
+	https://github.com/jaraco/jaraco.functools/
+	https://pypi.org/project/jaraco.functools/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+RDEPEND="
+	>=dev-python/more-itertools-0.12.0-r1[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	test? (
+		dev-python/jaraco-classes[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+src_configure() {
+	grep -q 'build-backend = "setuptools' pyproject.toml ||
+		die "Upstream changed build-backend, recheck"
+	# write a custom pyproject.toml to ease setuptools bootstrap
+	cat > pyproject.toml <<-EOF || die
+		[build-system]
+		requires = ["flit_core >=3.2,<4"]
+		build-backend = "flit_core.buildapi"
+
+		[project]
+		name = "jaraco.functools"
+		version = "${PV}"
+		description = "Functools like those found in stdlib"
+	EOF
+}
+
+python_install() {
+	distutils-r1_python_install
+	# rename to workaround a bug in pkg_resources
+	# https://bugs.gentoo.org/834522
+	mv "${D}$(python_get_sitedir)"/jaraco{_,.}functools-${PV}.dist-info || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/Manifest
index 5da9f7940bb..2cb8e7dac33 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/Manifest
@@ -1,2 +1 @@
-DIST more-itertools-10.4.0.tar.gz 120755 BLAKE2B 26950158c03c3d05cf5e6983941bf087e7799c90aff2928b20cfa9efc80a890f85a9616e95e363c4151d2233fa49b0dfaa381ab6e27d188573162887226ccdff SHA512 03f1a2390cac259138c96b4bd53712f14b8ee09dc83fe32f237835e7cac59ed22d48f6bc97d1734e06fb0fb44511abf72bf5d30b72e757ab2c62ee0b0f02ffb1
 DIST more-itertools-10.5.0.tar.gz 121020 BLAKE2B 16ab278873f4d7de97f61a2e865ff8561baa0aacd743c7483138c3dc7c8a219609ae80a0ff30bfc22f7064bfed45d764f17e35c2780ac6caf3a24231ab544e9b SHA512 fdb56b6bce26b335da61ae3a4bd0154a78389786132f62eaea53f0e8ee603c5609e35c69baccaac57935e81f839409b70f94cb8bbab9d541b0964a2c929c8168
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.4.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.4.0.ebuild
deleted file mode 100644
index b45d5bbe71c..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.4.0.ebuild
+++ /dev/null
@@ -1,24 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYPI_NO_NORMALIZE=1
-PYTHON_COMPAT=( python3_{10..13} pypy3 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="More routines for operating on iterables, beyond itertools"
-HOMEPAGE="
-	https://github.com/more-itertools/more-itertools/
-	https://pypi.org/project/more-itertools/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-distutils_enable_sphinx docs \
-	dev-python/sphinx-rtd-theme
-distutils_enable_tests unittest
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.5.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.5.0.ebuild
index a05c3990922..b45d5bbe71c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.5.0.ebuild
@@ -17,7 +17,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 distutils_enable_sphinx docs \
 	dev-python/sphinx-rtd-theme
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/msgpack/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/msgpack/Manifest
index 9ee781cdfb6..3bd4a08cf02 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/msgpack/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/msgpack/Manifest
@@ -1,3 +1,2 @@
-DIST msgpack-1.0.7.tar.gz 166311 BLAKE2B 8ddf2acf6bf81498d981c3ec83cbdffde1b1611f8ac23d3377f3f1541e679eda288b40b949bd586ca24a7059da3a0f73fa797a661375135ec092f408521c8527 SHA512 0ebd36f45b73106a4272588b55d55e72b6b8441be652b16f63f5547ae7ff1bc517a6b4549ef999ee63deb2856354a71ef37fd8d8829e516232518b046cf589c5
 DIST msgpack-1.0.8.tar.gz 167014 BLAKE2B 714b0355941104e791c5a3b8ee2bd4f40b11484631a3bde63e7c0bdbb925a603c4704b037ab437c2330dc0d2e466d41ccfd50c6a45ef798e5cd34a87e4e3863f SHA512 b739667d4384ba0e18a4e55de6033933822180eb5d28bd7f5ecd7e7da112a214f400740feb45de6f0873d12c8b062b1a8b9b9e5939c2961a8c9585f282645c5b
 DIST msgpack-1.1.0.tar.gz 167260 BLAKE2B fd6497ce248fabae481de41cb27bccf001e75425564f16caff9f5dceb52d82949481589a92635f4c25178f03002daf604073fc2bb07c8133e81a8ee2f1ccb7c4 SHA512 2af3a6ae9a68a0261bf1cbb5ca6925004b421241c445d17023976fe38738049458937a578828cdf3c1f2fd19dfbbcceb21762957bfd459d6862adb110cad3faa
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/msgpack/msgpack-1.0.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/msgpack/msgpack-1.0.7.ebuild
deleted file mode 100644
index e336975b473..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/msgpack/msgpack-1.0.7.ebuild
+++ /dev/null
@@ -1,51 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_EXT=1
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..12} pypy3 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="MessagePack (de)serializer for Python"
-HOMEPAGE="
-	https://msgpack.org/
-	https://github.com/msgpack/msgpack-python/
-	https://pypi.org/project/msgpack/
-"
-
-LICENSE="Apache-2.0"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-macos"
-IUSE="+native-extensions"
-
-# extension code is relying on CPython implementation details
-BDEPEND="
-	native-extensions? (
-		$(python_gen_cond_dep '
-			>=dev-python/cython-3.0.0[${PYTHON_USEDEP}]
-		' 'python*')
-	)
-"
-
-distutils_enable_tests pytest
-
-python_prepare_all() {
-	# Remove pre-generated cython files
-	rm msgpack/_cmsgpack.cpp || die
-
-	# native-extensions are always disabled on PyPy
-	# https://github.com/msgpack/msgpack-python/blob/main/setup.py#L76
-	if ! use native-extensions ; then
-		export MSGPACK_PUREPYTHON=1
-	fi
-
-	distutils-r1_python_prepare_all
-}
-
-python_test() {
-	rm -rf msgpack || die
-	epytest
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/msgpack/msgpack-1.1.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/msgpack/msgpack-1.1.0.ebuild
index 5494aa178eb..42fe4709f0d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/msgpack/msgpack-1.1.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/msgpack/msgpack-1.1.0.ebuild
@@ -18,7 +18,7 @@ HOMEPAGE="
 
 LICENSE="Apache-2.0"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-macos"
 IUSE="+native-extensions"
 
 # extension code is relying on CPython implementation details
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest
index 2bd6c6eb7ee..4b85d64b912 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest
@@ -1,4 +1 @@
-DIST platformdirs-4.2.2.tar.gz 20916 BLAKE2B d7c551a950118a127664b8210f33497760ce06381ac6a4ea098d1a1c60605507b5e2a9762d5f7d112332d3cebd63cb642b25e93a8b67dd2a1ee7cca189f3555f SHA512 e67aff332a6c84669d77a68e7d5546bfd14e08dcf61681b03447bf6381c0d981c63be0f87fd63bc99f0a51c92bf960902ded83ba8872801c14755ab163d45a0f
-DIST platformdirs-4.3.1.tar.gz 21236 BLAKE2B 852d402831ad6060c6efc3841dd56a8484aca547e820ad9b46cc838d92f560407a769a01942bf03c31949e4b37240d292358617afdfa0dd7ea03eeba6bc62086 SHA512 6d4cd808190808bab5a90f44d9fe2fda0d624c7a76faf9f4a4a6093cd098a28b79782dbf895dcd0eeb82778aa094deeb0959fcbe25bdd93818a47b9e197b6299
-DIST platformdirs-4.3.2.tar.gz 21276 BLAKE2B 9bd9a2b3258e2fe411062895bbcc5036c77d95e092df81c9b9b113f64b4568ee44623a747048c9011e9465fb22600db9256e4900c7710a75fc27cf19c07732c7 SHA512 0bad11558f3d60f1476cdcd36a405c7218b9ce68342e3a78f95936356d91fcaaa869549503cc35055d9ce3b3eec219a980ba35e814dd3706fb4b7812aff04dd4
-DIST platformdirs-4.3.3.tar.gz 21304 BLAKE2B 94248b49ab0b0ea7c43231c15c3f479c1ea0a82242a9d274b6e6b71559710f1d3bbd8ad89083c89f7627956a983ad2902cbf33b8b99a12a1481214a969fcc292 SHA512 0dc8b8585c4130660a779a1846a4d468a182dfcc0f03700001242f1eb78ba2bd9799777f6ac29367034ed23c66f1af4eda4f294201197d6444d6fdd92e7f93a1
+DIST platformdirs-4.3.6.tar.gz 21302 BLAKE2B 3488d33c70c420a7234fa773a7b61eaabc85e7aabfa75c9de308074ef653b534823a133038eb8098d41f987596d7fa6c70abd6cdde28234590261ecd6c8a9f56 SHA512 8a14126346f5472798074bd9ef73b39cd0c6517951556f7ab839d2c1993d8001a3359101fe3a7a00e803d8a5540cf33057d99e1a2e93b1bd5e20a948c89e4e44
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.1.ebuild
deleted file mode 100644
index 7b2b77a8066..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.1.ebuild
+++ /dev/null
@@ -1,54 +0,0 @@
-# Copyright 2021-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} pypy3 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="A small Python module for determining appropriate platform-specific dirs"
-HOMEPAGE="
-	https://pypi.org/project/platformdirs/
-	https://github.com/tox-dev/platformdirs/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
-
-BDEPEND="
-	test? (
-		dev-python/appdirs[${PYTHON_USEDEP}]
-		dev-python/pytest-mock[${PYTHON_USEDEP}]
-	)
-"
-
-distutils_enable_tests pytest
-
-src_configure() {
-	grep -q 'build-backend = "hatchling' pyproject.toml ||
-		die "Upstream changed build-backend, recheck"
-	# write a custom pyproject.toml to ease setuptools bootstrap
-	cat > pyproject.toml <<-EOF || die
-		[build-system]
-		requires = ["flit_core >=3.2,<4"]
-		build-backend = "flit_core.buildapi"
-
-		[project]
-		name = "${PN}"
-		version = "${PV}"
-		description = 'A small Python package for determining appropriate platform-specific dirs, e.g. a "user data dir".'
-	EOF
-	# sigh
-	cat > src/platformdirs/version.py <<-EOF || die
-		__version__ = version = '${PV}'
-		__version_tuple__ = version_tuple = (${PV//./, })
-	EOF
-}
-
-python_test() {
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	epytest -p pytest_mock
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.2.ebuild
deleted file mode 100644
index 7b2b77a8066..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.2.ebuild
+++ /dev/null
@@ -1,54 +0,0 @@
-# Copyright 2021-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} pypy3 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="A small Python module for determining appropriate platform-specific dirs"
-HOMEPAGE="
-	https://pypi.org/project/platformdirs/
-	https://github.com/tox-dev/platformdirs/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
-
-BDEPEND="
-	test? (
-		dev-python/appdirs[${PYTHON_USEDEP}]
-		dev-python/pytest-mock[${PYTHON_USEDEP}]
-	)
-"
-
-distutils_enable_tests pytest
-
-src_configure() {
-	grep -q 'build-backend = "hatchling' pyproject.toml ||
-		die "Upstream changed build-backend, recheck"
-	# write a custom pyproject.toml to ease setuptools bootstrap
-	cat > pyproject.toml <<-EOF || die
-		[build-system]
-		requires = ["flit_core >=3.2,<4"]
-		build-backend = "flit_core.buildapi"
-
-		[project]
-		name = "${PN}"
-		version = "${PV}"
-		description = 'A small Python package for determining appropriate platform-specific dirs, e.g. a "user data dir".'
-	EOF
-	# sigh
-	cat > src/platformdirs/version.py <<-EOF || die
-		__version__ = version = '${PV}'
-		__version_tuple__ = version_tuple = (${PV//./, })
-	EOF
-}
-
-python_test() {
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	epytest -p pytest_mock
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.3.ebuild
deleted file mode 100644
index 7b2b77a8066..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.3.ebuild
+++ /dev/null
@@ -1,54 +0,0 @@
-# Copyright 2021-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} pypy3 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="A small Python module for determining appropriate platform-specific dirs"
-HOMEPAGE="
-	https://pypi.org/project/platformdirs/
-	https://github.com/tox-dev/platformdirs/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
-
-BDEPEND="
-	test? (
-		dev-python/appdirs[${PYTHON_USEDEP}]
-		dev-python/pytest-mock[${PYTHON_USEDEP}]
-	)
-"
-
-distutils_enable_tests pytest
-
-src_configure() {
-	grep -q 'build-backend = "hatchling' pyproject.toml ||
-		die "Upstream changed build-backend, recheck"
-	# write a custom pyproject.toml to ease setuptools bootstrap
-	cat > pyproject.toml <<-EOF || die
-		[build-system]
-		requires = ["flit_core >=3.2,<4"]
-		build-backend = "flit_core.buildapi"
-
-		[project]
-		name = "${PN}"
-		version = "${PV}"
-		description = 'A small Python package for determining appropriate platform-specific dirs, e.g. a "user data dir".'
-	EOF
-	# sigh
-	cat > src/platformdirs/version.py <<-EOF || die
-		__version__ = version = '${PV}'
-		__version_tuple__ = version_tuple = (${PV//./, })
-	EOF
-}
-
-python_test() {
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	epytest -p pytest_mock
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.2.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.6.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.2.2.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.6.ebuild
index 36cccfe9d29..a67ec460cbe 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.2.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.6.ebuild
@@ -11,7 +11,7 @@ inherit distutils-r1 pypi
 DESCRIPTION="A small Python module for determining appropriate platform-specific dirs"
 HOMEPAGE="
 	https://pypi.org/project/platformdirs/
-	https://github.com/platformdirs/platformdirs/
+	https://github.com/tox-dev/platformdirs/
 "
 
 LICENSE="MIT"
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pyproject-hooks/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/pyproject-hooks/Manifest
index e83e095938e..0f63b86e196 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pyproject-hooks/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pyproject-hooks/Manifest
@@ -1 +1,2 @@
 DIST pyproject-hooks-1.1.0.gh.tar.gz 18774 BLAKE2B e6b376188655a5bc188567f412c22f8224209612c4fb0332f8c0c441180c18589139549139957834b3359bf3ced961e22f97e2449edc354047afaa6d2eff58d7 SHA512 256028d13adbe35126a63431a2a49e0c48adddce5ffc3ff2eebad368eee7ce52591ecfd8a8526876de20bc59dfc87156533d6a97b55538a739873e60f9509eff
+DIST pyproject_hooks-1.2.0.tar.gz 19228 BLAKE2B e02864220393876639cc459918f48c02e19835b392102d117cb5900c9a4f5228bc21377421f7afdd67300ba15d131194197a3b4b1ce0ad7fef195bca9be4344b SHA512 e098e521f03cfae9a96c0ee5d2e2ef46ef832d8f38c7d8380fc17355776e09ae3a704879e6e4a2bc7999092c4dbf80267b3b56850135c74d275a12607e0ffe83
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pyproject-hooks/pyproject-hooks-1.2.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pyproject-hooks/pyproject-hooks-1.2.0.ebuild
new file mode 100644
index 00000000000..3853b5b2228
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pyproject-hooks/pyproject-hooks-1.2.0.ebuild
@@ -0,0 +1,38 @@
+# Copyright 2021-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( python3_{10..13} pypy3 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Wrappers to build Python packages using PEP 517 hooks"
+HOMEPAGE="
+	https://pypi.org/project/pyproject-hooks/
+	https://github.com/pypa/pyproject-hooks/
+	https://pyproject-hooks.readthedocs.io/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+
+BDEPEND="
+	test? (
+		dev-python/testpath[${PYTHON_USEDEP}]
+		$(python_gen_cond_dep '
+			dev-python/tomli[${PYTHON_USEDEP}]
+		' 3.10)
+	)
+"
+
+distutils_enable_tests pytest
+
+EPYTEST_DESELECT=(
+	# fails due to setuptools 70.1
+	# https://bugs.gentoo.org/936052
+	# https://github.com/pypa/pyproject-hooks/issues/203
+	tests/test_call_hooks.py::test_setup_py
+)
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/rich/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/rich/Manifest
index 18e5efadf16..f4fde6065f3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/rich/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/rich/Manifest
@@ -1,3 +1,3 @@
-DIST rich-13.7.1.gh.tar.gz 15058064 BLAKE2B 6fad18bf0a4e4f72e530c78db7a498f27dd8c9a7b9b17ca5ef12a94bbe513857f3c42d4903f8ebbfe8907727cddaf290f08862c27efb29db8aaf70c7bcb13ace SHA512 0c69101bc6c2a238a4c516812cda08299115b903b8282ee348b45b212a88fcbfbf69d11a3705a97bdb6192988ee3047804bb5b52b7950d860542cde8ce2d4bd2
-DIST rich-13.8.0.gh.tar.gz 15062770 BLAKE2B e319018387ff27f4ec2bce1d272ff7fe676d224a14798fa585c0d72fcdedd084c3e1d4b73d3d2db45a113e0c5433c7103382c7134ff6e1c8e580ff2c3fa444ae SHA512 d20545689b6acd14a5010f0dbb38a2dbc1fd551619198d098e6bf68628e194f3b5450c11b77feb190ea4b4bb2c22a9a6b619b17c9f7815a4e69e1c431750ab60
 DIST rich-13.8.1.gh.tar.gz 15062921 BLAKE2B 6df186dee1eccabbb28ef4bcd3bbceac335fbe39cf1ff6318726146f3eead9033fe362ca3c363c057c9b898ebb824d55f13454d68cb917dfc82e07e1e0038fa4 SHA512 d84d05fcc657fbcbcca09c22856c36fb945fde481111565292b13a9c5472cc1cf7e6266069f80b48821f7307a1479edc65a48d3b8a96334922b151d93b402daa
+DIST rich-13.9.1.gh.tar.gz 15063679 BLAKE2B ce08c00e9d1754c75485ebc025a2479bd2dd851f38d87a40c38ef17118c626a9f1ca17219578b7a0e7ad758d626465f467850ccf2d37d8d29501951eca516eec SHA512 c45406ad33f86d0f310a6ae229b0e9eea39313bf21fb7d44bc2e40993c4928814db26f6b9740477dc6418c4eb1974fe2bf782b98288dac12b109673ee783a62c
+DIST rich-13.9.2.gh.tar.gz 15063908 BLAKE2B c83f736630a7bfbccda7d790476e7a9f518f2fa4e6bb3d4f5190bdeae784571875066c94bd8f4e01117b45a7eee83e9072bb7bb64ab5d5d8675aac5a63d5b0b5 SHA512 468e8f758c374264a77be154dde8908e04502cf8dfdc442dacfaebaaf9f1fbf634ae8dcbcefe42f7562183532a372aebebcdcb03c90031f619a8c5f2cd78f653
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-13.8.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-13.8.1.ebuild
index 652acb19383..c930ae408f0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-13.8.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-13.8.1.ebuild
@@ -20,7 +20,7 @@ SRC_URI="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 
 RDEPEND="
 	dev-python/colorama[${PYTHON_USEDEP}]
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-13.8.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-13.9.1.ebuild
similarity index 95%
rename from sdk_container/src/third_party/portage-stable/dev-python/rich/rich-13.8.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/rich/rich-13.9.1.ebuild
index 652acb19383..de21ed690f8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-13.8.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-13.9.1.ebuild
@@ -26,6 +26,9 @@ RDEPEND="
 	dev-python/colorama[${PYTHON_USEDEP}]
 	>=dev-python/markdown-it-py-2.2.0[${PYTHON_USEDEP}]
 	>=dev-python/pygments-2.13.0[${PYTHON_USEDEP}]
+	$(python_gen_cond_dep '
+		>=dev-python/typing-extensions-4.0.0[${PYTHON_USEDEP}]
+	' 3.10)
 "
 BDEPEND="
 	test? (
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-13.7.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-13.9.2.ebuild
similarity index 90%
rename from sdk_container/src/third_party/portage-stable/dev-python/rich/rich-13.7.1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/rich/rich-13.9.2.ebuild
index c930ae408f0..de21ed690f8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-13.7.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-13.9.2.ebuild
@@ -20,12 +20,15 @@ SRC_URI="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 
 RDEPEND="
 	dev-python/colorama[${PYTHON_USEDEP}]
 	>=dev-python/markdown-it-py-2.2.0[${PYTHON_USEDEP}]
 	>=dev-python/pygments-2.13.0[${PYTHON_USEDEP}]
+	$(python_gen_cond_dep '
+		>=dev-python/typing-extensions-4.0.0[${PYTHON_USEDEP}]
+	' 3.10)
 "
 BDEPEND="
 	test? (
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
index 3a76820ee22..fec469fcf63 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
@@ -1,4 +1,3 @@
 DIST setuptools-73.0.1.tar.gz 2526506 BLAKE2B 766453a7f6f3e34bdc63628b8c0321730c66381cc6048d01fbf9dbf76eb9900cd5cfa6dbd7c55c95ada3e01065d43bf7cd9029793e0735cae989b3cb1b95287c SHA512 5def2d817329524e610c7981fc3a84687ea4d2e0a72799341a706a16ec61df3efc16c4622f8b88746ad4cb52f92f2493c23a99a21cf3607ed48da480dedd200b
-DIST setuptools-74.1.2.tar.gz 1356467 BLAKE2B bc625e323f94ba9166f2c9747610d71c0ef7ad2a07f6b3e0cedabcbac67bba6d05679a7bce3c3e761807727c10e111801d486c01f3cdb7e22ca4324370c2cfb9 SHA512 581cc51bf70fe378ca8dcdb2cbed6056de4c335c7e997ed126cc707a84c52571dfa0379f34e2f8bebf50ab27f4c20c718dd854f1378e3c6d4cf75a094e57a77c
 DIST setuptools-74.1.3.tar.gz 1356471 BLAKE2B c59476710f10aae77f8b466ce2b072966a889b13c3e2e2a9524497ce43893bcd296412f8e0be8a3ccaa9be46b429680c11fe291095a65a185243701fa667be6c SHA512 7892d1ff0a1cd90f6cd367536392bf2933d354eb61d5177a01218b253bc254b51e74c040601adf35aff1652f1e1c6dbffca3cdce3f4fc32b8bd23c36cd885ddc
-DIST setuptools-75.0.0.tar.gz 1347819 BLAKE2B db2745fecb86a0747acab21371ea0714b2c97694490f3e71bb59a51d05b782af60f044cbb9ad29c4798644cd986119d98592ae857ccfd9b3a3fc98199291568b SHA512 78955967c23450822a154db99f9a4cb5d45bfb2fe42797ea39c784e23004172d75fbbba6a6b89fa8c0d63c6b9ffb45e791e48b3d8201cfffc84bd75769cd02ef
+DIST setuptools-75.1.0.tar.gz 1348057 BLAKE2B a749260ee2b3162ce102204d89b00bcb6d69c84a7785dee443467946b4fe275f080917b204e65d8abd9e629e5ebef311825a1a472b3e5a09815373ab172b1ca4 SHA512 5003e81c7988dd522cfba233ac643ade9a1ff074a13182a81da7fe3f40565b97dd2696c96b8a0694fcd3417e527e2cf6d6ea5e21d29ff927c1ab5916a2607239
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-73.0.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-73.0.1.ebuild
index 3a4611df6fd..3e241dfd0c5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-73.0.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-73.0.1.ebuild
@@ -26,7 +26,7 @@ IUSE="test"
 RESTRICT="!test? ( test )"
 
 RDEPEND="
-	!!<dev-python/setuptools-rust-1.8.0
+	!<dev-python/setuptools-rust-1.8.0
 	>=dev-python/jaraco-text-3.7.0-r1[${PYTHON_USEDEP}]
 	>=dev-python/more-itertools-8.12.0-r1[${PYTHON_USEDEP}]
 	>=dev-python/packaging-24[${PYTHON_USEDEP}]
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-74.1.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-74.1.2.ebuild
deleted file mode 100644
index d0ea50e812c..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-74.1.2.ebuild
+++ /dev/null
@@ -1,126 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
-EAPI=8
-
-# please bump dev-python/ensurepip-setuptools along with this package!
-
-DISTUTILS_USE_PEP517=standalone
-PYTHON_TESTED=( python3_{10..13} pypy3 )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" )
-PYTHON_REQ_USE="xml(+)"
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Collection of extensions to Distutils"
-HOMEPAGE="
-	https://github.com/pypa/setuptools/
-	https://pypi.org/project/setuptools/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
-IUSE="test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	!!<dev-python/setuptools-rust-1.8.0
-	>=dev-python/jaraco-text-3.7.0-r1[${PYTHON_USEDEP}]
-	>=dev-python/more-itertools-8.12.0-r1[${PYTHON_USEDEP}]
-	>=dev-python/packaging-24[${PYTHON_USEDEP}]
-	>=dev-python/platformdirs-2.6.2-r1[${PYTHON_USEDEP}]
-	>=dev-python/wheel-0.44.0[${PYTHON_USEDEP}]
-	$(python_gen_cond_dep '
-		>=dev-python/tomli-2.0.1[${PYTHON_USEDEP}]
-	' 3.10)
-	!!<=dev-libs/gobject-introspection-1.76.1-r0
-	!!=dev-libs/gobject-introspection-1.78.1-r0
-	!!=dev-libs/gobject-introspection-1.80.1-r1
-"
-BDEPEND="
-	${RDEPEND}
-	test? (
-		$(python_gen_cond_dep '
-			>=dev-python/build-1.0.3[${PYTHON_USEDEP}]
-			>=dev-python/ini2toml-0.14[${PYTHON_USEDEP}]
-			>=dev-python/filelock-3.4.0[${PYTHON_USEDEP}]
-			>=dev-python/jaraco-envs-2.2[${PYTHON_USEDEP}]
-			>=dev-python/jaraco-path-3.2.0[${PYTHON_USEDEP}]
-			dev-python/jaraco-test[${PYTHON_USEDEP}]
-			dev-python/pip[${PYTHON_USEDEP}]
-			dev-python/pip-run[${PYTHON_USEDEP}]
-			dev-python/pyproject-hooks[${PYTHON_USEDEP}]
-			dev-python/pytest[${PYTHON_USEDEP}]
-			>=dev-python/pytest-home-0.5[${PYTHON_USEDEP}]
-			dev-python/pytest-subprocess[${PYTHON_USEDEP}]
-			dev-python/pytest-timeout[${PYTHON_USEDEP}]
-			dev-python/pytest-xdist[${PYTHON_USEDEP}]
-			>=dev-python/tomli-w-1.0.0[${PYTHON_USEDEP}]
-			>=dev-python/virtualenv-20[${PYTHON_USEDEP}]
-		' "${PYTHON_TESTED[@]}")
-	)
-"
-# setuptools-scm is here because installing plugins apparently breaks stuff at
-# runtime, so let's pull it early. See bug #663324.
-#
-# trove-classifiers are optionally used in validation, if they are
-# installed.  Since we really oughtn't block them, let's always enforce
-# the newest version for the time being to avoid errors.
-# https://github.com/pypa/setuptools/issues/4459
-PDEPEND="
-	dev-python/setuptools-scm[${PYTHON_USEDEP}]
-	>=dev-python/trove-classifiers-2024.7.2[${PYTHON_USEDEP}]
-"
-
-src_prepare() {
-	local PATCHES=(
-		# TODO: remove this when we're 100% PEP517 mode
-		"${FILESDIR}/setuptools-62.4.0-py-compile.patch"
-	)
-
-	distutils-r1_src_prepare
-
-	# breaks tests
-	sed -i -e '/--import-mode/d' pytest.ini || die
-
-	# remove bundled dependencies
-	rm -r */_vendor || die
-}
-
-python_test() {
-	if ! has "${EPYTHON}" "${PYTHON_TESTED[@]/_/.}"; then
-		return
-	fi
-
-	local EPYTEST_DESELECT=(
-		# network
-		setuptools/tests/test_build_meta.py::test_legacy_editable_install
-		setuptools/tests/test_distutils_adoption.py
-		setuptools/tests/test_editable_install.py
-		setuptools/tests/test_virtualenv.py::test_no_missing_dependencies
-		setuptools/tests/test_virtualenv.py::test_test_command_install_requirements
-		# TODO
-		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_basic
-		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_ignore_errors
-		# expects bundled deps in virtualenv
-		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_in_sdist
-		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_not_in_wheel
-		# fails if python-xlib is installed
-		setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_allow_hosts
-		# TODO, probably some random package
-		setuptools/tests/config/test_setupcfg.py::TestOptions::test_cmdclass
-		# broken by unbundling
-		setuptools/tests/test_setuptools.py::test_wheel_includes_vendored_metadata
-		# fails on normalized metadata, perhaps different dep version?
-		setuptools/tests/test_build_meta.py::TestBuildMetaBackend::test_build_with_pyproject_config
-		# TODO
-		setuptools/tests/test_sdist.py::test_sanity_check_setuptools_own_sdist
-	)
-
-	local EPYTEST_XDIST=1
-	local -x PRE_BUILT_SETUPTOOLS_WHEEL=${DISTUTILS_WHEEL_PATH}
-	epytest -o tmp_path_retention_policy=all \
-		-m "not uses_network" setuptools
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-74.1.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-74.1.3.ebuild
index d0ea50e812c..63143677e23 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-74.1.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-74.1.3.ebuild
@@ -26,7 +26,7 @@ IUSE="test"
 RESTRICT="!test? ( test )"
 
 RDEPEND="
-	!!<dev-python/setuptools-rust-1.8.0
+	!<dev-python/setuptools-rust-1.8.0
 	>=dev-python/jaraco-text-3.7.0-r1[${PYTHON_USEDEP}]
 	>=dev-python/more-itertools-8.12.0-r1[${PYTHON_USEDEP}]
 	>=dev-python/packaging-24[${PYTHON_USEDEP}]
@@ -35,9 +35,9 @@ RDEPEND="
 	$(python_gen_cond_dep '
 		>=dev-python/tomli-2.0.1[${PYTHON_USEDEP}]
 	' 3.10)
-	!!<=dev-libs/gobject-introspection-1.76.1-r0
-	!!=dev-libs/gobject-introspection-1.78.1-r0
-	!!=dev-libs/gobject-introspection-1.80.1-r1
+	!<=dev-libs/gobject-introspection-1.76.1-r0
+	!=dev-libs/gobject-introspection-1.78.1-r0
+	!=dev-libs/gobject-introspection-1.80.1-r1
 "
 BDEPEND="
 	${RDEPEND}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-75.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-75.1.0.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-75.0.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-75.1.0.ebuild
index 3b8c9465b6c..df219ec8434 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-75.0.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-75.1.0.ebuild
@@ -26,7 +26,7 @@ IUSE="test"
 RESTRICT="!test? ( test )"
 
 RDEPEND="
-	!!<dev-python/setuptools-rust-1.8.0
+	!<dev-python/setuptools-rust-1.8.0
 	dev-python/jaraco-collections[${PYTHON_USEDEP}]
 	dev-python/jaraco-functools[${PYTHON_USEDEP}]
 	>=dev-python/jaraco-text-3.7.0-r1[${PYTHON_USEDEP}]
@@ -37,9 +37,9 @@ RDEPEND="
 	$(python_gen_cond_dep '
 		>=dev-python/tomli-2.0.1[${PYTHON_USEDEP}]
 	' 3.10)
-	!!<=dev-libs/gobject-introspection-1.76.1-r0
-	!!=dev-libs/gobject-introspection-1.78.1-r0
-	!!=dev-libs/gobject-introspection-1.80.1-r1
+	!<=dev-libs/gobject-introspection-1.76.1-r0
+	!=dev-libs/gobject-introspection-1.78.1-r0
+	!=dev-libs/gobject-introspection-1.80.1-r1
 "
 BDEPEND="
 	${RDEPEND}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/Manifest
index bfd8a713f81..275148e81f6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/Manifest
@@ -1 +1 @@
-DIST snakeoil-0.10.8.tar.gz 174380 BLAKE2B 96c5f4e106513ee8061c6278345ac132510202faa0e915b362170ee7de5f23f0b7bfdc671c0c07721f57eeeb90df5f6851be70d4541295029d93126ea680e50b SHA512 7088cd3fb34bc666a51ddd59b0bf6c9d9da2f04727057ffa5b74ffb188efd63153afcf45442e99b8e1611642b71cf92518dafcacb85717dfa82370df18458497
+DIST snakeoil-0.10.9.tar.gz 174546 BLAKE2B c42771bff9b068aa4c31f76e0d8efc44121d2946b24ff8b8ce6e11028503d7272087ae62c1b6c9963c9b3eb89202ffbad917c63984d478d062c4ba2272811ba2 SHA512 0cedfeca3c8a30cfa53a2135b9dc8f83b003dd07fd0a1767fc1e2fe3d1ee67022033c20c4f990dede7e6a0ad0e8dc94eeebce7529b230ce83c84d6161c1b656d
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.8.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.9.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.8.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.9.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/tomli/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/tomli/Manifest
index b87d6410b6b..10b08e1fbb6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/tomli/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/tomli/Manifest
@@ -1,2 +1,4 @@
 DIST tomli-2.0.1-py3-none-any.whl.zip 12757 BLAKE2B 0a33773bc0409831aec6ee803ef0ef9d6b6b441213d549184068e218b73d6178d617bc2b58d11db98f0e6284baaf81663723fbc6eb89f7466608f0d89aeb1982 SHA512 b6164b03d3db360093f92e644e87a37a0ce20d63d7e9e271fcafd727f4fdb73ad6b301aaf32b3d2839f6eedbc8ea499dafba7335b8fdfc4667e30ed50c9805b4
 DIST tomli-2.0.1.gh.tar.gz 133685 BLAKE2B 0d3a1f4ee4e74eeab6a7e7c3d5e866ce1baf9017136cdc8ce1f6275f8d6d151239e5a00b97b6409872fac0e8558a49120adf16f0ae21f9d92ae630dfd39cd6ff SHA512 a467f8d48cdbd7213bd9b6f85fd48ba142ab7c9656c40bb30785e1c4b37a9e29eaed420f183458ad20112baee8413ebbec87755332795c8f02235d1018c3aa5c
+DIST tomli-2.0.2-py3-none-any.whl.zip 13237 BLAKE2B 642af1b59a2b2bceeee2480208f3680ec699bc9b572bde186ff8c845526e41e2ebc145f78ae4094ae3ee084ebfde561ec635358ff3df9c5609101c96d0b54ded SHA512 ad8278fc99a6913ebb70a618a7cad7acca9737e6ec546c932b4d0c1caddc1e70ef832340a33f2db974235459ff627949308d517b3c3a15b6baf8a4f1b3095e49
+DIST tomli-2.0.2.gh.tar.gz 135227 BLAKE2B 1d61fd26793c4f814ed606a60b85edb388bf97d6fd17c830504971be725c84e9e6e67904170cff305fdb7be8196b56d0cc29dd36f8b202798788f4839ba8ddc6 SHA512 3eeea334d6d225590a9e074685c65d052e2f5d5286ca895ff7e9532d7289f0daa31ae67b5076d803e5adad4f20a9831058a0c4599715f049079904934d3d9c25
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/tomli/tomli-2.0.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/tomli/tomli-2.0.2.ebuild
new file mode 100644
index 00000000000..2ff54bd4c53
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/tomli/tomli-2.0.2.ebuild
@@ -0,0 +1,40 @@
+# Copyright 2021-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=no
+PYTHON_COMPAT=( python3_{10..13} pypy3 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="A lil' TOML parser"
+HOMEPAGE="
+	https://pypi.org/project/tomli/
+	https://github.com/hukkin/tomli/
+"
+SRC_URI="
+	https://github.com/hukkin/tomli/archive/${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+	$(pypi_wheel_url --unpack)
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+BDEPEND="
+	app-arch/unzip
+"
+
+distutils_enable_tests unittest
+
+python_compile() {
+	python_domodule src/tomli "${WORKDIR}"/*.dist-info
+}
+
+python_install() {
+	distutils-r1_python_install
+	python_optimize
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.22.3-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.22.3-r2.ebuild
index 1e6709d31d7..4c211891b93 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.22.3-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.22.3-r2.ebuild
@@ -22,7 +22,7 @@ S=${WORKDIR}/py-${P}
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 
 # setuptools is needed for distutils import
 DEPEND=">=dev-libs/tree-sitter-0.22.1:="
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.23.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.23.0.ebuild
index a6868ec550d..12fadd9d9bb 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.23.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.23.0.ebuild
@@ -22,7 +22,7 @@ S=${WORKDIR}/py-${P}
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
 
 # setuptools is needed for distutils import
 DEPEND=">=dev-libs/tree-sitter-0.23.0:="
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest
index 5194bf84b76..469cc1048f9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest
@@ -1,2 +1 @@
-DIST trove_classifiers-2024.7.2.tar.gz 16071 BLAKE2B 6f13df1498b68e2f24838473ad8b6feb341e33da6eabc2e104c823e6db65ada348ef36c8fd96226818d89c11bf0b0ac9665c9a6ecbea5ba620d2e48c64c5b82f SHA512 af9a366425e845b1bbd098c8085ec8064dbf6864940c7dd5def1672c2046756e2c76255b282b2c989c34d14b113b7c6abd32d23eeed88317d374043040f46486
 DIST trove_classifiers-2024.9.12.tar.gz 16058 BLAKE2B 6cac2247910e95bf1f0b9a37b0f0e59062652526a45c4097c743a5f0665a5d8b5042bb7eb02741f2bf9b7d669a1be238940ab2b498281ef3ce6f3fa4c0c2961c SHA512 4fc6efc514638dfb2aee4fbd06f258bb9d5d9d54269e6d33f3739a63d61d6d3caa9a7124f9e5ad601714253c27b97bc9a60f3a9369f2f358ed19fbdfcefcbb10
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2024.7.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2024.7.2.ebuild
deleted file mode 100644
index 0879f0c5b4e..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2024.7.2.ebuild
+++ /dev/null
@@ -1,42 +0,0 @@
-# Copyright 2022-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( pypy3 python3_{10..13} )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Canonical source for classifiers on PyPI (pypi.org)"
-HOMEPAGE="
-	https://github.com/pypa/trove-classifiers/
-	https://pypi.org/project/trove-classifiers/
-"
-
-LICENSE="Apache-2.0"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-distutils_enable_tests pytest
-
-src_configure() {
-	grep -q 'build-backend = "setuptools' pyproject.toml ||
-		die "Upstream changed build-backend, recheck"
-	# write a custom pyproject.toml to ease hatchling bootstrap
-	cat > pyproject.toml <<-EOF || die
-		[build-system]
-		requires = ["flit_core >=3.2,<4"]
-		build-backend = "flit_core.buildapi"
-
-		[project]
-		name = "trove-classifiers"
-		version = "${PV}"
-		description = "Canonical source for classifiers on PyPI (pypi.org)."
-	EOF
-}
-
-python_test() {
-	epytest
-	"${EPYTHON}" -m tests.lib || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2024.9.12.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2024.9.12.ebuild
index 0fb0bac459d..0879f0c5b4e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2024.9.12.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2024.9.12.ebuild
@@ -16,7 +16,7 @@ HOMEPAGE="
 
 LICENSE="Apache-2.0"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 distutils_enable_tests pytest
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/urllib3/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/urllib3/Manifest
index 6b235d6edb8..7ca1265b11b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/urllib3/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/urllib3/Manifest
@@ -1,3 +1,2 @@
 DIST hypercorn-d1719f8c1570cbd8e6a3719ffdb14a4d72880abb.gh.tar.gz 156216 BLAKE2B fcb5f49653401e6e4079e1c770d3cd407602d4d6764437b735bd4ec04191dec59cdc930822fa2aff726ee25cddd0f71fd457dedf31026bff1da121d93af8b768 SHA512 62d6787d88a2e716f0ac04fc49f6cdc586e473a660ee754ff66961922ae78bcc75d1f78b091e78557dd60f006e8e480114738c7b4ff71beac804e4fc9603240b
-DIST urllib3-2.2.2.tar.gz 292266 BLAKE2B 50d4825ff4bd950742708bec63feb1713e211293f7720c79f2c71740f3eb3d501b476b8de5b389b8fb978c2486081023ebc2e05162c5d4fcedd811452743e07a SHA512 98695bcf37e772a1220cc05679ea799d82a09c73115717668c90dab9377690dd096f648d60ac0759a23cf65f2b1b6f363ec6826f669d4299bfa0a203a45dce0f
 DIST urllib3-2.2.3.tar.gz 300677 BLAKE2B 7eb17ab324bf210fb52b1012bf9d37c1a7f3b742aafe7e49adf2dde1678089e94683feedaa2301dd510944da0a5afc331ded13d0631af3efe4dbd576d0dee0ec SHA512 f461cc959d675b8b13c2f40f4b021cab01ccb3a5033143f5c3eae3fce7486115994d198c78db9ef353fce47c17b25e0ecb010fbdebc1b8731d4fd708054b39cc
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/urllib3/urllib3-2.2.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/urllib3/urllib3-2.2.2.ebuild
deleted file mode 100644
index a1b47de9734..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/urllib3/urllib3-2.2.2.ebuild
+++ /dev/null
@@ -1,94 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
-EAPI=8
-
-DISTUTILS_USE_PEP517=hatchling
-PYTHON_TESTED=( python3_{10..13} pypy3 )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" )
-PYTHON_REQ_USE="ssl(+)"
-
-inherit distutils-r1 pypi
-
-# The package has a test dependency on their own hypercorn fork.
-HYPERCORN_COMMIT=d1719f8c1570cbd8e6a3719ffdb14a4d72880abb
-DESCRIPTION="HTTP library with thread-safe connection pooling, file post, and more"
-HOMEPAGE="
-	https://github.com/urllib3/urllib3/
-	https://pypi.org/project/urllib3/
-"
-SRC_URI+="
-	test? (
-		https://github.com/urllib3/hypercorn/archive/${HYPERCORN_COMMIT}.tar.gz
-			-> hypercorn-${HYPERCORN_COMMIT}.gh.tar.gz
-	)
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
-IUSE="brotli http2 test zstd"
-RESTRICT="!test? ( test )"
-
-# [secure] extra is deprecated and slated for removal, we don't need it:
-# https://github.com/urllib3/urllib3/issues/2680
-RDEPEND="
-	>=dev-python/PySocks-1.5.8[${PYTHON_USEDEP}]
-	<dev-python/PySocks-2.0[${PYTHON_USEDEP}]
-	brotli? ( >=dev-python/brotlicffi-0.8.0[${PYTHON_USEDEP}] )
-	http2? (
-		<dev-python/h2-5[${PYTHON_USEDEP}]
-		>=dev-python/h2-4[${PYTHON_USEDEP}]
-	)
-	zstd? ( >=dev-python/zstandard-0.18.0[${PYTHON_USEDEP}] )
-"
-BDEPEND="
-	test? (
-		$(python_gen_cond_dep "
-			${RDEPEND}
-			dev-python/brotlicffi[\${PYTHON_USEDEP}]
-			dev-python/freezegun[\${PYTHON_USEDEP}]
-			dev-python/h2[\${PYTHON_USEDEP}]
-			dev-python/httpx[\${PYTHON_USEDEP}]
-			dev-python/pytest[\${PYTHON_USEDEP}]
-			dev-python/pytest-rerunfailures[\${PYTHON_USEDEP}]
-			dev-python/pytest-timeout[\${PYTHON_USEDEP}]
-			dev-python/pytest-xdist[\${PYTHON_USEDEP}]
-			dev-python/quart[\${PYTHON_USEDEP}]
-			dev-python/quart-trio[\${PYTHON_USEDEP}]
-			dev-python/trio[\${PYTHON_USEDEP}]
-			>=dev-python/tornado-4.2.1[\${PYTHON_USEDEP}]
-			>=dev-python/trustme-0.5.3[\${PYTHON_USEDEP}]
-			>=dev-python/zstandard-0.18.0[\${PYTHON_USEDEP}]
-		" "${PYTHON_TESTED[@]}")
-	)
-"
-
-src_prepare() {
-	# upstream considers 0.5 s to be "long" for a timeout
-	# we get tons of test failures on *fast* systems because of that
-	sed -i -e '/LONG_TIMEOUT/s:0.5:5:' test/__init__.py || die
-	distutils-r1_src_prepare
-}
-
-python_test() {
-	local -x PYTHONPATH=${WORKDIR}/hypercorn-${HYPERCORN_COMMIT}/src
-	local -x CI=1
-	if ! has "${EPYTHON}" "${PYTHON_TESTED[@]/_/.}"; then
-		einfo "Skipping tests on ${EPYTHON}"
-		return
-	fi
-
-	local EPYTEST_DESELECT=(
-		# TODO: timeouts
-		test/contrib/test_pyopenssl.py::TestSocketClosing::test_timeout_errors_cause_retries
-		test/with_dummyserver/test_socketlevel.py::TestSocketClosing::test_timeout_errors_cause_retries
-		# TODO: random regression?
-		test/contrib/test_socks.py::TestSocks5Proxy::test_socket_timeout
-	)
-
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	local EPYTEST_XDIST=1
-	epytest -p timeout -p rerunfailures --reruns=10 --reruns-delay=2
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/urllib3/urllib3-2.2.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/urllib3/urllib3-2.2.3.ebuild
index cb3c2903602..713b06d9a5b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/urllib3/urllib3-2.2.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/urllib3/urllib3-2.2.3.ebuild
@@ -27,7 +27,7 @@ SRC_URI+="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
 IUSE="brotli http2 test zstd"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/Manifest
index 872e923d8b0..14591e4668a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/Manifest
@@ -1,6 +1,8 @@
 DIST linux-6.10.tar.xz 145142812 BLAKE2B bb243ea7493b9d63aa2df2050a3f1ae2b89ee84a20015239cf157e3f4f51c7ac5efedc8a51132b2d7482f9276ac418de6624831c8a3b806130d9c2d2124c539b SHA512 baa2487954044f991d2ae254d77d14a1f0185dd62c9f0fcaff69f586c9f906823017b8db1c4588f27b076dfa3ebb606929fec859f60ea419e7974330b9289cc2
+DIST linux-6.11.tar.xz 146900704 BLAKE2B e7750c0878d71a56a0ce52d4c4c912199dad5bf5e2e8f872585a6494afbb37cbd852e612a6858936d2dc9b7776a3933818f540db408d57e90d18ea5249bba7ab SHA512 329c1f94008742e3f0c2ce7e591a16316d1b2cb9ea4596d4f45604097e07b7aa2f64afa40630a07f321a858455c77aa32ba57b271932ddcf4dc27863f9081cea
 DIST linux-6.8.tar.xz 142502100 BLAKE2B c6f17f816cea16e629f63e9379b98888713f57b2c5173306926471f139a9d612a0c74e119341f8075390e55e203d787d9edeb4ad5a064b18870f6f0f7ffaafb2 SHA512 5c4eb4aa1d3f7d1ea01c0f7ddeadacdece6e144fd4bdfc16b2b925d3e10dc04de3a6db69320b79a96c3560052616f001d2c09e7a1bb4f7b731e2380a7ecce068
 DIST linux-6.9.tar.xz 144034416 BLAKE2B 4cf86c3cfe6e6534745d42dfaeca59b17ea1168c4e8b615c80e6d8aac735f11283cd85fa992b440b5d4452917e94b9f08397a64af0be5894e3df23c68892377e SHA512 fed3b4cd1fbfb4d94618587c1934273d2ecc8b6e42a3d586ff8a5f24980be930f2ef803aa2923ca3bfa5e4e619f967f3af315368f24fa76f610b10443624a579
 DIST patch-6.10.3.xz 252260 BLAKE2B 65acf62ff3e326d5ebb9f47067b626a25295fde2057531cf43e537601c42b0110419c0d6eee8c7c24e5d6d88ecf30e9b76d516efb925c91817504c52780b4df1 SHA512 28ad0de2086ca4b59637f8a7c69c6f5436b53235bf52c9ee18f428748c773780c54606a5c96d71614cadd49c707a8bb11843a7393da078e15d7f554244bfb9ca
+DIST patch-6.11.2.xz 229032 BLAKE2B 43393fdde341b4058ff75b1fb02174ce9cfdb03063de93f86cf3bb61e9faabb0cd4ba52bc2f6fae4898454d18379fb2da9743be6987eb4326fbadf459a695c46 SHA512 a75a5b8b08d3c4f90329d0c18c1b3f08d8eca81c07bfb1966a34a84b2743ebdcabda39d7189b7681ee6e60dbf4d2ac996d3f6bc13a14eb4fea3b4eca9b4ea56a
 DIST patch-6.8.2.xz 247244 BLAKE2B a85078230548543c38550a5546689d0b44a54208cdad591ab34e10dec9348ce2f74e45bf85f373b14977d40556067e2e2c17ac4b6791fbb8aaba98feccd3cdac SHA512 a8e32b89f7680670c69c62f356846bb65b57614f979114627a9a2f945d7dc97c921d30197dffa993e5b18e499ba8c7196046ffdf0e721528a5378d1ee65a9ba5
 DIST patch-6.9.2.xz 16184 BLAKE2B 8a37e96c253b55b57c86f1654f2ea8bf65af96b1b38213e90032cb918bb8eea992d6ddbfa6a6774a229ab2e2288ab57bdb6cbad6e7e393c123f24850e06847c9 SHA512 a27af24f0caaa5de3811b6db5acc2d72b96df9ebb5c44bad99a949d871fb06c6ffd2be10cfc35b246d430c7be2291701f802aed47eaa8818ad12b8818a60f3ec
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.5.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.5.0-r2.ebuild
new file mode 100644
index 00000000000..6e0b552e64f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.5.0-r2.ebuild
@@ -0,0 +1,139 @@
+# Copyright 2021-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( {15..19} )
+LLVM_OPTIONAL=1
+PYTHON_COMPAT=( python3_{10..13} )
+
+inherit bash-completion-r1 estack linux-info llvm-r1 optfeature python-any-r1 toolchain-funcs
+
+DESCRIPTION="Tool for inspection and simple manipulation of eBPF programs and maps"
+HOMEPAGE="https://kernel.org/"
+
+# Use LINUX_VERSION to specify the full kernel version triple (x.y.z)
+LINUX_VERSION=6.11.2
+LINUX_VER=$(ver_cut 1-2 ${LINUX_VERSION})
+LINUX_V="${LINUX_VERSION:0:1}.x"
+
+LINUX_SOURCES="linux-${LINUX_VER}.tar.xz"
+SRC_URI="https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/${LINUX_SOURCES}"
+
+if [[ ${LINUX_VERSION} == *.*.* ]] ; then
+	LINUX_PATCH="patch-${LINUX_VERSION}.xz"
+	SRC_URI+=" https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/${LINUX_PATCH}"
+fi
+
+S_K="${WORKDIR}/linux-${LINUX_VER}"
+S="${S_K}/tools/bpf/bpftool"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+IUSE="caps llvm"
+
+RDEPEND="
+	sys-libs/zlib:=
+	virtual/libelf:=
+	caps? ( sys-libs/libcap:= )
+	llvm? ( $(llvm_gen_dep 'sys-devel/llvm:${LLVM_SLOT}') )
+	!llvm? ( sys-libs/binutils-libs:= )
+"
+DEPEND="
+	${RDEPEND}
+	>=sys-kernel/linux-headers-5.8
+"
+BDEPEND="
+	${LINUX_PATCH+dev-util/patchutils}
+	${PYTHON_DEPS}
+	app-arch/tar
+	dev-python/docutils
+"
+
+CONFIG_CHECK="~DEBUG_INFO_BTF"
+
+pkg_setup() {
+	python-any-r1_pkg_setup
+	use llvm && llvm-r1_pkg_setup
+}
+
+# src_unpack and src_prepare are copied from dev-util/perf since
+# it's building from the same tarball, please keep it in sync with perf
+src_unpack() {
+	local paths=(
+		'arch/*/include/*' 'arch/*/lib/*' 'arch/*/tools/*' 'include/*'
+		'kernel/bpf/*' 'lib/*' 'scripts/*' 'tools/arch/*' 'tools/bpf/*'
+		'tools/build/*' 'tools/include/*' 'tools/lib/*' 'tools/perf/*'
+		'tools/scripts/*'
+	)
+
+	# We expect the tar implementation to support the -j and --wildcards option
+	echo ">>> Unpacking ${LINUX_SOURCES} (${paths[*]}) to ${PWD}"
+	gtar --wildcards -xpf "${DISTDIR}"/${LINUX_SOURCES} \
+		"${paths[@]/#/linux-${LINUX_VER}/}" || die
+
+	if [[ -n ${LINUX_PATCH} ]] ; then
+		eshopts_push -o noglob
+		ebegin "Filtering partial source patch"
+		xzcat "${DISTDIR}"/${LINUX_PATCH} | filterdiff -p1 ${paths[@]/#/-i} > ${P}.patch
+		assert -n "Unpacking to ${P} from ${DISTDIR}/${LINUX_PATCH} failed"
+		eend $? || die "filterdiff failed"
+		test -s ${P}.patch || die "patch is empty?!"
+		eshopts_pop
+	fi
+
+	local a
+	for a in ${A}; do
+		[[ ${a} == ${LINUX_SOURCES} ]] && continue
+		[[ ${a} == ${LINUX_PATCH} ]] && continue
+		unpack ${a}
+	done
+}
+
+src_prepare() {
+	default
+
+	if [[ -n ${LINUX_PATCH} ]] ; then
+		pushd "${S_K}" >/dev/null || die
+		eapply "${WORKDIR}"/${P}.patch
+		popd || die
+	fi
+
+	# Use rst2man or rst2man.py depending on which one exists (#930076)
+	type -P rst2man >/dev/null || sed -i -e 's/rst2man/rst2man.py/g' Documentation/Makefile || die
+
+	# remove -Werror (bug 887981)
+	sed -i -e 's/\-Werror//g' ../../lib/bpf/Makefile || die
+
+	# fix up python shebangs (bug 940781)
+	python_fix_shebang "${S_K}"/scripts/bpf_doc.py
+}
+
+bpftool_make() {
+	local arch=$(tc-arch-kernel)
+	tc-export AR CC LD
+
+	emake V=1 VF=1 \
+		HOSTCC="$(tc-getBUILD_CC)" HOSTLD="$(tc-getBUILD_LD)" \
+		EXTRA_CFLAGS="${CFLAGS}" ARCH="${arch}" \
+		prefix="${EPREFIX}"/usr \
+		bash_compdir="$(get_bashcompdir)" \
+		feature-libcap="$(usex caps 1 0)" \
+		feature-llvm="$(usex llvm 1 0)" \
+		"$@"
+}
+
+src_compile() {
+	bpftool_make
+	bpftool_make -C Documentation
+}
+
+src_install() {
+	bpftool_make DESTDIR="${D}" install
+	bpftool_make mandir="${ED}"/usr/share/man -C Documentation install
+}
+
+pkg_postinst() {
+	optfeature "clang-bpf-co-re support" sys-devel/clang[llvm_targets_BPF]
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/desktop-file-utils/desktop-file-utils-0.27-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/desktop-file-utils/desktop-file-utils-0.27-r1.ebuild
index 8ec2df453d6..7afca699af8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/desktop-file-utils/desktop-file-utils-0.27-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/desktop-file-utils/desktop-file-utils-0.27-r1.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://www.freedesktop.org/software/${PN}/releases/${P}.tar.xz"
 
 LICENSE="GPL-2+"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos ~x64-solaris"
 
 RDEPEND=">=dev-libs/glib-2.12:2"
 DEPEND="${RDEPEND}"
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.78.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.78.6.ebuild
index 3a9c2631172..5548584c2db 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.78.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.78.6.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 GNOME_ORG_MODULE="glib"
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 PYTHON_REQ_USE="xml(+)"
 DISTUTILS_USE_PEP517=setuptools
 DISTUTILS_SINGLE_IMPL=1
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.78.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.78.6.ebuild
index 6b1843a1936..9616b413064 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.78.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.78.6.ebuild
@@ -2,7 +2,7 @@
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 GNOME_ORG_MODULE="glib"
 
 inherit gnome.org python-single-r1
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-1.26-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-1.26-r1.ebuild
index 37c3f429d6d..d55f767254c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-1.26-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-1.26-r1.ebuild
@@ -58,7 +58,7 @@ src_unpack() {
 	if use verify-sig; then
 		einfo "Unpacking ${MY_P}.tar.xz ..."
 		verify-sig_verify_detached - "${DISTDIR}"/${MY_P}.tar.sign \
-			< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -x))
+			< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -xf -))
 		assert "Unpack failed"
 	else
 		default
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-1.27-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-1.27-r1.ebuild
index 5babcf05a99..1f86be66916 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-1.27-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-1.27-r1.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{9..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 inherit cmake python-single-r1
 
 MY_PN=dwarves
@@ -59,7 +59,7 @@ src_unpack() {
 	if use verify-sig; then
 		einfo "Unpacking ${MY_P}.tar.xz ..."
 		verify-sig_verify_detached - "${DISTDIR}"/${MY_P}.tar.sign \
-			< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -x))
+			< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -xf -))
 		assert "Unpack failed"
 	else
 		default
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-1.27.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-1.27.ebuild
index 37c3f429d6d..d55f767254c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-1.27.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-1.27.ebuild
@@ -58,7 +58,7 @@ src_unpack() {
 	if use verify-sig; then
 		einfo "Unpacking ${MY_P}.tar.xz ..."
 		verify-sig_verify_detached - "${DISTDIR}"/${MY_P}.tar.sign \
-			< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -x))
+			< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -xf -))
 		assert "Unpack failed"
 	else
 		default
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-9999.ebuild
index 37c3f429d6d..560c9a73d4a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-9999.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{9..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 inherit cmake python-single-r1
 
 MY_PN=dwarves
@@ -58,7 +58,7 @@ src_unpack() {
 	if use verify-sig; then
 		einfo "Unpacking ${MY_P}.tar.xz ..."
 		verify-sig_verify_detached - "${DISTDIR}"/${MY_P}.tar.sign \
-			< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -x))
+			< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -xf -))
 		assert "Unpack failed"
 	else
 		default
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
index dcdacc5c4e1..e2bc9f93960 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
@@ -1,4 +1,4 @@
 DIST linux-6.10.tar.xz 145142812 BLAKE2B bb243ea7493b9d63aa2df2050a3f1ae2b89ee84a20015239cf157e3f4f51c7ac5efedc8a51132b2d7482f9276ac418de6624831c8a3b806130d9c2d2124c539b SHA512 baa2487954044f991d2ae254d77d14a1f0185dd62c9f0fcaff69f586c9f906823017b8db1c4588f27b076dfa3ebb606929fec859f60ea419e7974330b9289cc2
-DIST linux-6.3.tar.xz 136891752 BLAKE2B f1887c8924efa8d0cb14c4e604affd0b0168bcf20f56a37c027405c7bc11aba822a43fcb38ccb55a81a26f747d00e1ab5a6554818affbf1e1c7ef5220150fc69 SHA512 768979440f4907ba64d4481b383d6101faf208f27a0b897156123aa278c5743fe3c4f61945b2541429c532d45382aaee8899ea9d44a1d2895bfbb79bfd937f65
+DIST linux-6.11.tar.xz 146900704 BLAKE2B e7750c0878d71a56a0ce52d4c4c912199dad5bf5e2e8f872585a6494afbb37cbd852e612a6858936d2dc9b7776a3933818f540db408d57e90d18ea5249bba7ab SHA512 329c1f94008742e3f0c2ce7e591a16316d1b2cb9ea4596d4f45604097e07b7aa2f64afa40630a07f321a858455c77aa32ba57b271932ddcf4dc27863f9081cea
 DIST linux-6.7.tar.xz 141406528 BLAKE2B cecdbd19905e43e485ab73b352ced18b37f2a138c97a6956cadcda5d3d271001117dc1cf896b166ff019fc7f405f9539e2ed0d6112b0890efb04d182adf4fd0e SHA512 de06de556191614bd9daf077ae239360352a402bab407748e67f1e5108c92fd933e451707840ab22fe0f9976db3d1e1b60ca9d41cf894f015ca09b3f652b74ad
 DIST patch-6.10.4.xz 303168 BLAKE2B d38bbcdd2f730a030add5b38c1ab09c7081c311ed716d3ae976a058dd34b235078700cdff05d79dc93d9badb75c95566a3bdfc39dfa045d54857d82ee2c92e9d SHA512 5f5e8b19d114fed733c8c98a581fe339f8896e05e5da6a37deb1d7d8aa9dd83b3c80a97b1c6f3f51b6f20cca9c435b20c28c2c511da2026980d9fa72624cf420
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/files/perf-6.0-c++17.patch b/sdk_container/src/third_party/portage-stable/dev-util/perf/files/perf-6.0-c++17.patch
deleted file mode 100644
index 08c34bc552c..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-util/perf/files/perf-6.0-c++17.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-https://bugs.gentoo.org/904169
---- a/tools/perf/Makefile.config
-+++ b/tools/perf/Makefile.config
-@@ -309,7 +309,7 @@
- CORE_CFLAGS += -Wextra
- CORE_CFLAGS += -std=gnu11
- 
--CXXFLAGS += -std=gnu++14 -fno-exceptions -fno-rtti
-+CXXFLAGS += -std=gnu++17 -fno-exceptions -fno-rtti
- CXXFLAGS += -Wall
- CXXFLAGS += -fno-omit-frame-pointer
- CXXFLAGS += -ggdb3
---- a/tools/build/feature/Makefile
-+++ b/tools/build/feature/Makefile
-@@ -339,7 +339,7 @@
- 	$(BUILD)
- 
- $(OUTPUT)test-llvm.bin:
--	$(BUILDXX) -std=gnu++14 				\
-+	$(BUILDXX) -std=gnu++17 				\
- 		-I$(shell $(LLVM_CONFIG) --includedir) 		\
- 		-L$(shell $(LLVM_CONFIG) --libdir)		\
- 		$(shell $(LLVM_CONFIG) --libs)			\
-@@ -347,12 +347,12 @@
- 		> $(@:.bin=.make.output) 2>&1
- 
- $(OUTPUT)test-llvm-version.bin:
--	$(BUILDXX) -std=gnu++14					\
-+	$(BUILDXX) -std=gnu++17					\
- 		-I$(shell $(LLVM_CONFIG) --includedir)		\
- 		> $(@:.bin=.make.output) 2>&1
- 
- $(OUTPUT)test-clang.bin:
--	$(BUILDXX) -std=gnu++14					\
-+	$(BUILDXX) -std=gnu++17					\
- 		-I$(shell $(LLVM_CONFIG) --includedir) 		\
- 		-L$(shell $(LLVM_CONFIG) --libdir)		\
- 		-lclang-cpp $(shell $(LLVM_CONFIG) --libs)	\
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/files/perf-6.0-clang.patch b/sdk_container/src/third_party/portage-stable/dev-util/perf/files/perf-6.0-clang.patch
deleted file mode 100644
index 65b38c8d399..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-util/perf/files/perf-6.0-clang.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-
-Adapt for building against LLVM/Clang with monolithic libraries.
-
---- a/tools/build/feature/Makefile
-+++ b/tools/build/feature/Makefile
-@@ -338,7 +338,7 @@ $(OUTPUT)test-llvm.bin:
- 	$(BUILDXX) -std=gnu++14 				\
- 		-I$(shell $(LLVM_CONFIG) --includedir) 		\
- 		-L$(shell $(LLVM_CONFIG) --libdir)		\
--		$(shell $(LLVM_CONFIG) --libs Core BPF)		\
-+		$(shell $(LLVM_CONFIG) --libs)			\
- 		$(shell $(LLVM_CONFIG) --system-libs)		\
- 		> $(@:.bin=.make.output) 2>&1
- 
-@@ -351,10 +351,7 @@ $(OUTPUT)test-clang.bin:
- 	$(BUILDXX) -std=gnu++14					\
- 		-I$(shell $(LLVM_CONFIG) --includedir) 		\
- 		-L$(shell $(LLVM_CONFIG) --libdir)		\
--		-Wl,--start-group -lclangBasic -lclangDriver	\
--		  -lclangFrontend -lclangEdit -lclangLex	\
--		  -lclangAST -Wl,--end-group 			\
--		$(shell $(LLVM_CONFIG) --libs Core option)	\
-+		-lclang-cpp $(shell $(LLVM_CONFIG) --libs)	\
- 		$(shell $(LLVM_CONFIG) --system-libs)		\
- 		> $(@:.bin=.make.output) 2>&1
- 
---- a/tools/perf/Makefile.perf
-+++ b/tools/perf/Makefile.perf
-@@ -416,14 +416,11 @@ EXTLIBS := $(call filter-out,$(EXCLUDE_EXTLIBS),$(EXTLIBS))
- LIBS = -Wl,--whole-archive $(PERFLIBS) $(EXTRA_PERFLIBS) -Wl,--no-whole-archive -Wl,--start-group $(EXTLIBS) -Wl,--end-group
- 
- ifeq ($(USE_CLANG), 1)
--  CLANGLIBS_LIST = AST Basic CodeGen Driver Frontend Lex Tooling Edit Sema Analysis Parse Serialization
--  CLANGLIBS_NOEXT_LIST = $(foreach l,$(CLANGLIBS_LIST),$(shell $(LLVM_CONFIG) --libdir)/libclang$(l))
--  LIBCLANG = $(foreach l,$(CLANGLIBS_NOEXT_LIST),$(wildcard $(l).a $(l).so))
--  LIBS += -Wl,--start-group $(LIBCLANG) -Wl,--end-group
-+  LIBS += -lclang-cpp
- endif
- 
- ifeq ($(USE_LLVM), 1)
--  LIBLLVM = $(shell $(LLVM_CONFIG) --libs all) $(shell $(LLVM_CONFIG) --system-libs)
-+  LIBLLVM = $(shell $(LLVM_CONFIG) --libs) $(shell $(LLVM_CONFIG) --system-libs)
-   LIBS += -L$(shell $(LLVM_CONFIG) --libdir) $(LIBLLVM)
- endif
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/files/perf-6.11-bpf-capstone.patch b/sdk_container/src/third_party/portage-stable/dev-util/perf/files/perf-6.11-bpf-capstone.patch
new file mode 100644
index 00000000000..7d8b376869f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/perf/files/perf-6.11-bpf-capstone.patch
@@ -0,0 +1,469 @@
+commit ea59b70a8418a313d6f2ab48a957de015fc33018
+Author: Arnaldo Carvalho de Melo <acme@redhat.com>
+Date:   Wed Jul 31 11:58:56 2024 -0300
+
+    perf bpf: Move BPF disassembly routines to separate file to avoid clash with capstone bpf headers
+    
+    There is a clash of the libbpf and capstone libraries, that ends up
+    with:
+    
+      In file included from /usr/include/capstone/capstone.h:325,
+                       from util/disasm.c:1513:
+      /usr/include/capstone/bpf.h:94:14: error: ‘bpf_insn’ defined as wrong kind of tag
+         94 | typedef enum bpf_insn {
+    
+    So far we're just trying to avoid this by not having both headers
+    included in the same .c or .h file, do it one more time by moving the
+    BPF diassembly routines from util/disasm.c to util/disasm_bpf.c.
+    
+    This is only being hit when building with BUILD_NONDISTRO=1, i.e.
+    building with binutils-devel, that isn't the in the default build due to
+    a licencing clash. We need to reimplement what is now isolated in
+    util/disasm_bpf.c using some other library to have BPF annotation
+    feature that now only is available with BUILD_NONDISTRO=1.
+    
+    Fixes: 6d17edc113de1e21 ("perf annotate: Use libcapstone to disassemble")
+    Cc: Adrian Hunter <adrian.hunter@intel.com>
+    Cc: Ian Rogers <irogers@google.com>
+    Cc: Jiri Olsa <jolsa@kernel.org>
+    Cc: Kan Liang <kan.liang@linux.intel.com>
+    Cc: Namhyung Kim <namhyung@kernel.org>
+    Link: https://lore.kernel.org/lkml/ZqpUSKPxMwaQKORr@x1
+    Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+diff --git a/tools/perf/util/Build b/tools/perf/util/Build
+index 0f18fe81ef0b..b24360c04aae 100644
+--- a/tools/perf/util/Build
++++ b/tools/perf/util/Build
+@@ -13,6 +13,7 @@ perf-util-y += copyfile.o
+ perf-util-y += ctype.o
+ perf-util-y += db-export.o
+ perf-util-y += disasm.o
++perf-util-y += disasm_bpf.o
+ perf-util-y += env.o
+ perf-util-y += event.o
+ perf-util-y += evlist.o
+diff --git a/tools/perf/util/disasm.c b/tools/perf/util/disasm.c
+index 410e52cd9cfd..85fb0cfedf94 100644
+--- a/tools/perf/util/disasm.c
++++ b/tools/perf/util/disasm.c
+@@ -16,6 +16,7 @@
+ #include "build-id.h"
+ #include "debug.h"
+ #include "disasm.h"
++#include "disasm_bpf.h"
+ #include "dso.h"
+ #include "env.h"
+ #include "evsel.h"
+@@ -1323,192 +1324,6 @@ static int dso__disassemble_filename(struct dso *dso, char *filename, size_t fil
+ 	return 0;
+ }
+ 
+-#if defined(HAVE_LIBBFD_SUPPORT) && defined(HAVE_LIBBPF_SUPPORT)
+-#define PACKAGE "perf"
+-#include <bfd.h>
+-#include <dis-asm.h>
+-#include <bpf/bpf.h>
+-#include <bpf/btf.h>
+-#include <bpf/libbpf.h>
+-#include <linux/btf.h>
+-#include <tools/dis-asm-compat.h>
+-
+-#include "bpf-event.h"
+-#include "bpf-utils.h"
+-
+-static int symbol__disassemble_bpf(struct symbol *sym,
+-				   struct annotate_args *args)
+-{
+-	struct annotation *notes = symbol__annotation(sym);
+-	struct bpf_prog_linfo *prog_linfo = NULL;
+-	struct bpf_prog_info_node *info_node;
+-	int len = sym->end - sym->start;
+-	disassembler_ftype disassemble;
+-	struct map *map = args->ms.map;
+-	struct perf_bpil *info_linear;
+-	struct disassemble_info info;
+-	struct dso *dso = map__dso(map);
+-	int pc = 0, count, sub_id;
+-	struct btf *btf = NULL;
+-	char tpath[PATH_MAX];
+-	size_t buf_size;
+-	int nr_skip = 0;
+-	char *buf;
+-	bfd *bfdf;
+-	int ret;
+-	FILE *s;
+-
+-	if (dso__binary_type(dso) != DSO_BINARY_TYPE__BPF_PROG_INFO)
+-		return SYMBOL_ANNOTATE_ERRNO__BPF_INVALID_FILE;
+-
+-	pr_debug("%s: handling sym %s addr %" PRIx64 " len %" PRIx64 "\n", __func__,
+-		  sym->name, sym->start, sym->end - sym->start);
+-
+-	memset(tpath, 0, sizeof(tpath));
+-	perf_exe(tpath, sizeof(tpath));
+-
+-	bfdf = bfd_openr(tpath, NULL);
+-	if (bfdf == NULL)
+-		abort();
+-
+-	if (!bfd_check_format(bfdf, bfd_object))
+-		abort();
+-
+-	s = open_memstream(&buf, &buf_size);
+-	if (!s) {
+-		ret = errno;
+-		goto out;
+-	}
+-	init_disassemble_info_compat(&info, s,
+-				     (fprintf_ftype) fprintf,
+-				     fprintf_styled);
+-	info.arch = bfd_get_arch(bfdf);
+-	info.mach = bfd_get_mach(bfdf);
+-
+-	info_node = perf_env__find_bpf_prog_info(dso__bpf_prog(dso)->env,
+-						 dso__bpf_prog(dso)->id);
+-	if (!info_node) {
+-		ret = SYMBOL_ANNOTATE_ERRNO__BPF_MISSING_BTF;
+-		goto out;
+-	}
+-	info_linear = info_node->info_linear;
+-	sub_id = dso__bpf_prog(dso)->sub_id;
+-
+-	info.buffer = (void *)(uintptr_t)(info_linear->info.jited_prog_insns);
+-	info.buffer_length = info_linear->info.jited_prog_len;
+-
+-	if (info_linear->info.nr_line_info)
+-		prog_linfo = bpf_prog_linfo__new(&info_linear->info);
+-
+-	if (info_linear->info.btf_id) {
+-		struct btf_node *node;
+-
+-		node = perf_env__find_btf(dso__bpf_prog(dso)->env,
+-					  info_linear->info.btf_id);
+-		if (node)
+-			btf = btf__new((__u8 *)(node->data),
+-				       node->data_size);
+-	}
+-
+-	disassemble_init_for_target(&info);
+-
+-#ifdef DISASM_FOUR_ARGS_SIGNATURE
+-	disassemble = disassembler(info.arch,
+-				   bfd_big_endian(bfdf),
+-				   info.mach,
+-				   bfdf);
+-#else
+-	disassemble = disassembler(bfdf);
+-#endif
+-	if (disassemble == NULL)
+-		abort();
+-
+-	fflush(s);
+-	do {
+-		const struct bpf_line_info *linfo = NULL;
+-		struct disasm_line *dl;
+-		size_t prev_buf_size;
+-		const char *srcline;
+-		u64 addr;
+-
+-		addr = pc + ((u64 *)(uintptr_t)(info_linear->info.jited_ksyms))[sub_id];
+-		count = disassemble(pc, &info);
+-
+-		if (prog_linfo)
+-			linfo = bpf_prog_linfo__lfind_addr_func(prog_linfo,
+-								addr, sub_id,
+-								nr_skip);
+-
+-		if (linfo && btf) {
+-			srcline = btf__name_by_offset(btf, linfo->line_off);
+-			nr_skip++;
+-		} else
+-			srcline = NULL;
+-
+-		fprintf(s, "\n");
+-		prev_buf_size = buf_size;
+-		fflush(s);
+-
+-		if (!annotate_opts.hide_src_code && srcline) {
+-			args->offset = -1;
+-			args->line = strdup(srcline);
+-			args->line_nr = 0;
+-			args->fileloc = NULL;
+-			args->ms.sym  = sym;
+-			dl = disasm_line__new(args);
+-			if (dl) {
+-				annotation_line__add(&dl->al,
+-						     &notes->src->source);
+-			}
+-		}
+-
+-		args->offset = pc;
+-		args->line = buf + prev_buf_size;
+-		args->line_nr = 0;
+-		args->fileloc = NULL;
+-		args->ms.sym  = sym;
+-		dl = disasm_line__new(args);
+-		if (dl)
+-			annotation_line__add(&dl->al, &notes->src->source);
+-
+-		pc += count;
+-	} while (count > 0 && pc < len);
+-
+-	ret = 0;
+-out:
+-	free(prog_linfo);
+-	btf__free(btf);
+-	fclose(s);
+-	bfd_close(bfdf);
+-	return ret;
+-}
+-#else // defined(HAVE_LIBBFD_SUPPORT) && defined(HAVE_LIBBPF_SUPPORT)
+-static int symbol__disassemble_bpf(struct symbol *sym __maybe_unused,
+-				   struct annotate_args *args __maybe_unused)
+-{
+-	return SYMBOL_ANNOTATE_ERRNO__NO_LIBOPCODES_FOR_BPF;
+-}
+-#endif // defined(HAVE_LIBBFD_SUPPORT) && defined(HAVE_LIBBPF_SUPPORT)
+-
+-static int
+-symbol__disassemble_bpf_image(struct symbol *sym,
+-			      struct annotate_args *args)
+-{
+-	struct annotation *notes = symbol__annotation(sym);
+-	struct disasm_line *dl;
+-
+-	args->offset = -1;
+-	args->line = strdup("to be implemented");
+-	args->line_nr = 0;
+-	args->fileloc = NULL;
+-	dl = disasm_line__new(args);
+-	if (dl)
+-		annotation_line__add(&dl->al, &notes->src->source);
+-
+-	zfree(&args->line);
+-	return 0;
+-}
+-
+ #ifdef HAVE_LIBCAPSTONE_SUPPORT
+ #include <capstone/capstone.h>
+ 
+diff --git a/tools/perf/util/disasm_bpf.c b/tools/perf/util/disasm_bpf.c
+new file mode 100644
+index 000000000000..1fee71c79b62
+--- /dev/null
++++ b/tools/perf/util/disasm_bpf.c
+@@ -0,0 +1,195 @@
++// SPDX-License-Identifier: GPL-2.0-only
++
++#include "util/annotate.h"
++#include "util/disasm_bpf.h"
++#include "util/symbol.h"
++#include <linux/zalloc.h>
++#include <string.h>
++
++#if defined(HAVE_LIBBFD_SUPPORT) && defined(HAVE_LIBBPF_SUPPORT)
++#define PACKAGE "perf"
++#include <bfd.h>
++#include <bpf/bpf.h>
++#include <bpf/btf.h>
++#include <bpf/libbpf.h>
++#include <dis-asm.h>
++#include <errno.h>
++#include <linux/btf.h>
++#include <tools/dis-asm-compat.h>
++
++#include "util/bpf-event.h"
++#include "util/bpf-utils.h"
++#include "util/debug.h"
++#include "util/dso.h"
++#include "util/map.h"
++#include "util/env.h"
++#include "util/util.h"
++
++int symbol__disassemble_bpf(struct symbol *sym, struct annotate_args *args)
++{
++	struct annotation *notes = symbol__annotation(sym);
++	struct bpf_prog_linfo *prog_linfo = NULL;
++	struct bpf_prog_info_node *info_node;
++	int len = sym->end - sym->start;
++	disassembler_ftype disassemble;
++	struct map *map = args->ms.map;
++	struct perf_bpil *info_linear;
++	struct disassemble_info info;
++	struct dso *dso = map__dso(map);
++	int pc = 0, count, sub_id;
++	struct btf *btf = NULL;
++	char tpath[PATH_MAX];
++	size_t buf_size;
++	int nr_skip = 0;
++	char *buf;
++	bfd *bfdf;
++	int ret;
++	FILE *s;
++
++	if (dso__binary_type(dso) != DSO_BINARY_TYPE__BPF_PROG_INFO)
++		return SYMBOL_ANNOTATE_ERRNO__BPF_INVALID_FILE;
++
++	pr_debug("%s: handling sym %s addr %" PRIx64 " len %" PRIx64 "\n", __func__,
++		  sym->name, sym->start, sym->end - sym->start);
++
++	memset(tpath, 0, sizeof(tpath));
++	perf_exe(tpath, sizeof(tpath));
++
++	bfdf = bfd_openr(tpath, NULL);
++	if (bfdf == NULL)
++		abort();
++
++	if (!bfd_check_format(bfdf, bfd_object))
++		abort();
++
++	s = open_memstream(&buf, &buf_size);
++	if (!s) {
++		ret = errno;
++		goto out;
++	}
++	init_disassemble_info_compat(&info, s,
++				     (fprintf_ftype) fprintf,
++				     fprintf_styled);
++	info.arch = bfd_get_arch(bfdf);
++	info.mach = bfd_get_mach(bfdf);
++
++	info_node = perf_env__find_bpf_prog_info(dso__bpf_prog(dso)->env,
++						 dso__bpf_prog(dso)->id);
++	if (!info_node) {
++		ret = SYMBOL_ANNOTATE_ERRNO__BPF_MISSING_BTF;
++		goto out;
++	}
++	info_linear = info_node->info_linear;
++	sub_id = dso__bpf_prog(dso)->sub_id;
++
++	info.buffer = (void *)(uintptr_t)(info_linear->info.jited_prog_insns);
++	info.buffer_length = info_linear->info.jited_prog_len;
++
++	if (info_linear->info.nr_line_info)
++		prog_linfo = bpf_prog_linfo__new(&info_linear->info);
++
++	if (info_linear->info.btf_id) {
++		struct btf_node *node;
++
++		node = perf_env__find_btf(dso__bpf_prog(dso)->env,
++					  info_linear->info.btf_id);
++		if (node)
++			btf = btf__new((__u8 *)(node->data),
++				       node->data_size);
++	}
++
++	disassemble_init_for_target(&info);
++
++#ifdef DISASM_FOUR_ARGS_SIGNATURE
++	disassemble = disassembler(info.arch,
++				   bfd_big_endian(bfdf),
++				   info.mach,
++				   bfdf);
++#else
++	disassemble = disassembler(bfdf);
++#endif
++	if (disassemble == NULL)
++		abort();
++
++	fflush(s);
++	do {
++		const struct bpf_line_info *linfo = NULL;
++		struct disasm_line *dl;
++		size_t prev_buf_size;
++		const char *srcline;
++		u64 addr;
++
++		addr = pc + ((u64 *)(uintptr_t)(info_linear->info.jited_ksyms))[sub_id];
++		count = disassemble(pc, &info);
++
++		if (prog_linfo)
++			linfo = bpf_prog_linfo__lfind_addr_func(prog_linfo,
++								addr, sub_id,
++								nr_skip);
++
++		if (linfo && btf) {
++			srcline = btf__name_by_offset(btf, linfo->line_off);
++			nr_skip++;
++		} else
++			srcline = NULL;
++
++		fprintf(s, "\n");
++		prev_buf_size = buf_size;
++		fflush(s);
++
++		if (!annotate_opts.hide_src_code && srcline) {
++			args->offset = -1;
++			args->line = strdup(srcline);
++			args->line_nr = 0;
++			args->fileloc = NULL;
++			args->ms.sym  = sym;
++			dl = disasm_line__new(args);
++			if (dl) {
++				annotation_line__add(&dl->al,
++						     &notes->src->source);
++			}
++		}
++
++		args->offset = pc;
++		args->line = buf + prev_buf_size;
++		args->line_nr = 0;
++		args->fileloc = NULL;
++		args->ms.sym  = sym;
++		dl = disasm_line__new(args);
++		if (dl)
++			annotation_line__add(&dl->al, &notes->src->source);
++
++		pc += count;
++	} while (count > 0 && pc < len);
++
++	ret = 0;
++out:
++	free(prog_linfo);
++	btf__free(btf);
++	fclose(s);
++	bfd_close(bfdf);
++	return ret;
++}
++#else // defined(HAVE_LIBBFD_SUPPORT) && defined(HAVE_LIBBPF_SUPPORT)
++int symbol__disassemble_bpf(struct symbol *sym __maybe_unused, struct annotate_args *args __maybe_unused)
++{
++	return SYMBOL_ANNOTATE_ERRNO__NO_LIBOPCODES_FOR_BPF;
++}
++#endif // defined(HAVE_LIBBFD_SUPPORT) && defined(HAVE_LIBBPF_SUPPORT)
++
++int symbol__disassemble_bpf_image(struct symbol *sym, struct annotate_args *args)
++{
++	struct annotation *notes = symbol__annotation(sym);
++	struct disasm_line *dl;
++
++	args->offset = -1;
++	args->line = strdup("to be implemented");
++	args->line_nr = 0;
++	args->fileloc = NULL;
++	dl = disasm_line__new(args);
++	if (dl)
++		annotation_line__add(&dl->al, &notes->src->source);
++
++	zfree(&args->line);
++	return 0;
++}
+diff --git a/tools/perf/util/disasm_bpf.h b/tools/perf/util/disasm_bpf.h
+new file mode 100644
+index 000000000000..2ecb19545388
+--- /dev/null
++++ b/tools/perf/util/disasm_bpf.h
+@@ -0,0 +1,12 @@
++// SPDX-License-Identifier: GPL-2.0-only
++
++#ifndef __PERF_DISASM_BPF_H
++#define __PERF_DISASM_BPF_H
++
++struct symbol;
++struct annotate_args;
++
++int symbol__disassemble_bpf(struct symbol *sym, struct annotate_args *args);
++int symbol__disassemble_bpf_image(struct symbol *sym, struct annotate_args *args);
++
++#endif /* __PERF_DISASM_BPF_H */
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-util/perf/metadata.xml
index 89fef8ad07a..2a4e4eada61 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/perf/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/dev-util/perf/metadata.xml
@@ -17,7 +17,6 @@
     <flag name="bpf">Enable support for eBPF features with <pkg>dev-libs/libbpf</pkg></flag>
     <flag name="babeltrace">Enable <pkg>dev-util/babeltrace</pkg> support</flag>
     <flag name="capstone">Use <pkg>dev-libs/capstone</pkg> for disassembly support</flag>
-    <flag name="clang">Enable builtin clang and LLVM support</flag>
     <flag name="doc">
       Build documentation and man pages. With this USE flag disabled,
       the --help parameter for perf and its sub-tools will not be
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.11.ebuild
similarity index 57%
rename from sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.3.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.11.ebuild
index 9d36b0ce8ca..b523d8477bf 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.11.ebuild
@@ -1,10 +1,11 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
-PYTHON_COMPAT=( python3_{10..11} )
-inherit bash-completion-r1 estack flag-o-matic llvm toolchain-funcs python-r1 linux-info
+LLVM_COMPAT=( {16..19} )
+PYTHON_COMPAT=( python3_{10..13} )
+inherit bash-completion-r1 estack flag-o-matic linux-info llvm-r1 toolchain-funcs python-r1
 
 DESCRIPTION="Userland tools for Linux Performance Counters"
 HOMEPAGE="https://perf.wiki.kernel.org/"
@@ -33,10 +34,12 @@ S="${S_K}/tools/perf"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="amd64 arm arm64 ppc ppc64 ~riscv x86 ~amd64-linux ~x86-linux"
-IUSE="audit babeltrace clang crypt debug +doc gtk java libpfm lzma numa perl python slang systemtap unwind zlib zstd"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86 ~amd64-linux ~x86-linux"
+IUSE="abi_mips_o32 abi_mips_n32 abi_mips_n64 audit babeltrace capstone big-endian bpf caps crypt debug +doc gtk java libpfm +libtraceevent +libtracefs lzma numa perl python slang systemtap tcmalloc unwind zstd"
 
-REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+"
 
 # setuptools (and Python) are always needed even if not building Python bindings
 BDEPEND="
@@ -55,35 +58,46 @@ BDEPEND="
 	)
 "
 
-RDEPEND="audit? ( sys-process/audit )
-	babeltrace? ( dev-util/babeltrace )
-	crypt? ( virtual/libcrypt:= )
-	clang? (
-		sys-devel/clang:=
-		sys-devel/llvm:=
+RDEPEND="
+	audit? ( sys-process/audit )
+	babeltrace? ( dev-util/babeltrace:0/1 )
+	bpf? (
+		dev-libs/libbpf
+		dev-util/bpftool
+		dev-util/pahole
+		$(llvm_gen_dep '
+			sys-devel/clang:${LLVM_SLOT}=
+			sys-devel/llvm:${LLVM_SLOT}=
+		')
 	)
+	caps? ( sys-libs/libcap )
+	capstone? ( dev-libs/capstone )
+	crypt? ( dev-libs/openssl:= )
 	gtk? ( x11-libs/gtk+:2 )
 	java? ( virtual/jre:* )
-	libpfm? ( dev-libs/libpfm )
+	libpfm? ( dev-libs/libpfm:= )
+	libtraceevent? ( dev-libs/libtraceevent )
+	libtracefs? ( dev-libs/libtracefs )
 	lzma? ( app-arch/xz-utils )
 	numa? ( sys-process/numactl )
 	perl? ( dev-lang/perl:= )
 	python? ( ${PYTHON_DEPS} )
 	slang? ( sys-libs/slang )
 	systemtap? ( dev-debug/systemtap )
-	unwind? ( sys-libs/libunwind )
-	zlib? ( sys-libs/zlib )
-	zstd? ( app-arch/zstd )
+	tcmalloc? ( dev-util/google-perftools )
+	unwind? ( sys-libs/libunwind:= )
+	zstd? ( app-arch/zstd:= )
 	dev-libs/elfutils
-	sys-libs/binutils-libs:="
+	sys-libs/binutils-libs:=
+	sys-libs/zlib
+	virtual/libcrypt
+"
 
 DEPEND="${RDEPEND}
 	>=sys-kernel/linux-headers-5.10
 	java? ( virtual/jdk )
 "
 
-CONFIG_CHECK="~PERF_EVENTS ~KALLSYMS"
-
 QA_FLAGS_IGNORED=(
 	'usr/bin/perf-read-vdso32' # not linked with anything except for libc
 	'usr/libexec/perf-core/dlfilters/.*' # plugins
@@ -98,18 +112,40 @@ pkg_pretend() {
 }
 
 pkg_setup() {
-	use clang && llvm_pkg_setup
+	local CONFIG_CHECK="
+		~DEBUG_INFO
+		~FTRACE
+		~FTRACE_SYSCALLS
+		~FUNCTION_TRACER
+		~KALLSYMS
+		~KALLSYMS_ALL
+		~KPROBES
+		~KPROBE_EVENTS
+		~PERF_EVENTS
+		~UPROBES
+		~UPROBE_EVENTS
+	"
+
+	use bpf && llvm-r1_pkg_setup
 	# We enable python unconditionally as libbpf always generates
 	# API headers using python script
 	python_setup
+
+	if use bpf ; then
+		CONFIG_CHECK+="~BPF ~BPF_EVENTS ~BPF_SYSCALL ~DEBUG_INFO_BTF ~HAVE_EBPF_JIT"
+	fi
+
+	linux-info_pkg_setup
 }
 
 # src_unpack and src_prepare are copied to dev-util/bpftool since
 # it's building from the same tarball, please keep it in sync with bpftool
 src_unpack() {
 	local paths=(
-		tools/arch tools/build tools/include tools/lib tools/perf tools/scripts
-		scripts include lib "arch/*/lib"
+		'arch/*/include/*' 'arch/*/lib/*' 'arch/*/tools/*' 'include/*'
+		'kernel/bpf/*' 'lib/*' 'scripts/*' 'tools/arch/*' 'tools/bpf/*'
+		'tools/build/*' 'tools/include/*' 'tools/lib/*' 'tools/perf/*'
+		'tools/scripts/*'
 	)
 
 	# We expect the tar implementation to support the -j option (both
@@ -121,9 +157,10 @@ src_unpack() {
 	if [[ -n ${LINUX_PATCH} ]] ; then
 		eshopts_push -o noglob
 		ebegin "Filtering partial source patch"
-		filterdiff -p1 ${paths[@]/#/-i } -z "${DISTDIR}"/${LINUX_PATCH} \
-			> ${P}.patch
+		xzcat "${DISTDIR}"/${LINUX_PATCH} | filterdiff -p1 ${paths[@]/#/-i} > ${P}.patch
+		assert -n "Unpacking to ${P} from ${DISTDIR}/${LINUX_PATCH} failed"
 		eend $? || die "filterdiff failed"
+		test -s ${P}.patch || die "patch is empty?!"
 		eshopts_pop
 	fi
 
@@ -144,8 +181,7 @@ src_prepare() {
 	fi
 
 	pushd "${S_K}" >/dev/null || die
-	eapply "${FILESDIR}"/perf-6.0-clang.patch
-	eapply "${FILESDIR}"/perf-6.0-c++17.patch
+	eapply "${FILESDIR}"/perf-6.11-bpf-capstone.patch
 	popd || die
 
 	# Drop some upstream too-developer-oriented flags and fix the
@@ -166,7 +202,7 @@ src_prepare() {
 	find -name '*.S' -exec sed -i '$a.section .note.GNU-stack,"",%progbits' {} +
 }
 
-puse() { usex $1 "" no; }
+puse() { usex $1 "" 1; }
 perf_make() {
 	# The arch parsing is a bit funky.  The perf tools package is integrated
 	# into the kernel, so it wants an ARCH that looks like the kernel arch,
@@ -187,62 +223,88 @@ perf_make() {
 	   ! use arm64 && \
 	   ! use ppc && ! use ppc64 \
 	   ! use s390 && \
-	   ! use riscv
+	   ! use riscv && \
+	   ! use loong
 	then
 		disable_libdw=1
 	fi
 
+	# perf directly invokes LD for linking without going through CC, on mips
+	# it is required to specify the emulation.  port of below buildroot patch
+	# https://patchwork.ozlabs.org/project/buildroot/patch/20170217105905.32151-1-Vincent.Riera@imgtec.com/
+	local linker="$(tc-getLD)"
+	if use mips
+	then
+		if use big-endian
+		then
+			use abi_mips_n64 && linker+=" -m elf64btsmip"
+			use abi_mips_n32 && linker+=" -m elf32btsmipn32"
+			use abi_mips_o32 && linker+=" -m elf32btsmip"
+		else
+			use abi_mips_n64 && linker+=" -m elf64ltsmip"
+			use abi_mips_n32 && linker+=" -m elf32ltsmipn32"
+			use abi_mips_o32 && linker+=" -m elf32ltsmip"
+		fi
+	fi
+
 	# FIXME: NO_CORESIGHT
-	emake V=1 VF=1 \
-		HOSTCC="$(tc-getBUILD_CC)" HOSTLD="$(tc-getBUILD_LD)" \
-		CC="$(tc-getCC)" CXX="$(tc-getCXX)" AR="$(tc-getAR)" LD="$(tc-getLD)" NM="$(tc-getNM)" \
-		CLANG="${CHOST}-clang" \
-		PKG_CONFIG="$(tc-getPKG_CONFIG)" \
-		prefix="${EPREFIX}/usr" bindir_relative="bin" \
-		tipdir="share/doc/${PF}" \
-		EXTRA_CFLAGS="${CFLAGS}" \
-		EXTRA_LDFLAGS="${LDFLAGS}" \
-		ARCH="${arch}" \
-		JDIR="${java_dir}" \
-		LIBCLANGLLVM=$(usex clang 1 "") \
-		LIBPFM4=$(usex libpfm 1 "") \
-		NO_AUXTRACE="" \
-		NO_BACKTRACE="" \
-		NO_CORESIGHT=1 \
-		NO_DEMANGLE= \
-		GTK2=$(usex gtk 1 "") \
-		feature-gtk2-infobar=$(usex gtk 1 "") \
-		NO_JVMTI=$(puse java) \
-		NO_LIBAUDIT=$(puse audit) \
-		NO_LIBBABELTRACE=$(puse babeltrace) \
-		NO_LIBBIONIC=1 \
-		NO_LIBBPF= \
-		NO_LIBCRYPTO=$(puse crypt) \
-		NO_LIBDW_DWARF_UNWIND="${disable_libdw}" \
-		NO_LIBELF= \
-		NO_LIBNUMA=$(puse numa) \
-		NO_LIBPERL=$(puse perl) \
-		NO_LIBPYTHON=$(puse python) \
-		NO_LIBUNWIND=$(puse unwind) \
-		NO_LIBZSTD=$(puse zstd) \
-		NO_SDT=$(puse systemtap) \
-		NO_SLANG=$(puse slang) \
-		NO_LZMA=$(puse lzma) \
-		NO_ZLIB=$(puse zlib) \
-		WERROR=0 \
-		LIBDIR="/usr/libexec/perf-core" \
-		libdir="${EPREFIX}/usr/$(get_libdir)" \
-		plugindir="${EPREFIX}/usr/$(get_libdir)/perf/plugins" \
+	local emakeargs=(
+		V=1 VF=1
+		HOSTCC="$(tc-getBUILD_CC)" HOSTLD="$(tc-getBUILD_LD)"
+		CC="$(tc-getCC)" CXX="$(tc-getCXX)" AR="$(tc-getAR)" LD="${linker}" NM="$(tc-getNM)"
+		CLANG="${CHOST}-clang"
+		PKG_CONFIG="$(tc-getPKG_CONFIG)"
+		prefix="${EPREFIX}/usr" bindir_relative="bin"
+		tipdir="share/doc/${PF}"
+		EXTRA_CFLAGS="${CFLAGS}"
+		EXTRA_LDFLAGS="${LDFLAGS}"
+		ARCH="${arch}"
+		BUILD_BPF_SKEL=$(usex bpf 1 "") \
+		BUILD_NONDISTRO=1
+		JDIR="${java_dir}"
+		CORESIGHT=
+		GTK2=$(usex gtk 1 "")
+		feature-gtk2-infobar=$(usex gtk 1 "")
+		NO_AUXTRACE=
+		NO_BACKTRACE=
+		NO_CAPSTONE=$(puse capstone)
+		NO_DEMANGLE=
+		NO_JEVENTS=$(puse python)
+		NO_JVMTI=$(puse java)
+		NO_LIBAUDIT=$(puse audit)
+		NO_LIBBABELTRACE=$(puse babeltrace)
+		NO_LIBBIONIC=1
+		NO_LIBBPF=$(puse bpf)
+		NO_LIBCAP=$(puse caps)
+		NO_LIBCRYPTO=$(puse crypt)
+		NO_LIBDW_DWARF_UNWIND="${disable_libdw}"
+		NO_LIBELF=
+		NO_LIBNUMA=$(puse numa)
+		NO_LIBPERL=$(puse perl)
+		NO_LIBPFM4=$(puse libpfm)
+		NO_LIBPYTHON=$(puse python)
+		NO_LIBTRACEEVENT=$(puse libtraceevent)
+		NO_LIBUNWIND=$(puse unwind)
+		NO_LIBZSTD=$(puse zstd)
+		NO_SDT=$(puse systemtap)
+		NO_SHELLCHECK=1
+		NO_SLANG=$(puse slang)
+		NO_LZMA=$(puse lzma)
+		NO_ZLIB=
+		TCMALLOC=$(usex tcmalloc 1 "")
+		WERROR=0
+		DEBUG=$(usex debug 1 "")
+		LIBDIR="/usr/libexec/perf-core"
+		libdir="${EPREFIX}/usr/$(get_libdir)"
+		plugindir="${EPREFIX}/usr/$(get_libdir)/perf/plugins"
 		"$@"
+	)
+	emake "${emakeargs[@]}"
 }
 
 src_compile() {
 	filter-lto
 
-	# test-clang.bin not build with g++
-	if use clang; then
-		make -C "${S_K}/tools/build/feature" V=1 CXX=${CHOST}-clang++ test-clang.bin || die
-	fi
 	perf_make -f Makefile.perf
 	use doc && perf_make -C Documentation man
 }
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.30-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.30-r1.ebuild
index 4ff9171a946..976f2d57e46 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.30-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.30-r1.ebuild
@@ -12,7 +12,7 @@ if [[ ${PV} == *9999 ]] ; then
 		https://github.com/pkgcore/pkgcheck.git"
 	inherit git-r3
 else
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 	inherit pypi
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.31.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.31.ebuild
index 6928104fa39..37ce36b372e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.31.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.31.ebuild
@@ -12,7 +12,7 @@ if [[ ${PV} == *9999 ]] ; then
 		https://github.com/pkgcore/pkgcheck.git"
 	inherit git-r3
 else
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-macos"
 	inherit pypi
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.3.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.3.0.ebuild
index d11205b46a0..9f2c0500734 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.3.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.3.0.ebuild
@@ -10,7 +10,7 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://gitea.treehouse.systems/ariadne/pkgconf.git"
 else
 	SRC_URI="https://distfiles.ariadne.space/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 DESCRIPTION="pkg-config compatible replacement with no dependencies other than C99"
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/Manifest b/sdk_container/src/third_party/portage-stable/dev-vcs/git/Manifest
index fae4997c9ac..422449f0694 100644
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/git/Manifest
@@ -1,39 +1,27 @@
-DIST git-2.39.3.tar.xz 7166100 BLAKE2B 862a5636df681e46797034bf22ca7712d70ead94ac0a911b81e4eeb3c83e67fdc56b839055b3b54bdab0ffceabe9fa2efb9e2870b1c0f40590ddb33e7427cd2a SHA512 ddd9f41df9d59aedaddb3a3cd551c105903b5f8c86455d4d05a8342920d67754b358b6ab0d6c10cca743b8e0e621baea16f71a9d6290f4d37297a9c45e8b3763
-DIST git-2.39.4.tar.xz 7172876 BLAKE2B 8e90c92065776ce0bdf9a8c01740f0fd66f63a9cf19edc2244a1b59c4cdd3a2d52d52985ffaf173192533042e1fd7fc5e29fcd70b9bf32c77ac24b2cd968567f SHA512 4d79b22eda772283d79bf8bad5260f139ff66bf942c9fa0e7b2be0888c1f2f941fd7dbb301ab5ee0e6f92444c0e8d3b1b0fdb4d3a41b9d8d242c866c9593f87f
 DIST git-2.39.5.tar.xz 7171400 BLAKE2B aebb0cb770612b9ee8ed4c38d83a57e3caebca5a9875c3570343483fd994242412d71ea8b2fce3753400ddc95765acf1b56178eb17cee195b4213e8342d02c9c SHA512 f866789971e1fb83a482beca54f19fb02f23b5d1d06dec5bcb10fcf262e24c746cb470a81beae97a48884188b5826437f76f70b4f62a78b578a18557233730d6
-DIST git-2.41.0.tar.xz 7273624 BLAKE2B 9119e1d1ff0ff332559a6609707846c2af7c61bea6ea728e834e4bd7f1ff6dd636a081c227b32a88fc5de1ea8987951cc56d0e94c90bbaa211ff415c5020d070 SHA512 a215bc6d89afbddd56adac901c24ea2b7f98a37bf6a6a2756893947012ffaa850e76247a3445a5ab13ab5a462f39986fec33eed086148aba5eb554dc1799fee0
-DIST git-2.41.1.tar.xz 7280988 BLAKE2B 0a04924bed7b855d70b31491544799d172b9f9298e2e9532d93f37c1e7520abb0880c6b1935192085d138116a280fc7a249b986a77b01cb4f29703d4f0102777 SHA512 fc56d15592b224d37797e43c341877acc29ac488abe6adab45bfacfee88b15655d8f5fed082c82cef82d30a96d07c009dd65c99be34a0fdf6ba2eb3cd88aaf55
 DIST git-2.41.2.tar.xz 7279240 BLAKE2B eedcff06d3b81736a1123b80f4095bc5cc9439876cbda9e6e19eeee3b17a4bf7d0afe8109f24e923a61c76446a55ab76403b44b0d80a4c40ad2d4df511a77d8c SHA512 d39670d24f11183b084ad05f32760d8fa400283509c8e60375f21a5449a1f015866903907cc0502dd388de748cfd9b934ca643d42746707fa8d1a695e20b7530
 DIST git-2.43.2.tar.xz 7388636 BLAKE2B 3c0d59d361b928efedfc06426f4c2c0f3852b3501d091f31a0466d226eddb31964a18bd4051ac0c0c11cf6827e6a9ede821b4532abf4e9b15204679f86690247 SHA512 0d95b8ac65bd76acb60c3b4d80242aeda8b2ab3dda7c8586ce46cc1ddedc000494b45fd269295033b82f38662cde08d366c63aa3ff39030500952342c9d3b280
-DIST git-2.43.4.tar.xz 7395872 BLAKE2B b8d5b949609176bf10c63aaf6adea8972559417322edb665b9c7bd278e4454213e248506898ad553772d1e80c61b2d33076dea0aacd3e55805770ebd7fb2d20c SHA512 5e0238283ee173d5f4b1222ca6f46fef261e265d9967089551cdcdff78a747feacca5bfda45ef8b6f1e7a86709d81d2a8e02cc170ae73d57f142644e4e5fd9d2
 DIST git-2.43.5.tar.xz 7394400 BLAKE2B 8c3e6dd1c64469ebc11adb6e3c4156ba0a9dd8fa9f73770b3c26a19ce3a9840561b52d67c07e37e19ad9d09c5ce74e14cf6248c15a37ff7d474cce7a594c3948 SHA512 7c507e29d102d3597ae867c0bfb1befc4facdfb1934b2361ee390c4cd9f68753aef1542a955a0684441f4ccad2b3a7fa560677466ccab4ee457499b0968d41b0
-DIST git-2.44.1.tar.xz 7436388 BLAKE2B cc4ef7da5db03f0b1a656cfbf3faaedf2f2cd8452fe656a9c9ef415006d5178db3d05faef5252d06e8ad4a927d13ef32eaf5d2da0e934d3157b94fa631336604 SHA512 803d820decd5ee9336d96b9a3145514644cdcb60de68396cfe6c29ab95b62b7040a92e86214317a701f3f93a51b6c49e914af4dd482aa843eb34436eb67d6154
 DIST git-2.44.2.tar.xz 7435020 BLAKE2B 625071528e6575af86aa51d7d5baeaa9b1b8be0e9f2b13f9f1c948a6dc0e9e03e227462c6ed9e8b80c413f02840f4f6b5d73487e0722d30835233480ea93caf3 SHA512 4dc70065fb1f47678cbed0d055f7734fce5cc26eeb627bda928056a80253053b230200db4b2936319df5b5b577eaaa1186a8bb041a205ac600d691e5663117ed
 DIST git-2.45.2.tar.xz 7487680 BLAKE2B 477acc786c26e0b04843ad6d07333607b2274d587263d72c6d036cade725e6f62f8c773903f401c799de71527d0473589afc507eec02f445e0c148dd7cbf407c SHA512 dce30d0d563f3f76ef49c8dc88105e0cf0941c8cd70303418d9d737f840ffba36bcc575c380c75080edf64af74487e1a680db146ec5f527a32104e887d4ceb73
 DIST git-2.46.0.tar.xz 7577180 BLAKE2B 11fd88faea8cca0982945320c0a1ff949d2abedca9ffde34d40a739349e2a7ae6ceb51a23e8c21f7985cd494d9d17abcec4769e766c3c5188162b906eb1b96bc SHA512 3afae7a094da070c627f68ceb54c2345e3a49e04e455197527b732eb220e8c3249f5d09655a59bf4280dd0c0a3e305abc1380693e0a7fb0b8138b741c4708184
-DIST git-htmldocs-2.39.3.tar.xz 1506828 BLAKE2B 732e86ee004a44230d8f10eac16a14fbfb348d4278001011a0d22ba91240fbe65cad341b0547b649db3ce7fc67fc6fb544c896e7ba4bd7f1fa3c9b42371febf9 SHA512 7616c9c6600759f06973d36d5233b3909da72f39318410f5522b890d282a74e7585433c7195fed4792d5b7955292a466abcc2185ffdc23d0e8928ad58d7db1bf
-DIST git-htmldocs-2.39.4.tar.xz 1508520 BLAKE2B 116d279292f5d472dc31a438cc9ae4ab27fca608169307e70290e0aa8db57be305eb4007bf746f0bffbcb707fb709c7e2317d334255df8027e3870e695b16282 SHA512 d0de533c0662462a5d56ff8dbf20bb6c314e5dd159670d896e5ae30e9853549ae3eeaebfd56421787addb8c4811644c8cc3df719a314368a9bd22330ac22a1d0
+DIST git-2.46.1.tar.xz 7582036 BLAKE2B 8b0c698b3423484c11d8ec12d3a3de82c2e865b81ecfb36f55c830ed9a12438002288a72194fb6301c7ebd506cbc0930406d13b9a1b663167aae24a2d6dc0c96 SHA512 ce1bb12cb8a320e4ef261d4715dc2144207f31cfe13b2b62cebfc9e61880db79876a634e29cf42992d4f472ce0af709f48f14c7ba800f157876f19982720fc6d
+DIST git-2.46.2.tar.xz 7581344 BLAKE2B 1ea2a166bd2717d581020a9921cf7e82dc2c77e2a9bd6bc70f4b6396c214c74b30e8ae6815eba33bd2995f7a6e2570b96c51acbfce25ab85e05d5fdbd09d870c SHA512 d8d1cec9a4ddc7b1892b7f5b3c808d235bcd4bfb1714ce0ce0e721242acc94f9ae7c2ae3181311feb5b458b04e89cd32acd3e9c90adbc4e86e05e7d5589d8a00
 DIST git-htmldocs-2.39.5.tar.xz 1508480 BLAKE2B 028d37c16a14e588b73783a5a7f8b6b95bd5864f83e9ec69855967f4188366c34d71d4fcdccaa55929d9c451b9822674d681c786c662ad5812c73d4663343345 SHA512 d486d2cfea1a1f84e64da85f22c153fad5110cf89523aa0618de21f331aee0c53a3269e92b883eee391312e5a33166f9f10abbcffde44732531cf80120671e2f
-DIST git-htmldocs-2.41.0.tar.xz 1525692 BLAKE2B 4ea74130e21fed3ebbe09b849eddc48654fa7563299d8c2173856741d3c490a1672ac6b2005f716d6ae2d7759f92caafc56ccbf2408ba8ec87266b9c10530d73 SHA512 8a28f330f21e1da901ef8575509b56cede1a8f1d03e49fca802e561095c137c9ef23f3d6bd33d0e8a537bc1f93131ce7aafc92d4a9b0a80ade67249f22ff69d5
-DIST git-htmldocs-2.41.1.tar.xz 1527884 BLAKE2B c3ac165f8e95e8d60d8d6071cc1afa5348908223d9c8a7f25e4343fea6c6d103d6fa569fe31576fc659159aa22fb101920c9e64cbfb1ffddbef99e58e38bf255 SHA512 f8ac76a66d3d6146568309272bdb88e90d0adebb4e8e2fffb47210b9d3bb088c7c17df96210ea6188db9d9dde32cc20dca766c8945a1696006ae18470a133a96
 DIST git-htmldocs-2.41.2.tar.xz 1528000 BLAKE2B 74b0e0fc489f1fc994c73399ff75450d1bebda54816a7bb6590218fbc8b36bd96c4ebd29c86c94ec4c80bf39e441fd66ffe74f2fbd0de3b9b14022abe9f0b139 SHA512 1ef6b36bf2dc4c11371cfcf8e82ac42a96bbaeb8fa4dec7acc2f5047589261b65f3d82e28dc130362aff692488016823ecb199c0ddc17606ed3a7c708fe89961
 DIST git-htmldocs-2.43.2.tar.xz 1545440 BLAKE2B 8e6943ed5c5ab13ee7f8f2e124a3dc1e6883bb5b6782be4a7b6fecc3e02bb51f41b057ec5f36b0e9557f05d676795544516585cffca8e025c762377be1815912 SHA512 18c8e0fc3351f708aa677ee5daeb61f8727ce94763d4a7067462af7b90dc1ee5c67e4ea6e770db08dd99a5196b7f3fa2c4673ce9e25ab3365be8175fcf5fe66c
-DIST git-htmldocs-2.43.4.tar.xz 1547548 BLAKE2B 69d1fcd77ffff72773649f8eaf0f07a3a9d7cb3135c15cb2dfa381efa4ec6ff6c862c8086eb73720e24cddece3a6936bd2dca3236e221dca60961ccde6be36b3 SHA512 37f26bb87aef80382b360ce38abb268a133dbc9c70dc63074f55c5484b66389e8dc33c06205984de60042d865d7d7cf7e73388bd7af738adb87ef7c774e54af1
 DIST git-htmldocs-2.43.5.tar.xz 1547732 BLAKE2B eabdbdf4c5eeeee7c10cb809043b0b3741f2e05c481662358c0dca94a059fd3ec1f022553d2bf67a7a06df2cb28c472fe8f581d47e7b018cb9b7a99ef2acfe08 SHA512 fe8b67df639d9960f974728ddad89c2c37bcdaf594ca45cc903a74436138613fe7789e63c5043bca956fa55a5ec14f5658a6c8eef9b242d22408110346a062d0
-DIST git-htmldocs-2.44.1.tar.xz 1559196 BLAKE2B e5b51ed1d7462b4579ed59047ad38006da94645ec1d00ec87948ab57f25e244b06de8710608914d1c3759a8887e37144200459421fcf1cfff400ff1c05bc5a8f SHA512 4c7fb3ad7f1c53d228dfef76789af1d7714928208428f497d80e14e7da1358a3c4e7b5b8fa155815d67b4865b8c08c7aa507be72979b6ff161c9ac66102ee649
 DIST git-htmldocs-2.44.2.tar.xz 1559412 BLAKE2B 9a62ab1d70b009a9bc29250c49ca835a46928703a73ec004ea57e7dc74212c5a29d7e0784cd752c8d2c1e23b70702e2c2f280904dfedefb3d4a687002a950596 SHA512 2a82e3c37aaca91643976d21fac3bd82b23fe2374856d73b0ba726339450ea6f8a5e8e38326546292f83923e28da280ca3bed549afff1aad684ebfb3926e4992
 DIST git-htmldocs-2.45.2.tar.xz 1569148 BLAKE2B 5013a13da54d87728f621a09d04dee1cba7b44d230360394b86e04269bf276399cf44de74ffc14a76ec1724e1015b630300d551b3a268273a768e0edc1a7fa45 SHA512 272bb31d8d43b270d5281c5d1beadea8e5a580c738ece2580d2c6ba7e7fe6fdbca71b672a2811273119495e62613f7a4d34764b4dfbc26e4dbf9dee5797fb440
 DIST git-htmldocs-2.46.0.tar.xz 1594172 BLAKE2B f59b8796a19a73e983ec56bfd3cb623a887b8e4d4d4767f90029fffffd874567020d1ea6b0fa923708721a34a5ccc0fb496d12126bb30a851865991983cc2e32 SHA512 af6f6bfbbae58dc60fd821e90f034d36a4a554b239ea60ab38f9ce9611cff44e5fd59366905b71c9363444a28aeadcaecac87a8596a8cd16c313921f6826c798
-DIST git-manpages-2.39.3.tar.xz 557428 BLAKE2B 4eb85035f7056a12c3f1276d26f99b3337b97721f8f4b0b3c74d2a484171bfdf74f566a03e175ba32b389c940ed7be66ce2933442ec77089d5db3aaeb2ed2557 SHA512 06414741667b990ff3a28f7cb29b502df3d4cc757d525438994af005c71d429ca969563a74d1d2b44185e5c40107ac8838b390835a8a947e542ce3636b43f98b
-DIST git-manpages-2.39.4.tar.xz 558200 BLAKE2B 04adff54a214354bc697bf0cca5066208f92fa5c659e5e939fdcc19a701c28119c36e37a5398357dedbc95bce6817e53ae0dee3344e2cb43db2e7a16c6e131f3 SHA512 5fc6593746de4022b97ee8862f7b4dae165ba33ab5ffa5ff643350149cdcdf8821056f25248b0a258301d226b320217b54532f7d07478d245477b1c9193c5d96
+DIST git-htmldocs-2.46.1.tar.xz 1552632 BLAKE2B 19a4d4e88a3be1b4ed2487003b16a6d52b8759247e53ba22b8f274a083d970c744e17c3326122c6e0383e91113d8fb17ab5fba0d1d03bf49a16687778c93c0cd SHA512 6720d732ce72d61e7e4aa7159f59c3677e442180f5b89bb95e5454856fd2b37e1f650bf711b2e1eb0d379544c72f5ae838863cbf479e008c72410396fcf3a419
+DIST git-htmldocs-2.46.2.tar.xz 1553104 BLAKE2B 9a7b784c1a01153dc660b4fe6eaa3ceac2d30eeb96015ab4ec73296811d27cc84715abd19f723ad16c64028114c2aceee2727380e7c9f8ff220ae4538dcc9c62 SHA512 51c5363ac48f04118071218ea095dae97676ac299a482511ef55e9267724f08e7c021ffa15418d9e32e676333ba31643c9049860f154f58a67d9604e141376c3
 DIST git-manpages-2.39.5.tar.xz 558188 BLAKE2B 062cc26c5ed5b955422c3c2c927eb666b7f141c20a52e85cc2910b657267a853a6cb971c61030fe266762ade37fdd830fc9fb0cef622e625d95ca359188a9720 SHA512 5cd07eff2ff90c0ffc7f0606cd35f44856a30febf53f7f8c5ab0438614f20459b2b96d4b140118c2c0c9c5e83ee66aaa1443aa64e9e4f2a78f5990d122fe1e74
-DIST git-manpages-2.41.0.tar.xz 565060 BLAKE2B 082f2272314981b21606aef22bf18f0fe1d8a29fce0ce29e451cbad986e8f9c398906632b694de1b328accda61e85f25fd8875ee2e104cb9a7da8873d48e1495 SHA512 118afe9af79f2747c1f762b51fa2cdce7b46396ab4321f57826a351575acf30d9a486e2713e558cab6f6b353724cef3f0f1eab587b181f547324e96e3fee0b91
-DIST git-manpages-2.41.1.tar.xz 565788 BLAKE2B d0a6bc84251c9b5f2b77126120531f47c74ad1de8cf984db4ed38f3c8068f9ce8c7bbc8172ae7030c3d18129575794e2aa42143fc540b07f3f079f6e9565faf3 SHA512 835e0699827255f065d65c732a97d2d84801bd8e1552ebe752390981b30b4bb0d11a246eb452c2649cdfadf492895112a202992ee4ef553ee9dd8f8e263438e1
 DIST git-manpages-2.41.2.tar.xz 565744 BLAKE2B 944e53adc56723c1235a8401a06b8abdd95cd75420652e8b056fdab2134ff260c336d2a01a1bce9f869bf4e2935448c71a6d0f09351210b795571d70c98578c9 SHA512 f211b96de489b2ba0263aa740cdd2ab25fb1d1ed97a85c0f46cd1cce54d716d13b1e9fc2bd2d78dd29649a133b8d0c24386ac4bd119fd3efaf7e19c17a47f00f
 DIST git-manpages-2.43.2.tar.xz 570496 BLAKE2B 5d0be8f51edddf5b6a0c18d21a1ee8c23c92977370d25e04144cae882505e9235486219964bcfca1f21dca7eb3533d4d91acda07eb66687a96ca488e6f4cc15c SHA512 09ab36dc8e9dc8d0ed29610ba6fe5bff8c76d01e9b36d1443bfa4d729d4c8c6849620188856f226b07ba1259e0a617454e470d852e2464ce2c408888a3e57347
-DIST git-manpages-2.43.4.tar.xz 571416 BLAKE2B e2d490f938f810d193a24a2c19e13c2428cf801a3a9fc8893db8d82967be750b0fc2e0f8f283b1a724db8348584ec11d8351835ccd874025b4ab8ddbc1085ab7 SHA512 5ab22a8edec7fb2cce132d59b322982ca4b30db5768652a9e8f641b3502678fac7b0866a71ccf799e6151f5bfdf14c21cadde86d459065e68ac8ef1913e91a08
 DIST git-manpages-2.43.5.tar.xz 571176 BLAKE2B 077b74f8436da64116d173459b21aeef7faf4de47f16f2fa3b5d4ee721d373b4d2d26978626525b60ccc4ad1c5fa343e80d0a0f3baff3ad0d41e284abb2cf04a SHA512 31075102a42655574431fc0e25c415fab853d2d7a8104a729229056c22ff30909928a92e9469650b23abd0f7941a213bd59302bb67b9170c3474fa4fbe044b4b
-DIST git-manpages-2.44.1.tar.xz 574200 BLAKE2B bd98eefb4207799e8e07d543680ef0f8ecbdc32980c646050d9936d4db3286ffca438fea51746509422f424493b03816fa29f0c5278650e1aa75e8ac26318709 SHA512 e81fb47487ee61e407a966f6a80bc0d287cb4f89b026327478d5fc6a16f8513d8fc7636af2503a73268f2950734944387aea537cec29f070232f9d6874eaf44a
 DIST git-manpages-2.44.2.tar.xz 574316 BLAKE2B ecfca8e05ca682097376ce6a1e8b9de8fcc36472860321987be12291a53d1a92befb950fd856775df65f28300b267b80975775cba046cfb89159887e8cba5516 SHA512 2ad6d922acf46028b3b7dd5a686c0396e5452e4d50b32ba9af0cc51cc3431003524b91279e2a795065a179af3d760ce72530580295ed09a53673274cf9567cc6
 DIST git-manpages-2.45.2.tar.xz 576428 BLAKE2B c89ebd25c0caf391fcd29cc8609252daf2cf742a8cc78ce5b64931befb126c951ebb7504bc8ccbee06b81727dc3e4ded67c69adf8d737f4df38dfda758e3c734 SHA512 d39a5c92c1cfcae145713b8ff1a84258947392a3cf1490e3f7d4f87836d05e79dc4fecbff16b7c1bc314572d6d32aa2c29e7fcde993b549b2fab71620734c19b
 DIST git-manpages-2.46.0.tar.xz 585072 BLAKE2B 8a7dbd9ac4d7e26c24f38baba0e2e639377ec56e23beef8123a4e28dd0c3cae26abd7a8491db9fd69c5ad58767617aadb4dec8649223a5db6520d383521fd142 SHA512 7bcc47107f9f06a42dafc7dfe3788a9fbacc550546cd6f1c481835749ad78e8b447e179cbb80e2a01ab765154562edbb64d94b244530bafdfb94c4a127c4068e
+DIST git-manpages-2.46.1.tar.xz 584836 BLAKE2B fa1836bb4eedeb184948fff372b742f1a9317899506cbef6bd44730a34ffd27c344e03c65d9c2a813f7428406f86b23f8546a38becfd63041372f39f30ec20c4 SHA512 a00cd09f968670ec229f2b82d3120fbeeb0cbcf73b6c2d15668faff225b6d899ac8f10d1385fd1d6e636988317b919dd495fddb53b7063d6f20edbd8d38e6c51
+DIST git-manpages-2.46.2.tar.xz 584812 BLAKE2B dd5592a1fd61b6eda0afa4f9292ce86dd14bca6a88016f96c53617f6505f27cc9a2ba9437c6330bb8003b3f57cd1e75bf441bf2a2168554bbda9c26db37db4cb SHA512 ce7a2a1fbb9376182b8ce3ed772fbeeef2cf338bc06bf9bcf3c07a65419e41b3754d6851a44886d0b07dfd82f8eefe7b8b1d9f5c28ed6b6a0ea4168ed457e121
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/files/git-2.46.2-unsafe-directory.patch b/sdk_container/src/third_party/portage-stable/dev-vcs/git/files/git-2.46.2-unsafe-directory.patch
new file mode 100644
index 00000000000..0e07371a0d8
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/git/files/git-2.46.2-unsafe-directory.patch
@@ -0,0 +1,14 @@
+Neuter the "safe directory" feature, except for tests.
+--- a/setup.c
++++ b/setup.c
+@@ -1316,7 +1316,9 @@ static int ensure_valid_ownership(const char *gitfile,
+ 	git_protected_config(safe_directory_cb, &data);
+ 
+ 	free(data.path);
+-	return data.is_safe;
++	if (git_env_bool("GIT_TEST_ASSUME_DIFFERENT_OWNER", 0))
++		return data.is_safe;
++	return 1;
+ }
+ 
+ void die_upon_dubious_ownership(const char *gitfile, const char *worktree,
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.39.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.39.3.ebuild
deleted file mode 100644
index 002f22160d1..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.39.3.ebuild
+++ /dev/null
@@ -1,644 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-GENTOO_DEPEND_ON_PERL=no
-
-# bug #329479: git-remote-testgit is not multiple-version aware
-PYTHON_COMPAT=( python3_{9..11} )
-
-inherit toolchain-funcs perl-module bash-completion-r1 optfeature plocale python-single-r1 systemd
-
-PLOCALES="bg ca de es fr is it ko pt_PT ru sv vi zh_CN"
-
-if [[ ${PV} == *9999 ]]; then
-	EGIT_REPO_URI="https://git.kernel.org/pub/scm/git/git.git"
-
-	inherit git-r3
-	# Please ensure that all _four_ 9999 ebuilds get updated; they track the 4 upstream branches.
-	# See https://git-scm.com/docs/gitworkflows#_graduation
-	# In order of stability:
-	# 9999-r0: maint
-	# 9999-r1: master
-	# 9999-r2: next
-	# 9999-r3: seen
-	case ${PVR} in
-		9999) EGIT_BRANCH=maint ;;
-		9999-r1) EGIT_BRANCH=master ;;
-		9999-r2) EGIT_BRANCH=next;;
-		9999-r3) EGIT_BRANCH=seen ;;
-	esac
-fi
-
-MY_PV="${PV/_rc/.rc}"
-MY_P="${PN}-${MY_PV}"
-
-DOC_VER="${MY_PV}"
-
-DESCRIPTION="Stupid content tracker: distributed VCS designed for speed and efficiency"
-HOMEPAGE="https://www.git-scm.com/"
-
-if [[ ${PV} != *9999 ]]; then
-	SRC_URI_SUFFIX="xz"
-	SRC_URI_KORG="https://www.kernel.org/pub/software/scm/git"
-
-	[[ ${PV/rc} != ${PV} ]] && SRC_URI_KORG+='/testing'
-
-	SRC_URI="${SRC_URI_KORG}/${MY_P}.tar.${SRC_URI_SUFFIX}"
-	SRC_URI+=" ${SRC_URI_KORG}/${PN}-manpages-${DOC_VER}.tar.${SRC_URI_SUFFIX}"
-	SRC_URI+=" doc? ( ${SRC_URI_KORG}/${PN}-htmldocs-${DOC_VER}.tar.${SRC_URI_SUFFIX} )"
-
-	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
-	fi
-fi
-
-S="${WORKDIR}"/${MY_P}
-
-LICENSE="GPL-2"
-SLOT="0"
-IUSE="+blksha1 +curl cgi doc keyring +gpg highlight +iconv mediawiki +nls +pcre perforce +perl +safe-directory selinux subversion tk +webdav xinetd cvs test"
-
-# Common to both DEPEND and RDEPEND
-DEPEND="
-	dev-libs/openssl:=
-	sys-libs/zlib
-	curl? (
-		net-misc/curl
-		webdav? ( dev-libs/expat )
-	)
-	keyring? (
-		app-crypt/libsecret
-		dev-libs/glib:2
-	)
-	iconv? ( virtual/libiconv )
-	pcre? ( dev-libs/libpcre2:= )
-	perl? ( dev-lang/perl:=[-build(-)] )
-	tk? ( dev-lang/tk:= )
-"
-RDEPEND="
-	${DEPEND}
-	gpg? ( app-crypt/gnupg )
-	perl? (
-		dev-perl/Error
-		dev-perl/MailTools
-		dev-perl/Authen-SASL
-		>=virtual/perl-libnet-3.110.0-r4[ssl]
-		cgi? (
-			dev-perl/CGI
-			highlight? ( app-text/highlight )
-		)
-		cvs? (
-			>=dev-vcs/cvsps-2.1:0
-			dev-perl/DBI
-			dev-perl/DBD-SQLite
-		)
-		mediawiki? (
-			dev-perl/DateTime-Format-ISO8601
-			dev-perl/HTML-Tree
-			dev-perl/MediaWiki-API
-		)
-		subversion? (
-			dev-vcs/subversion[-dso(-),perl]
-			dev-perl/libwww-perl
-			dev-perl/TermReadKey
-		)
-	)
-	perforce? ( ${PYTHON_DEPS} )
-	selinux? ( sec-policy/selinux-git )
-"
-
-# This is how info docs are created with Git:
-#   .txt/asciidoc --(asciidoc)---------> .xml/docbook
-#   .xml/docbook  --(docbook2texi.pl)--> .texi
-#   .texi         --(makeinfo)---------> .info
-BDEPEND="
-	doc? (
-		app-text/asciidoc
-		app-text/docbook2X
-		app-text/xmlto
-		sys-apps/texinfo
-	)
-	keyring? ( virtual/pkgconfig )
-	nls? ( sys-devel/gettext )
-	test? (	app-crypt/gnupg	)
-"
-
-# Live ebuild builds man pages and HTML docs, additionally
-if [[ ${PV} == *9999 ]]; then
-	BDEPEND+=" app-text/asciidoc"
-fi
-
-SITEFILE="50${PN}-gentoo.el"
-
-REQUIRED_USE="
-	cgi? ( perl )
-	cvs? ( perl )
-	mediawiki? ( perl )
-	perforce? ( ${PYTHON_REQUIRED_USE} )
-	subversion? ( perl )
-	webdav? ( curl )
-"
-
-RESTRICT="!test? ( test )"
-
-PATCHES=(
-	# Avoid automagic CVS, bug #350330
-	"${FILESDIR}"/git-2.37.0_rc1-optional-cvs.patch
-
-	# Make submodule output quiet
-	"${FILESDIR}"/git-2.21.0-quiet-submodules-testcase.patch
-)
-
-pkg_setup() {
-	if use subversion && has_version "dev-vcs/subversion[dso]" ; then
-		ewarn "Per Gentoo bugs #223747, #238586, when subversion is built"
-		ewarn "with USE=dso, there may be weird crashes in git-svn. You"
-		ewarn "have been warned!"
-	fi
-
-	if use perforce ; then
-		python-single-r1_pkg_setup
-	fi
-}
-
-# This is needed because for some obscure reasons future calls to make don't
-# pick up these exports if we export them in src_unpack()
-exportmakeopts() {
-	local extlibs myopts
-
-	myopts=(
-		ASCIIDOC_NO_ROFF=YesPlease
-
-		$(usex perl 'INSTALLDIRS=vendor NO_PERL_CPAN_FALLBACKS=YesPlease' NO_PERL=YesPlease)
-
-		$(usev elibc_musl NO_REGEX=NeedsStartEnd)
-		$(usev !cvs NO_CVS=YesPlease)
-		$(usev !iconv NO_ICONV=YesPlease)
-		$(usev !nls NO_GETTEXT=YesPlease)
-		$(usev !perforce NO_PYTHON=YesPlease)
-		$(usev !subversion NO_SVN_TESTS=YesPlease)
-		$(usev !tk NO_TCLTK=YesPlease)
-	)
-
-	if use blksha1 ; then
-		myopts+=( BLK_SHA1=YesPlease )
-	fi
-
-	if use curl ; then
-		use webdav || myopts+=( NO_EXPAT=YesPlease )
-	else
-		myopts+=( NO_CURL=YesPlease )
-	fi
-
-	# Broken assumptions because of static build system
-	myopts+=(
-		NO_FINK=YesPlease
-		NO_DARWIN_PORTS=YesPlease
-		INSTALL=install
-		TAR=tar
-		SHELL_PATH="${EPREFIX}/bin/sh"
-		SANE_TOOL_PATH=
-		OLD_ICONV=
-		NO_EXTERNAL_GREP=
-	)
-
-	# Can't define this to null, since the entire makefile depends on it
-	sed -i -e '/\/usr\/local/s/BASIC_/#BASIC_/' Makefile || die
-
-	if use pcre; then
-		myopts+=( USE_LIBPCRE2=YesPlease )
-		extlibs+=( -lpcre2-8 )
-	fi
-
-	if [[ ${CHOST} == *-solaris* ]]; then
-		myopts+=(
-			NEEDS_LIBICONV=YesPlease
-			HAVE_CLOCK_MONOTONIC=1
-		)
-
-		if grep -Fq getdelim "${ESYSROOT}"/usr/include/stdio.h ; then
-			myopts+=( HAVE_GETDELIM=1 )
-		fi
-	fi
-
-	myopts+=( ASCIIDOC8=YesPlease )
-
-	export MY_MAKEOPTS="${myopts[@]}"
-	export EXTLIBS="${extlibs[@]}"
-}
-
-src_unpack() {
-	if [[ ${PV} != *9999 ]] ; then
-		unpack ${MY_P}.tar.${SRC_URI_SUFFIX}
-
-		cd "${S}" || die
-		unpack ${PN}-manpages-${DOC_VER}.tar.${SRC_URI_SUFFIX}
-
-		if use doc ; then
-			pushd "${S}"/Documentation &>/dev/null || die
-			unpack ${PN}-htmldocs-${DOC_VER}.tar.${SRC_URI_SUFFIX}
-			popd &>/dev/null || die
-		fi
-	else
-		git-r3_src_unpack
-		#cp "${FILESDIR}"/GIT-VERSION-GEN . || die
-	fi
-
-}
-
-src_prepare() {
-	if ! use safe-directory ; then
-		# This patch neuters the "safe directory" detection.
-		# bugs #838271, #838223
-		PATCHES+=(
-			"${FILESDIR}"/git-2.37.2-unsafe-directory.patch
-		)
-	fi
-
-	default
-
-	if use prefix ; then
-		# bug #757309
-		eapply "${FILESDIR}"/git-2.37.2-darwin-prefix-gettext.patch
-	fi
-
-	sed -i \
-		-e 's:^\(CFLAGS[[:space:]]*=\).*$:\1 $(OPTCFLAGS) -Wall:' \
-		-e 's:^\(LDFLAGS[[:space:]]*=\).*$:\1 $(OPTLDFLAGS):' \
-		-e 's:^\(CC[[:space:]]* =\).*$:\1$(OPTCC):' \
-		-e 's:^\(AR[[:space:]]* =\).*$:\1$(OPTAR):' \
-		-e "s:\(PYTHON_PATH[[:space:]]\+=[[:space:]]\+\)\(.*\)$:\1${EPREFIX}\2:" \
-		-e "s:\(PERL_PATH[[:space:]]\+=[[:space:]]\+\)\(.*\)$:\1${EPREFIX}\2:" \
-		Makefile || die
-
-	# Fix docbook2texi command
-	sed -r -i 's/DOCBOOK2X_TEXI[[:space:]]*=[[:space:]]*docbook2x-texi/DOCBOOK2X_TEXI = docbook2texi.pl/' \
-		Documentation/Makefile || die
-}
-
-git_emake() {
-	# bug #320647: PYTHON_PATH
-	local PYTHON_PATH=""
-	use perforce && PYTHON_PATH="${PYTHON}"
-
-	local mymakeargs=(
-		${MY_MAKEOPTS}
-
-		prefix="${EPREFIX}"/usr
-		htmldir="${EPREFIX}"/usr/share/doc/${PF}/html
-		perllibdir="$(use perl && perl_get_raw_vendorlib)"
-		sysconfdir="${EPREFIX}"/etc
-
-		CC="$(tc-getCC)"
-		CFLAGS="${CFLAGS}"
-		PKG_CONFIG="$(tc-getPKG_CONFIG)"
-
-		# TODO: --verbose?
-		GIT_TEST_OPTS="--no-color"
-
-		OPTAR="$(tc-getAR)"
-		OPTCC="$(tc-getCC)"
-		OPTCFLAGS="${CFLAGS}"
-		OPTLDFLAGS="${LDFLAGS}"
-
-		PERL_PATH="${EPREFIX}/usr/bin/perl"
-		PERL_MM_OPT=""
-
-		PYTHON_PATH="${PYTHON_PATH}"
-
-		V=1
-		"$@"
-	)
-
-	emake "${mymakeargs[@]}"
-}
-
-src_configure() {
-	exportmakeopts
-}
-
-src_compile() {
-	git_emake
-
-	if use perl && use cgi ; then
-		git_emake gitweb
-	fi
-
-	if [[ ${CHOST} == *-darwin* ]] && tc-is-clang ; then
-		git_emake -C contrib/credential/osxkeychain
-	fi
-
-	pushd Documentation &>/dev/null || die
-	if [[ ${PV} == *9999 ]] ; then
-		git_emake man
-		if use doc ; then
-			git_emake info html
-		fi
-	else
-		if use doc ; then
-			git_emake info
-		fi
-	fi
-	popd &>/dev/null || die
-
-	if use keyring ; then
-		git_emake -C contrib/credential/libsecret
-	fi
-
-	pushd contrib/subtree &>/dev/null || die
-	git_emake git-subtree
-	# git-subtree.1 requires the full USE=doc dependency stack
-	use doc && git_emake git-subtree.html git-subtree.1
-	popd &>/dev/null || die
-
-	git_emake -C contrib/diff-highlight
-
-	if use mediawiki ; then
-		git_emake -C contrib/mw-to-git
-	fi
-}
-
-src_test() {
-	local disabled=(
-		# We make safe-directory optional
-		t0033-safe-directory.sh
-	)
-
-	local tests_cvs=(
-		t9200-git-cvsexportcommit.sh
-		t9400-git-cvsserver-server.sh
-		t9401-git-cvsserver-crlf.sh
-		t9402-git-cvsserver-refs.sh
-		t9600-cvsimport.sh
-		t9601-cvsimport-vendor-branch.sh
-		t9602-cvsimport-branches-tags.sh
-		t9603-cvsimport-patchsets.sh
-		t9604-cvsimport-timestamps.sh
-	)
-
-	local tests_perl=(
-		t3701-add-interactive.sh
-		t5502-quickfetch.sh
-		t5512-ls-remote.sh
-		t5520-pull.sh
-		t7106-reset-unborn-branch.sh
-		t7501-commit.sh
-	)
-	# Bug #225601 - t0004 is not suitable for root perm
-	# Bug #219839 - t1004 is not suitable for root perm
-	# t0001-init.sh - check for init notices EPERM*  fails
-	local tests_nonroot=(
-		t0001-init.sh
-		t0004-unwritable.sh
-		t0070-fundamental.sh
-		t1004-read-tree-m-u-wf.sh
-		t3700-add.sh
-		t7300-clean.sh
-	)
-	# t9100 still fails with symlinks in SVN 1.7
-	local test_svn=( t9100-git-svn-basic.sh )
-
-	# Unzip is used only for the testcase code, not by any normal parts of Git.
-	if ! has_version app-arch/unzip ; then
-		einfo "Disabling tar-tree tests"
-		disabled+=( t5000-tar-tree.sh )
-	fi
-
-	local cvs=0
-	use cvs && let cvs=${cvs}+1
-	if [[ ${EUID} -eq 0 ]] ; then
-		if [[ ${cvs} -eq 1 ]] ; then
-			ewarn "Skipping CVS tests because CVS does not work as root!"
-			ewarn "You should retest with FEATURES=userpriv!"
-			disabled+=( ${tests_cvs[@]} )
-		fi
-		einfo "Skipping other tests that require being non-root"
-		disabled+=( ${tests_nonroot[@]} )
-	else
-		if [[ ${cvs} -gt 0 ]] && has_version dev-vcs/cvs ; then
-			let cvs=${cvs}+1
-		fi
-
-		if [[ ${cvs} -gt 1 ]] && has_version "dev-vcs/cvs[server]" ; then
-			let cvs=${cvs}+1
-		fi
-
-		if [[ ${cvs} -lt 3 ]] ; then
-			einfo "Disabling CVS tests (needs dev-vcs/cvs[USE=server])"
-			disabled+=( ${tests_cvs[@]} )
-		fi
-	fi
-
-	if ! use perl ; then
-		einfo "Disabling tests that need Perl"
-		disabled+=( ${tests_perl[@]} )
-	fi
-
-	einfo "Disabling tests that fail with SVN 1.7"
-	disabled+=( ${test_svn[@]} )
-
-	# Reset all previously disabled tests
-	pushd t &>/dev/null || die
-	local i
-	for i in *.sh.DISABLED ; do
-		[[ -f "${i}" ]] && mv -f "${i}" "${i%.DISABLED}"
-	done
-	einfo "Disabled tests:"
-	for i in ${disabled[@]} ; do
-		if [[ -f "${i}" ]] ; then
-			mv -f "${i}" "${i}.DISABLED" && einfo "Disabled ${i}"
-		fi
-	done
-
-	# Avoid the test system removing the results because we want them ourselves
-	sed -e '/^[[:space:]]*$(MAKE) clean/s,^,#,g' -i Makefile || die
-
-	# Clean old results first, must always run
-	nonfatal git_emake clean
-	popd &>/dev/null || die
-
-	# Now run the tests, keep going if we hit an error, and don't terminate on
-	# failure
-	local rc
-	einfo "Start test run"
-	#MAKEOPTS=-j1
-	nonfatal git_emake --keep-going test
-	rc=$?
-
-	# Display nice results, now print the results
-	pushd t &>/dev/null || die
-	nonfatal git_emake aggregate-results
-
-	# And bail if there was a problem
-	[[ ${rc} -eq 0 ]] || die "Tests failed. Please file a bug!"
-}
-
-src_install() {
-	git_emake DESTDIR="${D}" install
-
-	if [[ ${CHOST} == *-darwin* ]] && tc-is-clang ; then
-		dobin contrib/credential/osxkeychain/git-credential-osxkeychain
-	fi
-
-	# Depending on the tarball and manual rebuild of the documentation, the
-	# manpages may exist in either OR both of these directories.
-	find man?/*.[157] >/dev/null 2>&1 && doman man?/*.[157]
-	find Documentation/*.[157] >/dev/null 2>&1 && doman Documentation/*.[157]
-	dodoc README* Documentation/{SubmittingPatches,CodingGuidelines}
-	use doc && dodir /usr/share/doc/${PF}/html
-	local d
-	for d in / /howto/ /technical/ ; do
-		docinto ${d}
-		dodoc Documentation${d}*.txt
-		if use doc ; then
-			docinto ${d}/html
-			dodoc Documentation${d}*.html
-		fi
-	done
-	docinto /
-	# Upstream does not ship this pre-built :-(
-	use doc && doinfo Documentation/{git,gitman}.info
-
-	newbashcomp contrib/completion/git-completion.bash ${PN}
-	bashcomp_alias git gitk
-	# Not really a bash-completion file (bug #477920)
-	# but still needed uncompressed (bug #507480)
-	insinto /usr/share/${PN}
-	doins contrib/completion/git-prompt.sh
-
-	#dobin contrib/fast-import/git-p4 # Moved upstream
-	#dodoc contrib/fast-import/git-p4.txt # Moved upstream
-	newbin contrib/fast-import/import-tars.perl import-tars
-	exeinto /usr/libexec/git-core/
-	newexe contrib/git-resurrect.sh git-resurrect
-
-	# git-subtree
-	pushd contrib/subtree &>/dev/null || die
-	git_emake DESTDIR="${D}" install
-	if use doc ; then
-		# Do not move git subtree install-man outside USE=doc!
-		git_emake DESTDIR="${D}" install-man install-html
-	fi
-	newdoc README README.git-subtree
-	dodoc git-subtree.txt
-	popd &>/dev/null || die
-
-	if use mediawiki ; then
-		git_emake -C contrib/mw-to-git DESTDIR="${D}" install
-	fi
-
-	# diff-highlight
-	dobin contrib/diff-highlight/diff-highlight
-	newdoc contrib/diff-highlight/README README.diff-highlight
-
-	# git-jump
-	exeinto /usr/libexec/git-core/
-	doexe contrib/git-jump/git-jump
-	newdoc contrib/git-jump/README git-jump.txt
-
-	# git-contacts
-	exeinto /usr/libexec/git-core/
-	doexe contrib/contacts/git-contacts
-	dodoc contrib/contacts/git-contacts.txt
-
-	if use keyring ; then
-		pushd contrib/credential/libsecret &>/dev/null || die
-		dobin git-credential-libsecret
-		popd &>/dev/null || die
-	fi
-
-	dodir /usr/share/${PN}/contrib
-	# The following are excluded:
-	# completion - installed above
-	# diff-highlight - done above
-	# emacs - removed upstream
-	# examples - these are stuff that is not used in Git anymore actually
-	# git-jump - done above
-	# gitview - installed above
-	# p4import - excluded because fast-import has a better one
-	# patches - stuff the Git guys made to go upstream to other places
-	# persistent-https - TODO
-	# mw-to-git - TODO
-	# subtree - build  seperately
-	# svnimport - use git-svn
-	# thunderbird-patch-inline - fixes thunderbird
-	local contrib_objects=(
-		buildsystems
-		fast-import
-		hg-to-git
-		hooks
-		remotes2config.sh
-		rerere-train.sh
-		stats
-		workdir
-	)
-	local i
-	for i in "${contrib_objects[@]}" ; do
-		cp -rf "${S}"/contrib/${i} "${ED}"/usr/share/${PN}/contrib || die "Failed contrib ${i}"
-	done
-
-	if use perl && use cgi ; then
-		# We used to install in /usr/share/${PN}/gitweb
-		# but upstream installs in /usr/share/gitweb
-		# so we will install a symlink and use their location for compat with other
-		# distros
-		dosym ../gitweb /usr/share/${PN}/gitweb
-
-		# INSTALL discusses configuration issues, not just installation
-		docinto /
-		newdoc  "${S}"/gitweb/INSTALL INSTALL.gitweb
-		newdoc  "${S}"/gitweb/README README.gitweb
-
-		for d in "${ED}"/usr/lib{,64}/perl5/ ; do
-			if [[ -d "${d}" ]] ; then
-				find "${d}" -name .packlist -delete || die
-			fi
-		done
-	else
-		rm -rf "${ED}"/usr/share/gitweb
-	fi
-
-	if ! use subversion ; then
-		rm -f "${ED}"/usr/libexec/git-core/git-svn \
-			"${ED}"/usr/share/man/man1/git-svn.1*
-	fi
-
-	if use xinetd ; then
-		insinto /etc/xinetd.d
-		newins "${FILESDIR}"/git-daemon.xinetd git-daemon
-	fi
-
-	if ! use prefix ; then
-		newinitd "${FILESDIR}"/git-daemon-r2.initd git-daemon
-		newconfd "${FILESDIR}"/git-daemon.confd git-daemon
-		systemd_newunit "${FILESDIR}/git-daemon_at-r1.service" "git-daemon@.service"
-		systemd_dounit "${FILESDIR}/git-daemon.socket"
-	fi
-
-	perl_delete_localpod
-
-	# Remove disabled linguas
-	# we could remove sources in src_prepare, but install does not
-	# handle missing locale dir well
-	rm_loc() {
-		if [[ -e "${ED}/usr/share/locale/${1}" ]] ; then
-			rm -r "${ED}/usr/share/locale/${1}" || die
-		fi
-	}
-	plocale_for_each_disabled_locale rm_loc
-}
-
-pkg_postinst() {
-	if [[ -z ${REPLACING_VERSIONS} ]] ; then
-		elog "Please read /usr/share/bash-completion/completions/git for Git bash command"
-		elog "completion."
-		elog "Please read /usr/share/git/git-prompt.sh for Git bash prompt"
-		elog "Note that the prompt bash code is now in that separate script"
-	fi
-
-	optfeature_header "Some scripts require additional dependencies:"
-	optfeature git-quiltimport dev-util/quilt
-	optfeature git-instaweb www-servers/lighttpd www-servers/apache www-servers/nginx
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.39.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.39.4.ebuild
deleted file mode 100644
index 17e1ff48a4b..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.39.4.ebuild
+++ /dev/null
@@ -1,644 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-GENTOO_DEPEND_ON_PERL=no
-
-# bug #329479: git-remote-testgit is not multiple-version aware
-PYTHON_COMPAT=( python3_{9..11} )
-
-inherit toolchain-funcs perl-module bash-completion-r1 optfeature plocale python-single-r1 systemd
-
-PLOCALES="bg ca de es fr is it ko pt_PT ru sv vi zh_CN"
-
-if [[ ${PV} == *9999 ]]; then
-	EGIT_REPO_URI="https://git.kernel.org/pub/scm/git/git.git"
-
-	inherit git-r3
-	# Please ensure that all _four_ 9999 ebuilds get updated; they track the 4 upstream branches.
-	# See https://git-scm.com/docs/gitworkflows#_graduation
-	# In order of stability:
-	# 9999-r0: maint
-	# 9999-r1: master
-	# 9999-r2: next
-	# 9999-r3: seen
-	case ${PVR} in
-		9999) EGIT_BRANCH=maint ;;
-		9999-r1) EGIT_BRANCH=master ;;
-		9999-r2) EGIT_BRANCH=next;;
-		9999-r3) EGIT_BRANCH=seen ;;
-	esac
-fi
-
-MY_PV="${PV/_rc/.rc}"
-MY_P="${PN}-${MY_PV}"
-
-DOC_VER="${MY_PV}"
-
-DESCRIPTION="Stupid content tracker: distributed VCS designed for speed and efficiency"
-HOMEPAGE="https://www.git-scm.com/"
-
-if [[ ${PV} != *9999 ]]; then
-	SRC_URI_SUFFIX="xz"
-	SRC_URI_KORG="https://www.kernel.org/pub/software/scm/git"
-
-	[[ ${PV/rc} != ${PV} ]] && SRC_URI_KORG+='/testing'
-
-	SRC_URI="${SRC_URI_KORG}/${MY_P}.tar.${SRC_URI_SUFFIX}"
-	SRC_URI+=" ${SRC_URI_KORG}/${PN}-manpages-${DOC_VER}.tar.${SRC_URI_SUFFIX}"
-	SRC_URI+=" doc? ( ${SRC_URI_KORG}/${PN}-htmldocs-${DOC_VER}.tar.${SRC_URI_SUFFIX} )"
-
-	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
-	fi
-fi
-
-S="${WORKDIR}"/${MY_P}
-
-LICENSE="GPL-2"
-SLOT="0"
-IUSE="+blksha1 +curl cgi doc keyring +gpg highlight +iconv mediawiki +nls +pcre perforce +perl +safe-directory selinux subversion tk +webdav xinetd cvs test"
-
-# Common to both DEPEND and RDEPEND
-DEPEND="
-	dev-libs/openssl:=
-	sys-libs/zlib
-	curl? (
-		net-misc/curl
-		webdav? ( dev-libs/expat )
-	)
-	keyring? (
-		app-crypt/libsecret
-		dev-libs/glib:2
-	)
-	iconv? ( virtual/libiconv )
-	pcre? ( dev-libs/libpcre2:= )
-	perl? ( dev-lang/perl:=[-build(-)] )
-	tk? ( dev-lang/tk:= )
-"
-RDEPEND="
-	${DEPEND}
-	gpg? ( app-crypt/gnupg )
-	perl? (
-		dev-perl/Error
-		dev-perl/MailTools
-		dev-perl/Authen-SASL
-		>=virtual/perl-libnet-3.110.0-r4[ssl]
-		cgi? (
-			dev-perl/CGI
-			highlight? ( app-text/highlight )
-		)
-		cvs? (
-			>=dev-vcs/cvsps-2.1:0
-			dev-perl/DBI
-			dev-perl/DBD-SQLite
-		)
-		mediawiki? (
-			dev-perl/DateTime-Format-ISO8601
-			dev-perl/HTML-Tree
-			dev-perl/MediaWiki-API
-		)
-		subversion? (
-			dev-vcs/subversion[-dso(-),perl]
-			dev-perl/libwww-perl
-			dev-perl/TermReadKey
-		)
-	)
-	perforce? ( ${PYTHON_DEPS} )
-	selinux? ( sec-policy/selinux-git )
-"
-
-# This is how info docs are created with Git:
-#   .txt/asciidoc --(asciidoc)---------> .xml/docbook
-#   .xml/docbook  --(docbook2texi.pl)--> .texi
-#   .texi         --(makeinfo)---------> .info
-BDEPEND="
-	doc? (
-		app-text/asciidoc
-		app-text/docbook2X
-		app-text/xmlto
-		sys-apps/texinfo
-	)
-	keyring? ( virtual/pkgconfig )
-	nls? ( sys-devel/gettext )
-	test? (	app-crypt/gnupg	)
-"
-
-# Live ebuild builds man pages and HTML docs, additionally
-if [[ ${PV} == *9999 ]]; then
-	BDEPEND+=" app-text/asciidoc"
-fi
-
-SITEFILE="50${PN}-gentoo.el"
-
-REQUIRED_USE="
-	cgi? ( perl )
-	cvs? ( perl )
-	mediawiki? ( perl )
-	perforce? ( ${PYTHON_REQUIRED_USE} )
-	subversion? ( perl )
-	webdav? ( curl )
-"
-
-RESTRICT="!test? ( test )"
-
-PATCHES=(
-	# Avoid automagic CVS, bug #350330
-	"${FILESDIR}"/git-2.37.0_rc1-optional-cvs.patch
-
-	# Make submodule output quiet
-	"${FILESDIR}"/git-2.21.0-quiet-submodules-testcase.patch
-)
-
-pkg_setup() {
-	if use subversion && has_version "dev-vcs/subversion[dso]" ; then
-		ewarn "Per Gentoo bugs #223747, #238586, when subversion is built"
-		ewarn "with USE=dso, there may be weird crashes in git-svn. You"
-		ewarn "have been warned!"
-	fi
-
-	if use perforce ; then
-		python-single-r1_pkg_setup
-	fi
-}
-
-# This is needed because for some obscure reasons future calls to make don't
-# pick up these exports if we export them in src_unpack()
-exportmakeopts() {
-	local extlibs myopts
-
-	myopts=(
-		ASCIIDOC_NO_ROFF=YesPlease
-
-		$(usex perl 'INSTALLDIRS=vendor NO_PERL_CPAN_FALLBACKS=YesPlease' NO_PERL=YesPlease)
-
-		$(usev elibc_musl NO_REGEX=NeedsStartEnd)
-		$(usev !cvs NO_CVS=YesPlease)
-		$(usev !iconv NO_ICONV=YesPlease)
-		$(usev !nls NO_GETTEXT=YesPlease)
-		$(usev !perforce NO_PYTHON=YesPlease)
-		$(usev !subversion NO_SVN_TESTS=YesPlease)
-		$(usev !tk NO_TCLTK=YesPlease)
-	)
-
-	if use blksha1 ; then
-		myopts+=( BLK_SHA1=YesPlease )
-	fi
-
-	if use curl ; then
-		use webdav || myopts+=( NO_EXPAT=YesPlease )
-	else
-		myopts+=( NO_CURL=YesPlease )
-	fi
-
-	# Broken assumptions because of static build system
-	myopts+=(
-		NO_FINK=YesPlease
-		NO_DARWIN_PORTS=YesPlease
-		INSTALL=install
-		TAR=tar
-		SHELL_PATH="${EPREFIX}/bin/sh"
-		SANE_TOOL_PATH=
-		OLD_ICONV=
-		NO_EXTERNAL_GREP=
-	)
-
-	# Can't define this to null, since the entire makefile depends on it
-	sed -i -e '/\/usr\/local/s/BASIC_/#BASIC_/' Makefile || die
-
-	if use pcre; then
-		myopts+=( USE_LIBPCRE2=YesPlease )
-		extlibs+=( -lpcre2-8 )
-	fi
-
-	if [[ ${CHOST} == *-solaris* ]]; then
-		myopts+=(
-			NEEDS_LIBICONV=YesPlease
-			HAVE_CLOCK_MONOTONIC=1
-		)
-
-		if grep -Fq getdelim "${ESYSROOT}"/usr/include/stdio.h ; then
-			myopts+=( HAVE_GETDELIM=1 )
-		fi
-	fi
-
-	myopts+=( ASCIIDOC8=YesPlease )
-
-	export MY_MAKEOPTS="${myopts[@]}"
-	export EXTLIBS="${extlibs[@]}"
-}
-
-src_unpack() {
-	if [[ ${PV} != *9999 ]] ; then
-		unpack ${MY_P}.tar.${SRC_URI_SUFFIX}
-
-		cd "${S}" || die
-		unpack ${PN}-manpages-${DOC_VER}.tar.${SRC_URI_SUFFIX}
-
-		if use doc ; then
-			pushd "${S}"/Documentation &>/dev/null || die
-			unpack ${PN}-htmldocs-${DOC_VER}.tar.${SRC_URI_SUFFIX}
-			popd &>/dev/null || die
-		fi
-	else
-		git-r3_src_unpack
-		#cp "${FILESDIR}"/GIT-VERSION-GEN . || die
-	fi
-
-}
-
-src_prepare() {
-	if ! use safe-directory ; then
-		# This patch neuters the "safe directory" detection.
-		# bugs #838271, #838223
-		PATCHES+=(
-			"${FILESDIR}"/git-2.37.2-unsafe-directory.patch
-		)
-	fi
-
-	default
-
-	if use prefix ; then
-		# bug #757309
-		eapply "${FILESDIR}"/git-2.37.2-darwin-prefix-gettext.patch
-	fi
-
-	sed -i \
-		-e 's:^\(CFLAGS[[:space:]]*=\).*$:\1 $(OPTCFLAGS) -Wall:' \
-		-e 's:^\(LDFLAGS[[:space:]]*=\).*$:\1 $(OPTLDFLAGS):' \
-		-e 's:^\(CC[[:space:]]* =\).*$:\1$(OPTCC):' \
-		-e 's:^\(AR[[:space:]]* =\).*$:\1$(OPTAR):' \
-		-e "s:\(PYTHON_PATH[[:space:]]\+=[[:space:]]\+\)\(.*\)$:\1${EPREFIX}\2:" \
-		-e "s:\(PERL_PATH[[:space:]]\+=[[:space:]]\+\)\(.*\)$:\1${EPREFIX}\2:" \
-		Makefile || die
-
-	# Fix docbook2texi command
-	sed -r -i 's/DOCBOOK2X_TEXI[[:space:]]*=[[:space:]]*docbook2x-texi/DOCBOOK2X_TEXI = docbook2texi.pl/' \
-		Documentation/Makefile || die
-}
-
-git_emake() {
-	# bug #320647: PYTHON_PATH
-	local PYTHON_PATH=""
-	use perforce && PYTHON_PATH="${PYTHON}"
-
-	local mymakeargs=(
-		${MY_MAKEOPTS}
-
-		prefix="${EPREFIX}"/usr
-		htmldir="${EPREFIX}"/usr/share/doc/${PF}/html
-		perllibdir="$(use perl && perl_get_raw_vendorlib)"
-		sysconfdir="${EPREFIX}"/etc
-
-		CC="$(tc-getCC)"
-		CFLAGS="${CFLAGS}"
-		PKG_CONFIG="$(tc-getPKG_CONFIG)"
-
-		# TODO: --verbose?
-		GIT_TEST_OPTS="--no-color"
-
-		OPTAR="$(tc-getAR)"
-		OPTCC="$(tc-getCC)"
-		OPTCFLAGS="${CFLAGS}"
-		OPTLDFLAGS="${LDFLAGS}"
-
-		PERL_PATH="${EPREFIX}/usr/bin/perl"
-		PERL_MM_OPT=""
-
-		PYTHON_PATH="${PYTHON_PATH}"
-
-		V=1
-		"$@"
-	)
-
-	emake "${mymakeargs[@]}"
-}
-
-src_configure() {
-	exportmakeopts
-}
-
-src_compile() {
-	git_emake
-
-	if use perl && use cgi ; then
-		git_emake gitweb
-	fi
-
-	if [[ ${CHOST} == *-darwin* ]] && tc-is-clang ; then
-		git_emake -C contrib/credential/osxkeychain
-	fi
-
-	pushd Documentation &>/dev/null || die
-	if [[ ${PV} == *9999 ]] ; then
-		git_emake man
-		if use doc ; then
-			git_emake info html
-		fi
-	else
-		if use doc ; then
-			git_emake info
-		fi
-	fi
-	popd &>/dev/null || die
-
-	if use keyring ; then
-		git_emake -C contrib/credential/libsecret
-	fi
-
-	pushd contrib/subtree &>/dev/null || die
-	git_emake git-subtree
-	# git-subtree.1 requires the full USE=doc dependency stack
-	use doc && git_emake git-subtree.html git-subtree.1
-	popd &>/dev/null || die
-
-	git_emake -C contrib/diff-highlight
-
-	if use mediawiki ; then
-		git_emake -C contrib/mw-to-git
-	fi
-}
-
-src_test() {
-	local disabled=(
-		# We make safe-directory optional
-		t0033-safe-directory.sh
-	)
-
-	local tests_cvs=(
-		t9200-git-cvsexportcommit.sh
-		t9400-git-cvsserver-server.sh
-		t9401-git-cvsserver-crlf.sh
-		t9402-git-cvsserver-refs.sh
-		t9600-cvsimport.sh
-		t9601-cvsimport-vendor-branch.sh
-		t9602-cvsimport-branches-tags.sh
-		t9603-cvsimport-patchsets.sh
-		t9604-cvsimport-timestamps.sh
-	)
-
-	local tests_perl=(
-		t3701-add-interactive.sh
-		t5502-quickfetch.sh
-		t5512-ls-remote.sh
-		t5520-pull.sh
-		t7106-reset-unborn-branch.sh
-		t7501-commit.sh
-	)
-	# Bug #225601 - t0004 is not suitable for root perm
-	# Bug #219839 - t1004 is not suitable for root perm
-	# t0001-init.sh - check for init notices EPERM*  fails
-	local tests_nonroot=(
-		t0001-init.sh
-		t0004-unwritable.sh
-		t0070-fundamental.sh
-		t1004-read-tree-m-u-wf.sh
-		t3700-add.sh
-		t7300-clean.sh
-	)
-	# t9100 still fails with symlinks in SVN 1.7
-	local test_svn=( t9100-git-svn-basic.sh )
-
-	# Unzip is used only for the testcase code, not by any normal parts of Git.
-	if ! has_version app-arch/unzip ; then
-		einfo "Disabling tar-tree tests"
-		disabled+=( t5000-tar-tree.sh )
-	fi
-
-	local cvs=0
-	use cvs && let cvs=${cvs}+1
-	if [[ ${EUID} -eq 0 ]] ; then
-		if [[ ${cvs} -eq 1 ]] ; then
-			ewarn "Skipping CVS tests because CVS does not work as root!"
-			ewarn "You should retest with FEATURES=userpriv!"
-			disabled+=( ${tests_cvs[@]} )
-		fi
-		einfo "Skipping other tests that require being non-root"
-		disabled+=( ${tests_nonroot[@]} )
-	else
-		if [[ ${cvs} -gt 0 ]] && has_version dev-vcs/cvs ; then
-			let cvs=${cvs}+1
-		fi
-
-		if [[ ${cvs} -gt 1 ]] && has_version "dev-vcs/cvs[server]" ; then
-			let cvs=${cvs}+1
-		fi
-
-		if [[ ${cvs} -lt 3 ]] ; then
-			einfo "Disabling CVS tests (needs dev-vcs/cvs[USE=server])"
-			disabled+=( ${tests_cvs[@]} )
-		fi
-	fi
-
-	if ! use perl ; then
-		einfo "Disabling tests that need Perl"
-		disabled+=( ${tests_perl[@]} )
-	fi
-
-	einfo "Disabling tests that fail with SVN 1.7"
-	disabled+=( ${test_svn[@]} )
-
-	# Reset all previously disabled tests
-	pushd t &>/dev/null || die
-	local i
-	for i in *.sh.DISABLED ; do
-		[[ -f "${i}" ]] && mv -f "${i}" "${i%.DISABLED}"
-	done
-	einfo "Disabled tests:"
-	for i in ${disabled[@]} ; do
-		if [[ -f "${i}" ]] ; then
-			mv -f "${i}" "${i}.DISABLED" && einfo "Disabled ${i}"
-		fi
-	done
-
-	# Avoid the test system removing the results because we want them ourselves
-	sed -e '/^[[:space:]]*$(MAKE) clean/s,^,#,g' -i Makefile || die
-
-	# Clean old results first, must always run
-	nonfatal git_emake clean
-	popd &>/dev/null || die
-
-	# Now run the tests, keep going if we hit an error, and don't terminate on
-	# failure
-	local rc
-	einfo "Start test run"
-	#MAKEOPTS=-j1
-	nonfatal git_emake --keep-going test
-	rc=$?
-
-	# Display nice results, now print the results
-	pushd t &>/dev/null || die
-	nonfatal git_emake aggregate-results
-
-	# And bail if there was a problem
-	[[ ${rc} -eq 0 ]] || die "Tests failed. Please file a bug!"
-}
-
-src_install() {
-	git_emake DESTDIR="${D}" install
-
-	if [[ ${CHOST} == *-darwin* ]] && tc-is-clang ; then
-		dobin contrib/credential/osxkeychain/git-credential-osxkeychain
-	fi
-
-	# Depending on the tarball and manual rebuild of the documentation, the
-	# manpages may exist in either OR both of these directories.
-	find man?/*.[157] >/dev/null 2>&1 && doman man?/*.[157]
-	find Documentation/*.[157] >/dev/null 2>&1 && doman Documentation/*.[157]
-	dodoc README* Documentation/{SubmittingPatches,CodingGuidelines}
-	use doc && dodir /usr/share/doc/${PF}/html
-	local d
-	for d in / /howto/ /technical/ ; do
-		docinto ${d}
-		dodoc Documentation${d}*.txt
-		if use doc ; then
-			docinto ${d}/html
-			dodoc Documentation${d}*.html
-		fi
-	done
-	docinto /
-	# Upstream does not ship this pre-built :-(
-	use doc && doinfo Documentation/{git,gitman}.info
-
-	newbashcomp contrib/completion/git-completion.bash ${PN}
-	bashcomp_alias git gitk
-	# Not really a bash-completion file (bug #477920)
-	# but still needed uncompressed (bug #507480)
-	insinto /usr/share/${PN}
-	doins contrib/completion/git-prompt.sh
-
-	#dobin contrib/fast-import/git-p4 # Moved upstream
-	#dodoc contrib/fast-import/git-p4.txt # Moved upstream
-	newbin contrib/fast-import/import-tars.perl import-tars
-	exeinto /usr/libexec/git-core/
-	newexe contrib/git-resurrect.sh git-resurrect
-
-	# git-subtree
-	pushd contrib/subtree &>/dev/null || die
-	git_emake DESTDIR="${D}" install
-	if use doc ; then
-		# Do not move git subtree install-man outside USE=doc!
-		git_emake DESTDIR="${D}" install-man install-html
-	fi
-	newdoc README README.git-subtree
-	dodoc git-subtree.txt
-	popd &>/dev/null || die
-
-	if use mediawiki ; then
-		git_emake -C contrib/mw-to-git DESTDIR="${D}" install
-	fi
-
-	# diff-highlight
-	dobin contrib/diff-highlight/diff-highlight
-	newdoc contrib/diff-highlight/README README.diff-highlight
-
-	# git-jump
-	exeinto /usr/libexec/git-core/
-	doexe contrib/git-jump/git-jump
-	newdoc contrib/git-jump/README git-jump.txt
-
-	# git-contacts
-	exeinto /usr/libexec/git-core/
-	doexe contrib/contacts/git-contacts
-	dodoc contrib/contacts/git-contacts.txt
-
-	if use keyring ; then
-		pushd contrib/credential/libsecret &>/dev/null || die
-		dobin git-credential-libsecret
-		popd &>/dev/null || die
-	fi
-
-	dodir /usr/share/${PN}/contrib
-	# The following are excluded:
-	# completion - installed above
-	# diff-highlight - done above
-	# emacs - removed upstream
-	# examples - these are stuff that is not used in Git anymore actually
-	# git-jump - done above
-	# gitview - installed above
-	# p4import - excluded because fast-import has a better one
-	# patches - stuff the Git guys made to go upstream to other places
-	# persistent-https - TODO
-	# mw-to-git - TODO
-	# subtree - build  seperately
-	# svnimport - use git-svn
-	# thunderbird-patch-inline - fixes thunderbird
-	local contrib_objects=(
-		buildsystems
-		fast-import
-		hg-to-git
-		hooks
-		remotes2config.sh
-		rerere-train.sh
-		stats
-		workdir
-	)
-	local i
-	for i in "${contrib_objects[@]}" ; do
-		cp -rf "${S}"/contrib/${i} "${ED}"/usr/share/${PN}/contrib || die "Failed contrib ${i}"
-	done
-
-	if use perl && use cgi ; then
-		# We used to install in /usr/share/${PN}/gitweb
-		# but upstream installs in /usr/share/gitweb
-		# so we will install a symlink and use their location for compat with other
-		# distros
-		dosym ../gitweb /usr/share/${PN}/gitweb
-
-		# INSTALL discusses configuration issues, not just installation
-		docinto /
-		newdoc  "${S}"/gitweb/INSTALL INSTALL.gitweb
-		newdoc  "${S}"/gitweb/README README.gitweb
-
-		for d in "${ED}"/usr/lib{,64}/perl5/ ; do
-			if [[ -d "${d}" ]] ; then
-				find "${d}" -name .packlist -delete || die
-			fi
-		done
-	else
-		rm -rf "${ED}"/usr/share/gitweb
-	fi
-
-	if ! use subversion ; then
-		rm -f "${ED}"/usr/libexec/git-core/git-svn \
-			"${ED}"/usr/share/man/man1/git-svn.1*
-	fi
-
-	if use xinetd ; then
-		insinto /etc/xinetd.d
-		newins "${FILESDIR}"/git-daemon.xinetd git-daemon
-	fi
-
-	if ! use prefix ; then
-		newinitd "${FILESDIR}"/git-daemon-r2.initd git-daemon
-		newconfd "${FILESDIR}"/git-daemon.confd git-daemon
-		systemd_newunit "${FILESDIR}/git-daemon_at-r1.service" "git-daemon@.service"
-		systemd_dounit "${FILESDIR}/git-daemon.socket"
-	fi
-
-	perl_delete_localpod
-
-	# Remove disabled linguas
-	# we could remove sources in src_prepare, but install does not
-	# handle missing locale dir well
-	rm_loc() {
-		if [[ -e "${ED}/usr/share/locale/${1}" ]] ; then
-			rm -r "${ED}/usr/share/locale/${1}" || die
-		fi
-	}
-	plocale_for_each_disabled_locale rm_loc
-}
-
-pkg_postinst() {
-	if [[ -z ${REPLACING_VERSIONS} ]] ; then
-		elog "Please read /usr/share/bash-completion/completions/git for Git bash command"
-		elog "completion."
-		elog "Please read /usr/share/git/git-prompt.sh for Git bash prompt"
-		elog "Note that the prompt bash code is now in that separate script"
-	fi
-
-	optfeature_header "Some scripts require additional dependencies:"
-	optfeature git-quiltimport dev-util/quilt
-	optfeature git-instaweb www-servers/lighttpd www-servers/apache www-servers/nginx
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.41.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.41.0.ebuild
deleted file mode 100644
index 00f157a6448..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.41.0.ebuild
+++ /dev/null
@@ -1,644 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-GENTOO_DEPEND_ON_PERL=no
-
-# bug #329479: git-remote-testgit is not multiple-version aware
-PYTHON_COMPAT=( python3_{10..12} )
-
-inherit toolchain-funcs perl-module bash-completion-r1 optfeature plocale python-single-r1 systemd
-
-PLOCALES="bg ca de es fr is it ko pt_PT ru sv vi zh_CN"
-
-if [[ ${PV} == *9999 ]]; then
-	EGIT_REPO_URI="https://git.kernel.org/pub/scm/git/git.git"
-
-	inherit git-r3
-	# Please ensure that all _four_ 9999 ebuilds get updated; they track the 4 upstream branches.
-	# See https://git-scm.com/docs/gitworkflows#_graduation
-	# In order of stability:
-	# 9999-r0: maint
-	# 9999-r1: master
-	# 9999-r2: next
-	# 9999-r3: seen
-	case ${PVR} in
-		9999) EGIT_BRANCH=maint ;;
-		9999-r1) EGIT_BRANCH=master ;;
-		9999-r2) EGIT_BRANCH=next;;
-		9999-r3) EGIT_BRANCH=seen ;;
-	esac
-fi
-
-MY_PV="${PV/_rc/.rc}"
-MY_P="${PN}-${MY_PV}"
-
-DOC_VER="${MY_PV}"
-
-DESCRIPTION="Stupid content tracker: distributed VCS designed for speed and efficiency"
-HOMEPAGE="https://www.git-scm.com/"
-
-if [[ ${PV} != *9999 ]]; then
-	SRC_URI_SUFFIX="xz"
-	SRC_URI_KORG="https://www.kernel.org/pub/software/scm/git"
-
-	[[ ${PV/rc} != ${PV} ]] && SRC_URI_KORG+='/testing'
-
-	SRC_URI="${SRC_URI_KORG}/${MY_P}.tar.${SRC_URI_SUFFIX}"
-	SRC_URI+=" ${SRC_URI_KORG}/${PN}-manpages-${DOC_VER}.tar.${SRC_URI_SUFFIX}"
-	SRC_URI+=" doc? ( ${SRC_URI_KORG}/${PN}-htmldocs-${DOC_VER}.tar.${SRC_URI_SUFFIX} )"
-
-	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-	fi
-fi
-
-S="${WORKDIR}"/${MY_P}
-
-LICENSE="GPL-2"
-SLOT="0"
-IUSE="+blksha1 +curl cgi doc keyring +gpg highlight +iconv mediawiki +nls +pcre perforce +perl +safe-directory selinux subversion tk +webdav xinetd cvs test"
-
-# Common to both DEPEND and RDEPEND
-DEPEND="
-	dev-libs/openssl:=
-	sys-libs/zlib
-	curl? (
-		net-misc/curl
-		webdav? ( dev-libs/expat )
-	)
-	keyring? (
-		app-crypt/libsecret
-		dev-libs/glib:2
-	)
-	iconv? ( virtual/libiconv )
-	pcre? ( dev-libs/libpcre2:= )
-	perl? ( dev-lang/perl:=[-build(-)] )
-	tk? ( dev-lang/tk:= )
-"
-RDEPEND="
-	${DEPEND}
-	gpg? ( app-crypt/gnupg )
-	perl? (
-		dev-perl/Error
-		dev-perl/MailTools
-		dev-perl/Authen-SASL
-		>=virtual/perl-libnet-3.110.0-r4[ssl]
-		cgi? (
-			dev-perl/CGI
-			highlight? ( app-text/highlight )
-		)
-		cvs? (
-			>=dev-vcs/cvsps-2.1:0
-			dev-perl/DBI
-			dev-perl/DBD-SQLite
-		)
-		mediawiki? (
-			dev-perl/DateTime-Format-ISO8601
-			dev-perl/HTML-Tree
-			dev-perl/MediaWiki-API
-		)
-		subversion? (
-			dev-vcs/subversion[-dso(-),perl]
-			dev-perl/libwww-perl
-			dev-perl/TermReadKey
-		)
-	)
-	perforce? ( ${PYTHON_DEPS} )
-	selinux? ( sec-policy/selinux-git )
-"
-
-# This is how info docs are created with Git:
-#   .txt/asciidoc --(asciidoc)---------> .xml/docbook
-#   .xml/docbook  --(docbook2texi.pl)--> .texi
-#   .texi         --(makeinfo)---------> .info
-BDEPEND="
-	doc? (
-		app-text/asciidoc
-		app-text/docbook2X
-		app-text/xmlto
-		sys-apps/texinfo
-	)
-	keyring? ( virtual/pkgconfig )
-	nls? ( sys-devel/gettext )
-	test? (	app-crypt/gnupg	)
-"
-
-# Live ebuild builds man pages and HTML docs, additionally
-if [[ ${PV} == *9999 ]]; then
-	BDEPEND+=" app-text/asciidoc"
-fi
-
-SITEFILE="50${PN}-gentoo.el"
-
-REQUIRED_USE="
-	cgi? ( perl )
-	cvs? ( perl )
-	mediawiki? ( perl )
-	perforce? ( ${PYTHON_REQUIRED_USE} )
-	subversion? ( perl )
-	webdav? ( curl )
-"
-
-RESTRICT="!test? ( test )"
-
-PATCHES=(
-	# Avoid automagic CVS, bug #350330
-	"${FILESDIR}"/git-2.37.0_rc1-optional-cvs.patch
-
-	# Make submodule output quiet
-	"${FILESDIR}"/git-2.21.0-quiet-submodules-testcase.patch
-)
-
-pkg_setup() {
-	if use subversion && has_version "dev-vcs/subversion[dso]" ; then
-		ewarn "Per Gentoo bugs #223747, #238586, when subversion is built"
-		ewarn "with USE=dso, there may be weird crashes in git-svn. You"
-		ewarn "have been warned!"
-	fi
-
-	if use perforce ; then
-		python-single-r1_pkg_setup
-	fi
-}
-
-# This is needed because for some obscure reasons future calls to make don't
-# pick up these exports if we export them in src_unpack()
-exportmakeopts() {
-	local extlibs myopts
-
-	myopts=(
-		ASCIIDOC_NO_ROFF=YesPlease
-
-		$(usex perl 'INSTALLDIRS=vendor NO_PERL_CPAN_FALLBACKS=YesPlease' NO_PERL=YesPlease)
-
-		$(usev elibc_musl NO_REGEX=NeedsStartEnd)
-		$(usev !cvs NO_CVS=YesPlease)
-		$(usev !iconv NO_ICONV=YesPlease)
-		$(usev !nls NO_GETTEXT=YesPlease)
-		$(usev !perforce NO_PYTHON=YesPlease)
-		$(usev !subversion NO_SVN_TESTS=YesPlease)
-		$(usev !tk NO_TCLTK=YesPlease)
-	)
-
-	if use blksha1 ; then
-		myopts+=( BLK_SHA1=YesPlease )
-	fi
-
-	if use curl ; then
-		use webdav || myopts+=( NO_EXPAT=YesPlease )
-	else
-		myopts+=( NO_CURL=YesPlease )
-	fi
-
-	# Broken assumptions because of static build system
-	myopts+=(
-		NO_FINK=YesPlease
-		NO_DARWIN_PORTS=YesPlease
-		INSTALL=install
-		TAR=tar
-		SHELL_PATH="${EPREFIX}/bin/sh"
-		SANE_TOOL_PATH=
-		OLD_ICONV=
-		NO_EXTERNAL_GREP=
-	)
-
-	# Can't define this to null, since the entire makefile depends on it
-	sed -i -e '/\/usr\/local/s/BASIC_/#BASIC_/' Makefile || die
-
-	if use pcre; then
-		myopts+=( USE_LIBPCRE2=YesPlease )
-		extlibs+=( -lpcre2-8 )
-	fi
-
-	if [[ ${CHOST} == *-solaris* ]]; then
-		myopts+=(
-			NEEDS_LIBICONV=YesPlease
-			HAVE_CLOCK_MONOTONIC=1
-		)
-
-		if grep -Fq getdelim "${ESYSROOT}"/usr/include/stdio.h ; then
-			myopts+=( HAVE_GETDELIM=1 )
-		fi
-	fi
-
-	myopts+=( ASCIIDOC8=YesPlease )
-
-	export MY_MAKEOPTS="${myopts[@]}"
-	export EXTLIBS="${extlibs[@]}"
-}
-
-src_unpack() {
-	if [[ ${PV} != *9999 ]] ; then
-		unpack ${MY_P}.tar.${SRC_URI_SUFFIX}
-
-		cd "${S}" || die
-		unpack ${PN}-manpages-${DOC_VER}.tar.${SRC_URI_SUFFIX}
-
-		if use doc ; then
-			pushd "${S}"/Documentation &>/dev/null || die
-			unpack ${PN}-htmldocs-${DOC_VER}.tar.${SRC_URI_SUFFIX}
-			popd &>/dev/null || die
-		fi
-	else
-		git-r3_src_unpack
-		#cp "${FILESDIR}"/GIT-VERSION-GEN . || die
-	fi
-
-}
-
-src_prepare() {
-	if ! use safe-directory ; then
-		# This patch neuters the "safe directory" detection.
-		# bugs #838271, #838223
-		PATCHES+=(
-			"${FILESDIR}"/git-2.37.2-unsafe-directory.patch
-		)
-	fi
-
-	default
-
-	if use prefix ; then
-		# bug #757309
-		eapply "${FILESDIR}"/git-2.37.2-darwin-prefix-gettext.patch
-	fi
-
-	sed -i \
-		-e 's:^\(CFLAGS[[:space:]]*=\).*$:\1 $(OPTCFLAGS) -Wall:' \
-		-e 's:^\(LDFLAGS[[:space:]]*=\).*$:\1 $(OPTLDFLAGS):' \
-		-e 's:^\(CC[[:space:]]* =\).*$:\1$(OPTCC):' \
-		-e 's:^\(AR[[:space:]]* =\).*$:\1$(OPTAR):' \
-		-e "s:\(PYTHON_PATH[[:space:]]\+=[[:space:]]\+\)\(.*\)$:\1${EPREFIX}\2:" \
-		-e "s:\(PERL_PATH[[:space:]]\+=[[:space:]]\+\)\(.*\)$:\1${EPREFIX}\2:" \
-		Makefile || die
-
-	# Fix docbook2texi command
-	sed -r -i 's/DOCBOOK2X_TEXI[[:space:]]*=[[:space:]]*docbook2x-texi/DOCBOOK2X_TEXI = docbook2texi.pl/' \
-		Documentation/Makefile || die
-}
-
-git_emake() {
-	# bug #320647: PYTHON_PATH
-	local PYTHON_PATH=""
-	use perforce && PYTHON_PATH="${PYTHON}"
-
-	local mymakeargs=(
-		${MY_MAKEOPTS}
-
-		prefix="${EPREFIX}"/usr
-		htmldir="${EPREFIX}"/usr/share/doc/${PF}/html
-		perllibdir="$(use perl && perl_get_raw_vendorlib)"
-		sysconfdir="${EPREFIX}"/etc
-
-		CC="$(tc-getCC)"
-		CFLAGS="${CFLAGS}"
-		PKG_CONFIG="$(tc-getPKG_CONFIG)"
-
-		# TODO: --verbose?
-		GIT_TEST_OPTS="--no-color"
-
-		OPTAR="$(tc-getAR)"
-		OPTCC="$(tc-getCC)"
-		OPTCFLAGS="${CFLAGS}"
-		OPTLDFLAGS="${LDFLAGS}"
-
-		PERL_PATH="${EPREFIX}/usr/bin/perl"
-		PERL_MM_OPT=""
-
-		PYTHON_PATH="${PYTHON_PATH}"
-
-		V=1
-		"$@"
-	)
-
-	emake "${mymakeargs[@]}"
-}
-
-src_configure() {
-	exportmakeopts
-}
-
-src_compile() {
-	git_emake
-
-	if use perl && use cgi ; then
-		git_emake gitweb
-	fi
-
-	if [[ ${CHOST} == *-darwin* ]] && tc-is-clang ; then
-		git_emake -C contrib/credential/osxkeychain
-	fi
-
-	pushd Documentation &>/dev/null || die
-	if [[ ${PV} == *9999 ]] ; then
-		git_emake man
-		if use doc ; then
-			git_emake info html
-		fi
-	else
-		if use doc ; then
-			git_emake info
-		fi
-	fi
-	popd &>/dev/null || die
-
-	if use keyring ; then
-		git_emake -C contrib/credential/libsecret
-	fi
-
-	pushd contrib/subtree &>/dev/null || die
-	git_emake git-subtree
-	# git-subtree.1 requires the full USE=doc dependency stack
-	use doc && git_emake git-subtree.html git-subtree.1
-	popd &>/dev/null || die
-
-	git_emake -C contrib/diff-highlight
-
-	if use mediawiki ; then
-		git_emake -C contrib/mw-to-git
-	fi
-}
-
-src_test() {
-	local disabled=(
-		# We make safe-directory optional
-		t0033-safe-directory.sh
-	)
-
-	local tests_cvs=(
-		t9200-git-cvsexportcommit.sh
-		t9400-git-cvsserver-server.sh
-		t9401-git-cvsserver-crlf.sh
-		t9402-git-cvsserver-refs.sh
-		t9600-cvsimport.sh
-		t9601-cvsimport-vendor-branch.sh
-		t9602-cvsimport-branches-tags.sh
-		t9603-cvsimport-patchsets.sh
-		t9604-cvsimport-timestamps.sh
-	)
-
-	local tests_perl=(
-		t3701-add-interactive.sh
-		t5502-quickfetch.sh
-		t5512-ls-remote.sh
-		t5520-pull.sh
-		t7106-reset-unborn-branch.sh
-		t7501-commit.sh
-	)
-	# Bug #225601 - t0004 is not suitable for root perm
-	# Bug #219839 - t1004 is not suitable for root perm
-	# t0001-init.sh - check for init notices EPERM*  fails
-	local tests_nonroot=(
-		t0001-init.sh
-		t0004-unwritable.sh
-		t0070-fundamental.sh
-		t1004-read-tree-m-u-wf.sh
-		t3700-add.sh
-		t7300-clean.sh
-	)
-	# t9100 still fails with symlinks in SVN 1.7
-	local test_svn=( t9100-git-svn-basic.sh )
-
-	# Unzip is used only for the testcase code, not by any normal parts of Git.
-	if ! has_version app-arch/unzip ; then
-		einfo "Disabling tar-tree tests"
-		disabled+=( t5000-tar-tree.sh )
-	fi
-
-	local cvs=0
-	use cvs && let cvs=${cvs}+1
-	if [[ ${EUID} -eq 0 ]] ; then
-		if [[ ${cvs} -eq 1 ]] ; then
-			ewarn "Skipping CVS tests because CVS does not work as root!"
-			ewarn "You should retest with FEATURES=userpriv!"
-			disabled+=( ${tests_cvs[@]} )
-		fi
-		einfo "Skipping other tests that require being non-root"
-		disabled+=( ${tests_nonroot[@]} )
-	else
-		if [[ ${cvs} -gt 0 ]] && has_version dev-vcs/cvs ; then
-			let cvs=${cvs}+1
-		fi
-
-		if [[ ${cvs} -gt 1 ]] && has_version "dev-vcs/cvs[server]" ; then
-			let cvs=${cvs}+1
-		fi
-
-		if [[ ${cvs} -lt 3 ]] ; then
-			einfo "Disabling CVS tests (needs dev-vcs/cvs[USE=server])"
-			disabled+=( ${tests_cvs[@]} )
-		fi
-	fi
-
-	if ! use perl ; then
-		einfo "Disabling tests that need Perl"
-		disabled+=( ${tests_perl[@]} )
-	fi
-
-	einfo "Disabling tests that fail with SVN 1.7"
-	disabled+=( ${test_svn[@]} )
-
-	# Reset all previously disabled tests
-	pushd t &>/dev/null || die
-	local i
-	for i in *.sh.DISABLED ; do
-		[[ -f "${i}" ]] && mv -f "${i}" "${i%.DISABLED}"
-	done
-	einfo "Disabled tests:"
-	for i in ${disabled[@]} ; do
-		if [[ -f "${i}" ]] ; then
-			mv -f "${i}" "${i}.DISABLED" && einfo "Disabled ${i}"
-		fi
-	done
-
-	# Avoid the test system removing the results because we want them ourselves
-	sed -e '/^[[:space:]]*$(MAKE) clean/s,^,#,g' -i Makefile || die
-
-	# Clean old results first, must always run
-	nonfatal git_emake clean
-	popd &>/dev/null || die
-
-	# Now run the tests, keep going if we hit an error, and don't terminate on
-	# failure
-	local rc
-	einfo "Start test run"
-	#MAKEOPTS=-j1
-	nonfatal git_emake --keep-going test
-	rc=$?
-
-	# Display nice results, now print the results
-	pushd t &>/dev/null || die
-	nonfatal git_emake aggregate-results
-
-	# And bail if there was a problem
-	[[ ${rc} -eq 0 ]] || die "Tests failed. Please file a bug!"
-}
-
-src_install() {
-	git_emake DESTDIR="${D}" install
-
-	if [[ ${CHOST} == *-darwin* ]] && tc-is-clang ; then
-		dobin contrib/credential/osxkeychain/git-credential-osxkeychain
-	fi
-
-	# Depending on the tarball and manual rebuild of the documentation, the
-	# manpages may exist in either OR both of these directories.
-	find man?/*.[157] >/dev/null 2>&1 && doman man?/*.[157]
-	find Documentation/*.[157] >/dev/null 2>&1 && doman Documentation/*.[157]
-	dodoc README* Documentation/{SubmittingPatches,CodingGuidelines}
-	use doc && dodir /usr/share/doc/${PF}/html
-	local d
-	for d in / /howto/ /technical/ ; do
-		docinto ${d}
-		dodoc Documentation${d}*.txt
-		if use doc ; then
-			docinto ${d}/html
-			dodoc Documentation${d}*.html
-		fi
-	done
-	docinto /
-	# Upstream does not ship this pre-built :-(
-	use doc && doinfo Documentation/{git,gitman}.info
-
-	newbashcomp contrib/completion/git-completion.bash ${PN}
-	bashcomp_alias git gitk
-	# Not really a bash-completion file (bug #477920)
-	# but still needed uncompressed (bug #507480)
-	insinto /usr/share/${PN}
-	doins contrib/completion/git-prompt.sh
-
-	#dobin contrib/fast-import/git-p4 # Moved upstream
-	#dodoc contrib/fast-import/git-p4.txt # Moved upstream
-	newbin contrib/fast-import/import-tars.perl import-tars
-	exeinto /usr/libexec/git-core/
-	newexe contrib/git-resurrect.sh git-resurrect
-
-	# git-subtree
-	pushd contrib/subtree &>/dev/null || die
-	git_emake DESTDIR="${D}" install
-	if use doc ; then
-		# Do not move git subtree install-man outside USE=doc!
-		git_emake DESTDIR="${D}" install-man install-html
-	fi
-	newdoc README README.git-subtree
-	dodoc git-subtree.txt
-	popd &>/dev/null || die
-
-	if use mediawiki ; then
-		git_emake -C contrib/mw-to-git DESTDIR="${D}" install
-	fi
-
-	# diff-highlight
-	dobin contrib/diff-highlight/diff-highlight
-	newdoc contrib/diff-highlight/README README.diff-highlight
-
-	# git-jump
-	exeinto /usr/libexec/git-core/
-	doexe contrib/git-jump/git-jump
-	newdoc contrib/git-jump/README git-jump.txt
-
-	# git-contacts
-	exeinto /usr/libexec/git-core/
-	doexe contrib/contacts/git-contacts
-	dodoc contrib/contacts/git-contacts.txt
-
-	if use keyring ; then
-		pushd contrib/credential/libsecret &>/dev/null || die
-		dobin git-credential-libsecret
-		popd &>/dev/null || die
-	fi
-
-	dodir /usr/share/${PN}/contrib
-	# The following are excluded:
-	# completion - installed above
-	# diff-highlight - done above
-	# emacs - removed upstream
-	# examples - these are stuff that is not used in Git anymore actually
-	# git-jump - done above
-	# gitview - installed above
-	# p4import - excluded because fast-import has a better one
-	# patches - stuff the Git guys made to go upstream to other places
-	# persistent-https - TODO
-	# mw-to-git - TODO
-	# subtree - build  seperately
-	# svnimport - use git-svn
-	# thunderbird-patch-inline - fixes thunderbird
-	local contrib_objects=(
-		buildsystems
-		fast-import
-		hg-to-git
-		hooks
-		remotes2config.sh
-		rerere-train.sh
-		stats
-		workdir
-	)
-	local i
-	for i in "${contrib_objects[@]}" ; do
-		cp -rf "${S}"/contrib/${i} "${ED}"/usr/share/${PN}/contrib || die "Failed contrib ${i}"
-	done
-
-	if use perl && use cgi ; then
-		# We used to install in /usr/share/${PN}/gitweb
-		# but upstream installs in /usr/share/gitweb
-		# so we will install a symlink and use their location for compat with other
-		# distros
-		dosym ../gitweb /usr/share/${PN}/gitweb
-
-		# INSTALL discusses configuration issues, not just installation
-		docinto /
-		newdoc  "${S}"/gitweb/INSTALL INSTALL.gitweb
-		newdoc  "${S}"/gitweb/README README.gitweb
-
-		for d in "${ED}"/usr/lib{,64}/perl5/ ; do
-			if [[ -d "${d}" ]] ; then
-				find "${d}" -name .packlist -delete || die
-			fi
-		done
-	else
-		rm -rf "${ED}"/usr/share/gitweb
-	fi
-
-	if ! use subversion ; then
-		rm -f "${ED}"/usr/libexec/git-core/git-svn \
-			"${ED}"/usr/share/man/man1/git-svn.1*
-	fi
-
-	if use xinetd ; then
-		insinto /etc/xinetd.d
-		newins "${FILESDIR}"/git-daemon.xinetd git-daemon
-	fi
-
-	if ! use prefix ; then
-		newinitd "${FILESDIR}"/git-daemon-r2.initd git-daemon
-		newconfd "${FILESDIR}"/git-daemon.confd git-daemon
-		systemd_newunit "${FILESDIR}/git-daemon_at-r1.service" "git-daemon@.service"
-		systemd_dounit "${FILESDIR}/git-daemon.socket"
-	fi
-
-	perl_delete_localpod
-
-	# Remove disabled linguas
-	# we could remove sources in src_prepare, but install does not
-	# handle missing locale dir well
-	rm_loc() {
-		if [[ -e "${ED}/usr/share/locale/${1}" ]] ; then
-			rm -r "${ED}/usr/share/locale/${1}" || die
-		fi
-	}
-	plocale_for_each_disabled_locale rm_loc
-}
-
-pkg_postinst() {
-	if [[ -z ${REPLACING_VERSIONS} ]] ; then
-		elog "Please read /usr/share/bash-completion/completions/git for Git bash command"
-		elog "completion."
-		elog "Please read /usr/share/git/git-prompt.sh for Git bash prompt"
-		elog "Note that the prompt bash code is now in that separate script"
-	fi
-
-	optfeature_header "Some scripts require additional dependencies:"
-	optfeature git-quiltimport dev-util/quilt
-	optfeature git-instaweb www-servers/lighttpd www-servers/apache www-servers/nginx
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.41.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.41.1.ebuild
deleted file mode 100644
index 9e5e8ddb671..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.41.1.ebuild
+++ /dev/null
@@ -1,644 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-GENTOO_DEPEND_ON_PERL=no
-
-# bug #329479: git-remote-testgit is not multiple-version aware
-PYTHON_COMPAT=( python3_{10..12} )
-
-inherit toolchain-funcs perl-module bash-completion-r1 optfeature plocale python-single-r1 systemd
-
-PLOCALES="bg ca de es fr is it ko pt_PT ru sv vi zh_CN"
-
-if [[ ${PV} == *9999 ]]; then
-	EGIT_REPO_URI="https://git.kernel.org/pub/scm/git/git.git"
-
-	inherit git-r3
-	# Please ensure that all _four_ 9999 ebuilds get updated; they track the 4 upstream branches.
-	# See https://git-scm.com/docs/gitworkflows#_graduation
-	# In order of stability:
-	# 9999-r0: maint
-	# 9999-r1: master
-	# 9999-r2: next
-	# 9999-r3: seen
-	case ${PVR} in
-		9999) EGIT_BRANCH=maint ;;
-		9999-r1) EGIT_BRANCH=master ;;
-		9999-r2) EGIT_BRANCH=next;;
-		9999-r3) EGIT_BRANCH=seen ;;
-	esac
-fi
-
-MY_PV="${PV/_rc/.rc}"
-MY_P="${PN}-${MY_PV}"
-
-DOC_VER="${MY_PV}"
-
-DESCRIPTION="Stupid content tracker: distributed VCS designed for speed and efficiency"
-HOMEPAGE="https://www.git-scm.com/"
-
-if [[ ${PV} != *9999 ]]; then
-	SRC_URI_SUFFIX="xz"
-	SRC_URI_KORG="https://www.kernel.org/pub/software/scm/git"
-
-	[[ ${PV/rc} != ${PV} ]] && SRC_URI_KORG+='/testing'
-
-	SRC_URI="${SRC_URI_KORG}/${MY_P}.tar.${SRC_URI_SUFFIX}"
-	SRC_URI+=" ${SRC_URI_KORG}/${PN}-manpages-${DOC_VER}.tar.${SRC_URI_SUFFIX}"
-	SRC_URI+=" doc? ( ${SRC_URI_KORG}/${PN}-htmldocs-${DOC_VER}.tar.${SRC_URI_SUFFIX} )"
-
-	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-	fi
-fi
-
-S="${WORKDIR}"/${MY_P}
-
-LICENSE="GPL-2"
-SLOT="0"
-IUSE="+blksha1 +curl cgi doc keyring +gpg highlight +iconv mediawiki +nls +pcre perforce +perl +safe-directory selinux subversion tk +webdav xinetd cvs test"
-
-# Common to both DEPEND and RDEPEND
-DEPEND="
-	dev-libs/openssl:=
-	sys-libs/zlib
-	curl? (
-		net-misc/curl
-		webdav? ( dev-libs/expat )
-	)
-	keyring? (
-		app-crypt/libsecret
-		dev-libs/glib:2
-	)
-	iconv? ( virtual/libiconv )
-	pcre? ( dev-libs/libpcre2:= )
-	perl? ( dev-lang/perl:=[-build(-)] )
-	tk? ( dev-lang/tk:= )
-"
-RDEPEND="
-	${DEPEND}
-	gpg? ( app-crypt/gnupg )
-	perl? (
-		dev-perl/Error
-		dev-perl/MailTools
-		dev-perl/Authen-SASL
-		>=virtual/perl-libnet-3.110.0-r4[ssl]
-		cgi? (
-			dev-perl/CGI
-			highlight? ( app-text/highlight )
-		)
-		cvs? (
-			>=dev-vcs/cvsps-2.1:0
-			dev-perl/DBI
-			dev-perl/DBD-SQLite
-		)
-		mediawiki? (
-			dev-perl/DateTime-Format-ISO8601
-			dev-perl/HTML-Tree
-			dev-perl/MediaWiki-API
-		)
-		subversion? (
-			dev-vcs/subversion[-dso(-),perl]
-			dev-perl/libwww-perl
-			dev-perl/TermReadKey
-		)
-	)
-	perforce? ( ${PYTHON_DEPS} )
-	selinux? ( sec-policy/selinux-git )
-"
-
-# This is how info docs are created with Git:
-#   .txt/asciidoc --(asciidoc)---------> .xml/docbook
-#   .xml/docbook  --(docbook2texi.pl)--> .texi
-#   .texi         --(makeinfo)---------> .info
-BDEPEND="
-	doc? (
-		app-text/asciidoc
-		app-text/docbook2X
-		app-text/xmlto
-		sys-apps/texinfo
-	)
-	keyring? ( virtual/pkgconfig )
-	nls? ( sys-devel/gettext )
-	test? (	app-crypt/gnupg	)
-"
-
-# Live ebuild builds man pages and HTML docs, additionally
-if [[ ${PV} == *9999 ]]; then
-	BDEPEND+=" app-text/asciidoc"
-fi
-
-SITEFILE="50${PN}-gentoo.el"
-
-REQUIRED_USE="
-	cgi? ( perl )
-	cvs? ( perl )
-	mediawiki? ( perl )
-	perforce? ( ${PYTHON_REQUIRED_USE} )
-	subversion? ( perl )
-	webdav? ( curl )
-"
-
-RESTRICT="!test? ( test )"
-
-PATCHES=(
-	# Avoid automagic CVS, bug #350330
-	"${FILESDIR}"/git-2.37.0_rc1-optional-cvs.patch
-
-	# Make submodule output quiet
-	"${FILESDIR}"/git-2.21.0-quiet-submodules-testcase.patch
-)
-
-pkg_setup() {
-	if use subversion && has_version "dev-vcs/subversion[dso]" ; then
-		ewarn "Per Gentoo bugs #223747, #238586, when subversion is built"
-		ewarn "with USE=dso, there may be weird crashes in git-svn. You"
-		ewarn "have been warned!"
-	fi
-
-	if use perforce ; then
-		python-single-r1_pkg_setup
-	fi
-}
-
-# This is needed because for some obscure reasons future calls to make don't
-# pick up these exports if we export them in src_unpack()
-exportmakeopts() {
-	local extlibs myopts
-
-	myopts=(
-		ASCIIDOC_NO_ROFF=YesPlease
-
-		$(usex perl 'INSTALLDIRS=vendor NO_PERL_CPAN_FALLBACKS=YesPlease' NO_PERL=YesPlease)
-
-		$(usev elibc_musl NO_REGEX=NeedsStartEnd)
-		$(usev !cvs NO_CVS=YesPlease)
-		$(usev !iconv NO_ICONV=YesPlease)
-		$(usev !nls NO_GETTEXT=YesPlease)
-		$(usev !perforce NO_PYTHON=YesPlease)
-		$(usev !subversion NO_SVN_TESTS=YesPlease)
-		$(usev !tk NO_TCLTK=YesPlease)
-	)
-
-	if use blksha1 ; then
-		myopts+=( BLK_SHA1=YesPlease )
-	fi
-
-	if use curl ; then
-		use webdav || myopts+=( NO_EXPAT=YesPlease )
-	else
-		myopts+=( NO_CURL=YesPlease )
-	fi
-
-	# Broken assumptions because of static build system
-	myopts+=(
-		NO_FINK=YesPlease
-		NO_DARWIN_PORTS=YesPlease
-		INSTALL=install
-		TAR=tar
-		SHELL_PATH="${EPREFIX}/bin/sh"
-		SANE_TOOL_PATH=
-		OLD_ICONV=
-		NO_EXTERNAL_GREP=
-	)
-
-	# Can't define this to null, since the entire makefile depends on it
-	sed -i -e '/\/usr\/local/s/BASIC_/#BASIC_/' Makefile || die
-
-	if use pcre; then
-		myopts+=( USE_LIBPCRE2=YesPlease )
-		extlibs+=( -lpcre2-8 )
-	fi
-
-	if [[ ${CHOST} == *-solaris* ]]; then
-		myopts+=(
-			NEEDS_LIBICONV=YesPlease
-			HAVE_CLOCK_MONOTONIC=1
-		)
-
-		if grep -Fq getdelim "${ESYSROOT}"/usr/include/stdio.h ; then
-			myopts+=( HAVE_GETDELIM=1 )
-		fi
-	fi
-
-	myopts+=( ASCIIDOC8=YesPlease )
-
-	export MY_MAKEOPTS="${myopts[@]}"
-	export EXTLIBS="${extlibs[@]}"
-}
-
-src_unpack() {
-	if [[ ${PV} != *9999 ]] ; then
-		unpack ${MY_P}.tar.${SRC_URI_SUFFIX}
-
-		cd "${S}" || die
-		unpack ${PN}-manpages-${DOC_VER}.tar.${SRC_URI_SUFFIX}
-
-		if use doc ; then
-			pushd "${S}"/Documentation &>/dev/null || die
-			unpack ${PN}-htmldocs-${DOC_VER}.tar.${SRC_URI_SUFFIX}
-			popd &>/dev/null || die
-		fi
-	else
-		git-r3_src_unpack
-		#cp "${FILESDIR}"/GIT-VERSION-GEN . || die
-	fi
-
-}
-
-src_prepare() {
-	if ! use safe-directory ; then
-		# This patch neuters the "safe directory" detection.
-		# bugs #838271, #838223
-		PATCHES+=(
-			"${FILESDIR}"/git-2.37.2-unsafe-directory.patch
-		)
-	fi
-
-	default
-
-	if use prefix ; then
-		# bug #757309
-		eapply "${FILESDIR}"/git-2.37.2-darwin-prefix-gettext.patch
-	fi
-
-	sed -i \
-		-e 's:^\(CFLAGS[[:space:]]*=\).*$:\1 $(OPTCFLAGS) -Wall:' \
-		-e 's:^\(LDFLAGS[[:space:]]*=\).*$:\1 $(OPTLDFLAGS):' \
-		-e 's:^\(CC[[:space:]]* =\).*$:\1$(OPTCC):' \
-		-e 's:^\(AR[[:space:]]* =\).*$:\1$(OPTAR):' \
-		-e "s:\(PYTHON_PATH[[:space:]]\+=[[:space:]]\+\)\(.*\)$:\1${EPREFIX}\2:" \
-		-e "s:\(PERL_PATH[[:space:]]\+=[[:space:]]\+\)\(.*\)$:\1${EPREFIX}\2:" \
-		Makefile || die
-
-	# Fix docbook2texi command
-	sed -r -i 's/DOCBOOK2X_TEXI[[:space:]]*=[[:space:]]*docbook2x-texi/DOCBOOK2X_TEXI = docbook2texi.pl/' \
-		Documentation/Makefile || die
-}
-
-git_emake() {
-	# bug #320647: PYTHON_PATH
-	local PYTHON_PATH=""
-	use perforce && PYTHON_PATH="${PYTHON}"
-
-	local mymakeargs=(
-		${MY_MAKEOPTS}
-
-		prefix="${EPREFIX}"/usr
-		htmldir="${EPREFIX}"/usr/share/doc/${PF}/html
-		perllibdir="$(use perl && perl_get_raw_vendorlib)"
-		sysconfdir="${EPREFIX}"/etc
-
-		CC="$(tc-getCC)"
-		CFLAGS="${CFLAGS}"
-		PKG_CONFIG="$(tc-getPKG_CONFIG)"
-
-		# TODO: --verbose?
-		GIT_TEST_OPTS="--no-color"
-
-		OPTAR="$(tc-getAR)"
-		OPTCC="$(tc-getCC)"
-		OPTCFLAGS="${CFLAGS}"
-		OPTLDFLAGS="${LDFLAGS}"
-
-		PERL_PATH="${EPREFIX}/usr/bin/perl"
-		PERL_MM_OPT=""
-
-		PYTHON_PATH="${PYTHON_PATH}"
-
-		V=1
-		"$@"
-	)
-
-	emake "${mymakeargs[@]}"
-}
-
-src_configure() {
-	exportmakeopts
-}
-
-src_compile() {
-	git_emake
-
-	if use perl && use cgi ; then
-		git_emake gitweb
-	fi
-
-	if [[ ${CHOST} == *-darwin* ]] && tc-is-clang ; then
-		git_emake -C contrib/credential/osxkeychain
-	fi
-
-	pushd Documentation &>/dev/null || die
-	if [[ ${PV} == *9999 ]] ; then
-		git_emake man
-		if use doc ; then
-			git_emake info html
-		fi
-	else
-		if use doc ; then
-			git_emake info
-		fi
-	fi
-	popd &>/dev/null || die
-
-	if use keyring ; then
-		git_emake -C contrib/credential/libsecret
-	fi
-
-	pushd contrib/subtree &>/dev/null || die
-	git_emake git-subtree
-	# git-subtree.1 requires the full USE=doc dependency stack
-	use doc && git_emake git-subtree.html git-subtree.1
-	popd &>/dev/null || die
-
-	git_emake -C contrib/diff-highlight
-
-	if use mediawiki ; then
-		git_emake -C contrib/mw-to-git
-	fi
-}
-
-src_test() {
-	local disabled=(
-		# We make safe-directory optional
-		t0033-safe-directory.sh
-	)
-
-	local tests_cvs=(
-		t9200-git-cvsexportcommit.sh
-		t9400-git-cvsserver-server.sh
-		t9401-git-cvsserver-crlf.sh
-		t9402-git-cvsserver-refs.sh
-		t9600-cvsimport.sh
-		t9601-cvsimport-vendor-branch.sh
-		t9602-cvsimport-branches-tags.sh
-		t9603-cvsimport-patchsets.sh
-		t9604-cvsimport-timestamps.sh
-	)
-
-	local tests_perl=(
-		t3701-add-interactive.sh
-		t5502-quickfetch.sh
-		t5512-ls-remote.sh
-		t5520-pull.sh
-		t7106-reset-unborn-branch.sh
-		t7501-commit.sh
-	)
-	# Bug #225601 - t0004 is not suitable for root perm
-	# Bug #219839 - t1004 is not suitable for root perm
-	# t0001-init.sh - check for init notices EPERM*  fails
-	local tests_nonroot=(
-		t0001-init.sh
-		t0004-unwritable.sh
-		t0070-fundamental.sh
-		t1004-read-tree-m-u-wf.sh
-		t3700-add.sh
-		t7300-clean.sh
-	)
-	# t9100 still fails with symlinks in SVN 1.7
-	local test_svn=( t9100-git-svn-basic.sh )
-
-	# Unzip is used only for the testcase code, not by any normal parts of Git.
-	if ! has_version app-arch/unzip ; then
-		einfo "Disabling tar-tree tests"
-		disabled+=( t5000-tar-tree.sh )
-	fi
-
-	local cvs=0
-	use cvs && let cvs=${cvs}+1
-	if [[ ${EUID} -eq 0 ]] ; then
-		if [[ ${cvs} -eq 1 ]] ; then
-			ewarn "Skipping CVS tests because CVS does not work as root!"
-			ewarn "You should retest with FEATURES=userpriv!"
-			disabled+=( ${tests_cvs[@]} )
-		fi
-		einfo "Skipping other tests that require being non-root"
-		disabled+=( ${tests_nonroot[@]} )
-	else
-		if [[ ${cvs} -gt 0 ]] && has_version dev-vcs/cvs ; then
-			let cvs=${cvs}+1
-		fi
-
-		if [[ ${cvs} -gt 1 ]] && has_version "dev-vcs/cvs[server]" ; then
-			let cvs=${cvs}+1
-		fi
-
-		if [[ ${cvs} -lt 3 ]] ; then
-			einfo "Disabling CVS tests (needs dev-vcs/cvs[USE=server])"
-			disabled+=( ${tests_cvs[@]} )
-		fi
-	fi
-
-	if ! use perl ; then
-		einfo "Disabling tests that need Perl"
-		disabled+=( ${tests_perl[@]} )
-	fi
-
-	einfo "Disabling tests that fail with SVN 1.7"
-	disabled+=( ${test_svn[@]} )
-
-	# Reset all previously disabled tests
-	pushd t &>/dev/null || die
-	local i
-	for i in *.sh.DISABLED ; do
-		[[ -f "${i}" ]] && mv -f "${i}" "${i%.DISABLED}"
-	done
-	einfo "Disabled tests:"
-	for i in ${disabled[@]} ; do
-		if [[ -f "${i}" ]] ; then
-			mv -f "${i}" "${i}.DISABLED" && einfo "Disabled ${i}"
-		fi
-	done
-
-	# Avoid the test system removing the results because we want them ourselves
-	sed -e '/^[[:space:]]*$(MAKE) clean/s,^,#,g' -i Makefile || die
-
-	# Clean old results first, must always run
-	nonfatal git_emake clean
-	popd &>/dev/null || die
-
-	# Now run the tests, keep going if we hit an error, and don't terminate on
-	# failure
-	local rc
-	einfo "Start test run"
-	#MAKEOPTS=-j1
-	nonfatal git_emake --keep-going test
-	rc=$?
-
-	# Display nice results, now print the results
-	pushd t &>/dev/null || die
-	nonfatal git_emake aggregate-results
-
-	# And bail if there was a problem
-	[[ ${rc} -eq 0 ]] || die "Tests failed. Please file a bug!"
-}
-
-src_install() {
-	git_emake DESTDIR="${D}" install
-
-	if [[ ${CHOST} == *-darwin* ]] && tc-is-clang ; then
-		dobin contrib/credential/osxkeychain/git-credential-osxkeychain
-	fi
-
-	# Depending on the tarball and manual rebuild of the documentation, the
-	# manpages may exist in either OR both of these directories.
-	find man?/*.[157] >/dev/null 2>&1 && doman man?/*.[157]
-	find Documentation/*.[157] >/dev/null 2>&1 && doman Documentation/*.[157]
-	dodoc README* Documentation/{SubmittingPatches,CodingGuidelines}
-	use doc && dodir /usr/share/doc/${PF}/html
-	local d
-	for d in / /howto/ /technical/ ; do
-		docinto ${d}
-		dodoc Documentation${d}*.txt
-		if use doc ; then
-			docinto ${d}/html
-			dodoc Documentation${d}*.html
-		fi
-	done
-	docinto /
-	# Upstream does not ship this pre-built :-(
-	use doc && doinfo Documentation/{git,gitman}.info
-
-	newbashcomp contrib/completion/git-completion.bash ${PN}
-	bashcomp_alias git gitk
-	# Not really a bash-completion file (bug #477920)
-	# but still needed uncompressed (bug #507480)
-	insinto /usr/share/${PN}
-	doins contrib/completion/git-prompt.sh
-
-	#dobin contrib/fast-import/git-p4 # Moved upstream
-	#dodoc contrib/fast-import/git-p4.txt # Moved upstream
-	newbin contrib/fast-import/import-tars.perl import-tars
-	exeinto /usr/libexec/git-core/
-	newexe contrib/git-resurrect.sh git-resurrect
-
-	# git-subtree
-	pushd contrib/subtree &>/dev/null || die
-	git_emake DESTDIR="${D}" install
-	if use doc ; then
-		# Do not move git subtree install-man outside USE=doc!
-		git_emake DESTDIR="${D}" install-man install-html
-	fi
-	newdoc README README.git-subtree
-	dodoc git-subtree.txt
-	popd &>/dev/null || die
-
-	if use mediawiki ; then
-		git_emake -C contrib/mw-to-git DESTDIR="${D}" install
-	fi
-
-	# diff-highlight
-	dobin contrib/diff-highlight/diff-highlight
-	newdoc contrib/diff-highlight/README README.diff-highlight
-
-	# git-jump
-	exeinto /usr/libexec/git-core/
-	doexe contrib/git-jump/git-jump
-	newdoc contrib/git-jump/README git-jump.txt
-
-	# git-contacts
-	exeinto /usr/libexec/git-core/
-	doexe contrib/contacts/git-contacts
-	dodoc contrib/contacts/git-contacts.txt
-
-	if use keyring ; then
-		pushd contrib/credential/libsecret &>/dev/null || die
-		dobin git-credential-libsecret
-		popd &>/dev/null || die
-	fi
-
-	dodir /usr/share/${PN}/contrib
-	# The following are excluded:
-	# completion - installed above
-	# diff-highlight - done above
-	# emacs - removed upstream
-	# examples - these are stuff that is not used in Git anymore actually
-	# git-jump - done above
-	# gitview - installed above
-	# p4import - excluded because fast-import has a better one
-	# patches - stuff the Git guys made to go upstream to other places
-	# persistent-https - TODO
-	# mw-to-git - TODO
-	# subtree - build  seperately
-	# svnimport - use git-svn
-	# thunderbird-patch-inline - fixes thunderbird
-	local contrib_objects=(
-		buildsystems
-		fast-import
-		hg-to-git
-		hooks
-		remotes2config.sh
-		rerere-train.sh
-		stats
-		workdir
-	)
-	local i
-	for i in "${contrib_objects[@]}" ; do
-		cp -rf "${S}"/contrib/${i} "${ED}"/usr/share/${PN}/contrib || die "Failed contrib ${i}"
-	done
-
-	if use perl && use cgi ; then
-		# We used to install in /usr/share/${PN}/gitweb
-		# but upstream installs in /usr/share/gitweb
-		# so we will install a symlink and use their location for compat with other
-		# distros
-		dosym ../gitweb /usr/share/${PN}/gitweb
-
-		# INSTALL discusses configuration issues, not just installation
-		docinto /
-		newdoc  "${S}"/gitweb/INSTALL INSTALL.gitweb
-		newdoc  "${S}"/gitweb/README README.gitweb
-
-		for d in "${ED}"/usr/lib{,64}/perl5/ ; do
-			if [[ -d "${d}" ]] ; then
-				find "${d}" -name .packlist -delete || die
-			fi
-		done
-	else
-		rm -rf "${ED}"/usr/share/gitweb
-	fi
-
-	if ! use subversion ; then
-		rm -f "${ED}"/usr/libexec/git-core/git-svn \
-			"${ED}"/usr/share/man/man1/git-svn.1*
-	fi
-
-	if use xinetd ; then
-		insinto /etc/xinetd.d
-		newins "${FILESDIR}"/git-daemon.xinetd git-daemon
-	fi
-
-	if ! use prefix ; then
-		newinitd "${FILESDIR}"/git-daemon-r2.initd git-daemon
-		newconfd "${FILESDIR}"/git-daemon.confd git-daemon
-		systemd_newunit "${FILESDIR}/git-daemon_at-r1.service" "git-daemon@.service"
-		systemd_dounit "${FILESDIR}/git-daemon.socket"
-	fi
-
-	perl_delete_localpod
-
-	# Remove disabled linguas
-	# we could remove sources in src_prepare, but install does not
-	# handle missing locale dir well
-	rm_loc() {
-		if [[ -e "${ED}/usr/share/locale/${1}" ]] ; then
-			rm -r "${ED}/usr/share/locale/${1}" || die
-		fi
-	}
-	plocale_for_each_disabled_locale rm_loc
-}
-
-pkg_postinst() {
-	if [[ -z ${REPLACING_VERSIONS} ]] ; then
-		elog "Please read /usr/share/bash-completion/completions/git for Git bash command"
-		elog "completion."
-		elog "Please read /usr/share/git/git-prompt.sh for Git bash prompt"
-		elog "Note that the prompt bash code is now in that separate script"
-	fi
-
-	optfeature_header "Some scripts require additional dependencies:"
-	optfeature git-quiltimport dev-util/quilt
-	optfeature git-instaweb www-servers/lighttpd www-servers/apache www-servers/nginx
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.45.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.45.2.ebuild
index 5be999ca814..923073195df 100644
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.45.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.45.2.ebuild
@@ -50,7 +50,7 @@ if [[ ${PV} != *9999 ]]; then
 	SRC_URI+=" doc? ( ${SRC_URI_KORG}/${PN}-htmldocs-${DOC_VER}.tar.${SRC_URI_SUFFIX} )"
 
 	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.46.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.46.0.ebuild
index 754773f787a..6112d2fa622 100644
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.46.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.46.0.ebuild
@@ -333,6 +333,10 @@ src_compile() {
 		git_emake gitweb
 	fi
 
+	if use perl ; then
+		git_emake -C contrib/credential/netrc
+	fi
+
 	if [[ ${CHOST} == *-darwin* ]] && tc-is-clang ; then
 		git_emake -C contrib/credential/osxkeychain
 	fi
@@ -482,6 +486,11 @@ src_test() {
 
 	# And bail if there was a problem
 	[[ ${rc} -eq 0 ]] || die "Tests failed. Please file a bug!"
+
+	popd &>/dev/null || die
+	if use perl ; then
+		emake -C contrib/credential/netrc testverbose
+	fi
 }
 
 src_install() {
@@ -608,6 +617,12 @@ src_install() {
 		rm -rf "${ED}"/usr/share/gitweb
 	fi
 
+	if use perl ; then
+		pushd contrib/credential/netrc &>/dev/null || die
+		dobin git-credential-netrc
+		popd &>/dev/null || die
+	fi
+
 	if ! use subversion ; then
 		rm -f "${ED}"/usr/libexec/git-core/git-svn \
 			"${ED}"/usr/share/man/man1/git-svn.1*
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.44.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.46.1.ebuild
similarity index 95%
rename from sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.44.1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.46.1.ebuild
index 8b02d722737..6112d2fa622 100644
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.44.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.46.1.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 GENTOO_DEPEND_ON_PERL=no
 
 # bug #329479: git-remote-testgit is not multiple-version aware
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 
 inherit toolchain-funcs perl-module bash-completion-r1 optfeature plocale python-single-r1 systemd
 
@@ -50,7 +50,7 @@ if [[ ${PV} != *9999 ]]; then
 	SRC_URI+=" doc? ( ${SRC_URI_KORG}/${PN}-htmldocs-${DOC_VER}.tar.${SRC_URI_SUFFIX} )"
 
 	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 fi
 
@@ -306,6 +306,10 @@ git_emake() {
 		OPTCFLAGS="${CFLAGS}"
 		OPTLDFLAGS="${LDFLAGS}"
 
+		CURL_CONFIG="${ESYSROOT}/usr/bin/curl-config"
+		CURL_CFLAGS="$($(tc-getPKG_CONFIG) --cflags libcurl)"
+		CURL_LDFLAGS="$($(tc-getPKG_CONFIG) --libs libcurl)"
+
 		PERL_PATH="${EPREFIX}/usr/bin/perl"
 		PERL_MM_OPT=""
 
@@ -329,6 +333,10 @@ src_compile() {
 		git_emake gitweb
 	fi
 
+	if use perl ; then
+		git_emake -C contrib/credential/netrc
+	fi
+
 	if [[ ${CHOST} == *-darwin* ]] && tc-is-clang ; then
 		git_emake -C contrib/credential/osxkeychain
 	fi
@@ -465,6 +473,8 @@ src_test() {
 	# Now run the tests, keep going if we hit an error, and don't terminate on
 	# failure
 	local rc
+	# t0610-reftable-basics.sh uses $A
+	local -x A=
 	einfo "Start test run"
 	#MAKEOPTS=-j1
 	nonfatal git_emake --keep-going test
@@ -476,6 +486,11 @@ src_test() {
 
 	# And bail if there was a problem
 	[[ ${rc} -eq 0 ]] || die "Tests failed. Please file a bug!"
+
+	popd &>/dev/null || die
+	if use perl ; then
+		emake -C contrib/credential/netrc testverbose
+	fi
 }
 
 src_install() {
@@ -570,7 +585,6 @@ src_install() {
 	local contrib_objects=(
 		buildsystems
 		fast-import
-		hg-to-git
 		hooks
 		remotes2config.sh
 		rerere-train.sh
@@ -603,6 +617,12 @@ src_install() {
 		rm -rf "${ED}"/usr/share/gitweb
 	fi
 
+	if use perl ; then
+		pushd contrib/credential/netrc &>/dev/null || die
+		dobin git-credential-netrc
+		popd &>/dev/null || die
+	fi
+
 	if ! use subversion ; then
 		rm -f "${ED}"/usr/libexec/git-core/git-svn \
 			"${ED}"/usr/share/man/man1/git-svn.1*
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.43.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.46.2.ebuild
similarity index 94%
rename from sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.43.4.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.46.2.ebuild
index 9e5e8ddb671..17a8afd1ac8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.43.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.46.2.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 GENTOO_DEPEND_ON_PERL=no
 
 # bug #329479: git-remote-testgit is not multiple-version aware
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 
 inherit toolchain-funcs perl-module bash-completion-r1 optfeature plocale python-single-r1 systemd
 
@@ -50,7 +50,7 @@ if [[ ${PV} != *9999 ]]; then
 	SRC_URI+=" doc? ( ${SRC_URI_KORG}/${PN}-htmldocs-${DOC_VER}.tar.${SRC_URI_SUFFIX} )"
 
 	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 fi
 
@@ -253,7 +253,7 @@ src_prepare() {
 		# This patch neuters the "safe directory" detection.
 		# bugs #838271, #838223
 		PATCHES+=(
-			"${FILESDIR}"/git-2.37.2-unsafe-directory.patch
+			"${FILESDIR}"/git-2.46.2-unsafe-directory.patch
 		)
 	fi
 
@@ -261,7 +261,10 @@ src_prepare() {
 
 	if use prefix ; then
 		# bug #757309
-		eapply "${FILESDIR}"/git-2.37.2-darwin-prefix-gettext.patch
+		sed -i \
+			-e 's:/usr/local/opt/gettext/:/do/not/look/elsewhere/:g' \
+			-e 's:/opt/homebrew/:/do/not/look/elsewhere/:g' \
+			config.mak.uname || die
 	fi
 
 	sed -i \
@@ -303,6 +306,10 @@ git_emake() {
 		OPTCFLAGS="${CFLAGS}"
 		OPTLDFLAGS="${LDFLAGS}"
 
+		CURL_CONFIG="${ESYSROOT}/usr/bin/curl-config"
+		CURL_CFLAGS="$($(tc-getPKG_CONFIG) --cflags libcurl)"
+		CURL_LDFLAGS="$($(tc-getPKG_CONFIG) --libs libcurl)"
+
 		PERL_PATH="${EPREFIX}/usr/bin/perl"
 		PERL_MM_OPT=""
 
@@ -326,6 +333,10 @@ src_compile() {
 		git_emake gitweb
 	fi
 
+	if use perl ; then
+		git_emake -C contrib/credential/netrc
+	fi
+
 	if [[ ${CHOST} == *-darwin* ]] && tc-is-clang ; then
 		git_emake -C contrib/credential/osxkeychain
 	fi
@@ -462,6 +473,8 @@ src_test() {
 	# Now run the tests, keep going if we hit an error, and don't terminate on
 	# failure
 	local rc
+	# t0610-reftable-basics.sh uses $A
+	local -x A=
 	einfo "Start test run"
 	#MAKEOPTS=-j1
 	nonfatal git_emake --keep-going test
@@ -473,6 +486,11 @@ src_test() {
 
 	# And bail if there was a problem
 	[[ ${rc} -eq 0 ]] || die "Tests failed. Please file a bug!"
+
+	popd &>/dev/null || die
+	if use perl ; then
+		emake -C contrib/credential/netrc testverbose
+	fi
 }
 
 src_install() {
@@ -567,7 +585,6 @@ src_install() {
 	local contrib_objects=(
 		buildsystems
 		fast-import
-		hg-to-git
 		hooks
 		remotes2config.sh
 		rerere-train.sh
@@ -600,6 +617,12 @@ src_install() {
 		rm -rf "${ED}"/usr/share/gitweb
 	fi
 
+	if use perl ; then
+		pushd contrib/credential/netrc &>/dev/null || die
+		dobin git-credential-netrc
+		popd &>/dev/null || die
+	fi
+
 	if ! use subversion ; then
 		rm -f "${ED}"/usr/libexec/git-core/git-svn \
 			"${ED}"/usr/share/man/man1/git-svn.1*
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r1.ebuild
index 754773f787a..17a8afd1ac8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r1.ebuild
@@ -253,7 +253,7 @@ src_prepare() {
 		# This patch neuters the "safe directory" detection.
 		# bugs #838271, #838223
 		PATCHES+=(
-			"${FILESDIR}"/git-2.37.2-unsafe-directory.patch
+			"${FILESDIR}"/git-2.46.2-unsafe-directory.patch
 		)
 	fi
 
@@ -333,6 +333,10 @@ src_compile() {
 		git_emake gitweb
 	fi
 
+	if use perl ; then
+		git_emake -C contrib/credential/netrc
+	fi
+
 	if [[ ${CHOST} == *-darwin* ]] && tc-is-clang ; then
 		git_emake -C contrib/credential/osxkeychain
 	fi
@@ -482,6 +486,11 @@ src_test() {
 
 	# And bail if there was a problem
 	[[ ${rc} -eq 0 ]] || die "Tests failed. Please file a bug!"
+
+	popd &>/dev/null || die
+	if use perl ; then
+		emake -C contrib/credential/netrc testverbose
+	fi
 }
 
 src_install() {
@@ -608,6 +617,12 @@ src_install() {
 		rm -rf "${ED}"/usr/share/gitweb
 	fi
 
+	if use perl ; then
+		pushd contrib/credential/netrc &>/dev/null || die
+		dobin git-credential-netrc
+		popd &>/dev/null || die
+	fi
+
 	if ! use subversion ; then
 		rm -f "${ED}"/usr/libexec/git-core/git-svn \
 			"${ED}"/usr/share/man/man1/git-svn.1*
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r2.ebuild
index 754773f787a..17a8afd1ac8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r2.ebuild
@@ -253,7 +253,7 @@ src_prepare() {
 		# This patch neuters the "safe directory" detection.
 		# bugs #838271, #838223
 		PATCHES+=(
-			"${FILESDIR}"/git-2.37.2-unsafe-directory.patch
+			"${FILESDIR}"/git-2.46.2-unsafe-directory.patch
 		)
 	fi
 
@@ -333,6 +333,10 @@ src_compile() {
 		git_emake gitweb
 	fi
 
+	if use perl ; then
+		git_emake -C contrib/credential/netrc
+	fi
+
 	if [[ ${CHOST} == *-darwin* ]] && tc-is-clang ; then
 		git_emake -C contrib/credential/osxkeychain
 	fi
@@ -482,6 +486,11 @@ src_test() {
 
 	# And bail if there was a problem
 	[[ ${rc} -eq 0 ]] || die "Tests failed. Please file a bug!"
+
+	popd &>/dev/null || die
+	if use perl ; then
+		emake -C contrib/credential/netrc testverbose
+	fi
 }
 
 src_install() {
@@ -608,6 +617,12 @@ src_install() {
 		rm -rf "${ED}"/usr/share/gitweb
 	fi
 
+	if use perl ; then
+		pushd contrib/credential/netrc &>/dev/null || die
+		dobin git-credential-netrc
+		popd &>/dev/null || die
+	fi
+
 	if ! use subversion ; then
 		rm -f "${ED}"/usr/libexec/git-core/git-svn \
 			"${ED}"/usr/share/man/man1/git-svn.1*
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r3.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r3.ebuild
index 754773f787a..17a8afd1ac8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r3.ebuild
@@ -253,7 +253,7 @@ src_prepare() {
 		# This patch neuters the "safe directory" detection.
 		# bugs #838271, #838223
 		PATCHES+=(
-			"${FILESDIR}"/git-2.37.2-unsafe-directory.patch
+			"${FILESDIR}"/git-2.46.2-unsafe-directory.patch
 		)
 	fi
 
@@ -333,6 +333,10 @@ src_compile() {
 		git_emake gitweb
 	fi
 
+	if use perl ; then
+		git_emake -C contrib/credential/netrc
+	fi
+
 	if [[ ${CHOST} == *-darwin* ]] && tc-is-clang ; then
 		git_emake -C contrib/credential/osxkeychain
 	fi
@@ -482,6 +486,11 @@ src_test() {
 
 	# And bail if there was a problem
 	[[ ${rc} -eq 0 ]] || die "Tests failed. Please file a bug!"
+
+	popd &>/dev/null || die
+	if use perl ; then
+		emake -C contrib/credential/netrc testverbose
+	fi
 }
 
 src_install() {
@@ -608,6 +617,12 @@ src_install() {
 		rm -rf "${ED}"/usr/share/gitweb
 	fi
 
+	if use perl ; then
+		pushd contrib/credential/netrc &>/dev/null || die
+		dobin git-credential-netrc
+		popd &>/dev/null || die
+	fi
+
 	if ! use subversion ; then
 		rm -f "${ED}"/usr/libexec/git-core/git-svn \
 			"${ED}"/usr/share/man/man1/git-svn.1*
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999.ebuild
index 754773f787a..17a8afd1ac8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999.ebuild
@@ -253,7 +253,7 @@ src_prepare() {
 		# This patch neuters the "safe directory" detection.
 		# bugs #838271, #838223
 		PATCHES+=(
-			"${FILESDIR}"/git-2.37.2-unsafe-directory.patch
+			"${FILESDIR}"/git-2.46.2-unsafe-directory.patch
 		)
 	fi
 
@@ -333,6 +333,10 @@ src_compile() {
 		git_emake gitweb
 	fi
 
+	if use perl ; then
+		git_emake -C contrib/credential/netrc
+	fi
+
 	if [[ ${CHOST} == *-darwin* ]] && tc-is-clang ; then
 		git_emake -C contrib/credential/osxkeychain
 	fi
@@ -482,6 +486,11 @@ src_test() {
 
 	# And bail if there was a problem
 	[[ ${rc} -eq 0 ]] || die "Tests failed. Please file a bug!"
+
+	popd &>/dev/null || die
+	if use perl ; then
+		emake -C contrib/credential/netrc testverbose
+	fi
 }
 
 src_install() {
@@ -608,6 +617,12 @@ src_install() {
 		rm -rf "${ED}"/usr/share/gitweb
 	fi
 
+	if use perl ; then
+		pushd contrib/credential/netrc &>/dev/null || die
+		dobin git-credential-netrc
+		popd &>/dev/null || die
+	fi
+
 	if ! use subversion ; then
 		rm -f "${ED}"/usr/libexec/git-core/git-svn \
 			"${ED}"/usr/share/man/man1/git-svn.1*
diff --git a/sdk_container/src/third_party/portage-stable/eclass/autotools.eclass b/sdk_container/src/third_party/portage-stable/eclass/autotools.eclass
index 0571b18ba52..641612f3719 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/autotools.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/autotools.eclass
@@ -312,7 +312,13 @@ eautoreconf() {
 	else
 		eautoconf --force
 	fi
-	[[ ${AT_NOEAUTOHEADER} != "yes" ]] && eautoheader
+	if [[ ${AT_NOEAUTOHEADER} != "yes" ]] ; then
+		if [[ ${WANT_AUTOCONF} == "2.1" ]] ; then
+			eautoheader
+		else
+			eautoheader --force
+		fi
+	fi
 	[[ ${AT_NOEAUTOMAKE} != "yes" ]] && FROM_EAUTORECONF="yes" eautomake ${AM_OPTS}
 
 	if [[ ${AT_NOELIBTOOLIZE} != "yes" ]] ; then
diff --git a/sdk_container/src/third_party/portage-stable/eclass/cargo.eclass b/sdk_container/src/third_party/portage-stable/eclass/cargo.eclass
index 3a63e502725..499fe5498c9 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/cargo.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/cargo.eclass
@@ -585,7 +585,7 @@ cargo_env() {
 	local -x CARGO_BUILD_TARGET=$(rust_abi)
 	local TRIPLE=${CARGO_BUILD_TARGET//-/_}
 	local TRIPLE=${TRIPLE^^} LD_A=( $(tc-getCC) ${LDFLAGS} )
-	local -x CARGO_TARGET_"${TRIPLE}"_RUSTFLAGS="-C strip=none -C linker=${LD_A[0]}"
+	local -Ix CARGO_TARGET_"${TRIPLE}"_RUSTFLAGS+=" -C strip=none -C linker=${LD_A[0]}"
 	[[ ${#LD_A[@]} -gt 1 ]] && local CARGO_TARGET_"${TRIPLE}"_RUSTFLAGS+="$(printf -- ' -C link-arg=%s' "${LD_A[@]:1}")"
 	local CARGO_TARGET_"${TRIPLE}"_RUSTFLAGS+=" ${RUSTFLAGS}"
 
diff --git a/sdk_container/src/third_party/portage-stable/eclass/guile-single.eclass b/sdk_container/src/third_party/portage-stable/eclass/guile-single.eclass
index 91f6036139d..66898504a6c 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/guile-single.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/guile-single.eclass
@@ -240,6 +240,6 @@ guile-single_src_install() {
 	guile_unstrip_ccache
 }
 
-EXPORT_FUNCTIONS pkg_setup src_prepare src_install
-
 fi  # _GUILE_SINGLE_ECLASS
+
+EXPORT_FUNCTIONS pkg_setup src_prepare src_install
diff --git a/sdk_container/src/third_party/portage-stable/eclass/java-utils-2.eclass b/sdk_container/src/third_party/portage-stable/eclass/java-utils-2.eclass
index 43d9b749ba3..1e9c28d5868 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/java-utils-2.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/java-utils-2.eclass
@@ -9,13 +9,12 @@
 # @SUPPORTED_EAPIS: 6 7 8
 # @BLURB: Base eclass for Java packages
 # @DESCRIPTION:
-# This eclass provides functionality which is used by java-pkg-2.eclass,
-# java-pkg-opt-2.eclass and java-ant-2 eclass, as well as from ebuilds.
+# This eclass provides functionality which is used by java-pkg-2.eclass and
+# java-pkg-opt-2.eclass as well as from ebuilds.
 #
 # This eclass should not be inherited this directly from an ebuild. Instead,
 # you should inherit java-pkg-2 for Java packages or java-pkg-opt-2 for packages
-# that have optional Java support. In addition you can inherit java-ant-2 for
-# Ant-based packages.
+# that have optional Java support.
 
 if [[ -z ${_JAVA_UTILS_2_ECLASS} ]] ; then
 _JAVA_UTILS_2_ECLASS=1
@@ -101,7 +100,7 @@ JAVA_PKG_ALLOW_VM_CHANGE=${JAVA_PKG_ALLOW_VM_CHANGE:="yes"}
 # @DEFAULT_UNSET
 # @DESCRIPTION:
 # Specify a non-standard Java source version for compilation (via javac -source
-# parameter or Ant equivalent via build.xml rewriting done by java-ant-2 eclass).
+# parameter).
 # Normally this is determined from the jdk version specified in DEPEND.
 # See java-pkg_get-source function below.
 #
@@ -204,9 +203,9 @@ JAVA_PKG_COMPILERS_CONF=${JAVA_PKG_COMPILERS_CONF:="/etc/java-config-2/build/com
 #
 # Useful for local testing.
 #
-# Use jikes and javac, in that order
+# Use <other compiler> and javac, in that order
 # @CODE
-#	JAVA_PKG_FORCE_COMPILER="jikes javac"
+#	JAVA_PKG_FORCE_COMPILER="<other compiler> javac"
 # @CODE
 
 # @ECLASS_VARIABLE: JAVA_PKG_FORCE_ANT_TASKS
@@ -1649,6 +1648,10 @@ java-pkg_set-current-vm() {
 	export GENTOO_VM=${1}
 }
 
+# @FUNCTION: java-pkg_current-vm-matches
+# @USAGE: <vm_string1> [<vm_string2> [<vm_string3>...]]
+# @RETURN: 0: the current vm matches any of the provided strings
+# @RETURN: 1: the current vm does not match any of the provided strings
 java-pkg_current-vm-matches() {
 	has $(java-pkg_get-current-vm) ${@}
 	return $?
@@ -2307,9 +2310,6 @@ java-pkg_init() {
 
 	# TODO we will probably want to set JAVAC and JAVACFLAGS
 
-	# Do some QA checks
-	java-pkg_check-jikes
-
 	# Can't use unset here because Portage does not save the unset
 	# see https://bugs.gentoo.org/show_bug.cgi?id=189417#c11
 
@@ -2325,7 +2325,7 @@ java-pkg_init() {
 	export ANT_RESPECT_JAVA_HOME=
 }
 
-# @FUNCTION: java-pkg-init-compiler_
+# @FUNCTION: java-pkg_init-compiler_
 # @INTERNAL
 # @DESCRIPTION:
 # This function attempts to figure out what compiler should be used. It does
@@ -2346,9 +2346,7 @@ java-pkg_init() {
 # If the user doesn't defined anything in JAVA_PKG_COMPILERS_CONF, or no
 # suitable compiler was found there, then the default is to use javac provided
 # by the current VM.
-#
-#
-# @RETURN name of the compiler to use
+# @RETURN: name of the compiler to use
 java-pkg_init-compiler_() {
 	debug-print-function ${FUNCNAME} $*
 
@@ -2950,6 +2948,12 @@ java-pkg_ensure-dep() {
 	fi
 }
 
+# @FUNCTION: java-pkg_check-phase
+# @INTERNAL
+# @USAGE: <phase_name>
+# @DESCRIPTION:
+# Checks whether the phase specified in $1 is the current active phase. If not,
+# a helpful QA message is displayed
 java-pkg_check-phase() {
 	local phase=${1}
 	local funcname=${FUNCNAME[1]}
@@ -2959,6 +2963,12 @@ java-pkg_check-phase() {
 	fi
 }
 
+# @FUNCTION: java-pkg_check-versioned-jar
+# @INTERNAL
+# @USAGE: <jar_filename>
+# @DESCRIPTION:
+# Checks whether the jar specified in $1 contains ${PV}. If it does, a helpful
+# QA message is displayed
 java-pkg_check-versioned-jar() {
 	local jar=${1}
 
@@ -2967,12 +2977,12 @@ java-pkg_check-versioned-jar() {
 	fi
 }
 
-java-pkg_check-jikes() {
-	if has jikes ${IUSE}; then
-		java-pkg_announce-qa-violation "deprecated USE flag 'jikes' in IUSE"
-	fi
-}
-
+# @FUNCTION: java-pkg_announce-qa-violation
+# @INTERNAL
+# @USAGE: [--nodie] <msg>
+# @DESCRIPTION:
+# Prints out the <msg> as a QA message. If ${JAVA_PKG_STRICT} is set, then die
+# is called. This can be overridden by providing --nodie
 java-pkg_announce-qa-violation() {
 	local nodie
 	if [[ ${1} == "--nodie" ]]; then
@@ -2989,6 +2999,10 @@ increment-qa-violations() {
 	export JAVA_PKG_QA_VIOLATIONS
 }
 
+# @FUNCTION: is-java-strict
+# @INTERNAL
+# @RETURN: 0: JAVA_PKG_STRICT is set
+# @RETURN: 1: JAVA_PKG_STRICT is not set
 is-java-strict() {
 	[[ -n ${JAVA_PKG_STRICT} ]]
 	return $?
diff --git a/sdk_container/src/third_party/portage-stable/eclass/ruby-utils.eclass b/sdk_container/src/third_party/portage-stable/eclass/ruby-utils.eclass
index 48a25114b39..81bda3abfb3 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/ruby-utils.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/ruby-utils.eclass
@@ -36,10 +36,10 @@ esac
 # provide for a better first installation experience.
 
 # All stable RUBY_TARGETS
-RUBY_TARGETS_PREFERENCE="ruby31 "
+RUBY_TARGETS_PREFERENCE="ruby32 ruby31 "
 
 # All other active ruby targets
-RUBY_TARGETS_PREFERENCE+="ruby32 ruby33"
+RUBY_TARGETS_PREFERENCE+="ruby33"
 
 _ruby_implementation_depend() {
 	local rubypn=
diff --git a/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass b/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
index c03312be43a..34f595bcd1b 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
@@ -22,7 +22,9 @@ _TOOLCHAIN_ECLASS=1
 DESCRIPTION="The GNU Compiler Collection"
 HOMEPAGE="https://gcc.gnu.org/"
 
-inherit edo flag-o-matic gnuconfig libtool multilib pax-utils python-any-r1 toolchain-funcs prefix
+inherit edo flag-o-matic gnuconfig libtool multilib pax-utils toolchain-funcs prefix
+
+[[ -n ${TOOLCHAIN_HAS_TESTS} ]] && inherit python-any-r1
 
 tc_is_live() {
 	[[ ${PV} == *9999* ]]
@@ -143,6 +145,12 @@ tc_version_is_between() {
 # @DESCRIPTION:
 # Indicate the developer who hosts the patchset for an ebuild.
 
+# @ECLASS_VARIABLE: TOOLCHAIN_HAS_TESTS
+# @DEFAULT_UNSET
+# @DESCRIPTION:
+# Controls whether python-any-r1 is inherited and validate_failures.py
+# is used.
+
 # @ECLASS_VARIABLE: GCC_PV
 # @INTERNAL
 # @DESCRIPTION:
@@ -273,6 +281,7 @@ STDCXX_INCDIR=${TOOLCHAIN_STDCXX_INCDIR:-${LIBPATH}/include/g++-v${GCC_BRANCH_VE
 LICENSE="GPL-3+ LGPL-3+ || ( GPL-3+ libgcc libstdc++ gcc-runtime-library-exception-3.1 ) FDL-1.3+"
 IUSE="test vanilla +nls"
 RESTRICT="!test? ( test )"
+[[ -z ${TOOLCHAIN_HAS_TESTS} ]] && RESTRICT+=" test"
 
 TC_FEATURES=()
 
@@ -392,10 +401,17 @@ if tc_has_feature valgrind ; then
 	BDEPEND+=" valgrind? ( dev-debug/valgrind )"
 fi
 
-# TODO: Add a pkg_setup & pkg_pretend check for whether the active compiler
-# supports Ada.
 if [[ ${PN} != gnat-gpl ]] && tc_has_feature ada ; then
-	BDEPEND+=" ada? ( || ( sys-devel/gcc[ada] dev-lang/gnat-gpl[ada] ) )"
+	BDEPEND+="
+		ada? (
+			|| (
+				sys-devel/gcc:${SLOT}[ada]
+				<sys-devel/gcc-${SLOT}[ada]
+				<dev-lang/ada-bootstrap-${SLOT}
+				dev-lang/gnat-gpl[ada]
+			)
+		)
+	"
 fi
 
 # TODO: Add a pkg_setup & pkg_pretend check for whether the active compiler
@@ -404,7 +420,7 @@ if tc_has_feature d && tc_version_is_at_least 12.0 ; then
 	# D in 12+ is self-hosting and needs D to bootstrap.
 	# TODO: package some binary we can use, like for Ada
 	# bug #840182
-	BDEPEND+=" d? ( || ( sys-devel/gcc[d(-)] <sys-devel/gcc-12[d(-)] ) )"
+	BDEPEND+=" d? ( || ( sys-devel/gcc:${SLOT}[d(-)] <sys-devel/gcc-${SLOT}[d(-)] <sys-devel/gcc-12[d(-)] ) )"
 fi
 
 if tc_has_feature rust && tc_version_is_at_least 14.0.0_pre20230421 ; then
@@ -537,7 +553,8 @@ get_gcc_src_uri() {
 	[[ -n ${MUSL_VER} ]] && \
 		GCC_SRC_URI+=" $(gentoo_urls gcc-${MUSL_GCC_VER}-musl-patches-${MUSL_VER}.tar.${TOOLCHAIN_PATCH_SUFFIX})"
 
-	GCC_SRC_URI+=" test? ( https://gitweb.gentoo.org/proj/gcc-patches.git/plain/scripts/testsuite-management/validate_failures.py?id=${GCC_VALIDATE_FAILURES_VERSION} -> gcc-validate-failures-${GCC_VALIDATE_FAILURES_VERSION}.py )"
+	[[ -n ${TOOLCHAIN_HAS_TESTS} ]] && \
+		GCC_SRC_URI+=" test? ( https://gitweb.gentoo.org/proj/gcc-patches.git/plain/scripts/testsuite-management/validate_failures.py?id=${GCC_VALIDATE_FAILURES_VERSION} -> gcc-validate-failures-${GCC_VALIDATE_FAILURES_VERSION}.py )"
 
 	echo "${GCC_SRC_URI}"
 }
@@ -548,6 +565,8 @@ SRC_URI=$(get_gcc_src_uri)
 
 toolchain_pkg_pretend() {
 	if ! _tc_use_if_iuse cxx ; then
+		_tc_use_if_iuse ada && \
+			ewarn 'Ada requires a C++ compiler, disabled due to USE="-cxx"'
 		_tc_use_if_iuse go && \
 			ewarn 'Go requires a C++ compiler, disabled due to USE="-cxx"'
 		_tc_use_if_iuse objc++ && \
@@ -564,12 +583,15 @@ toolchain_pkg_setup() {
 	# bug #265283
 	unset LANGUAGES
 
+	# bug #932245
+	[[ ${LIBTOOL} = rlibtool ]] && die "\$LIBTOOL is using rlibtool from dev-build/slibtool. You must not use rlibtool, only rclibtool."
+
 	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
 	# Avoid really confusing logs from subconfigure spam, makes logs far
 	# more legible.
 	MAKEOPTS="--output-sync=line ${MAKEOPTS}"
 
-	use test && python-any-r1_pkg_setup
+	[[ -n ${TOOLCHAIN_HAS_TESTS} ]] && use test && python-any-r1_pkg_setup
 }
 
 #---->> src_unpack <<----
@@ -633,7 +655,7 @@ toolchain_src_prepare() {
 		tc_enable_hardened_gcc
 	fi
 
-	if use test ; then
+	if [[ -n ${TOOLCHAIN_HAS_TESTS} ]] && use test ; then
 		cp "${DISTDIR}"/gcc-validate-failures-${GCC_VALIDATE_FAILURES_VERSION}.py "${T}"/validate_failures.py || die
 		chmod +x "${T}"/validate_failures.py || die
 	fi
@@ -762,7 +784,6 @@ tc_enable_hardened_gcc() {
 	sed -i \
 		-e "/^HARD_CFLAGS = /s|=|= ${hardened_gcc_flags} |" \
 		"${S}"/gcc/Makefile.in || die
-
 }
 
 # This is a historical wart.  The original Gentoo/amd64 port used:
@@ -807,6 +828,230 @@ setup_multilib_osdirnames() {
 	sed -i "${sed_args[@]}" "${S}"/gcc/config/${config} || die
 }
 
+# @FUNCTION: toolchain_setup_ada
+# @INTERNAL
+# @DESCRIPTION:
+# Determine the most suitable GNAT (Ada compiler) for bootstrapping
+# and setup the environment, including wrappers, for building.
+toolchain_setup_ada() {
+	local latest_gcc=$(best_version -b "sys-devel/gcc")
+	latest_gcc="${latest_gcc#sys-devel/gcc-}"
+	latest_gcc=$(ver_cut 1 ${latest_gcc})
+
+	local ada_bootstrap
+	local ada_candidate
+	local ada_bootstrap_type
+	# GNAT can usually be built using the last major version and
+	# the current version, at least.
+	#
+	# Order of preference (descending):
+	# 1) Match the version being built;
+	# 2) Iterate downwards from the version being built;
+	# 3) Iterate upwards from the version being built to the greatest version installed.
+	for ada_candidate in ${SLOT} $(seq $((${SLOT} - 1)) -1 10) $(seq $((${SLOT} + 1)) ${latest_gcc}) ; do
+		has_version -b "sys-devel/gcc:${ada_candidate}" || continue
+
+		ebegin "Testing sys-devel/gcc:${ada_candidate} for Ada"
+		if has_version -b "sys-devel/gcc:${ada_candidate}[ada(-)]" ; then
+			ada_bootstrap=${ada_candidate}
+			ada_bootstrap_type=gcc
+
+			eend 0
+			break
+		fi
+		eend 1
+	done
+
+	# As a penultimate resort, try dev-lang/ada-bootstrap.
+	if ver_test ${ada_bootstrap} -gt ${PV} || [[ -z ${ada_bootstrap} ]] ; then
+		ebegin "Testing fallback dev-lang/ada-bootstrap for Ada"
+		if has_version -b "<dev-lang/ada-bootstrap-${SLOT}" ; then
+			# TODO: Figure out ada-bootstrap versioning/slots
+
+			#local latest_ada_bootstrap=$(best_version -b "<dev-lang/ada-bootstrap-${SLOT}")
+			#latest_ada_bootstrap="${latest_ada_bootstrap#dev-lang/ada-bootstrap-}"
+			#latest_ada_bootstrap=$(ver_cut 1 ${latest_ada_bootstrap})
+			ada_bootstrap="10"
+			ada_bootstrap_type=ada-bootstrap
+
+			eend 0
+		else
+			eend 1
+		fi
+	fi
+
+	# As a last resort, try dev-lang/gnat-gpl.
+	if ver_test ${ada_bootstrap} -gt ${PV} || [[ -z ${ada_bootstrap} ]] ; then
+		ebegin "Testing fallback dev-lang/gnat-gpl for Ada"
+		if has_version -b "dev-lang/gnat-gpl" ; then
+			ada_bootstrap=10
+			ada_bootstrap_type=gcc
+			eend 0
+		else
+			eend 1
+		fi
+	fi
+
+	# OK, even gnat-gpl didn't work. Give up for now.
+	# TODO: Source a newer, or build our own, bootstrap tarball (bug #940472).
+	if [[ -z ${ada_bootstrap} ]] ; then
+		eerror "Couldn't find a suitable GNAT compiler for Ada!"
+		eerror "Please try installing dev-lang/ada-bootstrap or failing that, dev-lang/gnat-gpl."
+		eerror "For other platforms, you may need to use crossdev."
+		die "Couldn't find an Ada bootstrap compiler!"
+	fi
+
+	cat <<-"EOF" > "${T}"/ada.spec || die
+		# Extracted from gcc/ada/gcc-interface/lang-specs.h
+		.adb:
+		@ada
+
+		.ads:
+		@ada
+
+		# TODO: ADA_DUMPS_OPTIONS
+		@ada:
+		%{pg:%{fomit-frame-pointer:%e-pg and -fomit-frame-pointer are incompatible}} \
+			%{!S:%{!c:%e-c or -S required for Ada}} \
+			${gnat1_path} %{I*} %{k8:-gnatk8} %{!Q:-quiet} \
+			%{nostdinc*} %{nostdlib*} \
+			%{fcompare-debug-second:-gnatd_A} \
+			%{O*} %{W*} %{w} %{p} %{pg:-p} \
+			%{coverage:-fprofile-arcs -ftest-coverage} \
+			%{Wall:-gnatwa} %{Werror:-gnatwe} %{w:-gnatws} \
+			%{gnatea:-gnatez} %{g*&m*&f*} \
+			%1 %{!S:%{o*:%w%*-gnatO}} \
+			%i %{S:%W{o*}%{!o*:-o %w%b.s}} \
+			%{gnatc*|gnats*: -o %j} %{-param*} \
+			%{!gnatc*:%{!gnats*:%(invoke_as)}}
+
+		@adawhy:
+			%{!c:%e-c required for gnat2why} \
+			gnat1why %{I*} %{k8:-gnatk8} %{!Q:-quiet} \
+			%{nostdinc*} %{nostdlib*} \
+			%{a} \
+			%{gnatea:-gnatez} %{g*&m*&f*} \
+			%1 %{o*:%w%*-gnatO} \
+			%i \
+			%{gnatc*|gnats*: -o %j} %{-param*}
+
+		@adascil:
+			%{!c:%e-c required for gnat2scil} \
+			gnat1scil %{I*} %{k8:-gnatk8} %{!Q:-quiet} \
+			%{nostdinc*} %{nostdlib*} \
+			%{a} \
+			%{gnatea:-gnatez} %{g*&m*&f*} \
+			%1 %{o*:%w%*-gnatO} \
+			%i \
+			%{gnatc*|gnats*: -o %j} %{-param*}
+		EOF
+
+	old_path="${PATH}"
+	case ${ada_bootstrap_type} in
+		ada-bootstrap)
+			export PATH="${BROOT}/usr/lib/ada-bootstrap/bin:${PATH}"
+			gnat1_path=${BROOT}/usr/lib/ada-bootstrap/libexec/gcc/${CBUILD}/${ada_bootstrap}/gnat1
+			;;
+		*)
+			gnat1_path=${BROOT}/usr/libexec/gcc/${CBUILD}/${ada_bootstrap}/gnat1
+			;;
+	esac
+
+	# Easier to substitute these values in rather than escape lots of
+	# bits above in the heredoc.
+	sed -i \
+		-e "s:\${BROOT}:${BROOT}:" \
+		-e "s:\${CBUILD}:${CBUILD}:" \
+		-e "s:\${gnat1_path}:${gnat1_path}:" \
+		-e "s:\${ada_bootstrap}:${ada_bootstrap}:" \
+		"${T}"/ada.spec || die
+
+	# The Makefile tries to find libgnat by querying $(CC) which won't
+	# work for us as the stage1 compiler doesn't necessarily have Ada
+	# support. Substitute the Ada compiler we found earlier.
+	local adalib
+	adalib=$(${CBUILD}-gcc-${ada_bootstrap} -print-libgcc-file-name || die "Finding adalib dir failed")
+	adalib="${adalib%/*}/adalib"
+	sed -i \
+		-e "s:adalib=.*:adalib=${adalib}:" \
+		"${S}"/gcc/ada/gcc-interface/Make-lang.in || die
+
+	# Create bin wrappers because not all of the build system respects
+	# GNATBIND or GNATMAKE.
+	mkdir "${T}"/ada-wrappers || die
+	local tool
+	for tool in gnat{,bind,chop,clean,kr,link,ls,make,name,prep} ; do
+		cat <<-EOF > "${T}"/ada-wrappers/${tool} || die
+		#!/bin/sh
+		exec $(type -P ${CBUILD}-${tool}-${ada_bootstrap}) "\$@"
+		EOF
+
+		export "${tool^^}"="${T}"/ada-wrappers/${tool}
+	done
+	chmod +x "${T}"/ada-wrappers/gnat{,bind,chop,clean,kr,link,ls,make,name,prep} || die
+
+	export PATH="${T}/ada-wrappers:${old_path}"
+	export CC="$(tc-getCC) -specs=${T}/ada.spec"
+}
+
+# @FUNCTION: toolchain_setup_d
+# @INTERNAL
+# @DESCRIPTION:
+# Determine the most suitable GDC (D compiler) for bootstrapping
+# and setup the environment for building.
+toolchain_setup_d() {
+	local gcc_pkg gcc_bin_base
+	if tc-is-cross-compiler ; then
+		gcc_pkg=cross-${CHOST}/gcc
+		gcc_bin_base=${BROOT}/usr/${CBUILD}/${CHOST}/gcc-bin
+	else
+		gcc_pkg=sys-devel/gcc
+		gcc_bin_base=${BROOT}/usr/${CHOST}/gcc-bin
+	fi
+
+	local latest_gcc=$(best_version -b "${gcc_pkg}")
+	latest_gcc="${latest_gcc#${gcc_pkg}-}"
+	latest_gcc=$(ver_cut 1 ${latest_gcc})
+
+	local d_bootstrap
+	local d_candidate
+	# Order of preference (descending):
+	# 1) Match the version being built;
+	# 2) Iterate downwards from the version being built;
+	# 3) Iterate upwards from the version being built to the greatest version installed.
+	for d_candidate in ${SLOT} $(seq $((${SLOT} - 1)) -1 10) $(seq $((${SLOT} + 1)) ${latest_gcc}) ; do
+		has_version -b "${gcc_pkg}:${d_candidate}" || continue
+
+		ebegin "Testing ${gcc_pkg}:${d_candidate} for D"
+		if has_version -b "${gcc_pkg}:${d_candidate}[d(-)]" ; then
+			d_bootstrap=${d_candidate}
+
+			eend 0
+			break
+		fi
+		eend 1
+	done
+
+	if [[ -z ${d_bootstrap} ]] ; then
+		if tc-is-cross-compiler ; then
+			# We can't add cross-${CHOST}/gcc[d] to BDEPEND but we can
+			# print a useful message to the user.
+			eerror "No ${gcc_pkg}[d] was found installed."
+			eerror "When cross-compiling GDC a bootstrap GDC is required."
+			eerror "Either disable the d USE flag or add:"
+			eerror ""
+			eerror "    ${gcc_pkg} d"
+			eerror ""
+			eerror "In your package.use and re-emerge it."
+			eerror ""
+		fi
+
+		die "Did not find any appropriate GDC compiler installed"
+	fi
+
+	export GDC=${gcc_bin_base}/${d_bootstrap}/${CHOST}-gdc
+}
+
 #---->> src_configure <<----
 
 toolchain_src_configure() {
@@ -817,18 +1062,14 @@ toolchain_src_configure() {
 	gcc_do_filter_flags
 
 	if ! tc_version_is_at_least 11 && [[ $(gcc-major-version) -ge 12 ]] ; then
-		# https://gcc.gnu.org/PR105695
-		# bug #849359
+		# https://gcc.gnu.org/PR105695 (bug #849359)
 		export ac_cv_std_swap_in_utility=no
 	fi
 
-	einfo "CFLAGS=\"${CFLAGS}\""
-	einfo "CXXFLAGS=\"${CXXFLAGS}\""
-	einfo "LDFLAGS=\"${LDFLAGS}\""
-
-	# Force internal zip based jar script to avoid random
-	# issues with 3rd party jar implementations. bug #384291
-	export JAR=no
+	local flag
+	for flag in $(all-flag-vars) ; do
+		einfo "${flag}=\"${!flag}\""
+	done
 
 	local confgcc=( --host=${CHOST} )
 
@@ -895,6 +1136,21 @@ toolchain_src_configure() {
 	is_modula2 && GCC_LANG+=",m2"
 	is_rust && GCC_LANG+=",rust"
 
+	_need_ada_bootstrap_mangling() {
+		if [[ ${CATEGORY}/${PN} == dev-lang/gnat-gpl ]] ; then
+			_tc_use_if_iuse system-bootstrap && return 0
+			return 1
+		fi
+
+		_tc_use_if_iuse ada
+	}
+	_need_d_bootstrap() {
+		_tc_use_if_iuse d && [[ ${GCCMAJOR} -ge 12 ]]
+	}
+
+	_need_ada_bootstrap_mangling && toolchain_setup_ada
+	_need_d_bootstrap && toolchain_setup_d
+
 	confgcc+=( --enable-languages=${GCC_LANG} )
 
 	### general options
@@ -919,7 +1175,15 @@ toolchain_src_configure() {
 		# unless USE=debug. Note that snapshots on stable branches don't count as "non-released"
 		# for these purposes.
 		if grep -q "experimental" gcc/DEV-PHASE ; then
-			# - USE=debug for pre-releases: yes,extra,rtl
+			# Tell users about the non-obvious behavior here so they don't think
+			# e.g. the next GCC release is super slow to compile things.
+			ewarn "Unreleased GCCs default to extra runtime checks even with USE=-debug,"
+			ewarn "matching upstream default behavior. We recommend keeping these enabled."
+			ewarn "The checks (sometimes substantially) increase build time but provide important protection"
+			ewarn "from potential miscompilations (wrong code) by turning them into build-time errors."
+			ewarn "To override (not recommended), set: GCC_CHECKS_LIST=\"release\"."
+
+			# - USE=debug for pre-releases: yes,extra,rtl (stornger than USE=debug for releases)
 			# - USE=-debug for pre-releases: yes,extra (following upstream default)
 			confgcc+=( --enable-checking="${GCC_CHECKS_LIST:-$(usex debug yes,extra,rtl yes,extra)}" )
 		else
@@ -1296,12 +1560,24 @@ toolchain_src_configure() {
 	fi
 
 	if in_iuse ada ; then
-		confgcc+=( --disable-libada )
+		confgcc+=( $(use_enable ada libada) )
 	fi
 
 	if in_iuse cet ; then
-		[[ ${CTARGET} == x86_64-*-gnu* ]] && confgcc+=( $(use_enable cet) )
-		[[ ${CTARGET} == aarch64-*-gnu* ]] && confgcc+=( $(use_enable cet standard-branch-protection) )
+		# Usage: triple_arch triple_env cet_name
+		enable_cet_for() {
+			if [[ ${CTARGET} == ${1}-* ]] ; then
+				if use cet && [[ ${CTARGET} == *-${2}* ]]; then
+					confgcc+=( --enable-${3} )
+				else
+					confgcc+=( --disable-${3} )
+				fi
+			fi
+		}
+
+		enable_cet_for 'i[34567]86' 'linux' 'cet'
+		enable_cet_for 'x86_64' 'gnu' 'cet'
+		enable_cet_for 'aarch64' 'gnu' 'standard-branch-protection'
 	fi
 
 	if in_iuse systemtap ; then
@@ -1423,6 +1699,10 @@ toolchain_src_configure() {
 	einfo "DATAPATH:        ${DATAPATH}"
 	einfo "STDCXX_INCDIR:   ${STDCXX_INCDIR}"
 	einfo "Languages:       ${GCC_LANG}"
+	einfo "GCC version:     $($(tc-getCC) -v 2>&1 | grep ' version ' | awk '{ print $3 }')"
+	is_ada && einfo "GNAT version:    $(${GNAT} 2>&1 | grep GNAT | awk '{ print $2 }')"
+	is_d && einfo "GDC version:     $(${GDC} -v 2>&1 | grep ' version ' | awk '{ print $3 }')"
+
 	echo
 
 	# Build in a separate build tree
@@ -1629,7 +1909,7 @@ gcc_do_filter_flags() {
 	declare -A l1_cache_sizes=()
 	# Workaround for inconsistent cache sizes on hybrid P/E cores
 	# See PR111768 (and bug #904426, bug #908523, and bug #915389)
-	if [[ ${CBUILD} == @(x86_64|i?86)* ]] && [[ ${CFLAGS} == *-march=native* ]] && tc-is-gcc ; then
+	if [[ ${CBUILD} == @(x86_64|i?86)* ]] && [[ "${CFLAGS}${CXXFLAGS}" == *-march=native* ]] && tc-is-gcc ; then
 		local x
 		local l1_cache_size
 		# Iterate over all cores and find their L1 cache size
@@ -1695,6 +1975,7 @@ gcc_do_filter_flags() {
 		CFLAGS="-O2 -pipe"
 		FFLAGS=${CFLAGS}
 		FCFLAGS=${CFLAGS}
+		GDCFLAGS=${CFLAGS}
 
 		# "hppa2.0-unknown-linux-gnu" -> hppa2_0_unknown_linux_gnu
 		local VAR="CFLAGS_"${CTARGET//[-.]/_}
@@ -1834,18 +2115,38 @@ gcc_do_make() {
 		# using not-O0 is just a build-time speed improvement anyway.
 		if ! tc-is-gcc || ver_test $(gcc-fullversion) -lt 10 ; then
 			STAGE1_CFLAGS="-O0"
+			STAGE1_CXXFLAGS="-O0"
+		# We have a very good host compiler but it may be a bit too good, and
+		# know about flags that the version we are compiling does not know
+		# about. In principle we could check e.g. which gnat1 we are using as
+		# a bootstrap. It's simpler to do it unconditionally for now.
+		elif _tc_use_if_iuse ada || _tc_use_if_iuse d; then
+			STAGE1_CFLAGS="-O2"
+			STAGE1_CXXFLAGS="-O2"
 		fi
 
 		# We only want to use the system's CFLAGS if not building a
 		# cross-compiler.
 		STAGE1_CFLAGS=${STAGE1_CFLAGS-"$(get_abi_CFLAGS ${TARGET_DEFAULT_ABI}) ${CFLAGS}"}
+		# multilib.eclass lacks get_abi_CXXFLAGS (bug #940501)
+		STAGE1_CXXFLAGS=${STAGE1_CXXFLAGS-"$(get_abi_CFLAGS ${TARGET_DEFAULT_ABI}) ${CXXFLAGS}"}
 		STAGE1_LDFLAGS=${STAGE1_LDFLAGS-"${abi_ldflags} ${LDFLAGS}"}
 		BOOT_CFLAGS=${BOOT_CFLAGS-"$(get_abi_CFLAGS ${TARGET_DEFAULT_ABI}) ${CFLAGS}"}
 		BOOT_LDFLAGS=${BOOT_LDFLAGS-"${abi_ldflags} ${LDFLAGS}"}
 		LDFLAGS_FOR_TARGET="${LDFLAGS_FOR_TARGET:-${LDFLAGS}}"
 
+		# If we need to in future, we could really simplify this
+		# to just be unconditional for stage1. It doesn't really
+		# matter there. If we want to go in the other direction
+		# and make this more conditional, we could check if
+		# the bootstrap compiler is < GCC 12. See bug #940470.
+		if _tc_use_if_iuse d && use hardened ; then
+			STAGE1_CXXFLAGS+=" -U_GLIBCXX_ASSERTIONS"
+		fi
+
 		emakeargs+=(
 			STAGE1_CFLAGS="${STAGE1_CFLAGS}"
+			STAGE1_CXXFLAGS="${STAGE1_CXXFLAGS}"
 			STAGE1_LDFLAGS="${STAGE1_LDFLAGS}"
 			BOOT_CFLAGS="${BOOT_CFLAGS}"
 			BOOT_LDFLAGS="${BOOT_LDFLAGS}"
@@ -1863,18 +2164,6 @@ gcc_do_make() {
 	pushd "${WORKDIR}"/build >/dev/null || die
 	emake "${emakeargs[@]}" ${GCC_MAKE_TARGET}
 
-	if is_ada; then
-		# Without these links, it is not getting the good compiler
-		# TODO: Need to check why
-		ln -s gcc ../build/prev-gcc || die
-		ln -s ${CHOST} ../build/prev-${CHOST} || die
-
-		# Building standard ada library
-		emake -C gcc gnatlib-shared
-		# Building gnat toold
-		emake -C gcc gnattools
-	fi
-
 	if ! is_crosscompile && _tc_use_if_iuse cxx && _tc_use_if_iuse doc ; then
 		if type -p doxygen > /dev/null ; then
 			cd "${CTARGET}"/libstdc++-v3/doc || die
@@ -1929,8 +2218,10 @@ toolchain_src_test() {
 	(
 		# Workaround our -Wformat-security default which breaks
 		# various tests as it adds unexpected warning output.
-		GCC_TESTS_CFLAGS+=" -Wno-format-security -Wno-format"
-		GCC_TESTS_CXXFLAGS+=" -Wno-format-security -Wno-format"
+		if tc_version_is_at_least 13 ; then
+			GCC_TESTS_CFLAGS+=" -Wno-format-security -Wno-format"
+			GCC_TESTS_CXXFLAGS+=" -Wno-format-security -Wno-format"
+		fi
 
 		# Workaround our -Wtrampolines default which breaks
 		# tests too.
@@ -1940,8 +2231,10 @@ toolchain_src_test() {
 		GCC_TESTS_LDFLAGS+=" -Wl,--no-warn-execstack"
 		# Avoid confusing tests like Fortran/C interop ones where
 		# CFLAGS are used.
-		GCC_TESTS_CFLAGS+=" -Wno-complain-wrong-lang"
-		GCC_TESTS_CXXFLAGS+=" -Wno-complain-wrong-lang"
+		if tc_version_is_at_least 13 ; then
+			GCC_TESTS_CFLAGS+=" -Wno-complain-wrong-lang"
+			GCC_TESTS_CXXFLAGS+=" -Wno-complain-wrong-lang"
+		fi
 
 		# Issues with Ada tests:
 		# gnat.dg/align_max.adb
@@ -2135,7 +2428,7 @@ toolchain_src_install() {
 	cd "${D}"${BINPATH} || die
 	# Ugh: we really need to auto-detect this list.
 	#      It's constantly out of date.
-	for x in cpp gcc gccrs g++ c++ gcov g77 gfortran gccgo gnat* ; do
+	for x in cpp gcc gccrs g++ c++ gcov gdc g77 gfortran gccgo gnat* ; do
 		# For some reason, g77 gets made instead of ${CTARGET}-g77...
 		# this should take care of that
 		if [[ -f ${x} ]] ; then
@@ -2275,7 +2568,7 @@ toolchain_src_install() {
 	pax-mark -r "${ED}/libexec/gcc/${CTARGET}/${GCC_CONFIG_VER}/cc1"
 	pax-mark -r "${ED}/libexec/gcc/${CTARGET}/${GCC_CONFIG_VER}/cc1plus"
 
-	if use test ; then
+	if [[ -n ${TOOLCHAIN_HAS_TESTS} ]] && use test ; then
 		mkdir "${T}"/test-results || die
 		cd "${WORKDIR}"/build || die
 		find . -name \*.sum -exec cp --parents -v {} "${T}"/test-results \; || die
@@ -2434,7 +2727,7 @@ create_revdep_rebuild_entry() {
 #---->> pkg_pre* <<----
 
 toolchain_pkg_preinst() {
-	if [[ ${MERGE_TYPE} != binary ]] && use test ; then
+	if [[ -n ${TOOLCHAIN_HAS_TESTS} && ${MERGE_TYPE} != binary ]] && use test ; then
 		# Install as orphaned to allow comparison across more versions even
 		# after unmerged. Also useful for historical records and tracking
 		# down regressions a while after they first appeared, but were only
diff --git a/sdk_container/src/third_party/portage-stable/eclass/xdg.eclass b/sdk_container/src/third_party/portage-stable/eclass/xdg.eclass
index 6af4b91875f..2e16a438d84 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/xdg.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/xdg.eclass
@@ -45,8 +45,6 @@ case ${EAPI} in
 			default
 		}
 
-		EXPORT_FUNCTIONS src_prepare
-
 		DEPEND="${_XDG_DEPEND}"
 		;;
 	*)
@@ -131,4 +129,12 @@ xdg_pkg_postrm() {
 
 fi
 
+case ${EAPI} in
+	6|7)
+		EXPORT_FUNCTIONS src_prepare
+		;;
+	*)
+		;;
+esac
+
 EXPORT_FUNCTIONS pkg_preinst pkg_postinst pkg_postrm
diff --git a/sdk_container/src/third_party/portage-stable/licenses/MikroTik b/sdk_container/src/third_party/portage-stable/licenses/MikroTik
new file mode 100644
index 00000000000..5551d6c0743
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/licenses/MikroTik
@@ -0,0 +1,372 @@
+MIKROTIKLS MIKROTIK SOFTWARE END-USER LICENCE AGREEMENT
+
+Export Eligibility Requirements
+
+By downloading any files from mikrotik.com, you agree to the following:
+
+1. You, hereby undersigned, are aware and acknowledge that the products,
+   all hardware, software and/or technology (collectively -"Products")
+   purchased, obtained from “Mikrotīkls” Ltd. (In Latvian: SIA
+   “Mikrotīkls”) a company registered in Latvia (14.03.1996., reg. No.
+   40003286799) or its affiliates are subject to the sanctions imposed by
+   European Union (EU), United Nations (UN), by USA (e.g., The Office of
+   Foreign Assets Control of United States of America (OFAC)) or by another
+   international organization, to which the Republic of Latvia is a member
+   state, hereinafter – International Organization, and set by binding
+   national and international laws on export control and economic sanctions,
+   restrictions and/or set by the binding regulation on prevention of money
+   laundering and terrorism financing.
+2. You may not --directly or indirectly-- make available, provide, sell,
+   export, reexport, transfer, divert, or otherwise dispose of any Products to
+   any destination, entity, or person prohibited by the laws or regulations of
+   the European Union (EU), United Nations (UN) and USA. EU sanctions and
+   restrictions are based on Article 215 TFEU (Treaty on the Functioning of
+   the European Union) and decisions adopted in the framework of the Common
+   Foreign and Security Policy and these restrictions includes but are not
+   limited to such countries and subjects as Burundi, Central African
+   Republic, Democratic Republic of the Congo, Guinea, Iran (it is prohibited
+   to export equipment or software intended for use in the monitoring or
+   interception by the Iranian regime of the Internet and of telephone
+   communications in Iran), Libya, North Korea, Somalia, Sudan, Syria, Crimea
+   and Sevastopol (in response to the illegal annexation of Crimea and
+   Sevastopol), Russian Federation, non-government controlled areas of Ukraine
+   in the oblasts of Donetsk, Kherson, Luhansk and Zaporizhzhia (in response
+   of Russia’s escalating war of aggression against Ukraine to the illegal
+   annexation of these territories), Republic of Belarus, Venezuela and/or
+   organizations, entities, persons specified and listed in the directives,
+   Council decisions and regulation. Sanction regimes established by the
+   national, USA and/or other International Organizations may
+   expand/supplement states, persons and/or entities determined by the EU
+   binding regulation. More information could be obtained:
+   https://www.sanctionsmap.eu/#/main https://sanctionssearch.ofac.treas.gov/
+   https://scsanctions.un.org/consolidated/
+3. By accepting these Export eligibility requirements and acknowledge of
+   trade compliance You assure that You or Your affiliated parties will not
+   directly or indirectly export, re-export, transfer or release, make
+   available any Products and/or any support related to the Products thereof
+   to any destination, person, entity or end use prohibited or restricted
+   under above described laws and imposed sanctions, restrictive measures
+   without prior authorization of corresponding authorities required by
+   regulation.
+4. You acknowledge that other countries may have trade laws pertaining to
+   the export, import, use, or distribution of Products, and that compliance
+   with same is the responsibility of You. These Export eligibility
+   requirements and acknowledgment of trade compliance shall survive the
+   expiration or termination of any license agreements signed by You in
+   connection with Products.
+5. By accepting these Export eligibility requirements and acknowledge of
+   trade compliance hereby declare that You have been informed and warned
+   about Export eligibility requirements and acknowledge of trade compliance
+   and You are liable for following its rules in good faith.
+6. Moreover by downloading any files from mikrotik.com, you agree to the
+   following:You are not a citizen, national or resident of, and are not under
+   the control of, the government of any country to which the United States,
+   European Union, Latvia or United Nations has prohibited export of technical
+   information, such as : Cuba, Iran, Libya, North Korea, Sudan, Syria,
+   Russian Federation, or Republic of Belarus. You will not download or
+   otherwise export or re-export the software, directly or indirectly, to the
+   above-prohibited countries nor to citizens, national or residents of those
+   countries. You are not listed on the United States Department of Treasury
+   list, list of European Union, Latvia or United Nations of Specially
+   Designated Nationals, Specially Designated Terrorists, and Specially
+   Designated Narcotics Traffickers, nor are you listed on the United States
+   Department of Commerce Table of Denial Orders. You will not download or
+   otherwise export or re-export the software, directly or indirectly, to
+   persons on the above-mentioned lists. You will not use the software for,
+   and will not allow the software to be used for, any purposes prohibited by
+   law of European Union (EU), United Nations (UN), by USA (e.g., The Office
+   of Foreign Assets Control of United States of America (OFAC)) or by another
+   international organization, to which the Republic of Latvia is a member
+   state , including, without limitation, for the development, design,
+   manufacture or production of nuclear, chemical, or biological weapons of
+   mass destruction.
+
+MIKROTIKLS MIKROTIK SOFTWARE END-USER LICENCE AGREEMENT
+
+MIKROTIK ROUTEROS SOFTWARE ROUTER SYSTEM
+
+This End-User License Agreement ("License Agreement") is a binding agreement
+between you (either an individual or a single entity) and MikroTikls SIA
+("MikroTikls" or "MikroTik"), which is the manufacturer of the SOFTWARE
+PRODUCT ("SOFTWARE PRODUCT" or "SOFTWARE") identified above. HARDWARE refers
+as the computer, which the Software Product is installed on. Any software
+provided along with the SOFTWARE PRODUCT that is associated with a separate
+end-user License Agreement is licensed to you under the terms of that License
+Agreement. The term SOFTWARE or SOFTWARE PRODUCT does not include the software
+listed after point 12 of this document that is under the GNU General Public
+License or other free software licenses listed after point 12 of this document.
+
+By opening or installing SOFTWARE PRODUCT MikroTik RouterOS you indicate that
+you agree with terms of this agreement, if you do not agree with the terms of
+this agreement, do not open the diskette package and do not install or use the
+software, instead, return the unopened package of the SOFTWARE including
+manuals, documentation, or written materials that are associated with this
+program to the place where you obtained them for full refund and delete all
+electronic copies of the SOFTWARE and documentation.
+
+1. GRANT OF LICENSE
+
+If you purchased a base license of the SOFTWARE PRODUCT you are granted a
+non-exclusive license to use the SOFTWARE PRODUCT and accompanying
+Documentation according to the contents of this License herein:
+
+a. SOFTWARE Installation and Use.
+
+   You may only install and use one copy of the SOFTWARE on the Computer.
+
+b. Back-up Copy.
+
+   You may make a single back-up copy of the SOFTWARE PRODUCT. You may use the
+   back-up copy solely for archival purposes. Except as expressly provided in
+   this License Agreement, you may not otherwise make copies of the SOFTWARE
+   PRODUCT, including the printed materials accompanying the SOFTWARE.
+
+2. DESCRIPTION OF OTHER RIGHTS AND LIMITATIONS
+
+a. You may not:
+   * permit other individuals to use the SOFTWARE except under the terms
+     listed in Article 1 "Grant of License" above;
+   * modify, translate, reverse engineer, decompile, disassemble (except
+     to the extent applicable laws specifically prohibit such restriction), or
+     create derivative works based on the Software;
+   * copy the Software; or
+   * remove any proprietary notices or labels on the Software.
+
+b. SOFTWARE PRODUCT Transfer.
+
+   You may permanently transfer all of your rights under this License
+   Agreement only as part of a permanent sale or transfer of the HARDWARE,
+   provided you retain no copies, you transfer all of the SOFTWARE PRODUCT
+   (including all component parts, the media and printed materials, any
+   upgrades, this License Agreement and, if applicable, the Certificate(s) of
+   Authenticity), and the recipient agrees to the terms of this License
+   Agreement. If the SOFTWARE PRODUCT is an upgrade, any transfer must also
+   include all prior versions of the SOFTWARE PRODUCT.
+
+c. Termination.
+
+   Without prejudice to any other rights MikroTikls may terminate this License
+   Agreement if you fail to comply with the terms and conditions of this
+   License Agreement. In such event, you must destroy all copies of the
+   SOFTWARE PRODUCT and all of its component parts.
+
+d. Trademarks.
+
+   This License Agreement does not grant you any rights in connection with any
+   trademarks or service marks of MikroTikls or its suppliers.
+
+3. RECORDS; AUDIT
+
+Licensee shall maintain accurate records as necessary to verify compliance
+with this Agreement. Licensor may conduct one or more audits to verify such
+compliance. Audits will be conducted during normal business hours. All audits
+shall be conducted at Licensor’s expense unless the results establish that
+Licensee has underpaid Licensor by more than 5% of the amount actually due, in
+which case Licensee shall pay all amounts due and bear the expense of the
+audit.
+
+4. UPGRADE PACKAGE
+
+If the SOFTWARE PRODUCT is labeled as an upgrade package, you must be properly
+licensed to use a product identified by MikroTikls as being eligible for the
+upgrade package in order to use the SOFTWARE PRODUCT ("Eligible Product"). For
+the purpose of upgrade package products only, "HARDWARE" shall mean the
+computer system or computer system component with which you received the
+Eligible Product. A SOFTWARE PRODUCT labeled as an upgrade package replaces
+and/or supplements the Eligible Product. You may use the resulting upgraded
+product only in accordance with the terms of this License Agreement. If the
+SOFTWARE PRODUCT is an upgrade of a component of a package of SOFTWARE
+programs that you licensed as a single product, the SOFTWARE PRODUCT may be
+used and transferred only as part of that single product package and may not
+be separated for use on more than one computer.
+
+If you receive your first copy of the SOFTWARE electronically, and a second
+copy on media, the second copy may be used for archival purposes only. This
+license does not grant you any right to any enhancement, update or upgrade.
+Rights to the SOFTWARE PRODUCT will be indicated on your invoice.
+
+5. FEATURE PACKAGE
+
+If the SOFTWARE PRODUCT is labeled as a "feature package" that required
+additional purchase, you must be properly licensed to use a product identified
+by MikroTikls as being eligible for the "feature package" in order to use the
+SOFTWARE PRODUCT ("Eligible Product"). For the purpose of "feature package",
+products only, "HARDWARE" shall mean the computer system or computer system
+component with which you received the Eligible Product. A SOFTWARE PRODUCT
+labeled as "feature package" replaces and/or supplements the Eligible Product.
+You may use the resulting SOFTWARE PRODUCT only in accordance with the terms
+of this License Agreement. If the SOFTWARE PRODUCT is an "feature package" of
+a component of a package of SOFTWARE programs that you licensed as a single
+product, the SOFTWARE PRODUCT may be used and transferred only as part of that
+single product package and may not be separated for use on more than one
+computer.
+
+If you receive your first copy of the SOFTWARE electronically, and a second
+copy on media, the second copy may be used for archival purposes only. Rights
+to the SOFTWARE PRODUCT will be indicated on your invoice.
+
+6. TRIAL or DEMO VERSION
+
+If the SOFWARE PRODUCT is authorized by MikroTikls as the Trial or Demo
+version, the Rights to the SOFTWARE cannot be transferred as described in
+Article 2 (b) of this License Agreement.
+
+MikroTikls shall have no obligation to fix any defects, which arise from the
+use of Trial or Demo version program.
+
+7. COPYRIGHT
+
+All title and intellectual property rights in and to the SOFTWARE PRODUCT,
+accompanying printed materials, and any copies of the SOFTWARE PRODUCT, are
+owned by MikroTikls or its suppliers. You may not copy the printed materials
+accompanying the SOFTWARE PRODUCT. All rights not expressly granted under this
+License Agreement are reserved by MikroTikls SIA and its suppliers.
+
+The SOFTWARE PRODUCT is protected by US copyright laws and international
+copyright treaties, as well as other intellectual property laws and treaties.
+The SOFTWARE PRODUCT is licensed, not sold.
+
+8. DUAL-MEDIA SOFTWARE PRODUCT.
+
+You may receive the SOFTWARE PRODUCT in more than one medium. Regardless of
+the type or size of medium you receive, you may use only one medium that is
+appropriate for the Computer. You may not use or install the other medium on
+another computer. You may not loan, rent, lease, lend or otherwise transfer
+the other medium to another user, except as part of the permanent transfer (as
+provided above) of the SOFTWARE PRODUCT.
+
+9. LIMITED WARRANTY
+
+MikroTikls warrants that for a period of ninety (90) days from the days of
+acquisition, the Software, if operated as directed, will substantially achieve
+the functionality described in the Documentation. MikroTikls does not warrant,
+however, that your use of the SOFTWARE will be uninterrupted or that the
+operation of the SOFTWARE will be error-free or secure and hereby disclaims
+any and all liability on account thereof. In addition, the security mechanisms
+implemented by the SOFTWARE have inherent limitations, and you must determine
+that the SOFTWARE sufficiently meets your requirements.
+
+MikroTikls also warrants that the media containing the Software, if provided
+by MikroTikls, is free from defects in material and workmanship and will so
+remain for (90) days from the date you acquired the Software. MikroTikls’
+sole liability for any breach of this warranty shall be, in MikroTikls’ sole
+discretion:
+
+a. to replace your defective media; or
+b. to advise you how to achieve substantially the same functionality with
+   the SOFTWARE as described in the Documentation; or
+c. if the above remidies are impracticable, to refund the license fee you
+   paid for the Software. Repaired, corrected, or replaced SOFTWARE and
+   Documentation shall be covered by this limited warranty for the period
+   under the warranty that covered the original SOFTWARE or if longer, for
+   thirty (30) days after the date (a) of shipment to you of the repaired or
+   replaced Software, or (b) MikroTikls advised you how to operate the
+   SOFTWARE so as to achieve the functionality described in the Documentation.
+   Only if you inform MikroTikls of your problem with the SOFTWARE during the
+   applicable warranty period and provide evidence of the date you acquired
+   the SOFTWARE will MikroTikls be obligated to honor this warranty.
+   MikroTikls will use reasonable commercial efforts to repair, replace,
+   advise, or refund pursuant to foregoing warranty within 30 days of being so
+   notified.
+
+THIS IS A LIMITED WARRANTY AND IT IS THE ONLY WARRANTY MADE BY MIKROTIKLS.
+MIKROTIKLS MAKES NO OTHER EXPRESS WARRANTY AND NO WARRANTY OR CONDITION OF
+NONINFRIGEMENT OF THIRD PARTIES’ RIGHTS. THE DURATION OF IMPLIED WARRANTIES,
+INCLUDING WITHOUT LIMITATION, WARRANTIES OF MERCHANTABILITY AND OF FITNESS FOR
+A PARTICULAR PURPOSE, IS LIMITED TO THE ABOVE LIMITED WARRANTY PERIOD; SOME
+STATES DO NOT ALLOW LIMITATIONS ON HOW LONG AN IMPLIED WARRANTY LASTS, SO
+THESE LIMITATIONS MAY NOT APPLY TO YOU, NO MIKROTIKLS DEALER, AGENT, OR
+EMPLOYEE IS AUTHORIZED TO MAKE ANY MODIFICATIONS, EXTENSIONS, OR ADDITIONS TO
+THIS WARRANTY. If any modifications are made to the SOFTWARE by you during the
+warranty period; if the media is subjected to accident, abuse, or improper
+use; or if you violate the terms of this Agreement, then this warranty shall
+immediately be terminated. This warranty shall not apply if the SOFTWARE is
+used on or in conjunction with hardware or SOFTWARE other than the unmodified
+version of hardware and SOFTWARE with which the SOFTWARE was designed to be
+used as described in the Documentation.
+
+THIS WARRANTY GIVES YOU SPECIFIC LEGAL RIGHTS, AND YOU MAY HAVE OTHER LEGAL
+RIGHTS THAT VARY FROM STATE TO STATE OR BY JURISDICTION.
+
+10. LIMITATION OF LIABILITY
+
+UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL THEORY, TORT, CONTRACT, OR
+OTHERWISE, SHALL MIKROTIKLS OR ITS SUPPLIERS OR RESELLERS BE LIABLE TO YOU OR
+ANY OTHER PERSON FOR ANY INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES OF ANY CHARACTER INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF
+GOODWILL, WORK STOPPAGE, COMPUTER FAILURE OR MALFUNCTION, OR ANY AND ALL OTHER
+COMMERCIAL DAMAGES OR LOSSES, OR FOR ANY DAMAGES IN EXCESS OF MIKROTIKLS’
+LIST PRICE FOR A LICENSE TO THE SOFTWARE AND DOCUMENTATION, EVEN IF MIKROTIKLS
+SHALL HAVE BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGES, OR FOR ANY CLAIM
+BY ANY OTHER PARTY. THIS LIMITATION OF LIABILITY SHALL NOT APPLY TO LIABILITY
+FOR DEATH OR PERSONAL INJURY TO THE EXTENT APPLICABLE LAW PROHIBITS SUCH
+LIMITATION. FURTHERMORE, SOME STATES DO NOT ALLOW THE EXCLUSION ORLIMITATION
+OF INCIDENTAL OR CONSEQUENTAL DAMAGES, SO THIS LIMITATION AND EXCLUSION MAY
+NOT APPLY TO YOU.
+
+EXPORT REQUIREMENTS
+
+You may not export or re-export the Software or any copy or adaptation in
+violation of any applicable laws or regulations.
+
+12. MISCELLANEOUS
+
+This Agreement represents the complete agreement concerning this license
+between the parties and supersedes all prior agreements and representations
+between them. It may be amended only by writing executed by both parties. If
+any provision of this Agreement is held to be unenforceable for any reason,
+such provision shall be reformed only to the extent necessary to make it
+enforceable.
+
+For license obligations below that require Mikrotikls to provide source code
+or other license obligations, you should contact Mikrotikls by mail at the
+following address:
+MikroTikls SIA
+attn: license compliance
+Ūnijas iela 2
+LV-1039, Riga
+LATVIA
+
+For license obligations below that require responses by email, you should
+contact Mikrotikls SIA at: mt@mikrotik.com
+
+For license obligations below that require responses by telephone or fax, you
+should contact Mikrotikls SIA at: telephone +371 7317700, fax +371 7317701
+
+To get a CD with the corresponding source code for the GPL-covered programs in
+this distribution, wire transfer $45 to MikroTikls SIA, Ūnijas iela 2, Riga,
+LV-1039, Latvia. Please contact MikroTikls SIA for our current account
+information and wire transfer instructions. Offer valid for three years from
+the date of distribution of this software. This CD will only include the
+source code of the following programs and any non-proprietary programs
+distributed according to license requirements. This CD will not include
+MikroTikls proprietary SOFTWARE.
+
+The following list may or may not include all of the GNU/GPL software that is
+included in the distribution. This list is not part of the GNU/GPL license
+obligations. For GNU/GLP license obligations, you must follow the GNU/GPL
+license procedures.
+
+Package name License URL e2fsprogs GPL http://e2fsprogs.sourceforge.net/
+linux kernel GPL http://www.kernel.org/
+OpenSSL OpenSSL (BSD) http://www.openssl.org/
+ppp PPP (BSD) ftp://metalab.unc.edu/pub/Linux/system/network/serial/ppp
+racoon Raccon (BSD) http://www.kame.net/
+SGI STL STL http://www.sgi.com/tech/stl/
+OpenSSH OpenSSH http://www.openssh.org/
+SYSLINUX GPL http://syslinux.zytor.com/
+expat expat http://expat.sourceforge.net/
+libsvg LGPL http://cairographics.org/libsvg
+libsvg-cairo LGPL http://cairographics.org/libsvg-cairo
+cairo MPL http://cairographics.org/
+fontconfig Fontconfig http://www.fontconfig.org/wiki/
+freetype Freetype http://www.freetype.org/
+net-snmp Net-snmp http://net-snmp.sourceforge.net/
+libcroco LGPL http://www.freespiders.org/projects/libcroco/
+pango LGPL http://www.pango.org/
+librsvg LGPL http://librsvg.sourceforge.net/
+glib LGPL http://www.gtk.org/
+gtk+ LGPL http://www.gtk.org/
+ZeroTier ZeroTier BSL https://www.zerotier.com/
+
+This software is based in part on the work of the Independent JPEG Group jpeg
diff --git a/sdk_container/src/third_party/portage-stable/media-libs/libpng/Manifest b/sdk_container/src/third_party/portage-stable/media-libs/libpng/Manifest
index 94f9732bfc6..17ef60db1f6 100644
--- a/sdk_container/src/third_party/portage-stable/media-libs/libpng/Manifest
+++ b/sdk_container/src/third_party/portage-stable/media-libs/libpng/Manifest
@@ -4,3 +4,5 @@ DIST libpng-1.6.40.tar.xz 1021332 BLAKE2B 4dd2df57791ca68cc31ba966b9176ecb374585
 DIST libpng-1.6.42.tar.xz 1035484 BLAKE2B 8a8895b673ff90416a00c9ff775d7bdc38ab1ab0d83fd6e70cfffea2ed78bd42896950a64bf48ad9a00ea50d8c5d5702975b0bae7bb3300d4de4c82b334e513e SHA512 a9e8641f79ebc811e8e1e94c4966737f8d0f3aef33c86834c419ca76050567891c065899c3bc0c945c59b5d50c5ff7d693cc51089d06efe92e71ae8014fa157c
 DIST libpng-1.6.43-apng-apng.patch.gz 10333 BLAKE2B 11bc92064e52f8a045b9d2a7158808471faf3e94b08dceae6aa5cfef635731ef3740e69b27118b9a5b2f2d3b810f108b8c30192388c569de1371f34a5f49f592 SHA512 3a3320c682fe8a575e76e9ede0a2d2d62533cbb206b428bfdf2729c649aaf3061b21e55c1d8848d474e40615b4e9870d49927b14de237777135524f904bac36c
 DIST libpng-1.6.43.tar.xz 1044076 BLAKE2B e8781001f001e6f514ca01ceafc51557e6cdedcbed3aa64df213d02635eec937cac4ccc0f34b636f582a7d141b67ec6c8d90a6ffb15c679ab0c3f4f8798be791 SHA512 c95d661fed548708ce7de5d80621a432272bdfe991f0d4db3695036e5fafb8a717b4e4314991bdd3227d7aa07f8c6afb6037c57fa0fe3349334a0b6c58268487
+DIST libpng-1.6.44-apng-apng.patch.gz 10336 BLAKE2B 3c78cadd08b48466eee7c271ec82649dab55f28977622128c78764257a3f53e3255ddb1d728f10cb457b4db314566fe54b7edc88ab68b3dd1a8310bda500ab4f SHA512 5b8502abd3fad84772136a9eea53a918f806ef7035fe6df5d2b631a5279f298b9f125922d5aab7306e7c7aa1445ac9e36072e22fab4005d20662232078187f3c
+DIST libpng-1.6.44.tar.xz 1045640 BLAKE2B 61064dd83f40a7e2e60ff723a568b7d0cda95aa80621a211aee7127b9783fbfc20cd82a2fe2d03584cbf9ab77c5444e3e008ac5ccc7f64af6e858ebcbcb78822 SHA512 bbd3e5e68d8b6fe3d85e59ca0babe8b522c19cac4b6ce0fcf21516cda7120b642be611eb1eaa565b7eabbacd22606593619aabd227b43a36f1efc707e7e11851
diff --git a/sdk_container/src/third_party/portage-stable/media-libs/libpng/libpng-1.6.44.ebuild b/sdk_container/src/third_party/portage-stable/media-libs/libpng/libpng-1.6.44.ebuild
new file mode 100644
index 00000000000..b5669bf7bc5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/media-libs/libpng/libpng-1.6.44.ebuild
@@ -0,0 +1,69 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit libtool multilib-minimal
+
+APNG_REPO=apng # sometimes libpng-apng is more up to date
+APNG_VERSION="1.6.44"
+DESCRIPTION="Portable Network Graphics library"
+HOMEPAGE="http://www.libpng.org/"
+SRC_URI="
+	https://downloads.sourceforge.net/${PN}/${P}.tar.xz
+	apng? (
+		https://downloads.sourceforge.net/${APNG_REPO}/${PN}$(ver_rs 1-2 '' $(ver_cut 1-2 ${APNG_VERSION}))/${PV}/${PN}-${APNG_VERSION}-apng.patch.gz -> ${PN}-${APNG_VERSION}-${APNG_REPO}-apng.patch.gz
+		https://downloads.sourceforge.net/${APNG_REPO}/${PN}$(ver_rs 1-2 '' $(ver_cut 1-2 ${APNG_VERSION}))/${PN}-${APNG_VERSION}-apng.patch.gz -> ${PN}-${APNG_VERSION}-${APNG_REPO}-apng.patch.gz
+	)
+"
+
+LICENSE="libpng2"
+SLOT="0/16"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="apng cpu_flags_x86_sse static-libs test"
+RESTRICT="!test? ( test )"
+
+RDEPEND=">=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}]"
+DEPEND="${RDEPEND}"
+
+DOCS=( ANNOUNCE CHANGES libpng-manual.txt README TODO )
+
+src_prepare() {
+	default
+
+	if use apng; then
+		case ${APNG_REPO} in
+			apng)
+				eapply -p0 "${WORKDIR}"/${PN}-${APNG_VERSION}-${APNG_REPO}-apng.patch
+				;;
+			libpng-apng)
+				eapply "${WORKDIR}"/${PN}-${APNG_VERSION}-${APNG_REPO}-apng.patch
+				;;
+			*)
+				die "Unknown APNG_REPO!"
+				;;
+		esac
+
+		# Don't execute symbols check with apng patch, bug #378111
+		sed -i -e '/^check/s:scripts/symbols.chk::' Makefile.in || die
+	fi
+
+	elibtoolize
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		$(multilib_native_enable tools)
+		$(use_enable test tests)
+		$(use_enable cpu_flags_x86_sse intel-sse)
+		$(use_enable static-libs static)
+	)
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_install_all() {
+	default
+
+	find "${ED}" \( -type f -o -type l \) -name '*.la' -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-analyzer/tcpdump/tcpdump-4.99.5.ebuild b/sdk_container/src/third_party/portage-stable/net-analyzer/tcpdump/tcpdump-4.99.5.ebuild
index 15b4ace7bf1..e53d68ee242 100644
--- a/sdk_container/src/third_party/portage-stable/net-analyzer/tcpdump/tcpdump-4.99.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-analyzer/tcpdump/tcpdump-4.99.5.ebuild
@@ -19,7 +19,7 @@ else
 	SRC_URI="https://www.tcpdump.org/release/${P}.tar.gz"
 	SRC_URI+=" verify-sig? ( https://www.tcpdump.org/release/${P}.tar.gz.sig )"
 
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+	KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
 fi
 
 LICENSE="BSD"
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.33.1.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.33.1.ebuild
index 6f65e746ad8..ecba26692fe 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.33.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.33.1.ebuild
@@ -18,7 +18,7 @@ SRC_URI="
 LICENSE="MIT ISC"
 # Subslot = SONAME of libcares.so.2
 SLOT="0/2"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="static-libs test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/ipset/ipset-7.22-r2.ebuild b/sdk_container/src/third_party/portage-stable/net-firewall/ipset/ipset-7.22-r2.ebuild
index 5024380e128..32d9e672f9d 100644
--- a/sdk_container/src/third_party/portage-stable/net-firewall/ipset/ipset-7.22-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-firewall/ipset/ipset-7.22-r2.ebuild
@@ -12,7 +12,7 @@ SRC_URI="https://ipset.netfilter.org/${P}.tar.bz2"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 arm ~arm64 ~loong ~ppc ppc64 ~riscv x86"
 
 RDEPEND="
 	net-firewall/iptables
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.7.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.7.1-r1.ebuild
index b1b106f61b4..7f52575c0f3 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.7.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.7.1-r1.ebuild
@@ -21,7 +21,7 @@ LICENSE="GPL-3 LGPL-2.1+"
 # Subslot format:
 # <libgnutls.so number>.<libgnutlsxx.so number>
 SLOT="0/30.30"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="brotli +cxx dane doc examples +idn nls +openssl pkcs11 seccomp sslv2 sslv3 static-libs test test-full +tls-heartbeat tools zlib zstd"
 REQUIRED_USE="test-full? ( cxx dane doc examples idn nls openssl pkcs11 seccomp tls-heartbeat tools )"
 RESTRICT="!test? ( test )"
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/Manifest b/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/Manifest
index 8d9c5aa0e0b..b0571a68ed3 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/Manifest
@@ -2,3 +2,5 @@ DIST libnftnl-1.2.6.tar.xz 336684 BLAKE2B a08010b26db0c7a5429f33a92ca4f17e8e1580
 DIST libnftnl-1.2.6.tar.xz.sig 566 BLAKE2B 8ad336d0d8c693beb6335e874ad62040257e0c4527f8acb32fcc8b4889eea88ba3a42c9b2b795db6f6e3d148066ee0a9217b1e30c7e784c793458dd480ee624a SHA512 61288aa03fb80d43d09866ce549815202f682b30b283cf3119ced0fe59536d10f1c029e433651d1cb31115e977b660886a153f3361f5cafdbb0ed6da602e5b2f
 DIST libnftnl-1.2.7.tar.xz 343876 BLAKE2B 42decbfdfce07c4743e7a55cf3d5d03a244ab6ac5e0f33107322ab44edcc96d360ac02f0376786656a5f7d43986499474e20a5b835f838e06d12efb017dd8eb4 SHA512 24ff3e7e97f51cb5dfda2fbd2f5e175abcec0dd58f94936022800ec356ff004a531f0915df72278b867769ba71473d407b01d52cc33a3cafb043d9a90b051f9d
 DIST libnftnl-1.2.7.tar.xz.sig 566 BLAKE2B ad79b0a149d37c0ae32bcf8c64b34e02146242ce731f6860bd8d63d90e96a58e04616d543783b8edc13a0f2ca6286c16c9d8b17c34d8e8920f680a17ee70bde0 SHA512 8bf9188a287850a5057be452541871af69187c4dacde580c57be15e7f3357ab4a874745f326880260e2c2b1486e59b684db41b0d8afd57bab9d77ad62ba052bd
+DIST libnftnl-1.2.8.tar.xz 343732 BLAKE2B 274fcdd9c7c0de173e9b2b35d79613e3f6f41d56a9223145d87f93d4f7c0bb085fd622581ecc69f248be4641874fd60b294ebf12cb4d4ed1ceea9b410ef70187 SHA512 c57030f34c50b09ae2fbf8dac5d9cf431eaaa5a5a08098e3e4c146a8bd4ae9b7753f5d2de5f2d0a6c15e5ba0c39f51275c9d8b03bdedeaadbafa6c96f9a972b6
+DIST libnftnl-1.2.8.tar.xz.sig 566 BLAKE2B 2c8eae671d41f84b1ded96f7dc98e214a240cc4025265e3008b986554c2d30d830c5f15c2e4b77d0a80d889cd7a0a85403c80bc905019734611baa25575b9daf SHA512 f56a5f049dab8397f4ff84070d782f17b701b46bd42c84cb3fb2b7241a7543f0b5f2877e7d6d95fb942f36119e54c939f89af964ea08858d2c41dc9fd7323b16
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/libnftnl-1.2.8.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/libnftnl-1.2.8.ebuild
new file mode 100644
index 00000000000..9356110ea5b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/libnftnl-1.2.8.ebuild
@@ -0,0 +1,71 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/netfilter.org.asc
+inherit linux-info verify-sig
+
+DESCRIPTION="Netlink API to the in-kernel nf_tables subsystem"
+HOMEPAGE="https://netfilter.org/projects/nftables/"
+
+if [[ ${PV} =~ ^[9]{4,}$ ]]; then
+	inherit autotools git-r3
+	EGIT_REPO_URI="https://git.netfilter.org/${PN}"
+else
+	SRC_URI="
+		https://netfilter.org/projects/${PN}/files/${P}.tar.xz
+		verify-sig? ( https://netfilter.org/projects/${PN}/files/${P}.tar.xz.sig )
+	"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+
+	BDEPEND+="verify-sig? ( sec-keys/openpgp-keys-netfilter )"
+fi
+
+LICENSE="GPL-2"
+SLOT="0/11" # libnftnl.so version
+IUSE="examples static-libs test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=net-libs/libmnl-1.0.4:=
+"
+BDEPEND+="
+	virtual/pkgconfig
+"
+DEPEND="${RDEPEND}"
+
+pkg_setup() {
+	if kernel_is ge 3 13; then
+		CONFIG_CHECK="~NF_TABLES"
+		linux-info_pkg_setup
+	else
+		eerror "This package requires kernel version 3.13 or newer to work properly."
+	fi
+}
+
+src_prepare() {
+	default
+
+	[[ ${PV} =~ ^[9]{4,}$ ]] && eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		$(use_enable static-libs static)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	find "${ED}" -type f -name '*.la' -delete || die
+
+	if use examples; then
+		find examples/ -name 'Makefile*' -delete || die "Could not rm examples"
+		dodoc -r examples
+		docompress -x /usr/share/doc/${PF}/examples
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/libpcap/libpcap-1.10.5.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/libpcap/libpcap-1.10.5.ebuild
index 0a04d901eec..4af913a9f68 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/libpcap/libpcap-1.10.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/libpcap/libpcap-1.10.5.ebuild
@@ -18,7 +18,7 @@ else
 	SRC_URI="https://www.tcpdump.org/release/${P}.tar.gz"
 	SRC_URI+=" verify-sig? ( https://www.tcpdump.org/release/${P}.tar.gz.sig )"
 
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+	KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
 fi
 
 # The project itself has COPYING with BSD, but the files used for
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/libpsl/libpsl-0.21.5.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/libpsl/libpsl-0.21.5.ebuild
index 138bdbb9516..797883568aa 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/libpsl/libpsl-0.21.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/libpsl/libpsl-0.21.5.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 inherit meson-multilib python-any-r1
 
 DESCRIPTION="C library for the Public Suffix List"
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/chrony/chrony-4.6.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/chrony/chrony-4.6.ebuild
index b331e0bd29f..1b5cd43d8ef 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/chrony/chrony-4.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/chrony/chrony-4.6.ebuild
@@ -19,7 +19,7 @@ else
 	SRC_URI+=" verify-sig? ( https://chrony-project.org/releases/${P/_/-}-tar-gz-asc.txt -> ${P/_/-}.tar.gz.asc )"
 
 	if [[ ${PV} != *_pre* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~ppc ~ppc64 ~riscv ~sparc ~x86"
+		KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~ppc ppc64 ~riscv ~sparc x86"
 	fi
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest b/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest
index 217735387d6..792b00ecc0b 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest
@@ -1,5 +1,5 @@
-DIST curl-8.10.0.tar.xz 2729448 BLAKE2B 18b438c0e4e7b0b698a1fee16406c611124e3d137349869dd8dbb43b5ba45163c6a053e02f665e627424c96e18f8499c13ebe1eeb4c1441936d0183d28696ae6 SHA512 055277695ea242fcb0bf26ca6c4867a385cd578cd73ed4c5c4a020233248044c1ecaebcbaeaac47d3ffe07a41300ea5fc86396d7e812137cf75ed3e1b54ca5b2
-DIST curl-8.10.0.tar.xz.asc 488 BLAKE2B 2b651b074b39eb8b34bc9e46a70d4e6597f04250fc3b5c8f8c4641a022529d176179cc54d9c7dccd9b64c62f1873a7ab214705d6a724928e68b871216658a683 SHA512 3d3ece14008facc373cd715d46eeb523bb17a701df3b1839f0774847692613a9472d3e7a60ba814846bbc8e8e4f17c81a1f1355e1c9eebef244b7cd00e0f6fb8
+DIST curl-8.10.1.tar.xz 2726748 BLAKE2B bfdfa24f6d652884044c5e8eea5d70daad651b46255c99c9df502f9595a2dcbf8c4034446becf9e87f8e8a3f397a8fda29ab3e0d6020ac0dae62dd42b8136b78 SHA512 f1c7a12492dcfb8ba08be69b96a83ce9074592cbaa6b95c72b3c16fc58ad35e9f9deec7b72baca7d360d013b0b1c7ea38bd4edae464903ac67aa3c76238d8c6c
+DIST curl-8.10.1.tar.xz.asc 488 BLAKE2B 8e8f2b628d4e8964a76c1c43c5557aacbfc2d2dbc51be8a0fa1b157c257f15f29aedba842cba7cb270c4adcf0b4a5d9c8b0b3d49633c48b061fb3e1472303d66 SHA512 21d6d560c027efc9e3e5db182a77501d6376442221ba910df817e2ec980bee44a9fe2afc698205f8d5e8313ae47915a341d60206a46b46e816d73ee357a894ac
 DIST curl-8.7.1.tar.xz 2707016 BLAKE2B a2a9f48d0b69c0d92fcbbda535ce55082a5243abe3ab2db80d6fa3f32fb2c98b65026d69fc45c94e966398cf9ba8d9c95b6b91f4768b54749ed3275dd21838ef SHA512 5bbde9d5648e9226f5490fa951690aaf159149345f3a315df2ba58b2468f3e59ca32e8a49734338afc861803a4f81caac6d642a4699b72c6310ebfb1f618aad2
 DIST curl-8.7.1.tar.xz.asc 488 BLAKE2B 1c91d116aecc8e98d8ec3aad68b7c96f11151e6c2716f531e5d2989e9b6b1199e180603673891d7967cdcdaee1d6b5e15160ccabe9b51590e2887022db03c2ed SHA512 f98c393997c4a32f545a8982226e8cd612395210915a4576c2ce227d0f650cff341be7bf15e989d1789abf32ac4fd9c190b9250b81e650b569e8532048746b37
 DIST curl-8.8.0.tar.xz 2748860 BLAKE2B c14903bad4cbd1752a5335afa6bcc78be1a484692fce0e0a6c2061963e0e6b4e56defb8332cef32d0dbddb481ad0443b71faf3a52a6e9d945c89ecbce373d2a3 SHA512 9d2c0d3a0d8f6c31ba4fabe48f801910f886fde43dc198dc4213708d6967ed5e040a1bb7348aa1cb126577ee508a3ec36fe65256d027d861d6ffb70f6383967a
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.10.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.10.1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.10.0-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.10.1.ebuild
index 335c3c36a02..8aa5f19b3d9 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.10.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.10.1.ebuild
@@ -158,7 +158,6 @@ QA_CONFIG_IMPL_DECL_SKIP=(
 PATCHES=(
 	"${FILESDIR}"/${PN}-prefix-2.patch
 	"${FILESDIR}"/${PN}-respect-cflags-3.patch
-	"${FILESDIR}"/${P}-sendrecv-poll.patch
 )
 
 src_prepare() {
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.9.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.9.1-r1.ebuild
index ab60a165368..8ba549d7daa 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.9.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.9.1-r1.ebuild
@@ -21,7 +21,7 @@ else
 		https://curl.se/download/${P}.tar.xz
 		verify-sig? ( https://curl.se/download/${P}.tar.xz.asc )
 	"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="BSD curl ISC test? ( BSD-4 )"
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-8.10.0-sendrecv-poll.patch b/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-8.10.0-sendrecv-poll.patch
deleted file mode 100644
index 44654377008..00000000000
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-8.10.0-sendrecv-poll.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-https://github.com/curl/curl/commit/a33bcc9b53b9d6ea9f879624e8abea0b012b008e
-From: Stefan Eissing <stefan@eissing.org>
-Date: Fri, 13 Sep 2024 18:36:53 +0200
-Subject: [PATCH] transfer: fix sendrecv() without interim poll
-
-There was a "clever" optimization that skipped sendrecv() handling when
-the transfer's pollset was empty. This happens for paused transfers, for
-example.
-
-Unforunately, if the libcurl application never calls curl_multi_poll(),
-the pollset is and will aways remain empty, prevent the transfer from
-progressing.
-
-Remove this "optimization" and always try send/receive where applicable.
-
-Fixes #14898
-Reported-by: Victor Kislov
-Closes #14901
---- a/lib/transfer.c
-+++ b/lib/transfer.c
-@@ -431,8 +431,6 @@ CURLcode Curl_sendrecv(struct Curl_easy *data, struct curltime *nowp)
-     if(select_bits_paused(data, data->state.select_bits)) {
-       /* leave the bits unchanged, so they'll tell us what to do when
-        * this transfer gets unpaused. */
--      /* DEBUGF(infof(data, "sendrecv, select_bits, early return on PAUSED"));
--      */
-       result = CURLE_OK;
-       goto out;
-     }
-@@ -440,16 +438,13 @@ CURLcode Curl_sendrecv(struct Curl_easy *data, struct curltime *nowp)
-     /* DEBUGF(infof(data, "sendrecv, select_bits %x, RUN", select_bits)); */
-     select_bits = (CURL_CSELECT_OUT|CURL_CSELECT_IN);
-   }
--  else if(data->last_poll.num) {
--    /* The transfer wanted something polled. Let's run all available
--     * send/receives. Worst case we EAGAIN on some. */
--    /* DEBUGF(infof(data, "sendrecv, had poll sockets, RUN")); */
-+  else {
-+    /* try both directions if the transfer wants it. We used to poll
-+     * the socket here and on ran send/recv depending on POLLIN/OUT, but
-+     * that does not when connections are multiplexed or handshake,
-+     * or other direction reversals are happening. */
-     select_bits = (CURL_CSELECT_OUT|CURL_CSELECT_IN);
-   }
--  else if(data->req.keepon & KEEP_SEND_TIMED) {
--    /* DEBUGF(infof(data, "sendrecv, KEEP_SEND_TIMED, RUN ul")); */
--    select_bits = CURL_CSELECT_OUT;
--  }
- 
- #ifdef USE_HYPER
-   if(data->conn->datastream) {
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.17.1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.17.1.ebuild
index cabb576b75c..9b8d86fbeb2 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.17.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.17.1.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/esnet/iperf/releases/download/${PV}/${P}.tar.gz"
 
 LICENSE="BSD"
 SLOT="3"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~mips ~ppc ppc64 ~riscv ~sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
 IUSE="sctp"
 
 DEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iputils/Manifest b/sdk_container/src/third_party/portage-stable/net-misc/iputils/Manifest
index 2863ec7dbc8..4667f6eb2e6 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/iputils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iputils/Manifest
@@ -1,4 +1,5 @@
 DIST iputils-20211215.tar.gz 524567 BLAKE2B b88ff84be1d4d6a741f8f3514739ceff45ea40c475b5d4c2df8571fe84d4f1af9bc3fdce29e9ff393417671c75204261c8d64dde00473caa314b0aeb1fbf74ce SHA512 191062e51f7c8e8b38e3e4a96845adb77cd69f487d548c7cc578fad544443b4bc0dbe965d8f8e6fbda0a2f5b2fe2829789c05f873190c53d773245959298f6e9
 DIST iputils-20221126.tar.gz 511944 BLAKE2B 97bdc49810ce9e517211323e8e8ffd2f2be505704d67533db0e8f296701048b82c61b39062aab4a8fa148b29175636a657c2dcdd65e3a16b1572d2f392b8ecf0 SHA512 7fdfd76e6f2977039bc0930a1a5451f17319bf17beefc429751d99ffe143a83344d5b4cdbf008627bd70caafeadaf906a8b7c00393fa819e50d6c02b512c367f
 DIST iputils-20240117.tar.xz 445684 BLAKE2B 635943e12010aef8c1291b407bfbe284e0179391fca76197b77037ae1ffc219fa1d8e36abcea5fb7fff10d55ab40eed7c081e5d92b29f0916a4b4dd806945491 SHA512 c45822c5641f194dc07cba919c13a4b7a79d050bb53957a894ebb6ccc1f71bac1f26489e13d18ef1ce235982f5fa1824e677f95037a0f5cce6bcb94be4c2e2de
+DIST iputils-20240905.tar.xz 459008 BLAKE2B 62ee614292fbf487d93d711ecbc11719d10f4dcb995bfd0d613459b49792ae4c8f0032a401fbf583206665ac4c592e90c30da5c75811340cc881c06a20a05318 SHA512 6731e4fb8b8f89469de746c911fca6f1c7e924a21ca14ec25c40707707be3fe5a696272ba2d293207bc8c20f72a070d8e0a640fab9e5ea240a29a1f027807c1b
 DIST iputils-manpages-20211215.tar.xz 17148 BLAKE2B 63a956805b01f57b070b6b4ceb32f6ddf4313c74203cde821fc2f6f16ab8de14861da31163adf496db555f1961592d4fbc2ba7a977ccb18773af3bdb8d3795c0 SHA512 eb8c8508221b06fc13bf196b01b11f3ec87cd77e25d89c088776e39d249e10a3915ebb39942805adee179b352543063ce3dac158d68783c68c23de550ec14eee
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iputils/files/iputils-20240905-man-pages.patch b/sdk_container/src/third_party/portage-stable/net-misc/iputils/files/iputils-20240905-man-pages.patch
new file mode 100644
index 00000000000..0c2d174ec24
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iputils/files/iputils-20240905-man-pages.patch
@@ -0,0 +1,30 @@
+https://github.com/iputils/iputils/pull/556
+
+From 1e2a59a879859eb01ca8b34523f54b6acbb886cb Mon Sep 17 00:00:00 2001
+From: Eli Schwartz <eschwartz@gentoo.org>
+Date: Wed, 18 Sep 2024 00:32:53 -0400
+Subject: [PATCH] meson: fix installation of prebuilt manpages in dist tarball
+
+page contains the name of the program we are building/installing a
+manual for. In the custom targets for building the manpages, we append
+.xml and .8 in turn -- we don't replace a ".xml" in the page name.
+
+As there is nothing to replace, we end up checking if e.g. "./arping"
+exists, and trying to install it as a manual if so -- rather than
+arping.8 as intended. Sync the logic so that this works.
+
+Signed-off-by: Eli Schwartz <eschwartz@gentoo.org>
+--- a/doc/meson.build
++++ b/doc/meson.build
+@@ -28,8 +28,8 @@ if meson.version().version_compare('>=0.58.0')
+ 	out_html_pages = []
+ 	generated_docs_exist = true
+ 	foreach page : manpages
+-		man_page_name = page.replace('.xml', '.8')
+-		html_page_name = page.replace('.xml', '.html')
++		man_page_name = page + '.8'
++		html_page_name = page + '.html'
+ 		out_man_pages += man_page_name
+ 		out_html_pages += html_page_name
+ 		if not fs.exists(man_page_name) or not fs.exists(html_page_name)
+
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iputils/iputils-20240905.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/iputils/iputils-20240905.ebuild
new file mode 100644
index 00000000000..9f4e50654ca
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iputils/iputils-20240905.ebuild
@@ -0,0 +1,145 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PLOCALES="de fr ja pt_BR tr uk zh_CN"
+
+inherit fcaps meson plocale systemd toolchain-funcs
+
+if [[ ${PV} == *9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/iputils/iputils.git"
+	inherit git-r3
+else
+	SRC_URI="https://github.com/iputils/iputils/releases/download/${PV}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+fi
+
+DESCRIPTION="Network monitoring tools including ping and ping6"
+HOMEPAGE="https://wiki.linuxfoundation.org/networking/iputils"
+
+# We install ping unconditionally so BSD is listed by itself
+# See LICENSE on each release, it summaries per-component
+LICENSE="
+	BSD
+	arping? ( GPL-2+ )
+	clockdiff? ( BSD )
+	tracepath? ( GPL-2+ )
+"
+SLOT="0"
+IUSE="+arping caps clockdiff doc idn nls test tracepath"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	caps? ( sys-libs/libcap )
+	idn? ( net-dns/libidn2:= )
+	nls? ( virtual/libintl )
+"
+DEPEND="
+	${RDEPEND}
+	virtual/os-headers
+"
+BDEPEND="
+	virtual/pkgconfig
+	test? ( sys-apps/iproute2 )
+	nls? ( sys-devel/gettext )
+"
+
+if [[ ${PV} == 9999 ]] ; then
+	BDEPEND+="
+		app-text/docbook-xml-dtd:4.2
+		app-text/docbook-xml-dtd:4.5
+		app-text/docbook-xsl-ns-stylesheets
+		app-text/docbook-xsl-stylesheets
+		dev-libs/libxslt
+	"
+fi
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-20240905-man-pages.patch
+)
+
+src_prepare() {
+	default
+
+	plocale_get_locales > po/LINGUAS || die
+}
+
+src_configure() {
+	local emesonargs=(
+		-DUSE_CAP=$(usex caps true false)
+		-DUSE_IDN=$(usex idn true false)
+		-DBUILD_ARPING=$(usex arping true false)
+		-DBUILD_CLOCKDIFF=$(usex clockdiff true false)
+		-DBUILD_PING=true
+		-DBUILD_TRACEPATH=$(usex tracepath true false)
+		-DNO_SETCAP_OR_SUID=true
+		-Dsystemdunitdir=$(systemd_get_systemunitdir)
+		-DUSE_GETTEXT=$(usex nls true false)
+		$(meson_use !test SKIP_TESTS)
+	)
+
+	if use doc || [[ ${PV} == 9999 ]] ; then
+		emesonargs+=(
+			-DBUILD_HTML_MANS=true
+			-DBUILD_MANS=true
+		)
+	fi
+
+	meson_src_configure
+}
+
+src_compile() {
+	tc-export CC
+
+	meson_src_compile
+}
+
+src_test() {
+	if [[ ${EUID} != 0 ]] ; then
+		einfo "Tests require root privileges. Skipping ..."
+		return
+	fi
+
+	meson_src_test
+}
+
+src_install() {
+	meson_src_install
+
+	FILECAPS=( cap_net_raw usr/bin/ping )
+	use arping && FILECAPS+=( usr/bin/arping )
+	use clockdiff && FILECAPS+=( usr/bin/clockdiff )
+
+	dosym ping /usr/bin/ping4
+	dosym ping /usr/bin/ping6
+
+	if use tracepath ; then
+		dosym tracepath /usr/bin/tracepath4
+		dosym tracepath /usr/bin/tracepath6
+		dosym tracepath.8 /usr/share/man/man8/tracepath4.8
+		dosym tracepath.8 /usr/share/man/man8/tracepath6.8
+	fi
+
+	if use doc ; then
+		mv "${ED}"/usr/share/${PN} "${ED}"/usr/share/doc/${PF}/html || die
+	fi
+}
+
+pkg_preinst() {
+	local version_with_tftpd="<${CATEGORY}/${PN}-20211215"
+	if has_version "${version_with_tftpd}[traceroute6]" || has_version "${version_with_tftpd}[tftpd]" ; then
+		HAD_TFTPD_VERSION=1
+	fi
+}
+
+pkg_postinst() {
+	fcaps_pkg_postinst
+
+	if [[ ${HAD_TFTPD_VERSION} -eq 1 ]] ; then
+		ewarn "This upstream version (>= 20211215) drops two tools:"
+		ewarn "1. tftpd (alternatives: net-ftp/tftp-hpa, net-dns/dnsmasq)"
+		ewarn "2. traceroute6 (alternatives: net-analyzer/mtr, net-analyzer/traceroute)"
+		ewarn "Please install one of the listed alternatives if needed!"
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iputils/iputils-99999999.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/iputils/iputils-99999999.ebuild
index 5f7265fcd16..1b08f767832 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/iputils/iputils-99999999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iputils/iputils-99999999.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -40,16 +40,21 @@ DEPEND="
 	virtual/os-headers
 "
 BDEPEND="
-	app-text/docbook-xml-dtd:4.2
-	app-text/docbook-xml-dtd:4.5
-	app-text/docbook-xsl-ns-stylesheets
-	app-text/docbook-xsl-stylesheets
-	dev-libs/libxslt
 	virtual/pkgconfig
 	test? ( sys-apps/iproute2 )
 	nls? ( sys-devel/gettext )
 "
 
+if [[ ${PV} == 9999 ]] ; then
+	BDEPEND+="
+		app-text/docbook-xml-dtd:4.2
+		app-text/docbook-xml-dtd:4.5
+		app-text/docbook-xsl-ns-stylesheets
+		app-text/docbook-xsl-stylesheets
+		dev-libs/libxslt
+	"
+fi
+
 src_prepare() {
 	default
 
@@ -68,10 +73,15 @@ src_configure() {
 		-Dsystemdunitdir=$(systemd_get_systemunitdir)
 		-DUSE_GETTEXT=$(usex nls true false)
 		$(meson_use !test SKIP_TESTS)
-		-DBUILD_HTML_MANS=$(usex doc true false)
-		-DBUILD_MANS=true
 	)
 
+	if use doc || [[ ${PV} == 9999 ]] ; then
+		emesonargs+=(
+			-DBUILD_HTML_MANS=true
+			-DBUILD_MANS=true
+		)
+	fi
+
 	meson_src_configure
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.8_p1-r2.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.8_p1-r2.ebuild
index 5bd73e0cec6..a736800b38b 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.8_p1-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.8_p1-r2.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
 
 LICENSE="BSD GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 # Probably want to drop ssl defaulting to on in a future version.
 IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
 
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/rsync/rsync-3.3.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/rsync/rsync-3.3.0-r1.ebuild
index cbbfbc2aabf..cbe9b5281c7 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/rsync/rsync-3.3.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/rsync/rsync-3.3.0-r1.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 # Uncomment when introducing a patch which touches configure
 RSYNC_NEEDS_AUTOCONF=1
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 inherit flag-o-matic prefix python-single-r1 systemd
 
 DESCRIPTION="File transfer program to keep remote files into sync"
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/rsync/rsync-9999.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/rsync/rsync-9999.ebuild
index 9a7937e0f18..5ee60814366 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/rsync/rsync-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/rsync/rsync-9999.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 # Uncomment when introducing a patch which touches configure
 RSYNC_NEEDS_AUTOCONF=1
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 inherit flag-o-matic prefix python-single-r1 systemd
 
 DESCRIPTION="File transfer program to keep remote files into sync"
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/socat/Manifest b/sdk_container/src/third_party/portage-stable/net-misc/socat/Manifest
index 5171cae8235..4b5e778fdd8 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/socat/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-misc/socat/Manifest
@@ -1,2 +1,3 @@
 DIST socat-1.7.4.4.tar.bz2 522127 BLAKE2B 221b1c7c1ef0ac9c2402a6917ce7740a7ed857ceae4f4c346ed3c69c261fd0f9ca667e21cab5f97427d3947b06fdb0ac6d090852465878db968a24b8ece587ad SHA512 3eedfbf599ecf1d6fd391d03d710044bc5e18a762395bc4cb151b96fe673d405a6630da3070ecddd5ac558126b56aa65feaa74d528eeb755a04aa0ec61690651
 DIST socat-1.8.0.0.tar.bz2 564066 BLAKE2B b0b3e8c46f746b1aaff7390bbf9521cca8c421f3c20cd7a7f7d8ffd3d7b5e5e881e2477642f7d29247ee5a9d9edf6c8370a43c5f2757e456966b17e3ba08a58a SHA512 dd15c31204f2843ab473a30aa841e960e7c00ac7487e2265d69f9e8ea0afde3841d57cfcb99084f03935d7223da65cee27166837f2f9b3a20c834bc161af802b
+DIST socat-1.8.0.1.tar.bz2 579492 BLAKE2B 0af65b18dc6fec28e59d75048b1e1c4f442f134d87bc6a9b5ea7b3032a0c5519e0d042ae760d451006eacf368870a0a47465d9ec2d5f2fe8d41efcd639ef58c5 SHA512 ce8147df545f74d4b6e1d3d0dae2dcea58c4c7e6ccd1cb2eec68c29ead2c3a818e9851b30a5e5f1456d70463c31b13ab1c5b350293359419a583ed693a917231
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/socat/socat-1.8.0.0.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/socat/socat-1.8.0.0.ebuild
index f256875f9b2..f840822a76f 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/socat/socat-1.8.0.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/socat/socat-1.8.0.0.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -47,7 +47,9 @@ src_configure() {
 }
 
 src_test() {
-	edo ./test.sh -v --expect-fail 217,311,313,410,478,528
+	# Most tests are skipped because they need network access or a TTY
+	# 518 519 need extra permissions
+	edo ./test.sh -v --expect-fail 217,311,313,410,478,518,519,528
 }
 
 src_install() {
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/socat/socat-1.8.0.1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/socat/socat-1.8.0.1.ebuild
new file mode 100644
index 00000000000..c95a08a9375
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/socat/socat-1.8.0.1.ebuild
@@ -0,0 +1,55 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit edo flag-o-matic toolchain-funcs
+
+MY_P=${P/_beta/-b}
+DESCRIPTION="Multipurpose relay (SOcket CAT)"
+HOMEPAGE="http://www.dest-unreach.org/socat/ https://repo.or.cz/socat.git"
+SRC_URI="http://www.dest-unreach.org/socat/download/${MY_P}.tar.bz2"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+IUSE="ipv6 readline ssl tcpd"
+
+DEPEND="
+	ssl? ( >=dev-libs/openssl-3:= )
+	readline? ( sys-libs/readline:= )
+	tcpd? ( sys-apps/tcp-wrappers )
+"
+RDEPEND="${DEPEND}"
+
+DOCS=( BUGREPORTS CHANGES DEVELOPMENT EXAMPLES FAQ FILES PORTING README SECURITY )
+
+src_configure() {
+	# bug #293324
+	filter-flags '-Wno-error*'
+
+	tc-export AR
+
+	local myeconfargs=(
+		$(use_enable ssl openssl)
+		$(use_enable readline)
+		$(use_enable ipv6 ip6)
+		$(use_enable tcpd libwrap)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	# Most tests are skipped because they need network access or a TTY
+	# 518 519 need extra permissions
+	edo ./test.sh -v --expect-fail 217,311,313,410,478,518,519,528
+}
+
+src_install() {
+	default
+
+	docinto html
+	dodoc doc/*.html doc/*.css
+}
diff --git a/sdk_container/src/third_party/portage-stable/perl-core/File-Temp/File-Temp-0.231.100-r1.ebuild b/sdk_container/src/third_party/portage-stable/perl-core/File-Temp/File-Temp-0.231.100-r1.ebuild
index e1fc2fbfc9a..dfb9db88db6 100644
--- a/sdk_container/src/third_party/portage-stable/perl-core/File-Temp/File-Temp-0.231.100-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/perl-core/File-Temp/File-Temp-0.231.100-r1.ebuild
@@ -10,7 +10,7 @@ inherit perl-module
 DESCRIPTION="File::Temp can be used to create and open temporary files in a safe way"
 
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE=""
 
 PATCHES=(
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
index 58071d9fab0..04da7dbc8fe 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# David Roman <davidroman96@gmail.com> (2024-10-04)
+# dev-libs/libunibreak is not keyworded
+media-libs/libass libunibreak
+
 # Sam James <sam@gentoo.org> (2024-08-23)
 # dev-util/bpftool and/or sys-devel/bpf-toolchain not keyworded here
 sys-apps/systemd bpf
@@ -274,7 +278,7 @@ media-sound/fluidsynth lash
 
 # Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> (2020-10-14)
 # app-i18n/fcitx:4 not keyworded.
-media-libs/libsdl2 fcitx4
+media-libs/libsdl2 fcitx
 
 # Sergei Trofimovich <slyfox@gentoo.org> (2020-09-18)
 # media-libs/libilbc is not ported to alpha
@@ -290,7 +294,6 @@ media-libs/mesa video_cards_zink vulkan vulkan-overlay zink
 
 # Sergei Trofimovich <slyfox@gentoo.org> (2020-07-18)
 # net-libs/webkit-gtk has no alpha keywords
-app-editors/emacs xwidgets
 gnome-extra/evolution-data-server oauth-gtk3 oauth-gtk4
 # needs gnome-extra/sushi, depends on net-libs/webkit-gtk
 gnome-base/nautilus previewer
@@ -560,7 +563,7 @@ x11-misc/colord argyllcms extra-print-profiles
 
 # Raúl Porcel <armin76@gentoo.org> (2012-12-30)
 # Needs testing
-media-libs/phonon gstreamer vlc
+media-libs/phonon vlc
 
 # Raúl Porcel <armin76@gentoo.org> (2012-05-28)
 # Needs x11-misc/lightdm(which also requires some other deps)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use
index 754ff9c5cfc..273406b0e81 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use
@@ -4,8 +4,8 @@
 # Michał Górny <mgorny@gentoo.org> (2024-09-04)
 # Build with debugging support by default to facilitate dev-debug/dtrace
 # and sys-apps/systemd[bpf].
->=sys-kernel/gentoo-kernel-6.10.8 debug
->=sys-kernel/vanilla-kernel-6.10.8 debug
+>=sys-kernel/gentoo-kernel-6.6.53 debug
+>=sys-kernel/vanilla-kernel-6.6.53 debug
 
 # James Le Cuirot <chewi@gentoo.org> (2022-06-25)
 # Realign the stack in the 32-bit build for compatibility with older binaries by
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
index 40350932035..8140309fc8e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
@@ -17,6 +17,10 @@
 
 #--- END OF EXAMPLES ---
 
+# Patrick McLean <chutzpah@gentoo.org> (2024-09-23)
+# Only supported on x86/amd64 (bug #940014).
+net-misc/lldpd -seccomp
+
 # orbea <orbea@riseup.net> (2024-07-19)
 # Unmask the dynarec flag which has amd64 asm.
 games-emulation/rmg -dynarec
@@ -88,8 +92,8 @@ sys-kernel/gentoo-kernel -generic-uki
 sys-kernel/gentoo-kernel-bin -generic-uki
 
 # Ionen Wolkens <ionen@gentoo.org> (2023-12-02)
-# dev-qt/qtwebengine:6 is keyworded here.
-dev-python/PyQt6 -pdfium
+# dev-qt/qtwebengine:6 and dev-qt/qtremoteobjects:6 are keyworded here.
+dev-python/PyQt6 -pdfium -remoteobjects
 
 # Jimi Huotari <chiitoo@gentoo.org> (2023-11-22)
 # Unmask on amd64.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask
index 22b18c98f82..2dd055c2fb8 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask
@@ -17,6 +17,10 @@
 
 #--- END OF EXAMPLES ---
 
+# Ionen Wolkens <ionen@gentoo.org> (2024-09-27)
+# dev-qt/qtremoteobjects:6 has not been stabilized yet.
+dev-python/PyQt6 remoteobjects
+
 # Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2024-07-24)
 # No stable versions of ROCm at the moment
 sys-apps/hwloc rocm
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
index 00bbe372094..84c176633a9 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
@@ -80,10 +80,6 @@ sys-kernel/installkernel -grub
 # media-libs/shaderc in not keyworded
 media-video/ffmpeg shaderc
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2023-11-13)
-# kde-plasma/print-manager is not keyworded
-kde-plasma/plasma-meta cups
-
 # Jon Janzen <jon@jonjanzen.com> (2023-09-11)
 # librttopo has not been tested on this arch
 dev-db/spatialite rttopo
@@ -113,7 +109,6 @@ dev-lang/idris2 test-full
 dev-python/cloudscraper test
 dev-python/QtPy test
 games-util/lgogdownloader gui
-kde-plasma/plasma-nm openconnect
 net-irc/quassel urlpreview
 net-misc/fatrat bittorrent
 net-misc/seafile-client shibboleth
@@ -225,7 +220,7 @@ net-wireless/gnuradio ctrlport
 
 # Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> (2020-10-14)
 # app-i18n/fcitx:4 not keyworded.
-media-libs/libsdl2 fcitx4
+media-libs/libsdl2 fcitx
 
 # Adam Feldman <NP-Hardass@gentoo.org> (2020-09-05)
 # dev-util/dogtail is not keyworded for arm
@@ -260,10 +255,6 @@ dev-util/schroot zfs
 # PPS should work on all arches, but only keyworded on some arches
 >=net-misc/ntp-4.2.6_p3-r1 -parse-clocks
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2019-10-29)
-# Neither sys-apps/bolt nor kde-plasma/plasma-thunderbolt are keyworded
-kde-plasma/plasma-meta thunderbolt
-
 # Craig Andrews <candrews@gentoo.org> (2019-07-03)
 # Unmask Raspberry Pi support on arm.
 media-tv/kodi -raspberry-pi
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.stable.mask
index 31ac62057c0..693acceaafa 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.stable.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2024-10-05)
+# media-libs/jasper fails tests (bug #907259)
+media-gfx/graphicsmagick jpeg2k
+
 # Andreas Sturmlechner <asturm@gentoo.org> (2024-07-23)
 # kde-frameworks/kservice, dev-qt/qtpaths not stable here
 x11-misc/xdg-utils plasma
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use
index 22f0c2a5e48..f1ba7d873ad 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use
@@ -4,8 +4,8 @@
 # Michał Górny <mgorny@gentoo.org> (2024-09-04)
 # Build with debugging support by default to facilitate dev-debug/dtrace
 # and sys-apps/systemd[bpf].
->=sys-kernel/gentoo-kernel-6.10.8 debug
->=sys-kernel/vanilla-kernel-6.10.8 debug
+>=sys-kernel/gentoo-kernel-6.6.53 debug
+>=sys-kernel/vanilla-kernel-6.6.53 debug
 
 # James Le Cuirot <chewi@gentoo.org> (2023-12-16)
 # Apply additional FFmpeg patches for efficient playback on some SoCs.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.stable.mask
index c6bd67ba884..c1bc45c5429 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.stable.mask
@@ -18,9 +18,8 @@ app-emulation/qemu capstone
 sys-kernel/installkernel efistub
 
 # Ionen Wolkens <ionen@gentoo.org> (2024-01-27)
-# dev-python/PyQt6-WebEngine is not stable here yet, bug #939558
 # dev-python/pyside6 is not stable here yet
-dev-python/QtPy pyqt6 pyside6
+dev-python/QtPy pyside6
 
 # Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-12-18)
 # This is still experimental, prebuilt images may not boot on all systems.
@@ -95,7 +94,7 @@ media-gfx/enblend doc
 
 # Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> (2020-10-14)
 # app-i18n/fcitx:4 not stable.
-media-libs/libsdl2 fcitx4
+media-libs/libsdl2 fcitx
 
 # Sam James <sam@gentoo.org> (2020-10-06)
 # Not yet stable on arm64.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
index 1a1450567f2..f1851b42d61 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
@@ -78,8 +78,8 @@ sys-kernel/gentoo-kernel generic-uki
 sys-kernel/gentoo-kernel-bin generic-uki
 
 # Ionen Wolkens <ionen@gentoo.org> (2023-12-02)
-# Needs dev-qt/qtwebengine:6 which has very few keywords.
-dev-python/PyQt6 pdfium
+# dev-qt/qtwebengine:6 and dev-qt/qtremoteobjects:6 have few keywords.
+dev-python/PyQt6 pdfium remoteobjects
 
 # Jimi Huotari <chiitoo@gentoo.org> (2023-11-22)
 # media-libs/libvpl is only keyworded for amd64 at this time.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
index ecee15a9d4d..a9616ebb258 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
@@ -17,10 +17,6 @@ jasper
 # sci-libs/atlas is only supported on specific architectures
 atlas
 
-# Michał Górny <mgorny@gentoo.org> (2024-02-05)
-# LLVM slots without keywords.
-llvm_slot_19
-
 # Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-07-11)
 # Mask secureboot flag on arches where sbsigntools is not keyworded
 secureboot
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
index dc92c7939f4..f0a070bc753 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
@@ -4,6 +4,10 @@
 # NOTE: When masking a USE flag due to missing keywords, please file a keyword
 # request bug for the hppa arch.
 
+# David Roman <davidroman96@gmail.com> (2024-10-04)
+# dev-libs/libunibreak is not keyworded
+media-libs/libass libunibreak
+
 # Sam James <sam@gentoo.org> (2024-08-23)
 # dev-util/bpftool and/or sys-devel/bpf-toolchain not keyworded here
 sys-apps/systemd bpf
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.stable.mask
index f807a893993..14afbb12801 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.stable.mask
@@ -197,7 +197,7 @@ x11-base/xorg-server xorg
 
 # Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> (2020-10-14)
 # app-i18n/fcitx:4 not stable.
-media-libs/libsdl2 fcitx4
+media-libs/libsdl2 fcitx
 
 # Rolf Eike Beer <eike@sf-mail.de> (2020-06-10)
 # not stable dev-vcs/mercurial because of broken dependencies: bug #727390
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/use.mask
index 429687a52b9..e988802889d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/use.mask
@@ -66,10 +66,6 @@ plymouth
 # sys-fs/dmraid has not been tested on HPPA
 dmraid
 
-# Jeroen Roovers <jer@gentoo.org> (2016-01-31)
-# USE=xwidgets requires net-libs/webkit-gtk
-xwidgets
-
 # Jeroen Roovers <jer@gentoo.org> (2015-10-16)
 # HPPA has no NUMA support in the kernel
 numa
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask
index 5ed3d683fbb..a10a477151e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask
@@ -1,6 +1,22 @@
 # Copyright 2022-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# David Roman <davidroman96@gmail.com> (2024-10-04)
+# dev-libs/libunibreak is not keyworded
+media-libs/libass libunibreak
+
+# WANG Xuerui <xen0n@gentoo.org> (2024-09-27)
+# media-libs/libilbc needs porting
+media-video/ffmpeg libilbc
+net-analyzer/wireshark ilbc
+net-libs/pjproject ilbc
+net-misc/asterisk ilbc
+net-voip/yate ilbc
+
+# Paul Zander <negril.nx+gentoo@gmail.com> (2024-09-14)
+# needs re-keywording and clean-up of media-libs/opencollada
+media-libs/assimp collada
+
 # Andreas Sturmlechner <asturm@gentoo.org> (2024-09-13)
 # dev-python/pyside6 isn't keyworded here
 dev-python/QtPy pyside6
@@ -181,6 +197,7 @@ dev-util/perf python
 #
 # See https://github.com/openssl/openssl/issues/21340
 >=dev-libs/openssl-3.1 asm
+>=dev-libs/openssl-3.2 -asm
 
 # WANG Xuerui <xen0n@gentoo.org> (2023-06-03)
 # sys-cluster/knem not keyworded yet
@@ -253,7 +270,7 @@ app-cdr/brasero tracker
 # time being
 dev-cpp/libcmis man
 media-libs/opencv tesseract
-media-video/ffmpeg libilbc libtesseract
+media-video/ffmpeg libtesseract
 
 # WANG Xuerui <xen0n@gentoo.org> (2022-12-05)
 # sys-auth/sssd isn't keyworded here yet
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask
index 019333fee28..113fd19129a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# David Roman <davidroman96@gmail.com> (2024-10-04)
+# dev-libs/libunibreak is not keyworded
+media-libs/libass libunibreak
+
 # Arthur Zamarin <arthurzam@gentoo.org> (2024-09-08)
 # Packages needing dev-python/selenium.
 dev-python/aiohttp-cors test
@@ -72,7 +76,6 @@ app-editors/emacs gui mailutils
 
 # Arthur Zamarin <arthurzam@gentoo.org> (2024-08-25)
 # net-libs/webkit-gtk has no mips keywords
-app-editors/emacs xwidgets
 dev-util/glade webkit
 
 # Arthur Zamarin <arthurzam@gentoo.org> (2024-08-25)
@@ -189,7 +192,7 @@ app-alternatives/ninja samurai
 
 # matoro <matoro_gentoo@matoro.tk> (2023-06-18)
 # app-i18n/fcitx:4 not keyworded here
-media-libs/libsdl2 fcitx4
+media-libs/libsdl2 fcitx
 
 # Sam James <sam@gentoo.org> (2023-06-18)
 # Qt 5 not keyworded here
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
index 1818fc6de33..015539e06ae 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# David Roman <davidroman96@gmail.com> (2024-10-04)
+# dev-libs/libunibreak is not keyworded
+media-libs/libass libunibreak
+
 # Matt Jolly <kangie@gentoo.org> (2024-08-14)
 # QUIC dependencies are not keyworded
 net-misc/curl http3 quic curl_quic_openssl curl_quic_ngtcp2
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
index d18dd825222..55abb27079c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
@@ -1,6 +1,14 @@
 # Copyright 2019-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# David Roman <davidroman96@gmail.com> (2024-10-04)
+# dev-libs/libunibreak not keyworded here
+media-libs/libass libunibreak
+
+# Paul Zander <negril.nx+gentoo@gmail.com> (2024-09-08)
+# needs re-keywording and clean-up of media-libs/opencollada
+media-libs/assimp collada
+
 # Michael Orlitzky <mjo@gentoo.org> (2024-09-01)
 # Mask the optional plotting backend sci-libs/vtk because it's a beast
 # and I don't want to deal with it right now.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.stable.mask
index ce36e2613c0..dedc92b09bf 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.stable.mask
@@ -1,10 +1,2 @@
-# Copyright 2023 Gentoo Authors
+# Copyright 2023-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
-
-# Matt Turner <mattst88@gentoo.org> (2023-10-30)
-# libei not stable yet
-x11-base/xwayland libei
-
-# Matt Turner <mattst88@gentoo.org> (2023-05-30)
-# sys-apps/dbus-broker is not stable
-app-accessibility/at-spi2-core dbus-broker
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
index f8a633d8046..e2615cab515 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# David Roman <davidroman96@gmail.com> (2024-10-04)
+# dev-libs/libunibreak not keyworded here
+media-libs/libass libunibreak
+
 # Sam James <sam@gentoo.org> (2024-08-23)
 # dev-util/bpftool and/or sys-devel/bpf-toolchain not keyworded here
 sys-apps/systemd bpf
@@ -335,7 +339,7 @@ xfce-base/tumbler epub
 
 # Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> (2020-10-14)
 # app-i18n/fcitx:4 not keyworded.
-media-libs/libsdl2 fcitx4
+media-libs/libsdl2 fcitx
 
 # Matt Turner <mattst88@gentoo.org> (2020-08-11)
 # No drivers on this architecture support Vulkan
@@ -660,7 +664,7 @@ x11-misc/colord argyllcms extra-print-profiles
 
 # Raúl Porcel <armin76@gentoo.org> (2012-12-30)
 # Needs testing
-media-libs/phonon gstreamer vlc
+media-libs/phonon vlc
 
 # Robin H Johnson <robbat2@gentoo.org> (2012-11-01)
 # MySQL 5.5 wants systemtap, tcmalloc & jemalloc
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.stable.mask
index 3a1db384598..5bec10bead0 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.stable.mask
@@ -122,7 +122,3 @@ dev-libs/libzip mbedtls
 net-libs/libssh mbedtls
 net-libs/libssh2 mbedtls
 net-vpn/openvpn mbedtls
-
-# Sergei Trofimovich <slyfox@gentoo.org> (2020-04-04)
-# Needs stable net-libs/webkit-gtk, bug #712260
-app-editors/emacs xwidgets
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.mask
index ec1bcf60075..4633a6bac66 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.mask
@@ -12,10 +12,8 @@ dev-qt/qtwebengine
 dev-qt/qtwebview
 dev-python/PyQtWebEngine
 app-text/zeal
-app-editors/ghostwriter
 app-editors/retext
 app-misc/anki
-app-office/merkuro
 app-office/kmymoney:5
 app-office/skrooge:5
 app-office/texmaker
@@ -28,45 +26,11 @@ dev-python/spyder-unittest
 dev-python/spyder-line-profiler
 dev-python/spyder-vim
 dev-python/spyder-notebook
-kde-apps/akonadi-calendar:5
-kde-apps/akonadi-import-wizard:5
-kde-apps/akonadiconsole:5
-kde-apps/akregator:5
-kde-apps/calendarjanitor:5
-kde-apps/calendarsupport:5
 kde-apps/cantor:5
-kde-apps/eventviews:5
-kde-apps/grantlee-editor:5
-kde-apps/incidenceeditor:5
-kde-apps/kaccounts-providers:5
-kde-apps/kaddressbook:5
-kde-apps/kalarm:5
-kde-apps/kdepim-addons:5
-kde-apps/kdepim-meta
-kde-apps/kdepim-runtime:5
 kde-apps/kimagemapeditor:5
-kde-apps/kmail:5
-kde-apps/kmail-account-wizard:5
-kde-apps/kmailtransport:5
-kde-apps/knotes:5
-kde-apps/konqueror:5
-kde-apps/konsolekalendar:5
-kde-apps/kontact:5
-kde-apps/korganizer:5
-kde-apps/libksieve:5
-kde-apps/mailcommon:5
-kde-apps/messagelib:5
-kde-apps/mbox-importer:5
-kde-apps/pim-data-exporter:5
-kde-apps/pim-sieve-editor:5
-kde-misc/kio-gdrive
-kde-misc/tellico:5
-kde-misc/zanshin:5
 media-gfx/luminance-hdr
 media-sound/frescobaldi
 media-sound/teamspeak-client:3
 net-analyzer/nmapsi
-net-libs/signon-ui
 sci-geosciences/qmapshack
-www-client/falkon
 www-client/otter
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
index 77014314280..cde9e69839a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
@@ -1,9 +1,9 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2024-09-12)
-# dev-python/PyQt6 and dev-python/pyside6 aren't keyworded here, bug #935070
-dev-python/QtPy pyqt6 pyside6
+# Patrick McLean <chutzpah@gentoo.org> (2024-09-23)
+# Only supported on x86/amd64 (bug #940014).
+net-misc/lldpd -seccomp
 
 # orbea <orbea@riseup.net> (2024-07-19)
 # Unmask the dynarec flag which has x86 asm.
@@ -35,14 +35,6 @@ dev-tex/abntex lyx
 # additional dev-qt/qtwebengine revdeps.
 kde-frameworks/purpose:5 kaccounts
 
-# Paul Zander <negril.nx+gentoo@gmail.com> (2024-06-17)
-# missing keywords on dev-python/PyQt6
-sci-geosciences/qgis qt6
-
-# José de Paula R. N. Assis <espinafre@gmail.com> (2024-03-25)
-# No PyQt6 (which is needed by USE=qt6 for qscintilla-python) on x86.
->=dev-python/qscintilla-python-2.14.1-r1 qt6
-
 # Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2024-03-21)
 # virt-firmware is keyworded here
 sys-kernel/installkernel -efistub
@@ -126,9 +118,6 @@ dev-python/QtPy test
 games-util/lgogdownloader gui
 kde-apps/kde-apps-meta pim
 kde-apps/kdenetwork-meta bittorrent
-kde-apps/kleopatra pim
-kde-apps/umbrello php
-kde-misc/kio-gdrive share
 kde-plasma/plasma-nm openconnect
 net-irc/quassel urlpreview
 net-misc/fatrat bittorrent
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.stable.mask
index 4f221ab56a9..f5f7c9b3ecb 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.stable.mask
@@ -17,6 +17,10 @@
 
 #--- END OF EXAMPLES ---
 
+# Andreas Sturmlechner <asturm@gentoo.org> (2024-09-20)
+# dev-python/pyside6 is not stable here.
+dev-python/QtPy pyside6
+
 # Andreas Sturmlechner <asturm@gentoo.org> (2024-09-02)
 # kde-plasma/plasma-workspace is not stable here.
 sys-auth/polkit kde
@@ -50,11 +54,8 @@ dev-games/openscenegraph las
 dev-libs/efl physics
 media-libs/a52dec djbfft
 dev-python/graphviz test
-kde-apps/cantor R
 dev-python/sympy symengine
-kde-apps/gwenview fits
 kde-apps/marble gps
-kde-plasma/plasma-workspace gps
 media-gfx/graphviz gts
 media-libs/libpano13 suitesparse
 media-libs/opencv gdal lapack
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/base/make.defaults
index 39891976a91..181383d8799 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/make.defaults
@@ -94,9 +94,9 @@ XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipp2p iface geoip fu
 LCD_DEVICES="bayrad cfontz glk hd44780 lb216 lcdm001 mtxorb text"
 
 # Manuel Rüger <mrueg@gentoo.org> (2015-09-09)
-# Hans de Graaff <graaff@gentoo.org> (2024-05-20)
+# Hans de Graaff <graaff@gentoo.org> (2024-10-08)
 # Default Ruby build target(s)
-RUBY_TARGETS="ruby31 ruby32"
+RUBY_TARGETS="ruby32"
 
 # Andreas K. Hüttel <dilfridge@gentoo.org> (2022-10-22)
 # These USE flags are what is common between the various sub-profiles. Stages 2
@@ -150,7 +150,7 @@ TWISTED_DISABLE_WRITING_OF_PLUGIN_CACHE="1"
 
 # Aaron W. Swenson <titanofold@gentoo.org> (2017-07-09)
 # Default target(s) for postgres{,-multi}.eclass
-POSTGRES_TARGETS="postgres15"
+POSTGRES_TARGETS="postgres16"
 
 # Michael Orlitzky <mjo@gentoo.org> (2017-11-17)
 #
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
index f33c69713d0..fe7d666017e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
@@ -1,6 +1,12 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2024-09-30)
+# gnat-gpl only exists for (bootstrapping) Ada. Until bug #940471 is handled,
+# force Ada on. Once it is split/moved/gutted, this won't be necessary
+# as it'll always build Ada.
+dev-lang/gnat-gpl ada
+
 # Michał Górny <mgorny@gentoo.org> (2024-06-29)
 # Disabling GIL (enabling freethreading) is experimental and prone
 # to break packages.  Should you choose to test it, please do not file
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
index b74f912ef14..5fbb9753e25 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
@@ -3,9 +3,22 @@
 
 # New entries go on top.
 
+# Volkmar W. Pogatzki <gentoo@pogatzki.net> (2024-09-21)
+# openjfx for OpenJDK 23 is not yet available.
+dev-java/openjdk:23 javafx
+
 # This file is only for generic masks. For arch-specific masks (i.e.
 # mask everywhere, unmask on arch/*) use arch/base.
 
+# Sam James <sam@gentoo.org> (2024-09-30)
+# gnat-gpl is purely for bootstrapping Ada and it's based on an old
+# version of GCC. Avoid risks of miscompilations.
+dev-lang/gnat-gpl pgo lto
+
+# Patrick McLean <chutzpah@gentoo.org> (2024-09-23)
+# Only supported on x86/amd64 (bug #940014).
+net-misc/lldpd seccomp
+
 # Volkmar W. Pogatzki <gentoo@pogatzki.net> (2024-09-12)
 # No suitable version of dev-libs/protobuf available.
 =dev-java/protobuf-java-4.28.1 system-protoc
@@ -19,15 +32,6 @@ app-alternatives/yacc reference
 # Causes crashes with e.g. dlz+samba (bug #938955)
 net-dns/bind jemalloc
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2024-09-02)
-# kde-plasma/print-manager:5 and kde-apps/khelpcenter:5 cleanup
-kde-plasma/plasma-meta:5 cups handbook
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2024-09-02)
-# Prepare kde-apps/kaccounts-integration:5 cleanup
-kde-plasma/plasma-desktop:5 kaccounts
-kde-plasma/plasma-welcome:5 kaccounts
-
 # Andreas Sturmlechner <asturm@gentoo.org> (2024-09-01)
 # Prepare for dev-util/kdevelop:5 removal
 kde-apps/umbrello:5 php
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask
index 575a76e0a50..eaf6d80fe29 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask
@@ -11,15 +11,9 @@
 <kde-frameworks/baloo-5.116.0-r1 kf6compat
 <kde-frameworks/kglobalaccel-5.116.0-r1 kf6compat
 <kde-frameworks/kguiaddons-5.116.0-r1 kf6compat
-<kde-frameworks/kuserfeedback-1.3.0-r4 kf6compat
 <kde-frameworks/kwallet-5.116.0-r1 kf6compat
 <kde-plasma/libplasma-5.116.0-r1 kf6compat
 
-# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2024-04-14)
-# Qt6 dependencies are not yet available in stable. Moreover,
-# Qt6 support in freecad is not completely finished.
-media-gfx/freecad qt6
-
 # Joonas Niilola <juippis@gentoo.org> (2023-07-14)
 # Calendar is broken with some languages on 115.0 release with <icu-75.
 # Bug #910229, #920713
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/base/use.stable.mask
index 4c528b5880f..9167592b9e1 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/use.stable.mask
@@ -4,6 +4,14 @@
 # This file requires eapi 5 or later. New entries go on top.
 # Please use the same syntax as in use.mask
 
+# Patrick Lauer <patrick@gentoo.org> (2024-09-26)
+# Postgresql 17 isn't stable yet
+postgres_targets_postgres17
+
+# Sam James <sam@gentoo.org> (2024-09-18)
+# LLVM slots without stable keywords.
+llvm_slot_19
+
 # Michał Górny <mgorny@gentoo.org> (2024-05-08)
 # Python implementations without stable keywords.
 python_targets_python3_13
diff --git a/sdk_container/src/third_party/portage-stable/profiles/desc/ada_target.desc b/sdk_container/src/third_party/portage-stable/profiles/desc/ada_target.desc
index 005be2d7364..d9b797cfb66 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/desc/ada_target.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/desc/ada_target.desc
@@ -1,6 +1,8 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 gnat_2021 - Compile with dev-lang/gnat-gpl-2021
 gcc_12 - Compile with sys-devel/gcc:12
 gcc_13 - Compile with sys-devel/gcc:13
+gcc_14 - Compile with sys-devel/gcc:14
+gcc_15 - Compile with sys-devel/gcc:15
diff --git a/sdk_container/src/third_party/portage-stable/profiles/desc/guile_single_target.desc b/sdk_container/src/third_party/portage-stable/profiles/desc/guile_single_target.desc
index 95f51d5f006..81322b2380d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/desc/guile_single_target.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/desc/guile_single_target.desc
@@ -3,5 +3,6 @@
 
 # This file contains descriptions of GUILE_SINGLE_TARGET USE_EXPAND flags.
 
+1-8 - Build only for GNU Guile 1.8.
 2-2 - Build only for GNU Guile 2.2.
 3-0 - Build only for GNU Guile 3.0.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/desc/guile_targets.desc b/sdk_container/src/third_party/portage-stable/profiles/desc/guile_targets.desc
index a958e0c9333..a56ca35810b 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/desc/guile_targets.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/desc/guile_targets.desc
@@ -3,5 +3,6 @@
 
 # This file contains descriptions of GUILE_TARGETS USE_EXPAND flags.
 
-2-2 - Build only for GNU Guile 2.2
-3-0 - Build only for GNU Guile 3.0
+1-8 - Build with GNU Guile 1.8
+2-2 - Build with GNU Guile 2.2
+3-0 - Build with GNU Guile 3.0
diff --git a/sdk_container/src/third_party/portage-stable/profiles/desc/postgres_targets.desc b/sdk_container/src/third_party/portage-stable/profiles/desc/postgres_targets.desc
index d40f508181c..7e18a89e66d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/desc/postgres_targets.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/desc/postgres_targets.desc
@@ -8,3 +8,4 @@ postgres13 - Build against PostgreSQL 13
 postgres14 - Build against PostgreSQL 14
 postgres15 - Build against PostgreSQL 15
 postgres16 - Build against PostgreSQL 16
+postgres17 - Build against PostgreSQL 17
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
index 64cf6b2a884..880c3d73987 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2024-09-30)
+# Needs porting to musl (bug #940130)
+=sys-auth/elogind-255.5
+
 # Sam James <sam@gentoo.org> (2024-08-31)
 # sys-devel/binutils[gprofng] is masked on musl
 dev-debug/gprofng-gui
@@ -199,6 +203,7 @@ app-admin/awscli-bin
 app-admin/bitwarden-desktop-bin
 app-admin/puppet-agent
 app-admin/puppetserver
+app-admin/winbox
 app-arch/rar
 app-backup/tsm
 app-benchmarks/geekbench
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
index 30e6852a7ea..4a9c862847d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Michał Górny <mgorny@gentoo.org> (2024-09-23)
+# Requires dev-python/nh3.
+dev-python/textile
+
 # matoro <matoro_gentoo@matoro.tk> (2024-08-10), #936643
 # Unmask old pre-rust librsvg.  This has vulnerabilities,
 # so it is masked by default and only unmasked on wd40
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.use.mask
index 888aadab1d1..92fac886fed 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Andreas Sturmlechner <asturm@gentoo.org> (2024-10-04)
+# >=media-libs/libopenraw-0.3.2 depends on rust
+xfce-base/tumbler raw
+
 # Petr Vaněk <arkamar@gentoo.org> (2024-09-01)
 # Requires dev-python/cryptography
 app-crypt/osslsigncode test
diff --git a/sdk_container/src/third_party/portage-stable/profiles/license_groups b/sdk_container/src/third_party/portage-stable/profiles/license_groups
index 6917ca54aef..364b7e8b49b 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/license_groups
+++ b/sdk_container/src/third_party/portage-stable/profiles/license_groups
@@ -81,7 +81,7 @@ OSI-APPROVED @OSI-APPROVED-FREE @OSI-APPROVED-NONFREE
 
 # License agreements that try to take away your rights. These are more
 # restrictive than "all-rights-reserved" or require explicit approval.
-EULA 2dboy-EULA AMD-GPU-PRO-EULA android AnyDesk-TOS Aseprite-EULA baudline bestcrypt CAPYBARA-EULA Coherent-Graphics Dell-EULA ETQW f.lux FAH-EULA-2014 Flightradar24 Gameplay-Group-EULA geekbench genymotion GIMPS GOG-EULA google-chrome Intel-SDP Introversion JoyPixels LOKI-EULA MakeMKV-EULA Microsemi microsoft-azurevpnclient microsoft-edge Microsoft-vscode Mojang MTA-0.5 NVIDIA-CUDA NVIDIA-SDK Ookla OPERA-2018 PAPERS-PLEASE PassMark-EULA PICO-8 Primate-Plunge PUEL-11 PUEL-12 Q3AEULA-20000111 QUAKE4 RAR sfpg SPS Steam supermicro Synology teamspeak3 teamspeak5 TeamViewer THINKTANKS TIK ubiquiti ut2003 ut2003-demo Vivaldi worklog-assistant WPS-EULA zi-labone
+EULA 2dboy-EULA AMD-GPU-PRO-EULA android AnyDesk-TOS Aseprite-EULA baudline bestcrypt CAPYBARA-EULA Coherent-Graphics Dell-EULA ETQW f.lux FAH-EULA-2014 Flightradar24 Gameplay-Group-EULA geekbench genymotion GIMPS GOG-EULA google-chrome Intel-SDP Introversion JoyPixels LOKI-EULA MakeMKV-EULA Microsemi microsoft-azurevpnclient microsoft-edge Microsoft-vscode MikroTik Mojang MTA-0.5 NVIDIA-CUDA NVIDIA-SDK Ookla OPERA-2018 PAPERS-PLEASE PassMark-EULA PICO-8 Primate-Plunge PUEL-11 PUEL-12 Q3AEULA-20000111 QUAKE4 RAR sfpg SPS Steam supermicro Synology teamspeak3 teamspeak5 TeamViewer THINKTANKS TIK ubiquiti ut2003 ut2003-demo Vivaldi worklog-assistant WPS-EULA zi-labone
 
 # Deprecated license labels, used by repoman and pkgcheck
 #DEPRECATED (currently none)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/package.deprecated b/sdk_container/src/third_party/portage-stable/profiles/package.deprecated
index d3b1657bffd..49933e11aad 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/package.deprecated
+++ b/sdk_container/src/third_party/portage-stable/profiles/package.deprecated
@@ -28,12 +28,6 @@ dev-python/pytest-lazy-fixture
 # from the removed cgi module rather than rely on this.
 dev-python/legacy-cgi
 
-# Volkmar W. Pogatzki <gentoo@pogatzki.net> (2024-03-10)
-# ant-core should no longer be ussed as of version 1.10.14 or higher.
-# It is now completely integrated in dev-java/ant and will be removed after a
-# grace period.
-dev-java/ant-core
-
 # Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2024-03-09)
 # Unmaintained upstream. Does not build with llvm-16 and up, nor with
 # python-3.12 and up. Please port to Qt6.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/package.mask b/sdk_container/src/third_party/portage-stable/profiles/package.mask
index 46731dc3af0..9158a41af59 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/package.mask
@@ -33,6 +33,93 @@
 
 #--- END OF EXAMPLES ---
 
+# Hans de Graaff <graaff@gentoo.org> (2024-10-06)
+# Obsolete slot without reverse dependencies. Use the newer slot
+# instead. Removal on 2024-11-08.
+dev-ruby/base64:0.1
+
+# Andrew Ammerlaan <andrewammerlaan@gentoo.org>
+# This version is known to break on certain systems. At the
+# same time it fixes several reported issues. Masked until
+# we can work out how to resolve the situation.
+# See also: https://github.com/gentoo/gentoo/pull/36091
+~sys-boot/plymouth-24.004.60
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2024-10-05)
+# Masked for removal in 30 days. Broken since KF6 incapacitated
+# breeze-icons-rcc, but no one even complained. Upstream porting
+# effort stalled indefinitely:
+# https://invent.kde.org/office/kexi/-/issues/152
+# Removal on 2024-11-04.
+app-office/kexi
+dev-db/kdb
+dev-libs/kproperty
+dev-libs/kreport
+kde-frameworks/breeze-icons-rcc
+
+# Sebastian Pipping <sping@gentoo.org> (2024-10-03)
+# Masked for removal in 30 days.  Last release in 2021,
+# last commit two years ago, has open bugs, .. (bug #940725).
+# Also removing its two dependencies that have no other
+# reverse dependencies in Gentoo or known use outside of Lurch.
+net-libs/libaxc
+net-libs/libomemo
+x11-plugins/lurch
+
+# Sam James <sam@gentoo.org> (2024-09-30)
+# GCC 10 and older no longer receive upstream support or fixes for
+# bugs. Please switch to a newer GCC version using gcc-config.
+# The lowest supported version of GCC is GCC 11.
+<sys-devel/gcc-11
+<sys-devel/kgcc64-11
+
+# Michał Górny <mgorny@gentoo.org> (2024-09-29)
+# This package has not been updated since Python 3.11.2.  It bundles
+# part of Python stdlib that's most likely vulnerable by now, as well
+# as some third-party packages.  And it really needs a dedicated
+# maintainer.
+# Removal on 2024-10-29.  Bug #910612.
+dev-python/brython
+
+# Volkmar W. Pogatzki <gentoo@pogatzki.net> (2024-09-28)
+# Nothing depends on it. Removal on 2024-10-28.
+dev-java/ant-core
+
+# Eli Schwartz <eschwartz@gentoo.org> (2024-09-22)
+# Unmaintained, abandoned upstream, does not compile with GCC 14.
+# Removal on 2024-10-22.  Bug #874732.
+dev-util/biew
+
+# Robin H. Johnson <robbat2@gentoo.org> (2024-09-22)
+# Upstream testing release; fails some tests as well here
+# Beware that if you upgrade to it, you may need to reset your keyrings.
+>=app-crypt/gnupg-2.5
+
+# Michał Górny <mgorny@gentoo.org> (2024-09-21)
+# Discontinued upstream.  Since 7.3.17, only 2.7 and 3.10 are released.
+# Vulnerable.
+# Removal on 2024-10-21.  Bug #939951.
+dev-python/pypy3_9
+dev-python/pypy3_9-exe
+dev-python/pypy3_9-exe-bin
+
+# Michał Górny <mgorny@gentoo.org> (2024-09-21)
+# Unmaintained.  Broken with >=dev-python/pytest-8.
+# Replaced by dev-python/pytest-lazy-fixtures.  No revdeps left.
+# Removal on 2024-10-21.  Bug #939420.
+dev-python/pytest-lazy-fixture
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2024-09-20)
+# No more revdeps after app-accessibility/kontrast:5 cleanup.
+# Removal on 2024-10-20.
+dev-db/futuresql5
+
+# Eli Schwartz <eschwartz@gentoo.org> (2024-09-19)
+# Breaks parallel builds with fatal compiler errors.
+# Bug #939798, #939875.
+=dev-python/ensurepip-setuptools-75.1.0
+=dev-python/setuptools-75.1.0
+
 # Hans de Graaff <graaff@gentoo.org> (2024-09-14)
 # Obsolete slots that were used for older cucumber version but that no
 # longer have reverse dependencies. Removal on 2024-10-14.
@@ -86,284 +173,15 @@ dev-ml/dyn
 # Removal on 2024-10-08.  Bug #932532.
 sci-physics/qmeq
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2024-09-07)
-# These packages are EOL in Plasma 6.
-# Removal on 2024-10-07.
-<kde-plasma/khotkeys-5.27.50:5
-<kde-plasma/libkworkspace-5.27.50:5
-<kde-plasma/xembed-sni-proxy-5.27.50:5
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2024-09-07)
-# Mask remaining KDE Gear 23.08.5 packages for removal on 2024-09-21.
-# All of these have KF6-based upgrades available - all users must upgrade.
-~app-cdr/dolphin-plugins-mountiso-23.08.5
-~app-crypt/keysmith-23.08.5
-~kde-apps/ark-23.08.5
-~kde-apps/baloo-widgets-23.08.5
-~kde-apps/bomber-23.08.5
-~kde-apps/bovo-23.08.5
-~kde-apps/dolphin-23.08.5
-~kde-apps/filelight-23.08.5
-~kde-apps/granatier-23.08.5
-~kde-apps/kajongg-23.08.5
-~kde-apps/kapman-23.08.5
-~kde-apps/kate-addons-23.08.5
-~kde-apps/kate-23.08.5
-~kde-apps/kate-lib-23.08.5
-~kde-apps/katomic-23.08.5
-~kde-apps/kbackup-23.08.5
-~kde-apps/kblackbox-23.08.5
-~kde-apps/kblocks-23.08.5
-~kde-apps/kbounce-23.08.5
-~kde-apps/kbreakout-23.08.5
-~kde-apps/kcalc-23.08.5
-~kde-apps/kcalutils-23.08.5
-~kde-apps/kcharselect-23.08.5
-~kde-apps/kdebugsettings-23.08.5
-~kde-apps/kdf-23.08.5
-~kde-apps/kdialog-23.08.5
-~kde-apps/kdiamond-23.08.5
-~kde-apps/keditbookmarks-23.08.5
-~kde-apps/kfind-23.08.5
-~kde-apps/kfourinline-23.08.5
-~kde-apps/kgoldrunner-23.08.5
-~kde-apps/kigo-23.08.5
-~kde-apps/killbots-23.08.5
-~kde-apps/kiriki-23.08.5
-~kde-apps/kjumpingcube-23.08.5
-~kde-apps/klickety-23.08.5
-~kde-apps/klines-23.08.5
-~kde-apps/kmahjongg-23.08.5
-~kde-apps/kmines-23.08.5
-~kde-apps/knavalbattle-23.08.5
-~kde-apps/knetwalk-23.08.5
-~kde-apps/knights-23.08.5
-~kde-apps/kolf-23.08.5
-~kde-apps/kollision-23.08.5
-~kde-apps/kolourpaint-24.02.2
-~kde-apps/konquest-23.08.5
-~kde-apps/konsole-23.08.5
-~kde-apps/kpat-23.08.5
-~kde-apps/kreversi-23.08.5
-~kde-apps/kshisen-23.08.5
-~kde-apps/ksirk-23.08.5
-~kde-apps/ksnakeduel-23.08.5
-~kde-apps/kspaceduel-23.08.5
-~kde-apps/ksquares-23.08.5
-~kde-apps/ksudoku-23.08.5
-~kde-apps/kteatime-23.08.5
-~kde-apps/ktimer-23.08.5
-~kde-apps/ktuberling-23.08.5
-~kde-apps/kubrick-23.08.5
-~kde-apps/kwalletmanager-23.08.5
-~kde-apps/kwrite-23.08.5
-~kde-apps/libkdegames-23.08.5
-~kde-apps/libkmahjongg-23.08.5
-~kde-apps/lskat-23.08.5
-~kde-apps/palapeli-23.08.5
-~kde-apps/picmi-23.08.5
-~kde-apps/sweeper-23.08.5
-~kde-apps/yakuake-23.08.5
-~kde-misc/kclock-23.08.5
-~kde-misc/kweather-23.08.5
-~kde-misc/markdownpart-23.08.5
-~media-gfx/skanpage-23.08.5
-~sys-block/partitionmanager-23.08.5
-~sys-libs/kpmcore-23.08.5
-<media-libs/pulseaudio-qt-1.4.0
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2024-09-07)
-# Plasma 6 is not planned to be going stable on x86.
-# Plasma 5 will be cleaned up shortly. Removal on 2024-09-21.
-<kde-plasma/bluedevil-5.27.50:5
-<kde-plasma/breeze-5.27.50:5
-<kde-plasma/breeze-grub-5.27.50:5
-<kde-plasma/breeze-gtk-5.27.50:5
-<kde-plasma/breeze-plymouth-5.27.50:5
-<kde-plasma/discover-5.27.50:5
-<kde-plasma/drkonqi-5.27.50:5
-<kde-plasma/flatpak-kcm-5.27.50:5
-<kde-plasma/kactivitymanagerd-5.27.50:5
-<kde-plasma/kde-cli-tools-5.27.50:5
-<kde-plasma/kde-gtk-config-5.27.50:5
-<kde-plasma/kdecoration-5.27.50:5
-<kde-plasma/kdeplasma-addons-5.27.50:5
-<kde-plasma/kgamma-5.27.50:5
-<kde-plasma/kinfocenter-5.27.50:5
-<kde-plasma/kmenuedit-5.27.50:5
-<kde-plasma/kpipewire-5.27.50:5
-<kde-plasma/kscreen-5.27.50:5
-<kde-plasma/kscreenlocker-5.27.50:5
-<kde-plasma/ksshaskpass-5.27.50:5
-<kde-plasma/ksystemstats-5.27.50:5
-<kde-plasma/kwallet-pam-5.27.50:5
-<kde-plasma/kwin-5.27.50:5
-<kde-plasma/kwrited-5.27.50:5
-<kde-plasma/layer-shell-qt-5.27.50:5
-<kde-plasma/libksysguard-5.27.50:5
-<kde-plasma/milou-5.27.50:5
-<kde-plasma/oxygen-5.27.50:5
-<kde-plasma/oxygen-sounds-5.27.50:5
-<kde-plasma/plasma-browser-integration-5.27.50:5
-<kde-plasma/plasma-desktop-5.27.50:5
-<kde-plasma/plasma-disks-5.27.50:5
-<kde-plasma/plasma-firewall-5.27.50:5
-<kde-plasma/plasma-integration-5.27.50:5
-<kde-plasma/plasma-meta-5.27.50:5
-<kde-plasma/plasma-nm-5.27.50:5
-<kde-plasma/plasma-pa-5.27.50:5
-<kde-plasma/plasma-sdk-5.27.50:5
-<kde-plasma/plasma-systemmonitor-5.27.50:5
-<kde-plasma/plasma-thunderbolt-5.27.50:5
-<kde-plasma/plasma-workspace-5.27.50:5
-<kde-plasma/plasma-workspace-wallpapers-5.27.50:5
-<kde-plasma/plasma-vault-5.27.50:5
-<kde-plasma/plasma-welcome-5.27.50:5
-<kde-plasma/plymouth-kcm-5.27.50:5
-<kde-plasma/powerdevil-5.27.50:5
-<kde-plasma/sddm-kcm-5.27.50:5
-<kde-plasma/systemsettings-5.27.50:5
-<kde-plasma/xdg-desktop-portal-kde-5.27.50:5
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2024-09-04)
-# Unmaintained upstream, latest media-libs/phonon release incompatible.
-# Removal on 2024-10-04.
-media-libs/phonon-gstreamer
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2024-09-04)
-# KF5 Porting aids (from KDElibs4). No more, or PMASKED revdeps.
-# Removal on 2024-10-04. Bug #755956
-kde-frameworks/khtml
-kde-frameworks/kjs
-kde-frameworks/kross
-
 # Fabian Groffen <grobian@gentoo.org> (2024-09-02)
 # exim_tinydb utility crashes due to invalid free() (used in startup script)
 =mail-mta/exim-4.98
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2024-08-31)
-# All users must upgrade to KDE PIM 6.
-# KDE PIM 5 depends on deprecated kde-frameworks/kross:5,
-# blocking deprecated dev-qt/qtscript:5 removal, and deprecated
-# dev-qt/qtwebengine:5.
-# x86 users: This is the end of the road for KDE PIM on x86. Export
-# your data with kde-apps/pim-data-exporter, if necessary, and migrate
-# to alternative PIM applications.
-# Bugs #810493, #925720. Removal on 2024-09-31.
-<app-office/merkuro-23.08.50
-<kde-apps/akonadi-23.08.50
-<kde-apps/akonadi-calendar-23.08.50
-<kde-apps/akonadi-contacts-23.08.50
-<kde-apps/akonadi-import-wizard-23.08.50
-<kde-apps/akonadi-mime-23.08.50
-<kde-apps/akonadi-notes-23.08.50
-<kde-apps/akonadi-search-23.08.50
-<kde-apps/akonadiconsole-23.08.50
-<kde-apps/akregator-23.08.50
-<kde-apps/calendarjanitor-23.08.50
-<kde-apps/calendarsupport-23.08.50
-<kde-apps/eventviews-23.08.50
-<kde-apps/grantlee-editor-23.08.50
-<kde-apps/grantleetheme-23.08.50
-<kde-apps/incidenceeditor-23.08.50
-<kde-apps/kaddressbook-23.08.50
-<kde-apps/kalarm-23.08.50
-<kde-apps/kcalutils-23.08.50
-<kde-apps/kdepim-addons-23.08.50
-<kde-apps/kdepim-meta-23.08.50
-<kde-apps/kdepim-runtime-23.08.50
-<kde-apps/kidentitymanagement-23.08.50
-<kde-apps/kimap-23.08.50
-<kde-apps/kitinerary-23.08.50
-<kde-apps/kldap-23.08.50
-<kde-apps/kleopatra-23.08.50
-<kde-apps/kmail-23.08.50
-<kde-apps/kmail-account-wizard-23.08.50
-<kde-apps/kmailtransport-23.08.50
-<kde-apps/kmbox-23.08.50
-<kde-apps/kmime-23.08.50
-<kde-apps/knotes-23.08.50
-<kde-apps/konsolekalendar-23.08.50
-<kde-apps/kontact-23.08.50
-<kde-apps/kontactinterface-23.08.50
-<kde-apps/korganizer-23.08.50
-<kde-apps/kpimtextedit-23.08.50
-<kde-apps/kpkpass-23.08.50
-<kde-apps/ksmtp-23.08.50
-<kde-apps/libgravatar-23.08.50
-<kde-apps/libkdepim-23.08.50
-<kde-apps/libkleo-23.08.50
-<kde-apps/libksieve-23.08.50
-<kde-apps/libktnef-23.08.50
-<kde-apps/mailcommon-23.08.50
-<kde-apps/mailimporter-23.08.50
-<kde-apps/mbox-importer-23.08.50
-<kde-apps/messagelib-23.08.50
-<kde-apps/pim-data-exporter-23.08.50
-<kde-apps/pim-sieve-editor-23.08.50
-<kde-apps/pimcommon-23.08.50
-<kde-misc/zanshin-23.08.50
-<kde-apps/kgpg-23.08.50
-app-text/kjots:5
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2024-08-31)
-# This is so old that it was only kept alive as KF5-based snapshot of an
-# upstream git branch containing a single "Initial port to KF/Qt5 (back in
-# 2017). That was never merged to master, project archived for a long time.
-# Bug #759772. Removal on 2024-09-31.
-media-gfx/kcoloredit
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2024-08-29)
-# No signs of development upstream (last commit in 2016). If you use this,
-# please ping them in order to get it ported over to KF6.
-# Removal on 2024-09-29.
-kde-misc/ktoshiba
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2024-08-29)
-# This is so old that it was only kept alive as KF5-based version by means
-# of a downstream patch porting away from KDElibs4 (back in 2014!). Not
-# functional in KIO-6 revdeps. Removal on 2024-09-29.
-kde-misc/openofficeorg-thumbnail
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2024-08-29)
-# Long unmaintained Plasma 5-only desktop widget. Removal on 2024-09-29.
-kde-misc/plasma-applet-network-monitor
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2024-08-29)
-# This is so old that it was only kept alive as KF5-based version by means
-# of a downstream patch porting away from KDElibs4. No reports of it even
-# being in a working state (e.g. bug 813031). Removal on 2024-09-29.
-kde-misc/kio-locate
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2024-08-25)
-# Broken with current Plasma 5 version, not ported to Plasma 6.
-# Removal on 2024-09-24.
-kde-misc/latte-dock
-
 # Florian Schmaus <flow@gentoo.org> (2024-08-23)
 # Has a serious bug that causes synced directories to end up world read-
 # and writeable. See https://github.com/nextcloud/desktop/issues/6863
 >=net-misc/nextcloud-client-3.13.1
 
-# Arsen Arsenović <arsen@gentoo.org> (2024-08-02)
-# Guile rework masks.  Mask all packages or package versions that are
-# being bumped as part of the Guile reslotting process.
-# Masked until the whole Guile ecosystem is updated.
->=dev-scheme/slib-3.3.1-r100
-www-apps/haunt
-dev-scheme/guile-commonmark
->=dev-scheme/guile-reader-0.6.3-r100
-dev-scheme/guile:2.2
-dev-scheme/guile:3.0
->=dev-build/make-4.4.1-r100
-
-# Eli Schwartz <eschwartz@gentoo.org> (2024-08-15)
-# Abandoned upstream since 2011, unmaintained in gentoo since 2017. Tons of
-# patches, breaks again with GCC 14. Severe QA issues, automagic dependencies,
-# sole reverse dependency wants to remove it anyway.
-# Removal on 2024-09-14. Bug #829229, #854900, #863959, #880839, #882265, #931102, #914924.
-app-text/cuneiform
-
 # Ionen Wolkens <ionen@gentoo.org> (2024-08-11)
 # >=1.1.14 enables usage of explicit sync (with >=nvidia-drivers-560
 # and compositors that supports like kwin-6), which currently seems
@@ -387,13 +205,6 @@ app-text/cuneiform
 >=dev-libs/gobject-introspection-common-1.80
 >=x11-terms/ptyxis-46
 
-# Joonas Niilola <juippis@gentoo.org> (2024-08-07)
-# Upstream doesn't recommend updating from 115 just yet. New
-# installs are fine. Downgrading from 128 to 115 may be impossible
-# so have backups ready if you attempt an upgrade.
->=mail-client/thunderbird-128.1.0
->=mail-client/thunderbird-bin-128.1.0
-
 # Eli Schwartz <eschwartz@gentoo.org> (2024-07-29)
 # Bad version can result in failing builds. Please upgrade to 72.1.0.
 =dev-python/ensurepip-setuptools-72.0.0
@@ -525,6 +336,7 @@ dev-ml/ppx_js_style:0/0.17
 >=xfce-base/garcon-4.19
 >=xfce-base/libxfce4ui-4.19
 >=xfce-base/libxfce4util-4.19
+>=xfce-base/libxfce4windowing-4.19.5
 >=xfce-base/thunar-4.19
 >=xfce-base/tumbler-4.19
 >=xfce-base/xfce4-appfinder-4.19
@@ -590,13 +402,6 @@ sec-keys/openpgp-keys-jiatan
 <sys-kernel/gentoo-kernel-5.10
 <virtual/dist-kernel-5.10
 
-# Sam James <sam@gentoo.org> (2023-11-19)
-# GCC 10 and older no longer receive upstream support or fixes for
-# bugs. Please switch to a newer GCC version using gcc-config.
-# The lowest supported version of GCC is GCC 11.
-<sys-devel/gcc-11
-<sys-devel/kgcc64-11
-
 # Sam James <sam@gentoo.org> (2023-09-09)
 # OpenSSL 1.1.x is EOL on 2023-09-11. Please upgrade immediately to >= OpenSSL 3.
 # https://www.openssl.org/blog/blog/2023/03/28/1.1.1-EOL/
@@ -713,20 +518,6 @@ dev-build/automake:1.11
 media-plugins/kodi-game-libretro-nestopia
 media-plugins/kodi-game-libretro-dosbox
 
-# Sam James <sam@gentoo.org> (2020-10-05)
-# Masked for testing. New major versions of Guile
-# often break reverse dependencies.
-# Guile in Gentoo is not slotted, so let's be cautious.
-# bug #705554, bug #689408.
->=dev-scheme/guile-3.0.4
-
-# Matt Turner <mattst88@gentoo.org> (2019-09-01)
-# TeXmacs is the only remaining package in tree that requires guile-1.8, which
-# is unsupported upstream. A TeXmacs port to Guile-2 has been in progress for a
-# few years. Bug #436400
-app-office/texmacs
-<dev-scheme/guile-2
-
 # Andreas Sturmlechner <asturm@gentoo.org> (2018-10-07)
 # Masked for more testing especially of reverse-deps.
 # ogre 1.11/1.12 breakage: bug #834468
@@ -763,9 +554,9 @@ app-office/texmacs
 # switch the compiler / the binutils) ASAP. If you need them for a specific
 # (isolated) use case, feel free to unmask them on your system.
 <sys-libs/glibc-2.38-r10
-<sys-libs/binutils-libs-2.40
-<sys-devel/binutils-2.40
-<sys-devel/binutils-hppa64-2.40
+<sys-libs/binutils-libs-2.42
+<sys-devel/binutils-2.42
+<sys-devel/binutils-hppa64-2.42
 
 # Michael Orlitzky <mjo@gentoo.org> (2017-01-07)
 # This package has some dangerous quality and security issues, but
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/arm64/clang/eapi b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/arm64/clang/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/arm64/clang/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/arm64/clang/parent b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/arm64/clang/parent
new file mode 100644
index 00000000000..855aaf17596
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/arm64/clang/parent
@@ -0,0 +1,2 @@
+..
+../../../features/clang-lld
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/arm64/eapi b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/arm64/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/arm64/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/arm64/gcc/eapi b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/arm64/gcc/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/arm64/gcc/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/arm64/gcc/parent b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/arm64/gcc/parent
new file mode 100644
index 00000000000..5ebbfd24d62
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/arm64/gcc/parent
@@ -0,0 +1,2 @@
+..
+../../../features/fsf-gcc-nold
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/arm64/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/arm64/make.defaults
new file mode 100644
index 00000000000..d998178e018
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/arm64/make.defaults
@@ -0,0 +1,5 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+CHOST="arm64-apple-darwin24"
+CHOST_arm64="${CHOST}"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/arm64/parent b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/arm64/parent
new file mode 100644
index 00000000000..a75c3ad0a55
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/arm64/parent
@@ -0,0 +1,2 @@
+..
+../../arch/arm64
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/eapi b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/make.defaults
new file mode 100644
index 00000000000..5ea2db2a3f0
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/make.defaults
@@ -0,0 +1,4 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+MACOSX_DEPLOYMENT_TARGET="15.0"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/package.use.mask
new file mode 100644
index 00000000000..0d222cee3b5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/package.use.mask
@@ -0,0 +1,7 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# Fabian Groffen <grobian@gentoo.org> (2011-04-10)
+# as long as util-linux installs uuid.h which breaks the system headers
+# (hence we don't) we can't do uuid support here
+x11-libs/libSM -uuid
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/parent b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/parent
new file mode 100644
index 00000000000..f3229c5b987
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/parent
@@ -0,0 +1 @@
+..
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/profile.bashrc b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/profile.bashrc
new file mode 100644
index 00000000000..933758acd5d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/profile.bashrc
@@ -0,0 +1,4 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+export MACOSX_DEPLOYMENT_TARGET=15.0
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/x64/eapi b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/x64/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/x64/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/x64/gcc/eapi b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/x64/gcc/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/x64/gcc/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/x64/gcc/parent b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/x64/gcc/parent
new file mode 100644
index 00000000000..fceecddb55c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/x64/gcc/parent
@@ -0,0 +1,2 @@
+..
+../../../features/fsf-gcc-ld64
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/x64/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/x64/make.defaults
new file mode 100644
index 00000000000..ec3bbe571ae
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/x64/make.defaults
@@ -0,0 +1,5 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+CHOST="x86_64-apple-darwin24"
+CHOST_amd64="${CHOST}"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/x64/parent b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/x64/parent
new file mode 100644
index 00000000000..269f6f48bb1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/15.0/x64/parent
@@ -0,0 +1,2 @@
+..
+../../arch/x64
diff --git a/sdk_container/src/third_party/portage-stable/profiles/profiles.desc b/sdk_container/src/third_party/portage-stable/profiles/profiles.desc
index e06559fd61d..445189fc42e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/profiles.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/profiles.desc
@@ -725,12 +725,14 @@ x64-macos	prefix/darwin/macos/12.0/x64					exp
 x64-macos	prefix/darwin/macos/12.0/x64/gcc				exp
 x64-macos	prefix/darwin/macos/13.0/x64/gcc				exp
 x64-macos	prefix/darwin/macos/14.0/x64/gcc				exp
+x64-macos	prefix/darwin/macos/15.0/x64/gcc				exp
 arm64-macos	prefix/darwin/macos/11.0/arm64					exp
 arm64-macos	prefix/darwin/macos/11.0/arm64/gcc				exp
 arm64-macos	prefix/darwin/macos/12.0/arm64					exp
 arm64-macos	prefix/darwin/macos/12.0/arm64/gcc				exp
 arm64-macos	prefix/darwin/macos/13.0/arm64/gcc				exp
 arm64-macos	prefix/darwin/macos/14.0/arm64/gcc				exp
+arm64-macos	prefix/darwin/macos/15.0/arm64/gcc				exp
 
 # Solaris Profiles
 x64-solaris	prefix/sunos/solaris/5.11/x64					exp
diff --git a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/gnome/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/gnome/make.defaults
index 3f9e6955f3b..2dc85fe967c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/gnome/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/gnome/make.defaults
@@ -1,4 +1,4 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-USE="colord eds evo gnome gnome-keyring gnome-online-accounts gnome-shell gstreamer introspection keyring nautilus networkmanager pulseaudio sysprof tracker wayland"
+USE="colord eds evo gnome gnome-keyring gnome-online-accounts gnome-shell gstreamer introspection keyring nautilus networkmanager pulseaudio sysprof tracker"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/gnome/package.use b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/gnome/package.use
index 3914d0992c9..a60190ee8b3 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/gnome/package.use
+++ b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/gnome/package.use
@@ -1,15 +1,6 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Alfred Wingate <parona@protonmail.com> (2023-12-25)
-# Prefer wayland over X with REQUIRED_USE: ^^ ( gbm wayland X )
->=media-tv/kodi-20.2 wayland -X
-
-# Mart Raudsepp <leio@gentoo.org> (2023-10-01)
-# x11-wm/mutter[wayland] requires xwayland[libei] for emulated input portal
-# for e.g. remote desktop remote input support
-x11-base/xwayland libei
-
 # Mart Raudsepp <leio@gentoo.org> (2022-01-05)
 # gnome-boxes requires spice-gtk[vala]
 net-misc/spice-gtk vala
@@ -32,15 +23,6 @@ dev-libs/efl sound
 # Needed by gnome-photos
 media-libs/gegl raw
 
-# Needed by a global USE=wayland right now; some REQUIRED_USE may be outdated and need review
->=media-libs/cogl-1.18.2-r1 gles2
->=media-libs/clutter-1.20 egl
-media-libs/cogl kms
-media-libs/libsdl2 gles2
-
-# Needed by mutter defaults and USE=wayland, bug #547300
->=media-libs/mesa-10.3 gles2
-
 # For eautoreconf in =app-crypt/seahorse-3.10.2-r1
 app-crypt/gcr vala
 
diff --git a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/make.defaults
index 02e4f168b0a..3e4f9fd3998 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/make.defaults
@@ -1,4 +1,4 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-USE="a52 aac acpi alsa bluetooth branding cairo cdda cdr cups dbus dri dts dvd dvdr elogind encode exif flac gif gpm gtk gui icu jpeg kf6compat lcms libnotify mad mng mp3 mp4 mpeg ogg opengl pango pdf png policykit ppds qml qt6 qt5 sdl sound spell startup-notification svg tiff truetype vorbis udev udisks unicode upower usb vulkan wxwidgets X xcb xft x264 xml xv xvid"
+USE="a52 aac acpi alsa bluetooth branding cairo cdda cdr cups dbus dri dts dvd dvdr elogind encode exif flac gif gpm gtk gui icu jpeg kf6compat lcms libnotify mad mng mp3 mp4 mpeg ogg opengl pango pdf png policykit ppds qml qt6 qt5 sdl sound spell startup-notification svg tiff truetype vorbis udev udisks unicode upower usb vulkan wayland wxwidgets X xcb xft x264 xml xv xvid"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/package.use b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/package.use
index 82330969f09..fda02fd6d08 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/package.use
+++ b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/package.use
@@ -10,10 +10,6 @@ net-p2p/transmission -qt5
 # Required by kde-frameworks/kio:6
 dev-qt/qtbase libproxy
 
-# Alfred Wingate <parona@protonmail.com> (2023-12-25)
-# Prefer X over gbm with REQUIRED_USE: ^^ ( gbm wayland X )
->=media-tv/kodi-20.2 X -gbm
-
 # Andreas Sturmlechner <asturm@gentoo.org> (2023-11-12)
 # NSS: Required by kde-apps/okular[pdf]
 # Boost: app-text/poppler[qt5] recommended w/ Boost (bug #795888)
@@ -24,6 +20,11 @@ app-text/poppler nss boost
 # accessibility required by kde-plasma/kwin:5
 dev-qt/qtgui:5 accessibility egl libinput
 
+# Mart Raudsepp <leio@gentoo.org> (2023-10-01)
+# kde-plasma/kwin and x11-wm/mutter[wayland] require xwayland[libei] for
+# emulated input portal for e.g. remote desktop remote input support
+x11-base/xwayland libei
+
 # Sam James <sam@gentoo.org> (2023-09-22)
 # Most people aren't going to use CMake's GUI. USE=gui is enabled by default
 # on desktop profiles and CMake is unavoidable, it feels a shame to drag in
@@ -35,6 +36,13 @@ dev-build/cmake -gui -qt6
 # Required by dev-python/PyQt5[multimedia]
 dev-qt/qtmultimedia:5 widgets
 
+# Andreas Sturmlechner <asturm@gentoo.org> (2023-05-21)
+# Needed by a global USE=wayland right now (REQUIRED_USE conflicts)
+media-libs/clutter egl
+media-libs/cogl gles2
+media-libs/libsdl2 gles2
+<media-libs/mesa-24.1 gles2
+
 # Alexey Sokolov <alexey+gentoo@asokolov.org> (2022-12-27)
 # On desktops it's common to use browser to browse internet, which these
 # days is full of emojis, which wouldn't render properly without the fonts.
@@ -48,11 +56,6 @@ dev-lang/python -bluetooth
 # Required by media-gfx/digikam, kde-apps/libkexiv2
 media-gfx/exiv2 xmp
 
-# Lars Wendler <polynomial-c@gentoo.org> (2020-08-06)
-# USE="qt5" and USE="libnotify" are mutually exclusive in this package
-# Disable libnotify here to have a better user experience
-net-misc/dhcpcd-ui -libnotify
-
 # Andreas Sturmlechner <asturm@gentoo.org> (2020-02-05)
 # Required by many packages, most notably Mozilla products
 dev-lang/python sqlite
diff --git a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/make.defaults
index 7f42ef98fc5..952f3e112e0 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/make.defaults
@@ -1,4 +1,4 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-USE="activities declarative dri kde kwallet networkmanager pipewire plasma policykit pulseaudio screencast semantic-desktop wayland widgets"
+USE="activities declarative dri kde kwallet networkmanager pipewire plasma policykit pulseaudio screencast semantic-desktop widgets"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/package.use b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/package.use
index 88e56d0ddcf..47695fff68d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/package.use
+++ b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/package.use
@@ -1,10 +1,6 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Alfred Wingate <parona@protonmail.com> (2023-12-25)
-# Prefer wayland over X with REQUIRED_USE: ^^ ( gbm wayland X )
->=media-tv/kodi-20.2 wayland -X
-
 # Marek Szuba <marecki@gentoo.org> (2023-11-12)
 # FUSE cannot be built with multiple audio drivers, and desktop/gnome
 # profiles set both USE=pulseaudio (directly) and USE=alsa (inherited
@@ -29,25 +25,15 @@ dev-util/ostree curl
 # Required by app-editors/okteta:5
 dev-qt/qtscript:5 scripttools
 
-# Required by kde-apps/akonadi:5
-dev-qt/qtsql:5 mysql
+# Required by kde-apps/akonadi:6
+dev-qt/qtbase:6 mysql
 
 # Enable by default, requires kde-frameworks/kwayland
 kde-apps/yakuake absolute-position
 
-# Required by kde-plasma/plasma-workspace, in ksmserver
-kde-plasma/kde-cli-tools kdesu
-
 # Required by media-gfx/graphviz which is required by kde-apps/kcachegrind
 media-libs/gd fontconfig
 
-# Needed by a global USE=wayland right now
-media-libs/libsdl2 gles2
-
-# Required by kde-plasma/kwin
-media-libs/mesa wayland
-x11-base/xwayland libei
-
 # Required by kde-apps/kdenlive
 media-libs/mlt ffmpeg frei0r rubberband
 
diff --git a/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2024 b/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2024
index d71acfa1d52..ade5eb7db7b 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2024
+++ b/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2024
@@ -7,3 +7,5 @@ slotmove app-admin/calamares 5 0
 slotmove x11-misc/kronometer 5 0
 slotmove app-dicts/dikt 5 0
 slotmove app-cdr/kcdemu 5 0
+move sys-apps/azure-nvme-utils sys-apps/azure-vm-utils
+move dev-python/sphinx-aiohttp-theme dev-python/aiohttp-theme
diff --git a/sdk_container/src/third_party/portage-stable/profiles/updates/4Q-2024 b/sdk_container/src/third_party/portage-stable/profiles/updates/4Q-2024
new file mode 100644
index 00000000000..519f651e476
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/updates/4Q-2024
@@ -0,0 +1 @@
+move dev-python/pyopengl_accelerate dev-python/pyopengl-accelerate
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-base-policy/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-base-policy/Manifest
index 2f21ce1ea09..abf41634d69 100644
--- a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-base-policy/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-base-policy/Manifest
@@ -1,3 +1,5 @@
 DIST patchbundle-selinux-base-policy-2.20240226-r1.tar.bz2 430565 BLAKE2B 2d552f868375c240e71e987542a3026970f1d375d7d1e65f11386ce1b07aae84911ded2379fc768ff4bff664eb98dc3361a7392467fed3feb4916477eb957f58 SHA512 f22245ad8759d88ddbf26b71443e4ba8c804fc80d69383120ed98b7887d08a7034b8125e4d15e695b26776ef4ac1a933e14a1a382d5be90aa942358842cc6c77
 DIST patchbundle-selinux-base-policy-2.20240226-r2.tar.bz2 442650 BLAKE2B f2f7c5e4a595afafc072fd78fc4ef3930cf739d05cbe9670f2fb2956fe84e3045518345e103bc3880603d2562f06ba0597fc005d8d394e9f8cd057363f9bf95f SHA512 2cb00d088eebdb098a6496f156eeb3dcee026fc6e53d732bac5bc8a4cfee1ce3bf2bdbbbfbbe9bba237d61c06f299d96bb9d123a57a44aaaa17cc122e15ea268
+DIST patchbundle-selinux-base-policy-2.20240916-r1.tar.bz2 274891 BLAKE2B 72b8181424450998164979ab582e8edee6d73b9110b4535e7880d1f7c989bd0ac391422872858da7bad3e3d77516996af93aa2f149f7d4a7f8fd329c481964cf SHA512 fd8259c91cc779301d6e0964827133529a9141dc235301da135210ea4359b800023848a25e33c45678477fa4f54e75da51be9ec85a3bed8b07cf5487e73b84f3
 DIST refpolicy-2.20240226.tar.bz2 610561 BLAKE2B 5dc54dcf7238776d4e4b282c1dcbc499f45c0d96676dbf931da39592854034874b5dd6197a2e2776fccec5106d5f245eea3fb9419959bd4d61e9b2c12aeaaa85 SHA512 896a57afb024bd131f25d2831a9a5ac90ee7e5d76b0565bc818c156f6c310d86758bcd4cedbd9df5b29954c9a92a42300d16685a7e07a5efd8f789320724b3f9
+DIST refpolicy-2.20240916.tar.bz2 618218 BLAKE2B d86ca75d254eef10f4aa57ef3977825211200cdf1eaa9bf9d416c9a52acee476b3f8719c3b0c8c17fdff2abc0c396989961e37e313a7b3bd3b4b0266a6280e75 SHA512 a8b6c90f8e186796b4c7db1e2d8ed3c3b8690bb5b8f180dcb6d5468ba80467e2969012c4edddf74429c0f5ce900d68fbbc0c2f8e253165af28f93f191039f064
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-base-policy/selinux-base-policy-2.20240916-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-base-policy/selinux-base-policy-2.20240916-r1.ebuild
new file mode 100644
index 00000000000..aed954eecb2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-base-policy/selinux-base-policy-2.20240916-r1.ebuild
@@ -0,0 +1,141 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+if [[ ${PV} == 9999* ]]; then
+	EGIT_REPO_URI="${SELINUX_GIT_REPO:-https://anongit.gentoo.org/git/proj/hardened-refpolicy.git}"
+	EGIT_BRANCH="${SELINUX_GIT_BRANCH:-master}"
+	EGIT_CHECKOUT_DIR="${WORKDIR}/refpolicy"
+
+	inherit git-r3
+else
+	SRC_URI="https://github.com/SELinuxProject/refpolicy/releases/download/RELEASE_${PV/./_}/refpolicy-${PV}.tar.bz2
+			https://dev.gentoo.org/~perfinion/patches/${PN}/patchbundle-${PN}-${PVR}.tar.bz2"
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:SELinux"
+DESCRIPTION="SELinux policy for core modules"
+
+IUSE="systemd +unconfined"
+
+PDEPEND="unconfined? ( sec-policy/selinux-unconfined )"
+DEPEND="=sec-policy/selinux-base-${PVR}[systemd?]"
+RDEPEND="${DEPEND}"
+BDEPEND="
+	sys-apps/checkpolicy
+	sys-devel/m4"
+
+MODS="application authlogin bootloader clock consoletype cron dmesg fstools getty hostname init iptables libraries locallogin logging lvm miscfiles modutils mount mta netutils nscd portage raid rsync selinuxutil setrans ssh staff storage su sysadm sysnetwork systemd tmpfiles udev userdomain usermanage unprivuser xdg"
+DEL_MODS="hotplug"
+LICENSE="GPL-2"
+SLOT="0"
+S="${WORKDIR}/"
+
+# Code entirely copied from selinux-eclass (cannot inherit due to dependency on
+# itself), when reworked reinclude it. Only postinstall (where -b base.pp is
+# added) needs to remain then.
+
+pkg_pretend() {
+	for i in ${POLICY_TYPES}; do
+		if [[ "${i}" == "targeted" ]] && ! use unconfined; then
+			die "If you use POLICY_TYPES=targeted, then USE=unconfined is mandatory."
+		fi
+	done
+}
+
+src_prepare() {
+	local modfiles
+
+	if [[ ${PV} != 9999* ]]; then
+		einfo "Applying SELinux policy updates ... "
+		eapply -p0 "${WORKDIR}/0001-full-patch-against-stable-release.patch"
+	fi
+
+	eapply_user
+
+	# Collect only those files needed for this particular module
+	for i in ${MODS}; do
+		modfiles="$(find "${S}"/refpolicy/policy/modules -iname $i.te) $modfiles"
+		modfiles="$(find "${S}"/refpolicy/policy/modules -iname $i.fc) $modfiles"
+	done
+
+	for i in ${DEL_MODS}; do
+		[[ "${MODS}" != *${i}* ]] || die "Duplicate module in MODS and DEL_MODS: ${i}"
+	done
+
+	for i in ${POLICY_TYPES}; do
+		mkdir "${S}"/${i} || die "Failed to create directory ${S}/${i}"
+		cp "${S}"/refpolicy/doc/Makefile.example "${S}"/${i}/Makefile \
+			|| die "Failed to copy Makefile.example to ${S}/${i}/Makefile"
+
+		cp ${modfiles} "${S}"/${i} \
+			|| die "Failed to copy the module files to ${S}/${i}"
+	done
+}
+
+src_compile() {
+	for i in ${POLICY_TYPES}; do
+		emake NAME=$i SHAREDIR="${SYSROOT%/}/usr/share/selinux" -C "${S}"/${i}
+	done
+}
+
+src_install() {
+	local BASEDIR="/usr/share/selinux"
+
+	for i in ${POLICY_TYPES}; do
+		for j in ${MODS}; do
+			einfo "Installing ${i} ${j} policy package"
+			insinto ${BASEDIR}/${i}
+			doins "${S}"/${i}/${j}.pp
+		done
+	done
+}
+
+pkg_postinst() {
+	# Set root path and don't load policy into the kernel when cross compiling
+	local root_opts=""
+	if [[ "${ROOT}" != "" ]]; then
+		root_opts="-p ${ROOT} -n"
+	fi
+
+	# Override the command from the eclass, we need to load in base as well here
+	local COMMAND="-i base.pp"
+	if has_version "<sys-apps/policycoreutils-2.5"; then
+		COMMAND="-b base.pp"
+	fi
+
+	for i in ${MODS}; do
+		COMMAND="${COMMAND} -i ${i}.pp"
+	done
+
+	for i in ${POLICY_TYPES}; do
+		einfo "Inserting the following modules, with base, into the $i module store: ${MODS}"
+
+		cd "${ROOT}/usr/share/selinux/${i}"
+
+		semodule ${root_opts} -s ${i} ${COMMAND}
+
+		for mod in ${DEL_MODS}; do
+			if semodule ${root_opts} -s ${i} -l | grep -q "\b${mod}\b"; then
+				einfo "Removing obsolete ${i} ${mod} policy package"
+				semodule ${root_opts} -s ${i} -r ${mod}
+			fi
+		done
+	done
+
+	# Don't relabel when cross compiling
+	if [[ "${ROOT}" == "" ]]; then
+		# Relabel depending packages
+		local PKGSET="";
+		if [[ -x /usr/bin/qdepends ]] ; then
+			PKGSET=$(/usr/bin/qdepends -Cq -r -Q ${CATEGORY}/${PN} | grep -v 'sec-policy/selinux-');
+		elif [[ -x /usr/bin/equery ]] ; then
+			PKGSET=$(/usr/bin/equery -Cq depends ${CATEGORY}/${PN} | grep -v 'sec-policy/selinux-');
+		fi
+		if [[ -n "${PKGSET}" ]] ; then
+			rlpkg ${PKGSET};
+		fi
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-base/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-base/Manifest
index 2f21ce1ea09..abf41634d69 100644
--- a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-base/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-base/Manifest
@@ -1,3 +1,5 @@
 DIST patchbundle-selinux-base-policy-2.20240226-r1.tar.bz2 430565 BLAKE2B 2d552f868375c240e71e987542a3026970f1d375d7d1e65f11386ce1b07aae84911ded2379fc768ff4bff664eb98dc3361a7392467fed3feb4916477eb957f58 SHA512 f22245ad8759d88ddbf26b71443e4ba8c804fc80d69383120ed98b7887d08a7034b8125e4d15e695b26776ef4ac1a933e14a1a382d5be90aa942358842cc6c77
 DIST patchbundle-selinux-base-policy-2.20240226-r2.tar.bz2 442650 BLAKE2B f2f7c5e4a595afafc072fd78fc4ef3930cf739d05cbe9670f2fb2956fe84e3045518345e103bc3880603d2562f06ba0597fc005d8d394e9f8cd057363f9bf95f SHA512 2cb00d088eebdb098a6496f156eeb3dcee026fc6e53d732bac5bc8a4cfee1ce3bf2bdbbbfbbe9bba237d61c06f299d96bb9d123a57a44aaaa17cc122e15ea268
+DIST patchbundle-selinux-base-policy-2.20240916-r1.tar.bz2 274891 BLAKE2B 72b8181424450998164979ab582e8edee6d73b9110b4535e7880d1f7c989bd0ac391422872858da7bad3e3d77516996af93aa2f149f7d4a7f8fd329c481964cf SHA512 fd8259c91cc779301d6e0964827133529a9141dc235301da135210ea4359b800023848a25e33c45678477fa4f54e75da51be9ec85a3bed8b07cf5487e73b84f3
 DIST refpolicy-2.20240226.tar.bz2 610561 BLAKE2B 5dc54dcf7238776d4e4b282c1dcbc499f45c0d96676dbf931da39592854034874b5dd6197a2e2776fccec5106d5f245eea3fb9419959bd4d61e9b2c12aeaaa85 SHA512 896a57afb024bd131f25d2831a9a5ac90ee7e5d76b0565bc818c156f6c310d86758bcd4cedbd9df5b29954c9a92a42300d16685a7e07a5efd8f789320724b3f9
+DIST refpolicy-2.20240916.tar.bz2 618218 BLAKE2B d86ca75d254eef10f4aa57ef3977825211200cdf1eaa9bf9d416c9a52acee476b3f8719c3b0c8c17fdff2abc0c396989961e37e313a7b3bd3b4b0266a6280e75 SHA512 a8b6c90f8e186796b4c7db1e2d8ed3c3b8690bb5b8f180dcb6d5468ba80467e2969012c4edddf74429c0f5ce900d68fbbc0c2f8e253165af28f93f191039f064
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-base/selinux-base-2.20240916-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-base/selinux-base-2.20240916-r1.ebuild
new file mode 100644
index 00000000000..351b84fbcc8
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-base/selinux-base-2.20240916-r1.ebuild
@@ -0,0 +1,158 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_REQ_USE="xml(+)"
+inherit python-any-r1
+
+if [[ ${PV} == 9999* ]]; then
+	EGIT_REPO_URI="${SELINUX_GIT_REPO:-https://anongit.gentoo.org/git/proj/hardened-refpolicy.git}"
+	EGIT_BRANCH="${SELINUX_GIT_BRANCH:-master}"
+	EGIT_CHECKOUT_DIR="${WORKDIR}/refpolicy"
+
+	inherit git-r3
+else
+	SRC_URI="https://github.com/SELinuxProject/refpolicy/releases/download/RELEASE_${PV/./_}/refpolicy-${PV}.tar.bz2
+			https://dev.gentoo.org/~perfinion/patches/selinux-base-policy/patchbundle-selinux-base-policy-${PVR}.tar.bz2"
+
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+
+IUSE="doc +unknown-perms systemd +ubac +unconfined"
+
+DESCRIPTION="Gentoo base policy for SELinux"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:SELinux"
+LICENSE="GPL-2"
+SLOT="0"
+
+RDEPEND=">=sys-apps/policycoreutils-2.8"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	${PYTHON_DEPS}
+	>=sys-apps/checkpolicy-2.8
+	sys-devel/m4"
+
+S=${WORKDIR}/
+
+src_prepare() {
+	if [[ ${PV} != 9999* ]]; then
+		einfo "Applying SELinux policy updates ... "
+		eapply -p0 "${WORKDIR}/0001-full-patch-against-stable-release.patch"
+	fi
+
+	eapply_user
+
+	cd "${S}/refpolicy" || die
+	emake bare
+}
+
+src_configure() {
+	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
+
+	# Update the SELinux refpolicy capabilities based on the users' USE flags.
+	if use unknown-perms; then
+		sed -i -e '/^UNK_PERMS/s/deny/allow/' "${S}/refpolicy/build.conf" \
+			|| die "Failed to allow Unknown Permissions Handling"
+		sed -i -e '/^UNK_PERMS/s/deny/allow/' "${S}/refpolicy/Makefile" \
+			|| die "Failed to allow Unknown Permissions Handling"
+	fi
+
+	if ! use ubac; then
+		sed -i -e '/^UBAC/s/y/n/' "${S}/refpolicy/build.conf" \
+			|| die "Failed to disable User Based Access Control"
+	fi
+
+	if use systemd; then
+		sed -i -e '/^SYSTEMD/s/n/y/' "${S}/refpolicy/build.conf" \
+			|| die "Failed to enable SystemD"
+	fi
+
+	echo "DISTRO = gentoo" >> "${S}/refpolicy/build.conf" || die
+
+	# Prepare initial configuration
+	cd "${S}/refpolicy" || die
+	emake conf
+
+	# Setup the policies based on the types delivered by the end user.
+	# These types can be "targeted", "strict", "mcs" and "mls".
+	for i in ${POLICY_TYPES}; do
+		cp -a "${S}/refpolicy" "${S}/${i}" || die
+		cd "${S}/${i}" || die
+
+		sed -i -e "/= module/d" "${S}/${i}/policy/modules.conf" || die
+
+		sed -i -e '/^QUIET/s/n/y/' -e "/^NAME/s/refpolicy/$i/" \
+			"${S}/${i}/build.conf" || die "build.conf setup failed."
+
+		if [[ "${i}" == "mls" ]] || [[ "${i}" == "mcs" ]];
+		then
+			# MCS/MLS require additional settings
+			sed -i -e "/^TYPE/s/standard/${i}/" "${S}/${i}/build.conf" \
+				|| die "failed to set type to mls"
+		fi
+
+		if [ "${i}" == "targeted" ]; then
+			sed -i -e '/root/d' -e 's/user_u/unconfined_u/' \
+			"${S}/${i}/config/appconfig-standard/seusers" \
+			|| die "targeted seusers setup failed."
+		fi
+
+		if [ "${i}" != "targeted" ] && [ "${i}" != "strict" ] && use unconfined; then
+			sed -i -e '/root/d' -e 's/user_u/unconfined_u/' \
+			"${S}/${i}/config/appconfig-${i}/seusers" \
+			|| die "policy seusers setup failed."
+		fi
+	done
+}
+
+src_compile() {
+	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
+
+	for i in ${POLICY_TYPES}; do
+		cd "${S}/${i}" || die
+		emake base
+		if use doc; then
+			emake html
+		fi
+	done
+}
+
+src_install() {
+	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
+
+	for i in ${POLICY_TYPES}; do
+		cd "${S}/${i}" || die
+
+		emake DESTDIR="${D}" install
+		emake DESTDIR="${D}" install-headers
+
+		echo "run_init_t" > "${D}/etc/selinux/${i}/contexts/run_init_type" || die
+
+		echo "textrel_shlib_t" >> "${D}/etc/selinux/${i}/contexts/customizable_types" || die
+
+		# libsemanage won't make this on its own
+		keepdir "/etc/selinux/${i}/policy"
+
+		if use doc; then
+			docinto ${i}/html
+			dodoc -r doc/html/*;
+		fi
+
+		insinto /usr/share/selinux/devel;
+		doins doc/policy.xml;
+
+	done
+
+	docinto /
+	dodoc doc/Makefile.example doc/example.{te,fc,if}
+
+	doman man/man8/*.8;
+
+	insinto /etc/selinux
+	doins "${FILESDIR}/config"
+
+	insinto /usr/share/portage/config/sets
+	doins "${FILESDIR}/selinux.conf"
+}
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-container/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-container/Manifest
index 2f21ce1ea09..abf41634d69 100644
--- a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-container/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-container/Manifest
@@ -1,3 +1,5 @@
 DIST patchbundle-selinux-base-policy-2.20240226-r1.tar.bz2 430565 BLAKE2B 2d552f868375c240e71e987542a3026970f1d375d7d1e65f11386ce1b07aae84911ded2379fc768ff4bff664eb98dc3361a7392467fed3feb4916477eb957f58 SHA512 f22245ad8759d88ddbf26b71443e4ba8c804fc80d69383120ed98b7887d08a7034b8125e4d15e695b26776ef4ac1a933e14a1a382d5be90aa942358842cc6c77
 DIST patchbundle-selinux-base-policy-2.20240226-r2.tar.bz2 442650 BLAKE2B f2f7c5e4a595afafc072fd78fc4ef3930cf739d05cbe9670f2fb2956fe84e3045518345e103bc3880603d2562f06ba0597fc005d8d394e9f8cd057363f9bf95f SHA512 2cb00d088eebdb098a6496f156eeb3dcee026fc6e53d732bac5bc8a4cfee1ce3bf2bdbbbfbbe9bba237d61c06f299d96bb9d123a57a44aaaa17cc122e15ea268
+DIST patchbundle-selinux-base-policy-2.20240916-r1.tar.bz2 274891 BLAKE2B 72b8181424450998164979ab582e8edee6d73b9110b4535e7880d1f7c989bd0ac391422872858da7bad3e3d77516996af93aa2f149f7d4a7f8fd329c481964cf SHA512 fd8259c91cc779301d6e0964827133529a9141dc235301da135210ea4359b800023848a25e33c45678477fa4f54e75da51be9ec85a3bed8b07cf5487e73b84f3
 DIST refpolicy-2.20240226.tar.bz2 610561 BLAKE2B 5dc54dcf7238776d4e4b282c1dcbc499f45c0d96676dbf931da39592854034874b5dd6197a2e2776fccec5106d5f245eea3fb9419959bd4d61e9b2c12aeaaa85 SHA512 896a57afb024bd131f25d2831a9a5ac90ee7e5d76b0565bc818c156f6c310d86758bcd4cedbd9df5b29954c9a92a42300d16685a7e07a5efd8f789320724b3f9
+DIST refpolicy-2.20240916.tar.bz2 618218 BLAKE2B d86ca75d254eef10f4aa57ef3977825211200cdf1eaa9bf9d416c9a52acee476b3f8719c3b0c8c17fdff2abc0c396989961e37e313a7b3bd3b4b0266a6280e75 SHA512 a8b6c90f8e186796b4c7db1e2d8ed3c3b8690bb5b8f180dcb6d5468ba80467e2969012c4edddf74429c0f5ce900d68fbbc0c2f8e253165af28f93f191039f064
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-container/selinux-container-2.20240916-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-container/selinux-container-2.20240916-r1.ebuild
new file mode 100644
index 00000000000..f905cf5f743
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-container/selinux-container-2.20240916-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="container"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for container"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dbus/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dbus/Manifest
index 2f21ce1ea09..abf41634d69 100644
--- a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dbus/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dbus/Manifest
@@ -1,3 +1,5 @@
 DIST patchbundle-selinux-base-policy-2.20240226-r1.tar.bz2 430565 BLAKE2B 2d552f868375c240e71e987542a3026970f1d375d7d1e65f11386ce1b07aae84911ded2379fc768ff4bff664eb98dc3361a7392467fed3feb4916477eb957f58 SHA512 f22245ad8759d88ddbf26b71443e4ba8c804fc80d69383120ed98b7887d08a7034b8125e4d15e695b26776ef4ac1a933e14a1a382d5be90aa942358842cc6c77
 DIST patchbundle-selinux-base-policy-2.20240226-r2.tar.bz2 442650 BLAKE2B f2f7c5e4a595afafc072fd78fc4ef3930cf739d05cbe9670f2fb2956fe84e3045518345e103bc3880603d2562f06ba0597fc005d8d394e9f8cd057363f9bf95f SHA512 2cb00d088eebdb098a6496f156eeb3dcee026fc6e53d732bac5bc8a4cfee1ce3bf2bdbbbfbbe9bba237d61c06f299d96bb9d123a57a44aaaa17cc122e15ea268
+DIST patchbundle-selinux-base-policy-2.20240916-r1.tar.bz2 274891 BLAKE2B 72b8181424450998164979ab582e8edee6d73b9110b4535e7880d1f7c989bd0ac391422872858da7bad3e3d77516996af93aa2f149f7d4a7f8fd329c481964cf SHA512 fd8259c91cc779301d6e0964827133529a9141dc235301da135210ea4359b800023848a25e33c45678477fa4f54e75da51be9ec85a3bed8b07cf5487e73b84f3
 DIST refpolicy-2.20240226.tar.bz2 610561 BLAKE2B 5dc54dcf7238776d4e4b282c1dcbc499f45c0d96676dbf931da39592854034874b5dd6197a2e2776fccec5106d5f245eea3fb9419959bd4d61e9b2c12aeaaa85 SHA512 896a57afb024bd131f25d2831a9a5ac90ee7e5d76b0565bc818c156f6c310d86758bcd4cedbd9df5b29954c9a92a42300d16685a7e07a5efd8f789320724b3f9
+DIST refpolicy-2.20240916.tar.bz2 618218 BLAKE2B d86ca75d254eef10f4aa57ef3977825211200cdf1eaa9bf9d416c9a52acee476b3f8719c3b0c8c17fdff2abc0c396989961e37e313a7b3bd3b4b0266a6280e75 SHA512 a8b6c90f8e186796b4c7db1e2d8ed3c3b8690bb5b8f180dcb6d5468ba80467e2969012c4edddf74429c0f5ce900d68fbbc0c2f8e253165af28f93f191039f064
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dbus/selinux-dbus-2.20240916-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dbus/selinux-dbus-2.20240916-r1.ebuild
new file mode 100644
index 00000000000..c64026f2cdf
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dbus/selinux-dbus-2.20240916-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="dbus"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for dbus"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-policykit/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-policykit/Manifest
index 2f21ce1ea09..abf41634d69 100644
--- a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-policykit/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-policykit/Manifest
@@ -1,3 +1,5 @@
 DIST patchbundle-selinux-base-policy-2.20240226-r1.tar.bz2 430565 BLAKE2B 2d552f868375c240e71e987542a3026970f1d375d7d1e65f11386ce1b07aae84911ded2379fc768ff4bff664eb98dc3361a7392467fed3feb4916477eb957f58 SHA512 f22245ad8759d88ddbf26b71443e4ba8c804fc80d69383120ed98b7887d08a7034b8125e4d15e695b26776ef4ac1a933e14a1a382d5be90aa942358842cc6c77
 DIST patchbundle-selinux-base-policy-2.20240226-r2.tar.bz2 442650 BLAKE2B f2f7c5e4a595afafc072fd78fc4ef3930cf739d05cbe9670f2fb2956fe84e3045518345e103bc3880603d2562f06ba0597fc005d8d394e9f8cd057363f9bf95f SHA512 2cb00d088eebdb098a6496f156eeb3dcee026fc6e53d732bac5bc8a4cfee1ce3bf2bdbbbfbbe9bba237d61c06f299d96bb9d123a57a44aaaa17cc122e15ea268
+DIST patchbundle-selinux-base-policy-2.20240916-r1.tar.bz2 274891 BLAKE2B 72b8181424450998164979ab582e8edee6d73b9110b4535e7880d1f7c989bd0ac391422872858da7bad3e3d77516996af93aa2f149f7d4a7f8fd329c481964cf SHA512 fd8259c91cc779301d6e0964827133529a9141dc235301da135210ea4359b800023848a25e33c45678477fa4f54e75da51be9ec85a3bed8b07cf5487e73b84f3
 DIST refpolicy-2.20240226.tar.bz2 610561 BLAKE2B 5dc54dcf7238776d4e4b282c1dcbc499f45c0d96676dbf931da39592854034874b5dd6197a2e2776fccec5106d5f245eea3fb9419959bd4d61e9b2c12aeaaa85 SHA512 896a57afb024bd131f25d2831a9a5ac90ee7e5d76b0565bc818c156f6c310d86758bcd4cedbd9df5b29954c9a92a42300d16685a7e07a5efd8f789320724b3f9
+DIST refpolicy-2.20240916.tar.bz2 618218 BLAKE2B d86ca75d254eef10f4aa57ef3977825211200cdf1eaa9bf9d416c9a52acee476b3f8719c3b0c8c17fdff2abc0c396989961e37e313a7b3bd3b4b0266a6280e75 SHA512 a8b6c90f8e186796b4c7db1e2d8ed3c3b8690bb5b8f180dcb6d5468ba80467e2969012c4edddf74429c0f5ce900d68fbbc0c2f8e253165af28f93f191039f064
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-policykit/selinux-policykit-2.20240916-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-policykit/selinux-policykit-2.20240916-r1.ebuild
new file mode 100644
index 00000000000..774bf493c54
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-policykit/selinux-policykit-2.20240916-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="policykit"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for policykit"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sssd/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sssd/Manifest
index 2f21ce1ea09..abf41634d69 100644
--- a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sssd/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sssd/Manifest
@@ -1,3 +1,5 @@
 DIST patchbundle-selinux-base-policy-2.20240226-r1.tar.bz2 430565 BLAKE2B 2d552f868375c240e71e987542a3026970f1d375d7d1e65f11386ce1b07aae84911ded2379fc768ff4bff664eb98dc3361a7392467fed3feb4916477eb957f58 SHA512 f22245ad8759d88ddbf26b71443e4ba8c804fc80d69383120ed98b7887d08a7034b8125e4d15e695b26776ef4ac1a933e14a1a382d5be90aa942358842cc6c77
 DIST patchbundle-selinux-base-policy-2.20240226-r2.tar.bz2 442650 BLAKE2B f2f7c5e4a595afafc072fd78fc4ef3930cf739d05cbe9670f2fb2956fe84e3045518345e103bc3880603d2562f06ba0597fc005d8d394e9f8cd057363f9bf95f SHA512 2cb00d088eebdb098a6496f156eeb3dcee026fc6e53d732bac5bc8a4cfee1ce3bf2bdbbbfbbe9bba237d61c06f299d96bb9d123a57a44aaaa17cc122e15ea268
+DIST patchbundle-selinux-base-policy-2.20240916-r1.tar.bz2 274891 BLAKE2B 72b8181424450998164979ab582e8edee6d73b9110b4535e7880d1f7c989bd0ac391422872858da7bad3e3d77516996af93aa2f149f7d4a7f8fd329c481964cf SHA512 fd8259c91cc779301d6e0964827133529a9141dc235301da135210ea4359b800023848a25e33c45678477fa4f54e75da51be9ec85a3bed8b07cf5487e73b84f3
 DIST refpolicy-2.20240226.tar.bz2 610561 BLAKE2B 5dc54dcf7238776d4e4b282c1dcbc499f45c0d96676dbf931da39592854034874b5dd6197a2e2776fccec5106d5f245eea3fb9419959bd4d61e9b2c12aeaaa85 SHA512 896a57afb024bd131f25d2831a9a5ac90ee7e5d76b0565bc818c156f6c310d86758bcd4cedbd9df5b29954c9a92a42300d16685a7e07a5efd8f789320724b3f9
+DIST refpolicy-2.20240916.tar.bz2 618218 BLAKE2B d86ca75d254eef10f4aa57ef3977825211200cdf1eaa9bf9d416c9a52acee476b3f8719c3b0c8c17fdff2abc0c396989961e37e313a7b3bd3b4b0266a6280e75 SHA512 a8b6c90f8e186796b4c7db1e2d8ed3c3b8690bb5b8f180dcb6d5468ba80467e2969012c4edddf74429c0f5ce900d68fbbc0c2f8e253165af28f93f191039f064
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sssd/selinux-sssd-2.20240916-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sssd/selinux-sssd-2.20240916-r1.ebuild
new file mode 100644
index 00000000000..3e80f3dc4fe
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sssd/selinux-sssd-2.20240916-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="sssd"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for sssd"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-unconfined/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-unconfined/Manifest
index 2f21ce1ea09..abf41634d69 100644
--- a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-unconfined/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-unconfined/Manifest
@@ -1,3 +1,5 @@
 DIST patchbundle-selinux-base-policy-2.20240226-r1.tar.bz2 430565 BLAKE2B 2d552f868375c240e71e987542a3026970f1d375d7d1e65f11386ce1b07aae84911ded2379fc768ff4bff664eb98dc3361a7392467fed3feb4916477eb957f58 SHA512 f22245ad8759d88ddbf26b71443e4ba8c804fc80d69383120ed98b7887d08a7034b8125e4d15e695b26776ef4ac1a933e14a1a382d5be90aa942358842cc6c77
 DIST patchbundle-selinux-base-policy-2.20240226-r2.tar.bz2 442650 BLAKE2B f2f7c5e4a595afafc072fd78fc4ef3930cf739d05cbe9670f2fb2956fe84e3045518345e103bc3880603d2562f06ba0597fc005d8d394e9f8cd057363f9bf95f SHA512 2cb00d088eebdb098a6496f156eeb3dcee026fc6e53d732bac5bc8a4cfee1ce3bf2bdbbbfbbe9bba237d61c06f299d96bb9d123a57a44aaaa17cc122e15ea268
+DIST patchbundle-selinux-base-policy-2.20240916-r1.tar.bz2 274891 BLAKE2B 72b8181424450998164979ab582e8edee6d73b9110b4535e7880d1f7c989bd0ac391422872858da7bad3e3d77516996af93aa2f149f7d4a7f8fd329c481964cf SHA512 fd8259c91cc779301d6e0964827133529a9141dc235301da135210ea4359b800023848a25e33c45678477fa4f54e75da51be9ec85a3bed8b07cf5487e73b84f3
 DIST refpolicy-2.20240226.tar.bz2 610561 BLAKE2B 5dc54dcf7238776d4e4b282c1dcbc499f45c0d96676dbf931da39592854034874b5dd6197a2e2776fccec5106d5f245eea3fb9419959bd4d61e9b2c12aeaaa85 SHA512 896a57afb024bd131f25d2831a9a5ac90ee7e5d76b0565bc818c156f6c310d86758bcd4cedbd9df5b29954c9a92a42300d16685a7e07a5efd8f789320724b3f9
+DIST refpolicy-2.20240916.tar.bz2 618218 BLAKE2B d86ca75d254eef10f4aa57ef3977825211200cdf1eaa9bf9d416c9a52acee476b3f8719c3b0c8c17fdff2abc0c396989961e37e313a7b3bd3b4b0266a6280e75 SHA512 a8b6c90f8e186796b4c7db1e2d8ed3c3b8690bb5b8f180dcb6d5468ba80467e2969012c4edddf74429c0f5ce900d68fbbc0c2f8e253165af28f93f191039f064
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-unconfined/selinux-unconfined-2.20240916-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-unconfined/selinux-unconfined-2.20240916-r1.ebuild
new file mode 100644
index 00000000000..ef6bafffa62
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-unconfined/selinux-unconfined-2.20240916-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="unconfined"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for unconfined"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/azure-nvme-utils/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/azure-nvme-utils/Manifest
deleted file mode 100644
index b22e463a9e9..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/azure-nvme-utils/Manifest
+++ /dev/null
@@ -1 +0,0 @@
-DIST azure-nvme-utils-0.2.0.tar.gz 13177 BLAKE2B 5c486d035422ea6547e2886324e0b6e2537d11089bc0b3dfd550130e82ab8de8cc9a5be8e3bfd0722cb71c17a66c261f0cfd021e4a48e5568de01dd0c052fbbc SHA512 4ef2de641839bfbcc2e1a084cec218d1105550366770d731bb7a3e5d4b4e45a47b21ccf9a3a8069f469389e1d27e485bfed235a55d398930bddc8829eebc2708
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/Manifest
new file mode 100644
index 00000000000..ae75b735cdc
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/Manifest
@@ -0,0 +1 @@
+DIST azure-vm-utils-0.3.0.tar.gz 15680 BLAKE2B b739299bda66dd594172e95ae0fe99155d1c101af4e20a012ce5dce658ee0648f802b5c4ec199d76bd650967abac763fea81a2e0202168fc74cd92fd25900956 SHA512 00eb9b0781f5070a35e921ee58d691cf4d530c695e6673fcb24fefbfefc9d869e0ccfab213dbb5ea78d2f93ef829aded3de1c411ccd24b03e52e564895bb2ed8
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/azure-nvme-utils/azure-nvme-utils-0.2.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/azure-vm-utils-0.3.0.ebuild
similarity index 69%
rename from sdk_container/src/third_party/portage-stable/sys-apps/azure-nvme-utils/azure-nvme-utils-0.2.0.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/azure-vm-utils-0.3.0.ebuild
index 5d342190558..e01cb1035d2 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/azure-nvme-utils/azure-nvme-utils-0.2.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/azure-vm-utils-0.3.0.ebuild
@@ -5,17 +5,15 @@ EAPI=8
 
 inherit cmake udev
 
-DESCRIPTION="Utility to help identify Azure NVMe devices"
-HOMEPAGE="https://github.com/Azure/azure-nvme-utils"
+DESCRIPTION="Utilities and udev rules to support Linux on Azure"
+HOMEPAGE="https://github.com/Azure/azure-vm-utils"
 SRC_URI="https://github.com/Azure/${PN}/archive/refs/tags/v${PV}/${P}.tar.gz"
 LICENSE="MIT"
 SLOT="0"
 KEYWORDS="~amd64 ~arm64"
-IUSE="+lun-fallback"
 
 src_configure() {
 	local mycmakeargs=(
-		-DAZURE_LUN_CALCULATION_BY_NSID_ENABLED=$(usex lun-fallback)
 		-DUDEV_RULES_INSTALL_DIR="$(get_udevdir)/rules.d"
 	)
 	cmake_src_configure
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/azure-nvme-utils/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/metadata.xml
similarity index 64%
rename from sdk_container/src/third_party/portage-stable/sys-apps/azure-nvme-utils/metadata.xml
rename to sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/metadata.xml
index f6dc5215014..f50058d0766 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/azure-nvme-utils/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/azure-vm-utils/metadata.xml
@@ -6,9 +6,6 @@
 		<name>James Le Cuirot</name>
 	</maintainer>
 	<upstream>
-		<remote-id type="github">Azure/azure-nvme-utils</remote-id>
+		<remote-id type="github">Azure/azure-vm-utils</remote-id>
 	</upstream>
-	<use>
-		<flag name="lun-fallback">Enable fallback LUN calculation via NSID</flag>
-	</use>
 </pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/bubblewrap/bubblewrap-0.10.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/bubblewrap/bubblewrap-0.10.0.ebuild
index f52fb2cc495..a727abdd331 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/bubblewrap/bubblewrap-0.10.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/bubblewrap/bubblewrap-0.10.0.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/containers/${PN}/releases/download/v${PV}/${P}.tar.x
 
 LICENSE="LGPL-2+"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 arm ~arm64 ~loong ppc ppc64 ~riscv x86"
 IUSE="selinux suid"
 
 RDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/dtc/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/dtc/Manifest
index 48789513fcd..3bca2a9fbcc 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/dtc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/dtc/Manifest
@@ -1,2 +1,3 @@
 DIST dtc-1.6.0.tar.xz 158584 BLAKE2B 47b15b5df7f5d87369d6daaad87f2989a80865f2fab19f89d050d390a9f8319bcd86a36e12f7cc8d62947bb4d1335769071d0e3ea0a6e16861aea163e78f4696 SHA512 15433b24f1d6b7ed1f8066d050bd1bcbf988731aa38147564e3dd04b5f69af8d69e03befdc621a768526c620425a9bdd24aad4f9ff135930d6a1eeb0625f7de3
 DIST dtc-1.7.0.tar.xz 165548 BLAKE2B de433a1034b7ef75559bf39f85695d0b275cfd17bf100c12b6186e226a65659053f9b5a053f20e64a5a0670ea3e728edd0e624c26287bd264594569408065bab SHA512 d3ba6902a9a2f2cdbaff55f12fca3cfe4a1ec5779074a38e3d8b88097c7abc981835957e8ce72971e10c131e05fde0b1b961768e888ff96d89e42c75edb53afb
+DIST dtc-1.7.1.tar.xz 169524 BLAKE2B c9d9d7c60ce13c8e138ab8ddf3e8166d7cf3867ca4e5ea53621bf73514319faf6a6bac09fb96c971554db9f77dd3428e01d53990586041092a64849685d8854b SHA512 3195924b374680e367d7be6b9793691efc0441858068c8bc8d8a908db00bbae781a99184b5c5e272af39045ec58cb0f92adbdd00ff808480b635bd632aa74719
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-1.7.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-1.7.1.ebuild
new file mode 100644
index 00000000000..954d08126e2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-1.7.1.ebuild
@@ -0,0 +1,66 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..12} )
+inherit meson python-single-r1
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.kernel.org/pub/scm/utils/dtc/dtc.git"
+	inherit git-r3
+else
+	SRC_URI="https://www.kernel.org/pub/software/utils/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+fi
+
+DESCRIPTION="Open Firmware device tree compiler"
+HOMEPAGE="https://devicetree.org/ https://git.kernel.org/cgit/utils/dtc/dtc.git/"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="python static-libs test yaml"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+BDEPEND="
+	app-alternatives/yacc
+	app-alternatives/lex
+	virtual/pkgconfig
+	python? ( dev-lang/swig )
+"
+RDEPEND="
+	python? ( ${PYTHON_DEPS} )
+	yaml? ( >=dev-libs/libyaml-0.2.3[static-libs?] )
+"
+DEPEND="
+	${RDEPEND}
+"
+
+DOCS=(
+	Documentation/dt-object-internal.txt
+	Documentation/dts-format.txt
+	Documentation/manual.txt
+)
+
+pkg_setup() {
+	if use python ; then
+		export SETUPTOOLS_SCM_PRETEND_VERSION=${PV}
+		python-single-r1_pkg_setup
+	fi
+}
+
+src_configure() {
+	local emesonargs=(
+		-Dtools=true
+		-Dvalgrind=disabled # only used for some tests
+		$(meson_feature python)
+		$(meson_use test tests)
+		$(meson_feature yaml)
+	)
+
+	# bug #909366
+	use static-libs && emesonargs+=( -Dstatic-build=true )
+
+	meson_src_configure
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-9999.ebuild
index c58d58fb784..6da2ddea52c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-9999.ebuild
@@ -33,7 +33,9 @@ RDEPEND="
 	python? ( ${PYTHON_DEPS} )
 	yaml? ( >=dev-libs/libyaml-0.2.3 )
 "
-DEPEND="${RDEPEND}"
+DEPEND="
+	${RDEPEND}
+"
 
 DOCS=(
 	Documentation/dt-object-internal.txt
@@ -48,19 +50,12 @@ pkg_setup() {
 	fi
 }
 
-src_prepare() {
-	default
-
-	if ! use test ; then
-		sed -i -e "/subdir('tests')/d" meson.build || die
-	fi
-}
-
 src_configure() {
 	local emesonargs=(
 		-Dtools=true
 		-Dvalgrind=disabled # only used for some tests
 		$(meson_feature python)
+		$(meson_use test tests)
 		$(meson_feature yaml)
 	)
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/Manifest
index 6021ab2da4c..a80da9eb313 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/Manifest
@@ -2,3 +2,5 @@ DIST gawk-5.2.2.tar.xz 3402872 BLAKE2B 49dd69d3e2414867d60fe42b74b39bc6858114aee
 DIST gawk-5.2.2.tar.xz.sig 488 BLAKE2B ad737580d7eeb556187a3eeb269decb484398ca91b0fbf08da7f78bba92328ca2fb566b00f8e880fb7c5f0f956e49f8ab9fddc73209902c420666d5413e8a467 SHA512 563911c3771feddf64810ef2480705fd470c90380c0e258940cedeef3f15d594ef657ddab267a6d958321333d466b77c9b83be2392549c959245324950fb32ed
 DIST gawk-5.3.0.tar.xz 3436180 BLAKE2B 1bab754626a51679e4d6fe4552bc965f402a51d176eab30686bf19c74085fd15507b51514c3c46d38f68d3e98da4326c138411abe12e4d8793cec617b2533f3c SHA512 c274a62c7420e7b7769b8ed94db40024bd5917ff49bd50a77ad6df1f16ecf116968aaf85da94015479466bf5570b370b6fdd197f95212ae0c3509dfcb7d9e35a
 DIST gawk-5.3.0.tar.xz.sig 488 BLAKE2B 9d35eca94424cc39bb52b0b790e0db0b9ee51099c40da0a8be7bc60450d227735ba51dcfc10a08f6765d2037054cb9324f0fba100ea2ad08cf56dac1e2c11ac0 SHA512 b0fd75375bee6ca113bb99b07a868729bb90a50d06bc4ff124603594cd9ba564433f69a26e8d01c30f4e4fbfb70ecad2ffa14ed93142b9a1aab2e38ae71b7903
+DIST gawk-5.3.1.tar.xz 3510032 BLAKE2B be9132324344c0b052e954e004a942ff7c6b14b86b73cda491d7a33485f60341be4d8da1a06d1d7a27445b9b39a528bcce3eee9c2a3f8756de21bdc57a33f54d SHA512 c6b4c50ce565e6355ca162955072471e37541c51855c0011e834243a7390db8811344b0c974335844770e408e1f63d72d0d81459a081c392e0245c726019eaff
+DIST gawk-5.3.1.tar.xz.sig 488 BLAKE2B 2abafbb965912a194d047bed3ac1ef33a2b44dce0bc4b1a83a6ca3e2ecf676da0ad8333bb3817f0f32c7d67ab8662dc6086c9e1d6f2185a93d786390197fc643 SHA512 3e13b1bd598b7d4c715c802dcc9db298aeab12721620692f9dd76d3941fdfd87381f660c93be5cc04b6cd7378a6464b9033c93419dfcb514dcc33da8d0d9f502
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.1.ebuild
new file mode 100644
index 00000000000..e4c14b19931
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.1.ebuild
@@ -0,0 +1,136 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+#GAWK_IS_BETA=yes
+
+DESCRIPTION="GNU awk pattern-matching language"
+HOMEPAGE="https://www.gnu.org/software/gawk/gawk.html"
+
+if [[ ${GAWK_IS_BETA} == yes || ${PV} == *_beta* ]] ; then
+	if [[ ${PV} == *_beta* ]] ; then
+		# Beta versioning is sometimes for the release prior, e.g.
+		# 5.2.1_beta is labelled upstream as 5.2.0b.
+		MY_PV=${PV/_beta/b}
+		MY_PV=$(ver_cut 1-2 ${MY_PV}).$(($(ver_cut 3 ${MY_PV}) - 1))$(ver_cut 4- ${MY_PV})
+		MY_P=${PN}-${MY_PV}
+
+		S="${WORKDIR}"/${MY_P}
+	else
+		MY_P=${P}
+	fi
+
+	SRC_URI="https://www.skeeve.com/gawk/${MY_P}.tar.gz"
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gawk.asc
+	inherit verify-sig
+
+	SRC_URI="mirror://gnu/gawk/${P}.tar.xz"
+	SRC_URI+=" verify-sig? ( mirror://gnu/gawk/${P}.tar.xz.sig )"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+# While tempting to enable mpfr by default as e.g. Fedora do, as of 5.2.x,
+# MPFR support is "on parole" and may be removed:
+# https://www.gnu.org/software/gawk/manual/html_node/MPFR-On-Parole.html.
+IUSE="mpfr pma nls readline"
+
+RDEPEND="
+	mpfr? (
+		dev-libs/gmp:=
+		dev-libs/mpfr:=
+	)
+	readline? ( sys-libs/readline:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	>=sys-apps/texinfo-7.1
+	>=sys-devel/bison-3.5.4
+	nls? ( sys-devel/gettext )
+"
+
+if [[ ${GAWK_IS_BETA} != yes ]] ; then
+	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-gawk )"
+fi
+
+src_prepare() {
+	default
+
+	# Use symlinks rather than hardlinks, and disable version links
+	sed -i \
+		-e '/^LN =/s:=.*:= $(LN_S):' \
+		-e '/install-exec-hook:/s|$|\nfoo:|' \
+		Makefile.in doc/Makefile.in || die
+
+	# bug #413327
+	sed -i '/^pty1:$/s|$|\n_pty1:|' test/Makefile.in || die
+
+	# Fix standards conflict on Solaris
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		sed -i \
+			-e '/\<_XOPEN_SOURCE\>/s/1$/600/' \
+			-e '/\<_XOPEN_SOURCE_EXTENDED\>/s/1//' \
+			extension/inplace.c || die
+	fi
+}
+
+src_configure() {
+	# README says gawk may not work properly if built with non-Bison.
+	# We already BDEPEND on Bison, so just unset YACC rather than
+	# guessing if we need to do yacc.bison or bison -y.
+	unset YACC
+
+	local myeconfargs=(
+		--cache-file="${S}"/config.cache
+		--libexec='$(libdir)/misc'
+		$(use_with mpfr)
+		$(use_enable nls)
+		$(use_enable pma)
+		$(use_with readline)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	# Automatic dodocs barfs
+	rm -rf README_d || die
+
+	default
+
+	# Install headers
+	insinto /usr/include/awk
+	doins *.h
+	rm "${ED}"/usr/include/awk/config.h || die
+}
+
+pkg_postinst() {
+	# Symlink creation here as the links do not belong to gawk, but to any awk
+	if has_version app-admin/eselect && has_version app-eselect/eselect-awk ; then
+		eselect awk update ifunset
+	else
+		local l
+		for l in "${EROOT}"/usr/share/man/man1/gawk.1* "${EROOT}"/usr/bin/gawk ; do
+			if [[ -e ${l} ]] && ! [[ -e ${l/gawk/awk} ]] ; then
+				ln -s "${l##*/}" "${l/gawk/awk}" || die
+			fi
+		done
+
+		if ! [[ -e ${EROOT}/bin/awk ]] ; then
+			# /bin might not exist yet (stage1)
+			[[ -d "${EROOT}/bin" ]] || mkdir "${EROOT}/bin" || die
+
+			ln -s "../usr/bin/gawk" "${EROOT}/bin/awk" || die
+		fi
+	fi
+}
+
+pkg_postrm() {
+	if has_version app-admin/eselect && has_version app-eselect/eselect-awk ; then
+		eselect awk update ifunset
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/Manifest
index e8aff49dffd..a141f6db445 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/Manifest
@@ -1,2 +1,3 @@
 DIST gentoo-functions-0.19.tar.bz2 12079 BLAKE2B be0a3a54d4dee1755866047b670a69cd6fec368239123c3f0c08180b79a33c20147bca0e35e568faef6877513551e731bdf0c181aeb0460f6574d2d708219373 SHA512 2674d3fe5724cc6d685ae58bf0ee33f4a1bdba2c5e5809cfb193fd0a710d4678c2d9392c2c62d2321cf455f524950266dc1629ab684fe46632d179e539d5a39e
 DIST gentoo-functions-1.7.2.tar.bz2 29059 BLAKE2B 2b3d13e6f5b553fd0fa7a0880677bd61c82c8815d3801a2d80e7632a97c36f81b41075109856f6248ad0eb2453b511066e63a110c97984e6427135ad19cdc234 SHA512 3839b04784576cc5c5824b24f967862ea421be051983d1ac587de7e21b0fbc4f403e0d4f707ee5cbcf466ec4a12d188da9413a81ca71993c957328ff225cb9af
+DIST gentoo-functions-1.7.3.tar.bz2 29623 BLAKE2B e37fcaf7ca70eda4507f8b539ad37c989a3a6d28d2a063aa1650f60f8cbb28b00103ffea0f1221fd4e8379d4066bca1fd5aeee30073eed6274cfaaaa277bee84 SHA512 4c5d5c9e8b93e366c5483e8777dfdc15afc6764110cc69f751bb5cc1e335dd70e0952017ea55f1be70fcd5120f07708b1601638c97132f53acde8b3f5a4afe34
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/gentoo-functions-1.7.3.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/gentoo-functions-1.7.3.ebuild
new file mode 100644
index 00000000000..320c82e6dfe
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/gentoo-functions-1.7.3.ebuild
@@ -0,0 +1,49 @@
+# Copyright 2014-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit meson
+
+DESCRIPTION="Base functions required by all Gentoo systems"
+HOMEPAGE="https://gitweb.gentoo.org/proj/gentoo-functions.git"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/gentoo-functions.git"
+else
+	SRC_URI="https://gitweb.gentoo.org/proj/gentoo-functions.git/snapshot/${P}.tar.bz2"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+src_configure() {
+	local emesonargs=(
+		# Deliberately avoid /usr as consumers assume we're at /lib/gentoo.
+		--prefix="${EPREFIX:-/}"
+		--mandir="${EPREFIX}/usr/share/man"
+		$(meson_use test tests)
+	)
+
+	meson_src_configure
+}
+
+src_install() {
+	meson_src_install
+
+	if [[ ${EPREFIX} ]]; then
+		while read -r; do
+			if [[ ${REPLY} == $'\t'genfun_prefix= ]]; then
+				printf '\tgenfun_prefix=%q\n' "${EPREFIX}"
+			else
+				printf '%s\n' "${REPLY}"
+			fi || ! break
+		done < "${ED}/lib/gentoo/functions.sh" > "${T}/functions.sh" \
+		&& mv -- "${T}/functions.sh" "${ED}/lib/gentoo/functions.sh" \
+		|| die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/gptfdisk/gptfdisk-1.0.10-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/gptfdisk/gptfdisk-1.0.10-r1.ebuild
index ac221c73a41..5513136c8d9 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/gptfdisk/gptfdisk-1.0.10-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/gptfdisk/gptfdisk-1.0.10-r1.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://downloads.sourceforge.net/${PN}/${PN}/${PV}/${P}.tar.gz"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv sparc x86 ~amd64-linux ~x86-linux"
 IUSE="ncurses static"
 
 # libuuid from util-linux is required.
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
index 88ced78286e..b115fc91c74 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
@@ -1,4 +1,5 @@
 DIST iproute2-6.10.0.tar.xz 920812 BLAKE2B 66332ea333ab2cdc4a2c71000fa2d06fd87cfdf5237dae458aff60ce606155302eb9d0ffaf87107255ab04c02f2b773dc040abb08bb89afb53091396dfc8a3ad SHA512 706479aa37a25fcf30c525c6abd85e0861e484d046e0636a28dbc52b958d45c9dba70b912f530dedd4b0b496e4b98969e23501bbbb41d3de50810bae014fcb41
+DIST iproute2-6.11.0.tar.xz 923736 BLAKE2B 1a360d7cb9a70f5cde184abe934f2d08e9c0d2196c4ec10015636af3984abe2738d9dd8d6c7a69569fc7449e9933829f4eccd593ab8c041ce7b6385adaed63cc SHA512 06bedd7ae573fe5cf9c72af698987ba03e53dc6fce5f41813bf5bb155b683490e5c75cc835ce5ba4509e491eb6138e96da162204c28ea1b3d80887107997a3b3
 DIST iproute2-6.6.0.tar.xz 917964 BLAKE2B 9d20f19c04c2bbde7a3ae53e61e4623b119570c8446f34b93ddadd64677caa432e00ee085498bc277e0842cc2124340c7100925106d0ef2c11dd8002aacac08f SHA512 21c99a3ba8e1d0047933e99b48fb00901eef18899cd5854000ae910d9d84d13aeafa48b32184775531285782909f4d283d0784491691a1f10462dab147de359d
 DIST iproute2-6.8.0.tar.xz 913512 BLAKE2B d30cdff8522627c27c9165f068f42adbec38f15548a8f2cd31276f283880dc402e10c5989e7227e80cdc891bcc4a574b330d634ae550e689758b849c0506c31f SHA512 54e50340a73c8810d69bfd54704b469149731634a97d94da08b5a305592a812131a441e5b646e32b480d61840e2ade29387e54b934effeee8ded4f06e557a5c0
 DIST iproute2-6.9.0.tar.xz 918144 BLAKE2B a7434a2537a55b4875db0e3cc35383dfe4d0c8a118a8a1102c4076bfb154c9c2ab0781dcff324fa18ce7cfde798bf332a9e0ff08003ff39acbb8129b597a93a6 SHA512 1cbb234cb8f94213c3529f0b74fed5a575ff1fb838e783b8d2b440643c2e91246eda42e9b26e9775897aadb8b8133d199b2851b8ea0df06a899dc02acf403325
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.11.0-musl-fixes.patch b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.11.0-musl-fixes.patch
new file mode 100644
index 00000000000..cc1370a3a6a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.11.0-musl-fixes.patch
@@ -0,0 +1,35 @@
+From https://bugs.gentoo.org/939811
+From: Holger Hoffstätte <holger@applied-asynchrony.com>
+
+--- a/bridge/mst.c
++++ b/bridge/mst.c
+@@ -4,8 +4,6 @@
+  */
+ 
+ #include <stdio.h>
+-#include <linux/if_bridge.h>
+-#include <net/if.h>
+ 
+ #include "libnetlink.h"
+ #include "json_print.h"
+@@ -13,6 +11,9 @@
+ 
+ #include "br_common.h"
+ 
++#include <linux/if_bridge.h>
++#include <net/if.h>
++
+ #define MST_ID_LEN 9
+ 
+ #define __stringify_1(x...) #x
+--- a/include/json_print.h
++++ b/include/json_print.h
+@@ -11,6 +11,8 @@
+ #include "json_writer.h"
+ #include "color.h"
+ 
++struct timeval;
++
+ #define _IS_JSON_CONTEXT(type) (is_json_context() && (type & PRINT_JSON || type & PRINT_ANY))
+ #define _IS_FP_CONTEXT(type)   (!is_json_context() && (type & PRINT_FP || type & PRINT_ANY))
+ 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.11.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.11.0-r1.ebuild
new file mode 100644
index 00000000000..c5c0744b82f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.11.0-r1.ebuild
@@ -0,0 +1,214 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit edo toolchain-funcs flag-o-matic
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
+	inherit git-r3
+else
+	SRC_URI="https://www.kernel.org/pub/linux/utils/net/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+DESCRIPTION="kernel routing and traffic control utilities"
+HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="atm berkdb bpf caps elf +iptables minimal nfs selinux"
+# Needs root
+RESTRICT="test"
+
+# We could make libmnl optional, but it's tiny, so eh
+RDEPEND="
+	!minimal? ( net-libs/libmnl:= )
+	atm? ( net-dialup/linux-atm )
+	berkdb? ( sys-libs/db:= )
+	bpf? ( >=dev-libs/libbpf-0.6:= )
+	caps? ( sys-libs/libcap )
+	elf? ( virtual/libelf:= )
+	iptables? ( >=net-firewall/iptables-1.4.20:= )
+	nfs? ( net-libs/libtirpc:= )
+	selinux? ( sys-libs/libselinux )
+"
+# We require newer linux-headers for ipset support (bug #549948) and some defines (bug #553876)
+DEPEND="
+	${RDEPEND}
+	>=sys-kernel/linux-headers-3.16
+"
+BDEPEND="
+	app-arch/xz-utils
+	>=sys-devel/bison-2.4
+	app-alternatives/lex
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-6.10.0-musl-1.patch # bug #936234
+	"${FILESDIR}"/${PN}-6.10.0-musl-2.patch # bug #926341
+	"${FILESDIR}"/${PN}-6.9.0-mtu.patch # bug #291907
+	"${FILESDIR}"/${PN}-6.8.0-configure-nomagic-nolibbsd.patch # bug #643722 & #911727
+	"${FILESDIR}"/${PN}-6.8.0-disable-libbsd-fallback.patch # bug #911727
+	"${FILESDIR}"/${PN}-6.11.0-musl-fixes.patch # bug #939811
+)
+
+src_prepare() {
+	default
+
+	# Fix version if necessary
+	local versionfile="include/version.h"
+	if [[ ${PV} != 9999 ]] && ! grep -Fq "${PV}" ${versionfile} ; then
+		einfo "Fixing version string"
+		sed -i "s@\"[[:digit:]\.]\+\"@\"${PV}\"@" \
+			${versionfile} || die
+	fi
+
+	# echo -n is not POSIX compliant
+	sed -i 's@echo -n@printf@' configure || die
+
+	sed -i \
+		-e '/^CC :\?=/d' \
+		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
+		-e "s|-O2|${CFLAGS} ${CPPFLAGS}|" \
+		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
+		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
+		Makefile || die
+
+	# Build against system headers
+	rm -r include/netinet || die #include/linux include/ip{,6}tables{,_common}.h include/libiptc
+	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
+
+	if use minimal ; then
+		sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile || die
+	fi
+}
+
+src_configure() {
+	tc-export AR CC PKG_CONFIG
+
+	# This sure is ugly. Should probably move into toolchain-funcs at some point.
+	local setns
+	pushd "${T}" >/dev/null || die
+	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c || die
+	if ${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null ; then
+		setns=y
+	else
+		setns=n
+	fi
+
+	echo 'int main(){return 0;}' > test.c || die
+	if ! ${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null ; then
+		sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile || die
+	fi
+	popd >/dev/null || die
+
+	# build system does not pass CFLAGS to LDFLAGS, as is recommended by GCC upstream
+	# https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-flto
+	# https://bugs.gentoo.org/929233
+	append-ldflags ${CFLAGS}
+
+	# run "configure" script first which will create "config.mk"...
+	# Using econf breaks since 5.14.0 (a9c3d70d902a0473ee5c13336317006a52ce8242)
+	edo ./configure --color=auto --libbpf_force $(usex bpf on off)
+
+	# Remove the definitions made by configure and allow them to be overridden
+	# by USE flags below.
+	# We have to do the cheesy only-sed-if-disabled because otherwise
+	# the *_FLAGS etc stuff found by configure will be used but result
+	# in a broken build.
+	if ! use berkdb ; then
+		sed -i -e '/HAVE_BERKELEY_DB/d' config.mk || die
+	fi
+
+	if ! use caps ; then
+		sed -i -e '/HAVE_CAP/d' config.mk || die
+	fi
+
+	if use minimal ; then
+		sed -i -e '/HAVE_MNL/d' config.mk || die
+	fi
+
+	if ! use elf ; then
+		sed -i -e '/HAVE_ELF/d' config.mk || die
+	fi
+
+	if ! use nfs ; then
+		sed -i -e '/HAVE_RPC/d' config.mk || die
+	fi
+
+	if ! use selinux ; then
+		sed -i -e '/HAVE_SELINUX/d' config.mk || die
+	fi
+
+	# ...Now switch on/off requested features via USE flags
+	# this is only useful if the test did not set other things, per bug #643722
+	# Keep in sync with ifs above, or refactor to be unified.
+	cat <<-EOF >> config.mk
+	TC_CONFIG_ATM := $(usex atm y n)
+	TC_CONFIG_XT  := $(usex iptables y n)
+	TC_CONFIG_NO_XT := $(usex iptables n y)
+	# We've locked in recent enough kernel headers, bug #549948
+	TC_CONFIG_IPSET := y
+	HAVE_BERKELEY_DB := $(usex berkdb y n)
+	HAVE_CAP      := $(usex caps y n)
+	HAVE_MNL      := $(usex minimal n y)
+	HAVE_ELF      := $(usex elf y n)
+	HAVE_RPC      := $(usex nfs y n)
+	HAVE_SELINUX  := $(usex selinux y n)
+	IP_CONFIG_SETNS := ${setns}
+	# Use correct iptables dir, bug #144265, bug #293709
+	IPT_LIB_DIR   := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
+	EOF
+}
+
+src_compile() {
+	emake V=1 NETNS_RUN_DIR=/run/netns
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	if use minimal ; then
+		into /
+		dosbin tc/tc
+		dobin ip/ip
+		return 0
+	fi
+
+	emake \
+		DESTDIR="${D}" \
+		PREFIX="${EPREFIX}/usr" \
+		LIBDIR="${EPREFIX}"/$(get_libdir) \
+		SBINDIR="${EPREFIX}"/sbin \
+		CONFDIR="${EPREFIX}"/etc/iproute2 \
+		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
+		MANDIR="${EPREFIX}"/usr/share/man \
+		ARPDDIR="${EPREFIX}"/var/lib/arpd \
+		install
+
+	dodir /bin
+	mv "${ED}"/{s,}bin/ip || die # bug #330115
+	mv "${ED}"/{s,}bin/ss || die # bug #547264
+
+	dolib.a lib/libnetlink.a
+	insinto /usr/include
+	doins include/libnetlink.h
+
+	# Collides with net-analyzer/ifstat
+	# https://bugs.gentoo.org/868321
+	mv "${ED}"/sbin/ifstat{,-iproute2} || die
+
+	if use berkdb ; then
+		keepdir /var/lib/arpd
+		# bug #47482, arpd doesn't need to be in /sbin
+		dodir /usr/bin
+		mv "${ED}"/sbin/arpd "${ED}"/usr/bin/ || die
+	elif [[ -d "${ED}"/var/lib/arpd ]]; then
+		rmdir --ignore-fail-on-non-empty -p "${ED}"/var/lib/arpd || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.11.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.11.0.ebuild
new file mode 100644
index 00000000000..26b79a0d084
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.11.0.ebuild
@@ -0,0 +1,214 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit edo toolchain-funcs flag-o-matic
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
+	inherit git-r3
+else
+	SRC_URI="https://www.kernel.org/pub/linux/utils/net/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+DESCRIPTION="kernel routing and traffic control utilities"
+HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="atm berkdb bpf caps elf +iptables minimal nfs selinux"
+# Needs root
+RESTRICT="test"
+
+# We could make libmnl optional, but it's tiny, so eh
+RDEPEND="
+	!net-misc/arpd
+	!minimal? ( net-libs/libmnl:= )
+	atm? ( net-dialup/linux-atm )
+	berkdb? ( sys-libs/db:= )
+	bpf? ( >=dev-libs/libbpf-0.6:= )
+	caps? ( sys-libs/libcap )
+	elf? ( virtual/libelf:= )
+	iptables? ( >=net-firewall/iptables-1.4.20:= )
+	nfs? ( net-libs/libtirpc:= )
+	selinux? ( sys-libs/libselinux )
+"
+# We require newer linux-headers for ipset support (bug #549948) and some defines (bug #553876)
+DEPEND="
+	${RDEPEND}
+	>=sys-kernel/linux-headers-3.16
+"
+BDEPEND="
+	app-arch/xz-utils
+	>=sys-devel/bison-2.4
+	app-alternatives/lex
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-6.10.0-musl-1.patch # bug #936234
+	"${FILESDIR}"/${PN}-6.10.0-musl-2.patch # bug #926341
+	"${FILESDIR}"/${PN}-6.9.0-mtu.patch # bug #291907
+	"${FILESDIR}"/${PN}-6.8.0-configure-nomagic-nolibbsd.patch # bug #643722 & #911727
+	"${FILESDIR}"/${PN}-6.8.0-disable-libbsd-fallback.patch # bug #911727
+)
+
+src_prepare() {
+	default
+
+	# Fix version if necessary
+	local versionfile="include/version.h"
+	if [[ ${PV} != 9999 ]] && ! grep -Fq "${PV}" ${versionfile} ; then
+		einfo "Fixing version string"
+		sed -i "s@\"[[:digit:]\.]\+\"@\"${PV}\"@" \
+			${versionfile} || die
+	fi
+
+	# echo -n is not POSIX compliant
+	sed -i 's@echo -n@printf@' configure || die
+
+	sed -i \
+		-e '/^CC :\?=/d' \
+		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
+		-e "s|-O2|${CFLAGS} ${CPPFLAGS}|" \
+		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
+		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
+		Makefile || die
+
+	# Build against system headers
+	rm -r include/netinet || die #include/linux include/ip{,6}tables{,_common}.h include/libiptc
+	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
+
+	if use minimal ; then
+		sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile || die
+	fi
+}
+
+src_configure() {
+	tc-export AR CC PKG_CONFIG
+
+	# This sure is ugly. Should probably move into toolchain-funcs at some point.
+	local setns
+	pushd "${T}" >/dev/null || die
+	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c || die
+	if ${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null ; then
+		setns=y
+	else
+		setns=n
+	fi
+
+	echo 'int main(){return 0;}' > test.c || die
+	if ! ${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null ; then
+		sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile || die
+	fi
+	popd >/dev/null || die
+
+	# build system does not pass CFLAGS to LDFLAGS, as is recommended by GCC upstream
+	# https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-flto
+	# https://bugs.gentoo.org/929233
+	append-ldflags ${CFLAGS}
+
+	# run "configure" script first which will create "config.mk"...
+	# Using econf breaks since 5.14.0 (a9c3d70d902a0473ee5c13336317006a52ce8242)
+	edo ./configure --color=auto --libbpf_force $(usex bpf on off)
+
+	# Remove the definitions made by configure and allow them to be overridden
+	# by USE flags below.
+	# We have to do the cheesy only-sed-if-disabled because otherwise
+	# the *_FLAGS etc stuff found by configure will be used but result
+	# in a broken build.
+	if ! use berkdb ; then
+		sed -i -e '/HAVE_BERKELEY_DB/d' config.mk || die
+	fi
+
+	if ! use caps ; then
+		sed -i -e '/HAVE_CAP/d' config.mk || die
+	fi
+
+	if use minimal ; then
+		sed -i -e '/HAVE_MNL/d' config.mk || die
+	fi
+
+	if ! use elf ; then
+		sed -i -e '/HAVE_ELF/d' config.mk || die
+	fi
+
+	if ! use nfs ; then
+		sed -i -e '/HAVE_RPC/d' config.mk || die
+	fi
+
+	if ! use selinux ; then
+		sed -i -e '/HAVE_SELINUX/d' config.mk || die
+	fi
+
+	# ...Now switch on/off requested features via USE flags
+	# this is only useful if the test did not set other things, per bug #643722
+	# Keep in sync with ifs above, or refactor to be unified.
+	cat <<-EOF >> config.mk
+	TC_CONFIG_ATM := $(usex atm y n)
+	TC_CONFIG_XT  := $(usex iptables y n)
+	TC_CONFIG_NO_XT := $(usex iptables n y)
+	# We've locked in recent enough kernel headers, bug #549948
+	TC_CONFIG_IPSET := y
+	HAVE_BERKELEY_DB := $(usex berkdb y n)
+	HAVE_CAP      := $(usex caps y n)
+	HAVE_MNL      := $(usex minimal n y)
+	HAVE_ELF      := $(usex elf y n)
+	HAVE_RPC      := $(usex nfs y n)
+	HAVE_SELINUX  := $(usex selinux y n)
+	IP_CONFIG_SETNS := ${setns}
+	# Use correct iptables dir, bug #144265, bug #293709
+	IPT_LIB_DIR   := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
+	EOF
+}
+
+src_compile() {
+	emake V=1 NETNS_RUN_DIR=/run/netns
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	if use minimal ; then
+		into /
+		dosbin tc/tc
+		dobin ip/ip
+		return 0
+	fi
+
+	emake \
+		DESTDIR="${D}" \
+		PREFIX="${EPREFIX}/usr" \
+		LIBDIR="${EPREFIX}"/$(get_libdir) \
+		SBINDIR="${EPREFIX}"/sbin \
+		CONFDIR="${EPREFIX}"/etc/iproute2 \
+		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
+		MANDIR="${EPREFIX}"/usr/share/man \
+		ARPDDIR="${EPREFIX}"/var/lib/arpd \
+		install
+
+	dodir /bin
+	mv "${ED}"/{s,}bin/ip || die # bug #330115
+	mv "${ED}"/{s,}bin/ss || die # bug #547264
+
+	dolib.a lib/libnetlink.a
+	insinto /usr/include
+	doins include/libnetlink.h
+
+	# Collides with net-analyzer/ifstat
+	# https://bugs.gentoo.org/868321
+	mv "${ED}"/sbin/ifstat{,-iproute2} || die
+
+	if use berkdb ; then
+		keepdir /var/lib/arpd
+		# bug #47482, arpd doesn't need to be in /sbin
+		dodir /usr/bin
+		mv "${ED}"/sbin/arpd "${ED}"/usr/bin/ || die
+	elif [[ -d "${ED}"/var/lib/arpd ]]; then
+		rmdir --ignore-fail-on-non-empty -p "${ED}"/var/lib/arpd || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild
index 1354f3c5f32..e650e4f2e1c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild
@@ -24,11 +24,10 @@ RESTRICT="test"
 
 # We could make libmnl optional, but it's tiny, so eh
 RDEPEND="
-	!net-misc/arpd
 	!minimal? ( net-libs/libmnl:= )
 	atm? ( net-dialup/linux-atm )
 	berkdb? ( sys-libs/db:= )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-0.6:= )
 	caps? ( sys-libs/libcap )
 	elf? ( virtual/libelf:= )
 	iptables? ( >=net-firewall/iptables-1.4.20:= )
@@ -48,10 +47,11 @@ BDEPEND="
 "
 
 PATCHES=(
+	"${FILESDIR}"/${PN}-6.10.0-musl-1.patch # bug #936234
+	"${FILESDIR}"/${PN}-6.10.0-musl-2.patch # bug #926341
 	"${FILESDIR}"/${PN}-6.9.0-mtu.patch # bug #291907
 	"${FILESDIR}"/${PN}-6.8.0-configure-nomagic-nolibbsd.patch # bug #643722 & #911727
 	"${FILESDIR}"/${PN}-6.8.0-disable-libbsd-fallback.patch # bug #911727
-	"${FILESDIR}"/${PN}-6.6.0-musl-c99.patch # bug #922622 & #932617
 )
 
 src_prepare() {
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/kmod/kmod-33.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/kmod/kmod-33.ebuild
index ef67100015c..7a9b69dd31e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/kmod/kmod-33.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/kmod/kmod-33.ebuild
@@ -13,7 +13,7 @@ if [[ ${PV} == 9999* ]]; then
 	inherit git-r3
 else
 	SRC_URI="https://mirrors.edge.kernel.org/pub/linux/utils/kernel/kmod/${P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86"
 fi
 
 LICENSE="LGPL-2"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/man-db/man-db-2.13.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/man-db/man-db-2.13.0.ebuild
index 9b16e190ab2..e441afb3ee1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/man-db/man-db-2.13.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/man-db/man-db-2.13.0.ebuild
@@ -14,7 +14,7 @@ else
 	inherit libtool
 	# TODO: Change tarballs to gitlab too...?
 	SRC_URI="mirror://nongnu/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="GPL-3"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/man-pages/man-pages-6.06.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/man-pages/man-pages-6.06.ebuild
index b6ca71aa68d..b7adda947d0 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/man-pages/man-pages-6.06.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/man-pages/man-pages-6.06.ebuild
@@ -98,7 +98,7 @@ src_unpack() {
 		# Upstream sign the decompressed .tar
 		einfo "Unpacking ${P}.tar.xz ..."
 		verify-sig_verify_detached - "${DISTDIR}"/${P}.tar.sign \
-			< <(xz -cd "${DISTDIR}"/${P}.tar.xz | tee >(tar -x))
+			< <(xz -cd "${DISTDIR}"/${P}.tar.xz | tee >(tar -xf -))
 		assert "Unpack failed"
 
 		unpack man-pages-gentoo-${GENTOO_PATCH}.tar.bz2
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/man-pages/man-pages-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/man-pages/man-pages-9999.ebuild
index da0221acf2f..3650f5532a8 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/man-pages/man-pages-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/man-pages/man-pages-9999.ebuild
@@ -98,7 +98,7 @@ src_unpack() {
 		# Upstream sign the decompressed .tar
 		einfo "Unpacking ${P}.tar.xz ..."
 		verify-sig_verify_detached - "${DISTDIR}"/${P}.tar.sign \
-			< <(xz -cd "${DISTDIR}"/${P}.tar.xz | tee >(tar -x))
+			< <(xz -cd "${DISTDIR}"/${P}.tar.xz | tee >(tar -xf -))
 		assert "Unpack failed"
 
 		unpack man-pages-gentoo-${GENTOO_PATCH}.tar.bz2
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/nvme-cli-2.10.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/nvme-cli-2.10.2.ebuild
index 22d82a1551e..f5026d58d53 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/nvme-cli-2.10.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/nvme-cli-2.10.2.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/linux-nvme/nvme-cli/archive/v${PV}.tar.gz -> ${P}.gh
 
 LICENSE="GPL-2 GPL-2+"
 SLOT="0"
-KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv ~sparc ~x86"
+KEYWORDS="amd64 ~arm64 ~loong ppc64 ~riscv ~sparc x86"
 IUSE="+json pdc"
 
 RDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pkgcore/pkgcore-0.12.28.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/pkgcore/pkgcore-0.12.28.ebuild
index aafbb6c3dbf..4e7d6879649 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/pkgcore/pkgcore-0.12.28.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pkgcore/pkgcore-0.12.28.ebuild
@@ -12,7 +12,7 @@ if [[ ${PV} == *9999 ]] ; then
 		https://github.com/pkgcore/pkgcore.git"
 	inherit git-r3
 else
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-macos"
 	inherit pypi
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/portage/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/portage/Manifest
index 68ee3af2c25..5789fe3a82b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/portage/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/Manifest
@@ -2,4 +2,5 @@ DIST portage-3.0.61.tar.bz2 1178151 BLAKE2B bad3140735b12a18a3108e91cc88146fc5c6
 DIST portage-3.0.63.tar.bz2 1187961 BLAKE2B 10523150b0eabac97309004c57356c40fa94ebd59f8f76701ae63d13f9424b523ccee2a367174af3a52078d5d9e4338b94e144247f6709c2f7df4418c040b06f SHA512 323adc17254f92e58f22028dad12ebcaaafa25c82567c5d31cc9575c30e0d78224c8f9efe0fcbeee549b08b0797edffb4bbe9c6fbbd8943e3f9dcda25eedd699
 DIST portage-3.0.64.tar.bz2 1187654 BLAKE2B 622cdda85315ab60ca3b1ae7cf1cb1fe479b69c945dafe14655030387d857ae89c0d8326b85fb3d3754ea95ecf2792ae60ba36f1ad9b18d1ac693fdabf9b235e SHA512 26a9fc9532aebd5965c6d62d78914d827ac48df100b5fc518934857881ca19b927e05b2cd9a2bb674b0e1bd5feff2058a083de9c8fb86af16efe8752325c7722
 DIST portage-3.0.65.tar.bz2 1193321 BLAKE2B 4734b0a2b17cf0cdbd0bedac9efa6cecb5799460e1faa8b8ab137fa017e17d47d6d5da6382e75322f21d4be77a31acffbacd753c70b43b011613cc5a6332bc96 SHA512 c864bcb3bef11916128852a5f50b161d82529d7316ec970703a9ec948c46a51148419ef1dfde2906f72347dd41d0eebd49f5a1769a228d97145f5517c34dbff8
+DIST portage-3.0.66.1.tar.bz2 1198196 BLAKE2B 8dbd1bc17c1a9a3530425efa31a27efba39e1ef5f5457b4084875c64f7128453139aea447c25a642c124438e88ef484a43b1838cbd8c03748017571dd18f9921 SHA512 fcd3d4d3dcfdb67cbcdb0f4854860f073b4a9d41dadc97a3e6f890e3c75091aceec5622e97495741622b5c390309f05dec35b9e951d7ee7a78e28a9b3ed2939d
 DIST portage-3.0.66.tar.bz2 1198148 BLAKE2B 77012739f18dfbbf088533fc9ccb64fe870d849ef6dadfdd92855d16fbca5eec08b065f94067898016787c03fd1b338dbe06192d56a97f2ad62681bda37c3be8 SHA512 0b182a2078c1c2b7d2e7148834dd6f2b2ae09bf4c91454e0cae908406abd9ad221a46738869ead17c5595c988bb2c11c462ba29ffb022389b1f2e824f093c853
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/portage/files/portage-3.0.66.1-webrsync.patch b/sdk_container/src/third_party/portage-stable/sys-apps/portage/files/portage-3.0.66.1-webrsync.patch
new file mode 100644
index 00000000000..7586c8a9ff9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/files/portage-3.0.66.1-webrsync.patch
@@ -0,0 +1,76 @@
+https://bugs.gentoo.org/940120
+https://gitweb.gentoo.org/proj/portage.git/commit/?id=123a7be533161b14cacc4aa98708fbf1027ecce1
+
+From 123a7be533161b14cacc4aa98708fbf1027ecce1 Mon Sep 17 00:00:00 2001
+From: Sam James <sam@gentoo.org>
+Date: Wed, 2 Oct 2024 06:02:24 +0100
+Subject: Revert "emerge-webrsync: actually honour the
+ sync-webrsync-verify-signature attribute"
+
+This reverts commit f99eb91227918d5bf0cc531e78bd597c73b7ce1f.
+
+Revert for now as we understand the status quo better, and this
+breaks syncing w/ emerge-webrsync. I'll come back to this but I'd
+rather work with a known quantity for now than rush a fix.
+
+Bug: https://bugs.gentoo.org/940120
+Signed-off-by: Sam James <sam@gentoo.org>
+---
+ bin/emerge-webrsync        | 9 ++++-----
+ misc/emerge-delta-webrsync | 9 ++++-----
+ 2 files changed, 8 insertions(+), 10 deletions(-)
+
+diff --git a/bin/emerge-webrsync b/bin/emerge-webrsync
+index 124bcaddc..caa4986da 100755
+--- a/bin/emerge-webrsync
++++ b/bin/emerge-webrsync
+@@ -105,17 +105,16 @@ do_debug=0
+ keep=false
+ 
+ handle_pgp_setup() {
+-	local attr repo_has_webrsync_verify webrsync_gpg
+-
+ 	# WEBRSYNC_VERIFY_SIGNATURE=0: disable PGP verification
+ 	# WEBRSYNC_VERIFY_SIGNATURE=1: use gemato for verification, fallback to regular gpg
+ 	# WEBRSYNC_VERIFY_SIGNATURE=2: use legacy FEATURES="webrsync-gpg"
+ 	WEBRSYNC_VERIFY_SIGNATURE=1
+ 
+-	has webrsync-gpg ${FEATURES} && webrsync_gpg=1
++	has webrsync-gpg ${FEATURES} && webrsync_gpg=1 || webrsync_gpg=0
+ 
+-	attr=$(__repo_attr "${repo_name}" sync-webrsync-verify-signature)
+-	[[ ${attr,,} == @(true|yes) ]] && repo_has_webrsync_verify=1
++	repo_has_webrsync_verify=$(
++		has $(__repo_attr "${repo_name}" sync-webrsync-verify-signature	| LC_ALL=C tr '[:upper:]' '[:lower:]') true yes
++	)
+ 
+ 	if [[ -n ${PORTAGE_TEMP_GPG_DIR} ]] || [[ ${repo_has_webrsync_verify} -eq 1 ]]; then
+ 		# If FEATURES=webrsync-gpg is enabled then allow direct emerge-webrsync
+diff --git a/misc/emerge-delta-webrsync b/misc/emerge-delta-webrsync
+index 8550c15fe..a788cdb0e 100755
+--- a/misc/emerge-delta-webrsync
++++ b/misc/emerge-delta-webrsync
+@@ -165,17 +165,16 @@ if [[ ! -d $STATE_DIR ]]; then
+ fi
+ 
+ handle_pgp_setup() {
+-	local attr repo_has_webrsync_verify webrsync_gpg
+-
+ 	# WEBRSYNC_VERIFY_SIGNATURE=0: disable PGP verification
+ 	# WEBRSYNC_VERIFY_SIGNATURE=1: use gemato for verification, fallback to regular gpg
+ 	# WEBRSYNC_VERIFY_SIGNATURE=2: use legacy FEATURES="webrsync-gpg"
+ 	WEBRSYNC_VERIFY_SIGNATURE=1
+ 
+-	has webrsync-gpg ${FEATURES} && webrsync_gpg=1
++	has webrsync-gpg ${FEATURES} && webrsync_gpg=1 || webrsync_gpg=0
+ 
+-	attr=$(__repo_attr "${repo_name}" sync-webrsync-verify-signature)
+-	[[ ${attr,,} == @(true|yes) ]] && repo_has_webrsync_verify=1
++	repo_has_webrsync_verify=$(
++		has $(__repo_attr "${repo_name}" sync-webrsync-verify-signature	| LC_ALL=C tr '[:upper:]' '[:lower:]') true yes
++	)
+ 
+ 	if [[ -n ${PORTAGE_TEMP_GPG_DIR} ]] || [[ ${repo_has_webrsync_verify} -eq 1 ]]; then
+ 		# If FEATURES=webrsync-gpg is enabled then allow direct emerge-webrsync
+-- 
+cgit v1.2.3-65-gdbad
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.65-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.65-r1.ebuild
index ed27fb3ddbc..50febb0bf55 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.65-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.65-r1.ebuild
@@ -20,7 +20,7 @@ if [[ ${PV} == 9999 ]] ; then
 	inherit git-r3
 else
 	SRC_URI="https://gitweb.gentoo.org/proj/portage.git/snapshot/${P}.tar.bz2"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 fi
 
 LICENSE="GPL-2"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.66.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.66.1-r1.ebuild
new file mode 100644
index 00000000000..9cedc14fc95
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.66.1-r1.ebuild
@@ -0,0 +1,231 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PYTHON_COMPAT=( pypy3 python3_{10..13} )
+PYTHON_REQ_USE='bzip2(+),threads(+)'
+TMPFILES_OPTIONAL=1
+
+inherit meson linux-info python-r1 tmpfiles
+
+DESCRIPTION="The package management and distribution system for Gentoo"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Portage"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="
+		https://anongit.gentoo.org/git/proj/portage.git
+		https://github.com/gentoo/portage.git
+	"
+	inherit git-r3
+else
+	SRC_URI="https://gitweb.gentoo.org/proj/portage.git/snapshot/${P}.tar.bz2"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="apidoc build doc gentoo-dev +ipc +native-extensions +rsync-verify selinux test xattr"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	${PYTHON_DEPS}
+	>=app-arch/tar-1.27
+	>=dev-build/meson-1.3.0-r1
+	>=sys-apps/sed-4.0.5
+	sys-devel/patch
+	!build? ( $(python_gen_impl_dep 'ssl(+)') )
+	apidoc? (
+		dev-python/sphinx[${PYTHON_USEDEP}]
+		dev-python/sphinx-epytext[${PYTHON_USEDEP}]
+	)
+	doc? (
+		~app-text/docbook-xml-dtd-4.4
+		app-text/xmlto
+	)
+	test? (
+		dev-python/pytest-xdist[${PYTHON_USEDEP}]
+		dev-vcs/git
+	)
+"
+# Require sandbox-2.2 for bug #288863.
+# For whirlpool hash, require python[ssl] (bug #425046).
+RDEPEND="
+	${PYTHON_DEPS}
+	acct-user/portage
+	>=app-arch/tar-1.27
+	app-arch/zstd
+	>=app-misc/pax-utils-0.1.17
+	dev-lang/python-exec:2
+	>=sys-apps/baselayout-2.9
+	>=sys-apps/findutils-4.9
+	!build? (
+		>=app-admin/eselect-1.2
+		app-portage/getuto
+		>=app-shells/bash-5.0:0
+		>=sec-keys/openpgp-keys-gentoo-release-20240703
+		>=sys-apps/sed-4.0.5
+		rsync-verify? (
+			>=app-crypt/gnupg-2.2.4-r2[ssl(-)]
+			>=app-portage/gemato-14.5[${PYTHON_USEDEP}]
+		)
+	)
+	elibc_glibc? ( >=sys-apps/sandbox-2.2 )
+	elibc_musl? ( >=sys-apps/sandbox-2.2 )
+	kernel_linux? ( sys-apps/util-linux )
+	selinux? ( >=sys-libs/libselinux-2.0.94[python,${PYTHON_USEDEP}] )
+	xattr? ( kernel_linux? (
+		>=sys-apps/install-xattr-0.3
+	) )
+"
+# coreutils-6.4 rdep is for date format in emerge-webrsync #164532
+# NOTE: FEATURES=installsources requires debugedit and rsync
+PDEPEND="
+	!build? (
+		>=net-misc/rsync-2.6.4
+		>=sys-apps/coreutils-6.4
+		>=sys-apps/file-5.44-r3
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-webrsync.patch
+)
+
+pkg_pretend() {
+	local CONFIG_CHECK="~IPC_NS ~PID_NS ~NET_NS ~UTS_NS"
+
+	check_extra_config
+}
+
+src_prepare() {
+	default
+
+	if use prefix-guest; then
+		sed -e "s|^\(main-repo = \).*|\\1gentoo_prefix|" \
+			-e "s|^\\[gentoo\\]|[gentoo_prefix]|" \
+			-e "s|^\(sync-uri = \).*|\\1rsync://rsync.prefix.bitzolder.nl/gentoo-portage-prefix|" \
+			-i cnf/repos.conf || die "sed failed"
+	fi
+}
+
+src_configure() {
+	local code_only=false
+	python_foreach_impl my_src_configure
+}
+
+my_src_configure() {
+	local emesonargs=(
+		-Dcode-only=${code_only}
+		-Deprefix="${EPREFIX}"
+		-Dportage-bindir="${EPREFIX}/usr/lib/portage/${EPYTHON}"
+		-Ddocdir="${EPREFIX}/usr/share/doc/${PF}"
+		$(meson_use doc)
+		$(meson_use apidoc)
+		$(meson_use gentoo-dev)
+		$(meson_use ipc)
+		$(meson_use xattr)
+	)
+
+	if use native-extensions && [[ "${EPYTHON}" != "pypy3" ]] ; then
+		emesonargs+=( -Dnative-extensions=true )
+	else
+		emesonargs+=( -Dnative-extensions=false )
+	fi
+
+	if use build; then
+		emesonargs+=( -Drsync-verify=false )
+	else
+		emesonargs+=( $(meson_use rsync-verify) )
+	fi
+
+	meson_src_configure
+	code_only=true
+}
+
+src_compile() {
+	python_foreach_impl meson_src_compile
+}
+
+src_test() {
+	local EPYTEST_XDIST=1
+	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+	python_foreach_impl epytest
+}
+
+src_install() {
+	python_foreach_impl my_src_install
+	dotmpfiles "${FILESDIR}"/portage-{ccache,tmpdir}.conf
+
+	local scripts
+	mapfile -t scripts < <(awk '/^#!.*python/ {print FILENAME} {nextfile}' "${ED}"/usr/{bin,sbin}/* || die)
+	python_replicate_script "${scripts[@]}"
+}
+
+my_src_install() {
+	local pydirs=(
+		"${D}$(python_get_sitedir)"
+		"${ED}/usr/lib/portage/${EPYTHON}"
+	)
+
+	meson_src_install
+	python_fix_shebang "${pydirs[@]}"
+	python_optimize "${pydirs[@]}"
+}
+
+pkg_preinst() {
+	if ! use build && [[ -z ${ROOT} ]]; then
+		python_setup
+		local sitedir=$(python_get_sitedir)
+		[[ -d ${D}${sitedir} ]] || die "${D}${sitedir}: No such directory"
+		env -u DISTDIR \
+			-u PORTAGE_OVERRIDE_EPREFIX \
+			-u PORTAGE_REPOSITORIES \
+			-u PORTDIR \
+			-u PORTDIR_OVERLAY \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.default_locations || die
+
+		env -u BINPKG_COMPRESS -u PORTAGE_REPOSITORIES \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_compression || die
+
+		env -u FEATURES -u PORTAGE_REPOSITORIES \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_multi_instance || die
+
+		env -u BINPKG_FORMAT \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_format || die
+	fi
+
+	# elog dir must exist to avoid logrotate error for bug #415911.
+	# This code runs in preinst in order to bypass the mapping of
+	# portage:portage to root:root which happens after src_install.
+	keepdir /var/log/portage/elog
+	# This is allowed to fail if the user/group are invalid for prefix users.
+	if chown portage:portage "${ED}"/var/log/portage{,/elog} 2>/dev/null ; then
+		chmod g+s,ug+rwx "${ED}"/var/log/portage{,/elog}
+	fi
+
+	if has_version "<${CATEGORY}/${PN}-2.3.77"; then
+		elog "The emerge --autounmask option is now disabled by default, except for"
+		elog "portions of behavior which are controlled by the --autounmask-use and"
+		elog "--autounmask-license options. For backward compatibility, previous"
+		elog "behavior of --autounmask=y and --autounmask=n is entirely preserved."
+		elog "Users can get the old behavior simply by adding --autounmask to the"
+		elog "make.conf EMERGE_DEFAULT_OPTS variable. For the rationale for this"
+		elog "change, see https://bugs.gentoo.org/658648."
+	fi
+}
+
+pkg_postinst() {
+	# Warn about obsolete "enotice" script, bug #867010
+	local bashrc=${EROOT}/etc/portage/profile/profile.bashrc
+	if [[ -e ${bashrc} ]] && grep -q enotice "${bashrc}"; then
+		eerror "Obsolete 'enotice' script detected!"
+		eerror "Please remove this from ${bashrc} to avoid problems."
+		eerror "See bug 867010 for more details."
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.66.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.66.1.ebuild
new file mode 100644
index 00000000000..5958c3dd1f5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.66.1.ebuild
@@ -0,0 +1,227 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PYTHON_COMPAT=( pypy3 python3_{10..13} )
+PYTHON_REQ_USE='bzip2(+),threads(+)'
+TMPFILES_OPTIONAL=1
+
+inherit meson linux-info python-r1 tmpfiles
+
+DESCRIPTION="The package management and distribution system for Gentoo"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Portage"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="
+		https://anongit.gentoo.org/git/proj/portage.git
+		https://github.com/gentoo/portage.git
+	"
+	inherit git-r3
+else
+	SRC_URI="https://gitweb.gentoo.org/proj/portage.git/snapshot/${P}.tar.bz2"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="apidoc build doc gentoo-dev +ipc +native-extensions +rsync-verify selinux test xattr"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	${PYTHON_DEPS}
+	>=app-arch/tar-1.27
+	>=dev-build/meson-1.3.0-r1
+	>=sys-apps/sed-4.0.5
+	sys-devel/patch
+	!build? ( $(python_gen_impl_dep 'ssl(+)') )
+	apidoc? (
+		dev-python/sphinx[${PYTHON_USEDEP}]
+		dev-python/sphinx-epytext[${PYTHON_USEDEP}]
+	)
+	doc? (
+		~app-text/docbook-xml-dtd-4.4
+		app-text/xmlto
+	)
+	test? (
+		dev-python/pytest-xdist[${PYTHON_USEDEP}]
+		dev-vcs/git
+	)
+"
+# Require sandbox-2.2 for bug #288863.
+# For whirlpool hash, require python[ssl] (bug #425046).
+RDEPEND="
+	${PYTHON_DEPS}
+	acct-user/portage
+	>=app-arch/tar-1.27
+	app-arch/zstd
+	>=app-misc/pax-utils-0.1.17
+	dev-lang/python-exec:2
+	>=sys-apps/baselayout-2.9
+	>=sys-apps/findutils-4.9
+	!build? (
+		>=app-admin/eselect-1.2
+		app-portage/getuto
+		>=app-shells/bash-5.0:0
+		>=sec-keys/openpgp-keys-gentoo-release-20240703
+		>=sys-apps/sed-4.0.5
+		rsync-verify? (
+			>=app-crypt/gnupg-2.2.4-r2[ssl(-)]
+			>=app-portage/gemato-14.5[${PYTHON_USEDEP}]
+		)
+	)
+	elibc_glibc? ( >=sys-apps/sandbox-2.2 )
+	elibc_musl? ( >=sys-apps/sandbox-2.2 )
+	kernel_linux? ( sys-apps/util-linux )
+	selinux? ( >=sys-libs/libselinux-2.0.94[python,${PYTHON_USEDEP}] )
+	xattr? ( kernel_linux? (
+		>=sys-apps/install-xattr-0.3
+	) )
+"
+# coreutils-6.4 rdep is for date format in emerge-webrsync #164532
+# NOTE: FEATURES=installsources requires debugedit and rsync
+PDEPEND="
+	!build? (
+		>=net-misc/rsync-2.6.4
+		>=sys-apps/coreutils-6.4
+		>=sys-apps/file-5.44-r3
+	)
+"
+
+pkg_pretend() {
+	local CONFIG_CHECK="~IPC_NS ~PID_NS ~NET_NS ~UTS_NS"
+
+	check_extra_config
+}
+
+src_prepare() {
+	default
+
+	if use prefix-guest; then
+		sed -e "s|^\(main-repo = \).*|\\1gentoo_prefix|" \
+			-e "s|^\\[gentoo\\]|[gentoo_prefix]|" \
+			-e "s|^\(sync-uri = \).*|\\1rsync://rsync.prefix.bitzolder.nl/gentoo-portage-prefix|" \
+			-i cnf/repos.conf || die "sed failed"
+	fi
+}
+
+src_configure() {
+	local code_only=false
+	python_foreach_impl my_src_configure
+}
+
+my_src_configure() {
+	local emesonargs=(
+		-Dcode-only=${code_only}
+		-Deprefix="${EPREFIX}"
+		-Dportage-bindir="${EPREFIX}/usr/lib/portage/${EPYTHON}"
+		-Ddocdir="${EPREFIX}/usr/share/doc/${PF}"
+		$(meson_use doc)
+		$(meson_use apidoc)
+		$(meson_use gentoo-dev)
+		$(meson_use ipc)
+		$(meson_use xattr)
+	)
+
+	if use native-extensions && [[ "${EPYTHON}" != "pypy3" ]] ; then
+		emesonargs+=( -Dnative-extensions=true )
+	else
+		emesonargs+=( -Dnative-extensions=false )
+	fi
+
+	if use build; then
+		emesonargs+=( -Drsync-verify=false )
+	else
+		emesonargs+=( $(meson_use rsync-verify) )
+	fi
+
+	meson_src_configure
+	code_only=true
+}
+
+src_compile() {
+	python_foreach_impl meson_src_compile
+}
+
+src_test() {
+	local EPYTEST_XDIST=1
+	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+	python_foreach_impl epytest
+}
+
+src_install() {
+	python_foreach_impl my_src_install
+	dotmpfiles "${FILESDIR}"/portage-{ccache,tmpdir}.conf
+
+	local scripts
+	mapfile -t scripts < <(awk '/^#!.*python/ {print FILENAME} {nextfile}' "${ED}"/usr/{bin,sbin}/* || die)
+	python_replicate_script "${scripts[@]}"
+}
+
+my_src_install() {
+	local pydirs=(
+		"${D}$(python_get_sitedir)"
+		"${ED}/usr/lib/portage/${EPYTHON}"
+	)
+
+	meson_src_install
+	python_fix_shebang "${pydirs[@]}"
+	python_optimize "${pydirs[@]}"
+}
+
+pkg_preinst() {
+	if ! use build && [[ -z ${ROOT} ]]; then
+		python_setup
+		local sitedir=$(python_get_sitedir)
+		[[ -d ${D}${sitedir} ]] || die "${D}${sitedir}: No such directory"
+		env -u DISTDIR \
+			-u PORTAGE_OVERRIDE_EPREFIX \
+			-u PORTAGE_REPOSITORIES \
+			-u PORTDIR \
+			-u PORTDIR_OVERLAY \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.default_locations || die
+
+		env -u BINPKG_COMPRESS -u PORTAGE_REPOSITORIES \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_compression || die
+
+		env -u FEATURES -u PORTAGE_REPOSITORIES \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_multi_instance || die
+
+		env -u BINPKG_FORMAT \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_format || die
+	fi
+
+	# elog dir must exist to avoid logrotate error for bug #415911.
+	# This code runs in preinst in order to bypass the mapping of
+	# portage:portage to root:root which happens after src_install.
+	keepdir /var/log/portage/elog
+	# This is allowed to fail if the user/group are invalid for prefix users.
+	if chown portage:portage "${ED}"/var/log/portage{,/elog} 2>/dev/null ; then
+		chmod g+s,ug+rwx "${ED}"/var/log/portage{,/elog}
+	fi
+
+	if has_version "<${CATEGORY}/${PN}-2.3.77"; then
+		elog "The emerge --autounmask option is now disabled by default, except for"
+		elog "portions of behavior which are controlled by the --autounmask-use and"
+		elog "--autounmask-license options. For backward compatibility, previous"
+		elog "behavior of --autounmask=y and --autounmask=n is entirely preserved."
+		elog "Users can get the old behavior simply by adding --autounmask to the"
+		elog "make.conf EMERGE_DEFAULT_OPTS variable. For the rationale for this"
+		elog "change, see https://bugs.gentoo.org/658648."
+	fi
+}
+
+pkg_postinst() {
+	# Warn about obsolete "enotice" script, bug #867010
+	local bashrc=${EROOT}/etc/portage/profile/profile.bashrc
+	if [[ -e ${bashrc} ]] && grep -q enotice "${bashrc}"; then
+		eerror "Obsolete 'enotice' script detected!"
+		eerror "Please remove this from ${bashrc} to avoid problems."
+		eerror "See bug 867010 for more details."
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sed/sed-4.9-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/sed/sed-4.9-r1.ebuild
index 564b3f9c376..9129b5a4835 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/sed/sed-4.9-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/sed/sed-4.9-r1.ebuild
@@ -35,8 +35,12 @@ BDEPEND="nls? ( sys-devel/gettext )
 
 src_prepare() {
 	default
-	# Modern C fixes from latest autotools. bug #900382
-	eautoreconf
+
+	# Ignore prefix as a workaround for bug #934329
+	if ! use prefix ; then
+		# Modern C fixes from latest autotools. bug #900382
+		eautoreconf
+	fi
 }
 
 src_configure() {
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/usbutils/usbutils-017.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/usbutils/usbutils-017.ebuild
index 3f340079040..761336b0b38 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/usbutils/usbutils-017.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/usbutils/usbutils-017.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 inherit python-single-r1
 
 DESCRIPTION="USB enumeration utilities"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.4-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.4-r1.ebuild
index 06be196fba1..7dae5bfb1ab 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.4-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.4-r1.ebuild
@@ -22,7 +22,7 @@ else
 	inherit verify-sig
 
 	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos"
+		KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos"
 	fi
 
 	SRC_URI="https://www.kernel.org/pub/linux/utils/util-linux/v${PV:0:4}/${MY_P}.tar.xz"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.1-r3.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.1-r3.ebuild
index 77bcfca431d..25192bc4ddb 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.1-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.1-r3.ebuild
@@ -119,7 +119,7 @@ src_unpack() {
 	if use verify-sig; then
 		einfo "Unpacking ${MY_P}.tar.xz ..."
 		verify-sig_verify_detached - "${DISTDIR}"/${MY_P}.tar.sign \
-			< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -x))
+			< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -xf -))
 		assert "Unpack failed"
 	else
 		default
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.2.ebuild
index 763811e1da0..c7517aac4cf 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.2.ebuild
@@ -119,7 +119,7 @@ src_unpack() {
 	if use verify-sig; then
 		einfo "Unpacking ${MY_P}.tar.xz ..."
 		verify-sig_verify_detached - "${DISTDIR}"/${MY_P}.tar.sign \
-			< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -x))
+			< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -xf -))
 		assert "Unpack failed"
 	else
 		default
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-9999.ebuild
index 763811e1da0..c7517aac4cf 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-9999.ebuild
@@ -119,7 +119,7 @@ src_unpack() {
 	if use verify-sig; then
 		einfo "Unpacking ${MY_P}.tar.xz ..."
 		verify-sig_verify_detached - "${DISTDIR}"/${MY_P}.tar.sign \
-			< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -x))
+			< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -xf -))
 		assert "Unpack failed"
 	else
 		default
diff --git a/sdk_container/src/third_party/portage-stable/sys-block/open-iscsi/open-iscsi-2.1.10-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-block/open-iscsi/open-iscsi-2.1.10-r1.ebuild
index 1b55729cf7f..d76f2a19349 100644
--- a/sdk_container/src/third_party/portage-stable/sys-block/open-iscsi/open-iscsi-2.1.10-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-block/open-iscsi/open-iscsi-2.1.10-r1.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/${PN}/${PN}/archive/${PV}.tar.gz -> ${P}.tar.gz"
 
 LICENSE="LGPL-3+ GPL-2+"
 SLOT="0/0.2"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm ~arm64 ~mips ~ppc ppc64 ~riscv ~sparc x86"
 IUSE="debug infiniband +tcp rdma systemd"
 REQUIRED_USE="infiniband? ( rdma ) || ( rdma tcp )"
 # Tries to write to /run/lock/iscsi etc
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/gnu-efi/gnu-efi-3.0.18-r3.ebuild b/sdk_container/src/third_party/portage-stable/sys-boot/gnu-efi/gnu-efi-3.0.18-r3.ebuild
index 511b4e30b24..26cfa7b58d2 100644
--- a/sdk_container/src/third_party/portage-stable/sys-boot/gnu-efi/gnu-efi-3.0.18-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/gnu-efi/gnu-efi-3.0.18-r3.ebuild
@@ -42,6 +42,16 @@ check_and_set_objcopy() {
 		# llvm-objcopy does not support EFI target, try to use binutils objcopy or fail
 		tc-export OBJCOPY
 		OBJCOPY="${OBJCOPY/llvm-/}"
+		# Test OBJCOPY to see if it supports EFI targets, and return if it does
+		LC_ALL=C "${OBJCOPY}" --help | grep -q '\<pei-' && return 0
+		# If OBJCOPY does not support EFI targets, it is possible that the 'objcopy' on our path is
+		# still LLVM if the 'binutils-plugin' USE flag is set. In this case, we check to see if the
+		# '(prefix)/usr/bin/objcopy' binary is available (it should be, it's a dependency), and if
+		# so, we use the absolute path explicitly.
+		local binutils_objcopy="${EPREFIX}"/usr/bin/"${OBJCOPY}"
+		if [[ -e "${binutils_objcopy}" ]]; then
+			OBJCOPY="${binutils_objcopy}"
+		fi
 		LANG=C LC_ALL=C "${OBJCOPY}" --help | grep -q '\<pei-' || die "${OBJCOPY} (objcopy) does not support EFI target"
 	fi
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/gnu-efi/gnu-efi-3.0.18-r5.ebuild b/sdk_container/src/third_party/portage-stable/sys-boot/gnu-efi/gnu-efi-3.0.18-r5.ebuild
index adfad0c0f98..d3d5d12d57b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-boot/gnu-efi/gnu-efi-3.0.18-r5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/gnu-efi/gnu-efi-3.0.18-r5.ebuild
@@ -42,6 +42,16 @@ check_and_set_objcopy() {
 		# llvm-objcopy does not support EFI target, try to use binutils objcopy or fail
 		tc-export OBJCOPY
 		OBJCOPY="${OBJCOPY/llvm-/}"
+		# Test OBJCOPY to see if it supports EFI targets, and return if it does
+		LC_ALL=C "${OBJCOPY}" --help | grep -q '\<pei-' && return 0
+		# If OBJCOPY does not support EFI targets, it is possible that the 'objcopy' on our path is
+		# still LLVM if the 'binutils-plugin' USE flag is set. In this case, we check to see if the
+		# '(prefix)/usr/bin/objcopy' binary is available (it should be, it's a dependency), and if
+		# so, we use the absolute path explicitly.
+		local binutils_objcopy="${EPREFIX}"/usr/bin/"${OBJCOPY}"
+		if [[ -e "${binutils_objcopy}" ]]; then
+			OBJCOPY="${binutils_objcopy}"
+		fi
 		if ! use arm && ! use riscv; then
 			# bug #939338
 			# objcopy does not understand PE/COFF on these arches: arm32, riscv64 and mips64le
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r4.ebuild b/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r4.ebuild
index be8779e57cb..5fc413c46cb 100644
--- a/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r4.ebuild
@@ -51,7 +51,7 @@ if [[ ${PV} != 9999 ]]; then
 		S=${WORKDIR}/${P%_*}
 	fi
 	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-danielkiper )"
-	KEYWORDS="amd64 arm arm64 ~ia64 ~loong ppc ppc64 ~riscv sparc x86"
+	KEYWORDS="amd64 arm arm64 ~loong ppc ppc64 ~riscv sparc x86"
 else
 	inherit git-r3
 	EGIT_REPO_URI="https://git.savannah.gnu.org/git/grub.git"
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r5.ebuild b/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r5.ebuild
index b79c99dc948..2328a488d4e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r5.ebuild
@@ -52,7 +52,7 @@ if [[ ${PV} != 9999 ]]; then
 		S=${WORKDIR}/${P%_*}
 	fi
 	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-danielkiper )"
-	KEYWORDS="~amd64 ~arm ~arm64 ~ia64 ~loong ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	KEYWORDS="amd64 ~arm arm64 ~loong ppc ppc64 ~riscv ~sparc x86"
 else
 	inherit git-r3
 	EGIT_REPO_URI="https://git.savannah.gnu.org/git/grub.git"
@@ -74,7 +74,7 @@ SRC_URI+=" fonts? ( mirror://gnu/unifont/${UNIFONT}/${UNIFONT}.pcf.gz )
 # Includes licenses for dejavu and unifont
 LICENSE="GPL-3+ BSD MIT fonts? ( GPL-2-with-font-exception ) themes? ( CC-BY-SA-3.0 BitstreamVera )"
 SLOT="2/${PVR}"
-IUSE="device-mapper doc efiemu +fonts mount nls sdl test +themes truetype libzfs"
+IUSE="+device-mapper doc efiemu +fonts mount nls sdl test +themes truetype libzfs"
 
 GRUB_ALL_PLATFORMS=( coreboot efi-32 efi-64 emu ieee1275 loongson multiboot
 	qemu qemu-mips pc uboot xen xen-32 xen-pvh )
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-9999.ebuild
index 31db1cdb8e2..a1ef3c91a73 100644
--- a/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-9999.ebuild
@@ -55,7 +55,7 @@ if [[ ${PV} != 9999 ]]; then
 		S=${WORKDIR}/${P%_*}
 	fi
 	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-danielkiper )"
-	KEYWORDS="~amd64 ~arm ~arm64 ~ia64 ~loong ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~sparc ~x86"
 else
 	inherit git-r3
 	EGIT_REPO_URI="https://git.savannah.gnu.org/git/grub.git"
@@ -75,7 +75,7 @@ SRC_URI+=" fonts? ( mirror://gnu/unifont/${UNIFONT}/${UNIFONT}.pcf.gz )
 # Includes licenses for dejavu and unifont
 LICENSE="GPL-3+ BSD MIT fonts? ( GPL-2-with-font-exception ) themes? ( CC-BY-SA-3.0 BitstreamVera )"
 SLOT="2/${PVR}"
-IUSE="device-mapper doc efiemu +fonts mount nls sdl test +themes truetype libzfs"
+IUSE="+device-mapper doc efiemu +fonts mount nls sdl test +themes truetype libzfs"
 
 GRUB_ALL_PLATFORMS=( coreboot efi-32 efi-64 emu ieee1275 loongson multiboot
 	qemu qemu-mips pc uboot xen xen-32 xen-pvh )
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/grub/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-boot/grub/metadata.xml
index a5ad32e2e73..c8fd5827d3e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-boot/grub/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/grub/metadata.xml
@@ -11,7 +11,7 @@
 </maintainer>
 <use>
 	<flag name="device-mapper">
-		Enable support for device-mapper from <pkg>sys-fs/lvm2</pkg>
+		Enable support for devmapper. Required for LUKS or LVM volume detection.
 	</flag>
 	<flag name="efiemu">
 		Build and install the efiemu runtimes
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/mokutil/Manifest b/sdk_container/src/third_party/portage-stable/sys-boot/mokutil/Manifest
index 24fa911ab2e..673a0ed23b4 100644
--- a/sdk_container/src/third_party/portage-stable/sys-boot/mokutil/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/mokutil/Manifest
@@ -1 +1,2 @@
 DIST mokutil-0.6.0.tar.gz 38047 BLAKE2B f2307807c700091f1e5a783b3ad8e7b3eaa17e05580b2c24fd0e92433c6b9bedfb51e9eb2d5d1c71448623b12b6667a573dd51ed03fc738aaf9815083e118ca0 SHA512 11a9d172dba4fbb674e58e5d82cb1dc65a80cff844c0eaebd106b4d4608b24a8207e0cfabf36fe1eedb67f68a8a18db2136c7b62aa3230ac104615e8284dbd7d
+DIST mokutil-0.7.2.tar.gz 39226 BLAKE2B e3b639070e03a41c9bbf45fd7c95656b1e149a1bf43fdc15396853303cf776b9b8279c48049ff5ec1c4397cb15c58d69c618b884864a7941ad747567963cd491 SHA512 cdab37f86191c009b8264f065c3ca8ca051d8c1366191dca4c142d4146a0f7b7614cb17e53b6a8ca6fde0462bc113d4a1a751673b755eea0b3ed6e90da507f5a
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/mokutil/mokutil-0.7.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-boot/mokutil/mokutil-0.7.2.ebuild
new file mode 100644
index 00000000000..4c6f2d37915
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/mokutil/mokutil-0.7.2.ebuild
@@ -0,0 +1,26 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools
+
+DESCRIPTION="The utility to manipulate machines owner keys which managed in shim"
+HOMEPAGE="https://github.com/lcp/mokutil"
+SRC_URI="https://github.com/lcp/mokutil/archive/${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+
+DEPEND="dev-libs/openssl:=
+	sys-apps/keyutils:=
+	sys-libs/efivar:=
+	virtual/libcrypt:="
+RDEPEND="${DEPEND}"
+BDEPEND="virtual/pkgconfig"
+
+src_prepare() {
+	default
+	eautoreconf
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/binutils-config-5.5.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/binutils-config-5.5.2.ebuild
index 75a32dd28cc..5eac04325a1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/binutils-config-5.5.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/binutils-config-5.5.2.ebuild
@@ -8,7 +8,7 @@ if [[ ${PV} == 9999 ]]; then
 	inherit git-r3
 else
 	SRC_URI="https://dev.gentoo.org/~dilfridge/distfiles/${P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 fi
 
 DESCRIPTION="Utility to change the binutils version being used"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.42-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.42-r2.ebuild
index 3f6aedfaf65..14fb7491d92 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.42-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.42-r2.ebuild
@@ -32,7 +32,7 @@ else
 	[[ -z ${PATCH_VER} ]] || SRC_URI="${SRC_URI}
 		https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
 	SLOT=$(ver_cut 1-2)
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
 fi
 
 #
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.43.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.43.9999.ebuild
index 5255b28bb0f..06e1d7caa39 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.43.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.43.9999.ebuild
@@ -292,6 +292,10 @@ src_configure() {
 		# - Broken at runtime without Java (https://sourceware.org/bugzilla/show_bug.cgi?id=29479)
 		# - binutils-config (and this ebuild?) needs adaptation first (https://bugs.gentoo.org/865113)
 		$(use_enable gprofng)
+
+		# Enables colored disassembly by default (equivalent to passing
+		# --disassembler-color=terminal to all objdump invocations).
+		--enable-colored-disassembly
 	)
 
 	case ${CTARGET} in
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
index 32ea17c9746..1a0501350eb 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
@@ -295,6 +295,10 @@ src_configure() {
 		# - Broken at runtime without Java (https://sourceware.org/bugzilla/show_bug.cgi?id=29479)
 		# - binutils-config (and this ebuild?) needs adaptation first (https://bugs.gentoo.org/865113)
 		$(use_enable gprofng)
+
+		# Enables colored disassembly by default (equivalent to passing
+		# --disassembler-color=terminal to all objdump invocations).
+		--enable-colored-disassembly
 	)
 
 	case ${CTARGET} in
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/Manifest
index e09bf89cb6e..24194323ded 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/Manifest
@@ -1,2 +1,3 @@
 DIST crossdev-20240209.tar.xz 30904 BLAKE2B b23c6c86796ce37968ce23a9399b068ecb78d6beb8e9b02ac11cd9e8b2f1c82f8905e615417525aa94d51f5da763841a8b9fc7cdc9b64d087a52b077adc92635 SHA512 5834cad934707f173529d7258f8230222e8d18903dea723b0051e06a8d974cab92f6aa7bbeef3a64aec0efd2d0b01f80b63503e78e30ddc1ba7e9a6a4ff08977
 DIST crossdev-20240702.tar.xz 31072 BLAKE2B a8c847490a89f86016adc0b33551ecdb91776e495c1b8fa03dccf70a35164b44b4a948cd9d7166ea1650207e71462633118b02da80cda403798e96b606faf10e SHA512 c9a836a2ce8e82c383693bc71e3094a2586577dc725f05092272023a6c70b5ded315055dc5961cbe0935ed0f4307e08e8551dda595f27b1ff34aa10a3b8bf3eb
+DIST crossdev-20240921.tar.xz 31008 BLAKE2B 9daeabcbeefa32624d71b86c5ddeb1f6bf6ccdf4e6f590bf7517388d4d68b73ae2651ca09d122f128f002568127bd5d7d767db9d6c043e5330b62c3104929848 SHA512 6b7f0bce309d2b0a8fdf9b28cf72098de9dafaf7f338a8308e94e2068cefc15cd2407eee39a9eeb0ea0a1bc46569cedc69a51bb01f140faebe374b660cb1cdf6
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20240921.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20240921.ebuild
new file mode 100644
index 00000000000..d5e567440ec
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20240921.ebuild
@@ -0,0 +1,40 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+if [[ ${PV} == "99999999" ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="
+		https://anongit.gentoo.org/git/proj/crossdev.git
+		https://github.com/gentoo/crossdev
+	"
+else
+	SRC_URI="https://dev.gentoo.org/~chewi/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+DESCRIPTION="Gentoo Cross-toolchain generator"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Crossdev"
+
+LICENSE="GPL-2"
+SLOT="0"
+
+RDEPEND="
+	>=sys-apps/portage-2.1
+	app-shells/bash
+	sys-apps/gentoo-functions
+	sys-apps/config-site
+"
+BDEPEND="app-arch/xz-utils"
+
+src_install() {
+	default
+
+	if [[ ${PV} == "99999999" ]] ; then
+		sed -i "s:@CDEVPV@:${EGIT_VERSION}:" "${ED}"/usr/bin/crossdev || die
+	fi
+
+	dodir /usr/share/config.site.d
+	mv "${ED}"/usr/share/config.site{,.d/80crossdev.conf} || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
index 4e1edd6e7e6..686a8a7e4cc 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
@@ -1,40 +1,36 @@
 DIST gcc-10.5.0-musl-patches-2.tar.xz 3452 BLAKE2B 5387e516d07d81477b3f39b8b3bd986bf861d32cd25dc5481c97bd3620d00c918c5661e86857f66dbf28a655401a53e43417f638c443e44cbfdbf5e950caac4d SHA512 86f2ce31cc4fc4fb5a6043fb527bf822d895e1a6220652024f78a1cbd5a962edb6be8dc5f43c32053e075f39bb2350ea8f14e7d57e0473dd2933a7b44676bde5
 DIST gcc-10.5.0-patches-6.tar.xz 18208 BLAKE2B 4cac3340108fb378c76ad62b728429f3c97f348d178744e7536575f3576ca8aa682b878b7df3b1c162dccae64a3cb56c66d8d60eae323e1ece2de4278084fdbd SHA512 9d6c84325fbc118cee01347468ce729c278e5b026b16da945fe54050726e26f86a46ee7b71a01a47cf927b70bfcce459c49a6bc4fb93dcfaa047c76d4c5bc5bc
 DIST gcc-10.5.0.tar.xz 77846412 BLAKE2B 9b71761f4015649514677784443886e59733ac3845f7dfaa4343f46327d36c08c403c444b9e492b870ac0b3f2e3568f972b7700a0ef05a497fb4066079b3143b SHA512 d86dbc18b978771531f4039465e7eb7c19845bf607dc513c97abf8e45ffe1086a99d98f83dfb7b37204af22431574186de9d5ff80c8c3c3a98dbe3983195bffd
-DIST gcc-11-20240501.tar.xz 76267628 BLAKE2B 31674f1fbaacac3bc8d4f0553b42569128c978b7153eb867387ff2cedd11ba29e2877a66eefbb41b93745e9ff3da7db18c00aacff5766a34b020cb82252da3a4 SHA512 b4fd43b02ddf60dd933f86813cf4c5e2abf4d3344adcffc4166ad2463b2aa37603eb85df642e952a1c72a6356fc41d80567096ddc4e46d4b4589ade34ae77b2d
 DIST gcc-11.4.0-musl-patches-2.tar.xz 4308 BLAKE2B a2335e155fc57816fed822a648e0eaefafcba9d04e1ad0fd7baeea5a694ab6f5e3c1678cb406f2a1bd17bab25cb01699d032713a1ccf337948dfda2093844607 SHA512 17b84f907cb1bd763873655e6f35fd3ed55a40b602b70a626f04f83b4cc89c6261db1661de78d4d969187a8c56e9f6305b742515a3836b962248a21df0df5d0c
 DIST gcc-11.4.0-patches-12.tar.xz 13824 BLAKE2B e4df9e0dc9512882022aaf325ebf65c540169454c91dd31f913c6f57f6eb291c79ae919671b53db1549799d4a70c09298bf45ed82ad05eb1f961443cc958369d SHA512 87fed0c3f8e28c9f702443db58350bb615110b27ebe334b5de2ea60678e2548c56cd75cffade210d69634e2ac0a9311f5100ddb45d97645aa76d5688bc421a61
 DIST gcc-11.5.0.tar.xz 82399864 BLAKE2B f4a61faad32aac9e9cb553c1a1a011df0a057f6e2cac92a13cc7e285d08191dd4a117f41a8faac2359c0e2a16f954c7fef354dda9df8c63bff1c5cefda82602c SHA512 88f17d5a5e69eeb53aaf0a9bc9daab1c4e501d145b388c5485ebeb2cc36178fbb2d3e49ebef4a8c007a05e88471a06b97cf9b08870478249f77fbfa3d4abd9a8
-DIST gcc-12-20240209.tar.xz 79824868 BLAKE2B 1ae5a646da470f06648c4766c77475ceb287c5f6647d5102f1aef6590f973233d5e7f83b5e0241488d49dba59dd605c211938379e68a393a2dccb3834103ae4b SHA512 9f9a04f4477f41bb2a5662aedef2af75b039de50c2dc99310e504e6080cb7aae06a1255337ea2e563975cb108ddc6766adbbaf4e3d5d5712801d7ba9a5209dbd
-DIST gcc-12-20240829.tar.xz 79907788 BLAKE2B d50f01fc6dc5962696062d0c5e0c12753e59030dc44e7b04f37a9a58cf675320151ada22f9d2796e15c3aa3d8e130afb4a8ab03112f8eeed5e57ab51c66e5cb4 SHA512 58cfef9a0c8bf40ec8ccbaeff1460c2e97fdfb76931e06e37fe067b14d52a6c0554e5b9706b937e1f1328c18a133ac61837d9ac52ec2591cd16353009b07aa6a
-DIST gcc-12-20240905.tar.xz 79894592 BLAKE2B 81e2633f138d19d4f96f2e9eb8f908183a9a172d422f1b4381909aadd2e3fb5302f5bb49bcc8b38cc0d32042a6c84141000423a701fabe8f4213c2e144539531 SHA512 f2d8fb19179d330300939c9441fd53f00b4e2595e4b1d85e818d40fd0908ae9867d314d9169597bd10db3655641790129d3c194ceff9a00cde441391d64b0c03
-DIST gcc-12.3.0-musl-patches-1.tar.xz 3572 BLAKE2B c7bf65f7c9ea8023ddaac821ee2b778622fa310ac72a72b2f7032494a8f304eac86217f9204622e6c21aaef9952bece0d09bc126facd4f42b602927909815ab5 SHA512 babc279fea2c1fd4c018815f2f5630214fd46015ce9f365c28af242681d51818eaca30ce298eddcab1eed5ac5f2759e2b47b2335afab9d722b4469a6d4fec326
-DIST gcc-12.3.0-patches-3.tar.xz 14852 BLAKE2B 7a5f1f43063b15f424099afd72096212fbbbc5151ff01f2de15dfb6e7cf274981c8cfaedba9ef61576c9096fb172fc550a7deb5cd7d9366fd249fd5dd3951f76 SHA512 aa89e4c2ae02f4fb42229ad5167f2eaa3a8fae51118645bf07199fe2124b9c83948590662b053d08002ef709fa870ea88315fd4ccbe4441a74e9cb62edcb82fb
+DIST gcc-12-20240919.tar.xz 79901284 BLAKE2B cac209e466ccdffd84610e22961bfbdcd70f6bdd838fe595aa5157670f2a3b9d7db688ffe700e4e7f643a1d3dd806686531e519b2a750b942be63a7dbd7dcb42 SHA512 b032e85be5720ea66b6183f3a5d9f2cc8505c21a0fbdb44d292d8143e37b3ec6e8c3417cb8fc7a18e7cbc961d61c51f681b3ea724086d325c05e7918f7949063
+DIST gcc-12-20240926.tar.xz 79903576 BLAKE2B 704ee10a6e0c358ab4e5ebf9849c2c77f0576ddfc7698f3a5ceab5ada41b201bff3b0ea3f476c3fac7e16dbc606a1885d5042335ef207250f21106286b2587d9 SHA512 259ade01b6d8583bb7bca28b883c9bb1a6929ab7f16d67c14e264dd6118d791ea3bf29c07afa72856cd0612b5e1c1a4ae9224b0e332519956a3642115cb2d592
+DIST gcc-12-20241003.tar.xz 79908436 BLAKE2B 8a07f081c0497d011fe14e9a56eaee2397dabab342b39fb7ca1144006be05ab5fcc599343cf14d7b235a5e3769d0e0883d7678fa263963041012fe4a5814eb14 SHA512 d13f43c85057b5f1f01f26255531675ebb98744e6ca2f3de81924976d3a67f5ce2e462751e1b830da2218e7947d1c8da5e736fc5527b9aa204b497a237e9f9f3
+DIST gcc-12.4.0-musl-patches-1.tar.xz 3068 BLAKE2B e5e39c24934072ea89e4467d0dc5196f3dadfb5ffba0c856d051648a2fbf57d434a57e95227cdf2b8cea45f0f5555aec2bc372d2f6cb0b69efd87831d248d364 SHA512 b9db204845a25be043d76cae826d42eebeeb4f9be7c3049af6fe7601a552bedfd24731156a6a36b4b5e2e2af656a589a5c556d2b0b3ded33ba290a773ee87c62
+DIST gcc-12.4.0-patches-1.tar.xz 15576 BLAKE2B 98c29888de7701b365be7ac9062f0cee3340d58c85485e26f0d02f1483ec64cc9c10651488a4fd937551afe30f4e19777e6766871a724ae3ba6c290c16f4fdf1 SHA512 3f7c5d36e56e07ea9dd143a5d13342a6c1ccbf0643abd1c0bcbfb46bb7c7b1308aef6e3e882031c9c191610f01af906b19be5aa2b139cf617614f46e97463aec
 DIST gcc-12.4.0.tar.xz 83377372 BLAKE2B 0d5aa9995bf53fa2dc976a846240cfb8fafd125ad6c54f45dc9d770215eae3e9ea0db82a9a4f79c51b4d5f8461a1d730c17db6841bc31bd96dba11d9ed7544ae SHA512 5bd29402cad2deb5d9388d0236c7146414d77e5b8d5f1c6c941c7a1f47691c3389f08656d5f6e8e2d6717bf2c81f018d326f632fb468f42925b40bd217fc4853
-DIST gcc-13-20240210.tar.xz 84354416 BLAKE2B 5807623d3f7dd751b6dfe164cfd50d57b2f93485c23c3c2228a4a846a9a94cdad52a5e6f2806e5e7ee2a7b5526386ebdb339c44c7ea023d69f8652088a1b114d SHA512 14a01ced7ac2bfd9fc93de4e3819b4d0823fbe129d3f1faabeb707e9e3e2613b4173321b58b3648a7250e3b7ff5d94edfee60e6c38682f31a1f7b57b1c01433f
 DIST gcc-13-20240614.tar.xz 84463660 BLAKE2B a1b551ff633c31d6972fed173f248ba5f6696eb1566801e180b78a7c7e20933b1aaae40839b4f1529d61166de55125395d4f9a812511c088e73f975bf1d2167f SHA512 1a543ddfb56e793367a43895a7ce4f97daeca6ffd5234ce50e8a7ae0f8db1071e01bdd653fda40d00eb7a680faead8f1d8d1295f983086a33a4c75e4affa2ea5
-DIST gcc-13-20240830.tar.xz 84496796 BLAKE2B af34dc5ec6a38948fce25b60860be2b87a381bb43dd4159fe174d0ea4566d2ca1b1830c3847139336ac34deeaac9d4f80832caf94f25622013f83c3c161e6b65 SHA512 3d8a531145062a22bca483452a08cc5218cb3af9a76828ff706d966c0cd122cf01b61705aa5cceb9364cf0fd0434ad9d32416d079638e1937513ef52d6a3b6dd
-DIST gcc-13-20240906.tar.xz 84500124 BLAKE2B 28c54c9df7fef6778f86edd4bc07c214666ad548e6e3ef30bfaf09df7f1dc6f1d4b6c51589746dff1ca2074f2fd63375c30c1c1b0e7e8b70c21e8db78af9de5a SHA512 32552c971aff250080815f3defce554529aafed4fbbd3486bdcf5895458d096260fc5eb7db451be581f888d93958c5fcf35e4ed14fa06fc990b2845e7f4fe9e3
+DIST gcc-13-20240920.tar.xz 84477260 BLAKE2B f9f0c376d2849a55a61ac5bbbdb456d160e861e8f0acb34651960aa680ec5e8e6d6bdbdeab94c02e51ad1766bd24e5f2dba3a386f6735ea103181dbc1348a943 SHA512 5b7304ea0032a3bd6f111c8da0a9f12958f45e9f117d408e02e8b4892157462c5643891bcedbded7386f5f9987d16a922bd21bd05ad33167379e1579b7baf1aa
+DIST gcc-13-20240927.tar.xz 84487900 BLAKE2B 7b04a3749f4f34cb4b25cce2e02e16422d143f214618468a571f7c0d505ae69928b3dc5b9c95696750a03247934e69816731445613abb9333d7b6b0e65ad5cdc SHA512 532f094e416c151fe80dcd61c64c78398cadea785bf6bd05428d39ff3da5472323cf1c8199ac6aad87abd2893996d18c29b1a2e50dc94286821564e888730d32
+DIST gcc-13-20241004.tar.xz 84474832 BLAKE2B 641d14af692557d47f182d6f53254afcfb4d15181e013b7f720ce9305b79f1969f69a4fda567f369ef49b8d5d8d77d870fbfb82a1d47cb479056b931a08a22be SHA512 5d8fe656965d2af442524d5247ef4f803f3da36f46edfca6a6b1ad66d2f3007a0e71104ef0beae08af10c7c7b060dfc60b3e4fc9117de3bbe107ae2b0869367e
 DIST gcc-13.2.0-musl-patches-2.tar.xz 5292 BLAKE2B c057d6574d03c05854edaa9f3fd40e9149662b04f3ac7a7db3eb078d73a7b535726d1bf52e5b12736dedb2f9898ad731f2e48a6421fcfbf7b90f929dee072fcb SHA512 a691da0c87c443a5e9d23731f4005f27871c5b12bc9102873ffa24d374aa7b9fbd187c4f5635d23fa9ffb17e351e76173c2d3fdf40646e355c4cb314b538de69
-DIST gcc-13.2.0-patches-14.tar.xz 46928 BLAKE2B fce23bc5315f35b04a4976550c4b44578944a1b17e40c7553351eeb8a1ef0f3a2538da5a5e1ae6f37b784ff11bbd8a44b8f6eec542be63e34d984dee69e1cd81 SHA512 d7d52bb2915fd89c06b0134bede8db939cadbb1f2dcddf923bee2c3f9f577ff9e5e986b60420d892539edf82867a0d1bd635807814bc618b06a2b37cdaca893a
 DIST gcc-13.2.0-patches-16.tar.xz 44792 BLAKE2B 0b6b584d68e69685638695596b780249ca0119ad362747a82d886fd10f77ceb05d02e033e906a090c67f44b1977f40df6a95206d81a32dd15e2f5413c6c92496 SHA512 324d9e63d16c35d55edde20de049162c01b0d487b4548d06c49f0da04a761ec255bc5e020cc2e7f60d12f5d129768afdcf7c86a59126f71f388ab375c34be6de
-DIST gcc-13.2.0-patches-17.tar.xz 45036 BLAKE2B 85fe5e6b0da7a4477f0026aaf397d93421503780ef3c91e0a5e3c6897ab73884d4fbc9d2f5f41ce3f3f172fa7eb98e45c348ce41d852457c472360eb2e48691c SHA512 ebe77a32af38df15bc4034e88fb6e90c84b3c0a172d854cabef789cc29bedba14ec0c27fbeae0959027587e02bc882a944ef68a1bb471432d021d11b4b037562
-DIST gcc-13.2.0-patches-18.tar.xz 44820 BLAKE2B 077ca09a3687e23e4ab633cf4a7e57df6293935d89a9b4d3f6234018d5da8d37896463b3bee136addadc86e1b5923157cfbbeed1801837fc92770d6622bbb0ec SHA512 c73512dcf313016b1dda3deb8222734f5e9c4888970801ea6398195b8f3916eaa20d32001a73fb9b8942d7a2e38616428ca4efd54f92ded9f3219679fbff026e
 DIST gcc-13.2.0-patches-3.tar.xz 30956 BLAKE2B 29ce043b46645640ca1e983397af3e158588ad87575f0bc59451ea4a7dd5e3bb5b190ed031de6a22cd790d423ba111e95d222187dd09985dceb12db9f0a2d907 SHA512 4ffecae7be320124ad0c4e71e39e142b7aa8db0e70b5f486f491d7a33ea31efc6464c6abeea77df02a8bd5cf81f08225d625c8af5c27f9afa32c0d7d989f7a3c
 DIST gcc-13.2.0.tar.xz 87858592 BLAKE2B 0034b29d3d6cc05821f0c4253ce077805943aff7b370729dd203bda57d89c107edd657eeddc2fb1e69ea15c7b0323b961f46516c7f4af89a3ccf7fea84701be2 SHA512 d99e4826a70db04504467e349e9fbaedaa5870766cda7c5cab50cdebedc4be755ebca5b789e1232a34a20be1a0b60097de9280efe47bdb71c73251e30b0862a2
+DIST gcc-13.3.0-patches-1.tar.xz 45084 BLAKE2B 4a4b2db25de2f17115e08b50d67449bb16de3296e78c165e2540beda7f84c28f6f3e909856c8b864b378f5e050ed149a60adc580faaf08351b81f4c460656493 SHA512 20e820a3e61f792d380651bb2e40b9c18ce7085962bd9302488ebdad1fff41d3742aea40d712daa5862276ca16d0081de722bf1191e86dcf065af5084271f632
 DIST gcc-14-20240817.tar.xz 88024252 BLAKE2B 994b3e263246e344c6898943a17feb63f07b3de02777a77c689e001343119bd451e1ed5c6958f368077f10b4778c65fa492c55d164e2a0b1bbd65b275aae3cd1 SHA512 31de06694efeb2be49b64e9e8314a766d36c3d5f5f2d52d1e0419ba69262b7c344ef0700957eff11007ba5b81bd5e74dea2a2c0286990cb33927bac4a7db9756
-DIST gcc-14-20240831.tar.xz 88125404 BLAKE2B 947ce02f545ad93d0ee4afcdc7cf7b64ef1cea2cdcea2120789d82370bb8fd0e7e34daf5d7a85e10318147367ef18059cdd0efa232cb4d409e8b4317ee4df800 SHA512 3d92b29c2a0f3c0e6fe043bf5d67d5928daf045538d4925aa6bc0bcc77a9e8bb3667f9d1b2337c56de35ca19203972a770c5afd077f69381371e7072313744db
-DIST gcc-14-20240907.tar.xz 88136648 BLAKE2B 0590ede2cedf9df429ba5c6fe385dbbdd82431160d1c4e779bfdb621b781df6e53bf8865effea62b2438a2e98476ba69a73f3dd81c40c86ad572e17c0fda0971 SHA512 fbcb917982f1abd96f12d63c058f49ae7f90e75294eb80532d4b9da1c601857a2874568274e8210d1538c6d5c3f37e67514d5d55525c2745006875930a1ceb0f
+DIST gcc-14-20240921.tar.xz 88149220 BLAKE2B d92a5a92f24a6f4ace3d1e321e7c9149e8a25222669998c8de010be596a18cc161f288e78ce358ce44fd29f28e56bc678a7c8c775a66ffb71a57c642a7f5af75 SHA512 6a50a6af4a5e661d636b6a7b13b0fe36a66e3be3e20ce97b62c4e9878c974396b9066dfccc108f0bf7f3b28b19e57535a415528b0f0ede1de13a4007625012db
+DIST gcc-14-20240928.tar.xz 88163000 BLAKE2B 1340373a6b0a47ad11d4d09153df432e70a7ae57600db5da32f962790962e252b4b81e74122d8f50a7457a339cae5d713fd75b8ed2637b5c3bf3cf57dbb8573b SHA512 5120b9c42c0f2a44703aac9891bd729f979768689c666f1b208c23604597dd5f0e2062f261a1fe4b69b3dce6ccb3de90a1e3e9af78df6fd543756de507beefa5
+DIST gcc-14-20241005.tar.xz 88173364 BLAKE2B 2aec7ce7aaee879be2ce0758e6eeaf664989e0257f5f0b1b94ef05f455729d9a6f5fb6710f4ac88320d0ecba68d12e0e46a074cb233984fd733d10b952bba6bd SHA512 f7d6302126a20906dab90a0b00d3c8bbec4948aec8024103578bb62f1dcad49d6a44f6b18792d18e32837d4aa764052d08a73bd4df546fa719c28fcdb9024f55
 DIST gcc-14.1.0-musl-patches-1.tar.xz 3600 BLAKE2B 4cd920b7ca1f122cae806707564d8e45bfd48e78c88788a12a301f6068b5a5f335d8885e67479ac536c66aeaa81f2ecb7240ae56e9fc821a7246ab66b453711f SHA512 61c48d90a55dfc2129d96aee69d939d6a89f6407f69f7bd12c1a619f28989f471fd219d731958f8e62b0fd650c32300f0ad8dc06d5df23d9fc8c1a77fe210c25
-DIST gcc-14.1.0-patches-4.tar.xz 11620 BLAKE2B c819fbdea1f3bf10c8d4214d4c33cf28c1410171d2833b6f8c1225eeefe749ddb815067b3fdb750e5839761aee8d39ffc51ffb492f88e630076818a61b18362b SHA512 0d6e1b04591607dfc8022124b186ce499467c32db7667ee1a640fe2e07706597edc0e4ad5c7ebcb75c8f5fc6e45e9b9ef715402c71ff9ab21fe380007fe5d84f
-DIST gcc-14.1.0-patches-5.tar.xz 12504 BLAKE2B 9453bb75c195e43e9b95cee89eee0722dadb8088ce258ae3334ad1023742b41fc0efea45ca4dbd73a20834aa09f72b5fd2d771e1bc58c0cff89a9d2b16ae8dd1 SHA512 b30b5ff1c0234ccfd440ede9e2c13c5fe3d72711ac94996694b3b325ec47f23c6549c41a70f7e08aea16e10fd45d348dcaaef7a7e49a981622d50b21a0971a30
-DIST gcc-14.2.0.tar.xz 92306460 BLAKE2B 87baf2a06dfa75d8fb6cd62c747ef1f57d3b9bbbe33a360d9ed3de4b4dbeaa8d920504c67e409bd9863414202c14fd854b46108e984418171205119216d03d3b SHA512 932bdef0cda94bacedf452ab17f103c0cb511ff2cec55e9112fc0328cbf1d803b42595728ea7b200e0a057c03e85626f937012e49a7515bc5dd256b2bf4bc396
-DIST gcc-15-20240825.tar.xz 89745112 BLAKE2B 983b2f3fbcc8cea6b145f58d8015bf4f848f102f8b196fb363940c7fd556bf2ca07eaff676f0a38a78c0105d2f804e75b2c85f98d2fa3626704b706c227919c9 SHA512 eb106d150988c3350ad2524519b497a5305ef92c09d1322738d6fa91ed382500eeac0a206e8eacd900f85d5ea39b4510783c77f9340e35a948009a2766ddad90
-DIST gcc-15-20240901.tar.xz 89393580 BLAKE2B 5d52cc331aa7dfee416b84112415c60cd03f93855fa46e7c8f55aad22cd39de6e41c77e8870bfe0c67bd38308eb1b99dfe2def0a0e03007ef92fde01923d12c9 SHA512 c6a0885047492f83915c7e13ea7a028c439deaf1390374498be84c55c1d5613f53533a0daa4cd8748b0792f32666f6e472b0e57b8021ba4def23eea91141d4ec
-DIST gcc-15-20240908.tar.xz 89408188 BLAKE2B bd8e48c9f4bde4091c1d0196220873e4b312ee7c62c3ad74d29c1110e24055d0806b51ad3e1be28a17b28199cf4169b23892b43b29cf0791d27a6daab827102e SHA512 e249c638a0bc9c114a2a54c9836b71c93964394a497264556a3ac515e48659582876d18ce4b703c9d5dfad2d0afcf8bdf763be55bde4c18ece2c228b3513c276
+DIST gcc-14.2.0-patches-1.tar.xz 13208 BLAKE2B 17247d5b8871d60a33175302b9657c70f161ae49cb1fea0f217c54d3644151c9cae705b6f88e440fc872597447dabe8c12d9f6c40cbc91fb5e161015e614b3ea SHA512 b7a6939894f48bb046e407bac50db15c9301552afa7d300794243dd139837fdb3a293e4d95259247dd3622e01affcc086393ee5422331bb3d796450a72d6d0fa
+DIST gcc-15-20240929.tar.xz 89549712 BLAKE2B 90b22ddf10f3c7f36f8a19e3a4436fed73b89f84b3f0c837cc12ba8585da1a2e38fc46801213dd6f8e61b115cf0a9f3952caeae268a9f6814c97f7ad08507358 SHA512 f082b945639db38125019f923856874b7f2a937168853c6339d0d9fbc5f0aa146879f4147b06759653c374c4e063fd02585a0fe942e666bcbb07851a308a652c
+DIST gcc-15-20241006.tar.xz 89582908 BLAKE2B d107d960db81e8e92c072ed5a25313b36b9e169575da00bc6bd4a0bfb74741ec162bbee0651db2b4e0d862bc87df0c53f5328863c082a32d29a7b786e93c11ef SHA512 5d220e95db5aff2e5a3c9487ae847e1c57224d9e4bcca3667b0e1f1e722766997348ed121837f099d177456d006adee9392fee3e10127b1b336b17f29aa84211
 DIST gcc-15.0.0-musl-patches-2.tar.xz 3076 BLAKE2B 0073248fe4f7dd827980559017b5aa1fb5c4c46acc9ad5c410dc152fd1e44966d3066bf7152338573cb45b1c36027de5f0c519abd414d97a37bccef07f6a5281 SHA512 295f1a669020bbe2874e9b03afd46b5d083073b276fca3543f3767a2d74f35df81cf0a67abad50c200cf7a3af36ec98ff9977cb7d5c19f334af7d3bb1926a3de
-DIST gcc-15.0.0-patches-11.tar.xz 14880 BLAKE2B ff720e0bf6e1ca18582b9f69e1406af4d226a9427df33be38c58cef0989403c001b2d247799e7b3883ce294242725f116a6a6bf84317f93b47b64abc5d86281e SHA512 78619a8cb6174d99954296e5c79c0eaa0ebe9df13560e1e6c8ce158f50f42cb801849995e465e2d200f999ef1c26f80ae580654841420ec77012e6551e801458
-DIST gcc-15.0.0-patches-12.tar.xz 12980 BLAKE2B 325743e1d4264e80ce91e866bb3cbb9d0e72e186fee0d29e6dace6c48b975992dcd7081fe2a924519d5c1503dedc14a4b41f584dd7d97924664bcc6f6537a8bc SHA512 e18401c517b05e13c203b147f9ba6991c867a8c0a50a7e1a67ea497243d46cbbac674c3498651946f941423241d36b6bc55571a8131fc3604c92604be288f60d
+DIST gcc-15.0.0-patches-13.tar.xz 16480 BLAKE2B b3d9637972ac3644ba0191cb26aa2c9f624ead14816a6358db81745ef984af9de3c0c1f5576edc3045d877b3907a97566b468734baa2e6b2a351187d3e9ff80e SHA512 da368e83643fe2312655654be2de4824c3b5e7efaafbf2dcf63aafa48580cfe74e5394707c577d82e22336dbadd52414e31a597dc3565d0378f3ead5323b9b3c
+DIST gcc-15.0.0-patches-14.tar.xz 14764 BLAKE2B 3da7b4d81ea45ca1254ab9f290ca0c94cacb2d168aa0b3f6b0ef18193f911e204148b1790df9ddf7d1f6955777b3470030e73751fc7d1c0fd23bccfdee10fcbf SHA512 7133b5df5f07307f85a07b05fdc5f8166920aa93b13c1465812be572c7185b7fcf174cc36ddb2bc9fd2323dd010db9a42d35df9871f185794cd22bff57c43eb9
+DIST gcc-15.0.0-patches-15.tar.xz 13116 BLAKE2B ec558b7ddf5907f63c4cde12a5a2b2d563d4db127b6da55682d066db12c5556ab2e70ef62cf019f20479cfd3d6c76a0f7da17dd5e729506b1abc0fad55ed82c4 SHA512 9fcf9f3e5f9d070061b9c636147f8b43fc8254314b51dce52a7a59d525309160da9fc950b64cac04644027a2b66b675bcc741c5883ade2d630cf2d4286b35d5b
 DIST gcc-8.5.0-patches-4.tar.xz 18616 BLAKE2B 7594cbaea5daecf1a0b3d526c06aeba0a84c6da66aee2e105a51fda6be8d30a37ccc3814281b284a4582d892a1d556bca063551584edfc2525bed8ea5b6888e7 SHA512 1aa5742c361186637e7855f06feb1a4547e7d4d5de6e51f3d049e0ef3c19e2eff179465f52781739f59422035b7f8e4c0efa3844849f920f3c96acfdc37ca6a6
 DIST gcc-8.5.0.tar.xz 63841008 BLAKE2B aa81a1a730fd7371360f6abed6ba78b5843fd18c58d5de5687acc320741b9e430e85df3535a1ef7a26051409be8d2f0945f503e5968480d919103123a99d4b12 SHA512 92f599680e6b7fbce88bcdda810f468777d541e5fddfbb287f7977d51093de2a5178bd0e6a08dfe37090ea10a0508a43ccd00220041abbbec33f1179bfc174d8
 DIST gcc-9.5.0-patches-2.tar.xz 14324 BLAKE2B 1d3bf3e673108ad2fcdcb86daefb4603d1c9f6aa815e34d1591054d466b76d6f50cce124ab4760528c4951ea16eb00888a3e6485417f81ebf250548732df4a8e SHA512 a6d6f650aaf0bd193a17ac279649f0544a282cea295824384c59341c3000eac4b574b60e00dd427585d928f9768166abf85168b47772132790ad98854acacbbf
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.0_pre20240623-PR115602.patch b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.0_pre20240623-PR115602.patch
deleted file mode 100644
index d78c6d96490..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.0_pre20240623-PR115602.patch
+++ /dev/null
@@ -1,120 +0,0 @@
-https://gcc.gnu.org/PR115602
-https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=c43c74f6ec795a586388de7abfdd20a0040f6f16
-
-From c43c74f6ec795a586388de7abfdd20a0040f6f16 Mon Sep 17 00:00:00 2001
-From: Richard Biener <rguenther@suse.de>
-Date: Mon, 24 Jun 2024 09:52:39 +0200
-Subject: [PATCH] tree-optimization/115602 - SLP CSE results in cycles
-
-The following prevents SLP CSE to create new cycles which happened
-because of a 1:1 permute node being present where its child was then
-CSEd to the permute node.  Fixed by making a node only available to
-CSE to after recursing.
-
-	PR tree-optimization/115602
-	* tree-vect-slp.cc (vect_cse_slp_nodes): Delay populating the
-	bst-map to avoid cycles.
-
-	* gcc.dg/vect/pr115602.c: New testcase.
----
- gcc/testsuite/gcc.dg/vect/pr115602.c | 27 +++++++++++++++++++++++
- gcc/tree-vect-slp.cc                 | 33 ++++++++++++++++++----------
- 2 files changed, 48 insertions(+), 12 deletions(-)
- create mode 100644 gcc/testsuite/gcc.dg/vect/pr115602.c
-
-diff --git a/gcc/testsuite/gcc.dg/vect/pr115602.c b/gcc/testsuite/gcc.dg/vect/pr115602.c
-new file mode 100644
-index 00000000000..9a208d1d950
---- /dev/null
-+++ b/gcc/testsuite/gcc.dg/vect/pr115602.c
-@@ -0,0 +1,27 @@
-+/* { dg-do compile } */
-+
-+typedef struct {
-+  double x, y;
-+} pointf;
-+struct {
-+  pointf focus;
-+  double zoom;
-+  pointf devscale;
-+  char button;
-+  pointf oldpointer;
-+} gvevent_motion_job;
-+char gvevent_motion_job_4;
-+double gvevent_motion_pointer_1, gvevent_motion_pointer_0;
-+void gvevent_motion() {
-+  double dx = (gvevent_motion_pointer_0 - gvevent_motion_job.oldpointer.x) /
-+              gvevent_motion_job.devscale.x,
-+         dy = (gvevent_motion_pointer_1 - gvevent_motion_job.oldpointer.y) /
-+              gvevent_motion_job.devscale.y;
-+  if (dx && dy < .0001)
-+    return;
-+  switch (gvevent_motion_job_4)
-+  case 2: {
-+    gvevent_motion_job.focus.x -= dy / gvevent_motion_job.zoom;
-+    gvevent_motion_job.focus.y += dx / gvevent_motion_job.zoom;
-+  }
-+}
-diff --git a/gcc/tree-vect-slp.cc b/gcc/tree-vect-slp.cc
-index e84aeabef94..b47b7e8c979 100644
---- a/gcc/tree-vect-slp.cc
-+++ b/gcc/tree-vect-slp.cc
-@@ -6079,35 +6079,44 @@ vect_optimize_slp_pass::run ()
- static void
- vect_cse_slp_nodes (scalar_stmts_to_slp_tree_map_t *bst_map, slp_tree& node)
- {
-+  bool put_p = false;
-   if (SLP_TREE_DEF_TYPE (node) == vect_internal_def
-       /* Besides some VEC_PERM_EXPR, two-operator nodes also
- 	 lack scalar stmts and thus CSE doesn't work via bst_map.  Ideally
- 	 we'd have sth that works for all internal and external nodes.  */
-       && !SLP_TREE_SCALAR_STMTS (node).is_empty ())
-     {
--      if (slp_tree *leader = bst_map->get (SLP_TREE_SCALAR_STMTS (node)))
-+      slp_tree *leader = bst_map->get (SLP_TREE_SCALAR_STMTS (node));
-+      if (leader)
- 	{
--	  if (*leader != node)
--	    {
--	      if (dump_enabled_p ())
--		dump_printf_loc (MSG_NOTE, vect_location,
--				 "re-using SLP tree %p for %p\n",
--				 (void *)*leader, (void *)node);
--	      vect_free_slp_tree (node);
--	      (*leader)->refcnt += 1;
--	      node = *leader;
--	    }
-+	  /* We've visited this node already.  */
-+	  if (!*leader || *leader == node)
-+	    return;
-+
-+	  if (dump_enabled_p ())
-+	    dump_printf_loc (MSG_NOTE, vect_location,
-+			     "re-using SLP tree %p for %p\n",
-+			     (void *)*leader, (void *)node);
-+	  vect_free_slp_tree (node);
-+	  (*leader)->refcnt += 1;
-+	  node = *leader;
- 	  return;
- 	}
- 
--      bst_map->put (SLP_TREE_SCALAR_STMTS (node).copy (), node);
-+      /* Avoid creating a cycle by populating the map only after recursion.  */
-+      bst_map->put (SLP_TREE_SCALAR_STMTS (node).copy (), nullptr);
-       node->refcnt += 1;
-+      put_p = true;
-       /* And recurse.  */
-     }
- 
-   for (slp_tree &child : SLP_TREE_CHILDREN (node))
-     if (child)
-       vect_cse_slp_nodes (bst_map, child);
-+
-+  /* Now record the node for CSE in other siblings.  */
-+  if (put_p)
-+    bst_map->put (SLP_TREE_SCALAR_STMTS (node).copy (), node);
- }
- 
- /* Optimize the SLP graph of VINFO.  */
--- 
-2.43.0
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.0_pre20240922-middle-end-check-explicitly-for-external-or-constant.patch b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.0_pre20240922-middle-end-check-explicitly-for-external-or-constant.patch
new file mode 100644
index 00000000000..7dcf89df522
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.0_pre20240922-middle-end-check-explicitly-for-external-or-constant.patch
@@ -0,0 +1,88 @@
+https://inbox.sourceware.org/gcc-patches/patch-18806-tamar@arm.com/T/#u
+https://gcc.gnu.org/PR116817
+
+From 9a5d1eb943dcaf26551b534eb62cbf1dd8443335 Mon Sep 17 00:00:00 2001
+Message-ID: <9a5d1eb943dcaf26551b534eb62cbf1dd8443335.1727104663.git.sam@gentoo.org>
+From: Tamar Christina <tamar.christina@arm.com>
+Date: Mon, 23 Sep 2024 15:29:52 +0100
+Subject: [PATCH] middle-end: check explicitly for external or constants when
+ checking for loop invariant [PR116817]
+
+Hi All,
+
+The previous check if a value was external was checking
+!vect_get_internal_def (vinfo, var) but this of course isn't completely right
+as they could reductions etc.
+
+This changes the check to just explicitly look at externals and constants.
+Note that reductions remain unhandled here, but we don't support codegen of
+boolean reductions today anyway.
+
+So at the time we do then this would have the be handled as well in lowering.
+
+Bootstrapped Regtested on aarch64-none-linux-gnu and no issues.
+
+Ok for master?
+
+Thanks,
+Tamar
+
+gcc/ChangeLog:
+
+	PR tree-optimization/116817
+	* tree-vect-patterns.cc (vect_recog_bool_pattern): Check for const or
+	externals.
+
+gcc/testsuite/ChangeLog:
+
+PR tree-optimization/116817
+	* g++.dg/vect/pr116817.cc: New test.
+---
+ gcc/testsuite/g++.dg/vect/pr116817.cc | 16 ++++++++++++++++
+ gcc/tree-vect-patterns.cc             |  5 ++++-
+ 2 files changed, 20 insertions(+), 1 deletion(-)
+ create mode 100644 gcc/testsuite/g++.dg/vect/pr116817.cc
+
+diff --git a/gcc/testsuite/g++.dg/vect/pr116817.cc b/gcc/testsuite/g++.dg/vect/pr116817.cc
+new file mode 100644
+index 00000000000..7e28982fb13
+--- /dev/null
++++ b/gcc/testsuite/g++.dg/vect/pr116817.cc
+@@ -0,0 +1,16 @@
++/* { dg-do compile } */
++/* { dg-additional-options "-O3" } */
++
++int main_ulData0;
++unsigned *main_pSrcBuffer;
++int main(void) {
++  int iSrc = 0;
++  bool bData0;
++  for (; iSrc < 4; iSrc++) {
++    if (bData0)
++      main_pSrcBuffer[iSrc] = main_ulData0;
++    else
++      main_pSrcBuffer[iSrc] = 0;
++    bData0 = !bData0;
++  }
++}
+diff --git a/gcc/tree-vect-patterns.cc b/gcc/tree-vect-patterns.cc
+index e7e877dd2adb55262822f1660f8d92b42d44e6d0..f0298b2ab97a1e7dd0d943340e1389c3c0fa796e 100644
+--- a/gcc/tree-vect-patterns.cc
++++ b/gcc/tree-vect-patterns.cc
+@@ -6062,12 +6062,15 @@ vect_recog_bool_pattern (vec_info *vinfo,
+       if (get_vectype_for_scalar_type (vinfo, type) == NULL_TREE)
+ 	return NULL;
+ 
++      stmt_vec_info var_def_info = vinfo->lookup_def (var);
+       if (check_bool_pattern (var, vinfo, bool_stmts))
+ 	var = adjust_bool_stmts (vinfo, bool_stmts, type, stmt_vinfo);
+       else if (integer_type_for_mask (var, vinfo))
+ 	return NULL;
+       else if (TREE_CODE (TREE_TYPE (var)) == BOOLEAN_TYPE
+-	       && !vect_get_internal_def (vinfo, var))
++	       && (!var_def_info
++		   || STMT_VINFO_DEF_TYPE (var_def_info) == vect_external_def
++		   || STMT_VINFO_DEF_TYPE (var_def_info) == vect_constant_def))
+ 	{
+ 	  /* If the condition is already a boolean then manually convert it to a
+ 	     mask of the given integer type but don't set a vectype.  */
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild
index 1c38d13dc19..0f2205413cb 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild
@@ -4,6 +4,7 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="10.5.0"
 PATCH_VER="6"
 MUSL_VER="2"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240501.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240501.ebuild
deleted file mode 100644
index 25c7d792237..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240501.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="11.4.0"
-PATCH_VER="12"
-MUSL_VER="2"
-MUSL_GCC_VER="11.4.0"
-PYTHON_COMPAT=( python3_{10..12} )
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild
index b371c9aa731..417f4754dea 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild
@@ -4,6 +4,7 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="11.4.0"
 PATCH_VER="12"
 MUSL_VER="2"
@@ -38,7 +39,7 @@ if tc_is_live ; then
 	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 	# Don't keyword live ebuilds
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 	:;
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.0.ebuild
index af4495489e4..e3066d71350 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.0.ebuild
@@ -4,10 +4,11 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="12.3.0"
-PATCH_VER="3"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="12.4.0"
+PATCH_VER="1"
 MUSL_VER="1"
-MUSL_GCC_VER="12.3.0"
+MUSL_GCC_VER="12.4.0"
 PYTHON_COMPAT=( python3_{10..12} )
 
 if [[ ${PV} == *.9999 ]] ; then
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20240209.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20240919.ebuild
similarity index 89%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20240209.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20240919.ebuild
index af4495489e4..5d493e9223c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20240209.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20240919.ebuild
@@ -4,10 +4,11 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="12.3.0"
-PATCH_VER="3"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="12.4.0"
+PATCH_VER="1"
 MUSL_VER="1"
-MUSL_GCC_VER="12.3.0"
+MUSL_GCC_VER="12.4.0"
 PYTHON_COMPAT=( python3_{10..12} )
 
 if [[ ${PV} == *.9999 ]] ; then
@@ -38,7 +39,7 @@ if tc_is_live ; then
 	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 	# Don't keyword live ebuilds
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	:;
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20240905.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20240926.ebuild
similarity index 95%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20240905.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20240926.ebuild
index 220fd184cf7..5845745860b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20240905.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20240926.ebuild
@@ -4,10 +4,11 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="12.3.0"
-PATCH_VER="3"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="12.4.0"
+PATCH_VER="1"
 MUSL_VER="1"
-MUSL_GCC_VER="12.3.0"
+MUSL_GCC_VER="12.4.0"
 PYTHON_COMPAT=( python3_{10..12} )
 
 if [[ ${PV} == *.9999 ]] ; then
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20240829.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20241003.ebuild
similarity index 95%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20240829.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20241003.ebuild
index 220fd184cf7..5845745860b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20240829.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20241003.ebuild
@@ -4,10 +4,11 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="12.3.0"
-PATCH_VER="3"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="12.4.0"
+PATCH_VER="1"
 MUSL_VER="1"
-MUSL_GCC_VER="12.3.0"
+MUSL_GCC_VER="12.4.0"
 PYTHON_COMPAT=( python3_{10..12} )
 
 if [[ ${PV} == *.9999 ]] ; then
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.9999.ebuild
index b66d7f055f2..f53e12b9ce5 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.9999.ebuild
@@ -4,6 +4,7 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="12.3.0"
 MUSL_GCC_VER="12.3.0"
 PYTHON_COMPAT=( python3_{10..12} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.0.ebuild
index b14b9fea480..dc739761db4 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.0.ebuild
@@ -5,6 +5,7 @@ EAPI=8
 
 PYTHON_COMPAT=( python3_{10..12} )
 TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="13.2.0"
 PATCH_VER="3"
 MUSL_VER="2"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240614.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240614.ebuild
index e8978a0424a..98f9b64a624 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240614.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240614.ebuild
@@ -4,9 +4,10 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="13.2.0"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="13.3.0"
 MUSL_GCC_VER="13.2.0"
-PATCH_VER="17"
+PATCH_VER="1"
 MUSL_VER="2"
 PYTHON_COMPAT=( python3_{10..12} )
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20240210.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240920.ebuild
similarity index 90%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20240210.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240920.ebuild
index 1a557eb3d3a..de6b5b831fa 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20240210.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240920.ebuild
@@ -4,10 +4,11 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="13.2.0"
-PATCH_VER="14"
-MUSL_VER="2"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="13.3.0"
 MUSL_GCC_VER="13.2.0"
+PATCH_VER="1"
+MUSL_VER="2"
 PYTHON_COMPAT=( python3_{10..12} )
 
 if [[ ${PV} == *.9999 ]] ; then
@@ -38,7 +39,7 @@ if tc_is_live ; then
 	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 	# Don't keyword live ebuilds
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	:;
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240830.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240927.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240830.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240927.ebuild
index 740880e9456..6bff7d38217 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240830.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240927.ebuild
@@ -4,9 +4,10 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="13.2.0"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="13.3.0"
 MUSL_GCC_VER="13.2.0"
-PATCH_VER="18"
+PATCH_VER="1"
 MUSL_VER="2"
 PYTHON_COMPAT=( python3_{10..12} )
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240906.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20241004.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240906.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20241004.ebuild
index 740880e9456..6bff7d38217 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240906.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20241004.ebuild
@@ -4,9 +4,10 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="13.2.0"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="13.3.0"
 MUSL_GCC_VER="13.2.0"
-PATCH_VER="18"
+PATCH_VER="1"
 MUSL_VER="2"
 PYTHON_COMPAT=( python3_{10..12} )
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.9999.ebuild
index 257dc331d8c..d8f1286b351 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.9999.ebuild
@@ -4,6 +4,7 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="13.2.0"
 MUSL_GCC_VER="13.2.0"
 PATCH_VER="16"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20240817.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20240817.ebuild
index dc3f01c1007..265a890763e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20240817.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20240817.ebuild
@@ -4,8 +4,9 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="14.1.0"
-PATCH_VER="4"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="14.2.0"
+PATCH_VER="1"
 MUSL_VER="1"
 MUSL_GCC_VER="14.1.0"
 PYTHON_COMPAT=( python3_{10..12} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20240831.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20240831.ebuild
deleted file mode 100644
index a20857ef74b..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20240831.ebuild
+++ /dev/null
@@ -1,53 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="14.1.0"
-PATCH_VER="5"
-MUSL_VER="1"
-MUSL_GCC_VER="14.1.0"
-PYTHON_COMPAT=( python3_{10..12} )
-
-if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# m68k doesnt build (ICE, bug 932733)
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20240921.ebuild
similarity index 95%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.0.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20240921.ebuild
index dc3f01c1007..265a890763e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20240921.ebuild
@@ -4,8 +4,9 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="14.1.0"
-PATCH_VER="4"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="14.2.0"
+PATCH_VER="1"
 MUSL_VER="1"
 MUSL_GCC_VER="14.1.0"
 PYTHON_COMPAT=( python3_{10..12} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20240817-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20240928.ebuild
similarity index 95%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20240817-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20240928.ebuild
index a20857ef74b..5c623e22f08 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20240817-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20240928.ebuild
@@ -4,8 +4,9 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="14.1.0"
-PATCH_VER="5"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="14.2.0"
+PATCH_VER="1"
 MUSL_VER="1"
 MUSL_GCC_VER="14.1.0"
 PYTHON_COMPAT=( python3_{10..12} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20240907.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20241005.ebuild
similarity index 95%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20240907.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20241005.ebuild
index a20857ef74b..5c623e22f08 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20240907.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20241005.ebuild
@@ -4,8 +4,9 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="14.1.0"
-PATCH_VER="5"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="14.2.0"
+PATCH_VER="1"
 MUSL_VER="1"
 MUSL_GCC_VER="14.1.0"
 PYTHON_COMPAT=( python3_{10..12} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.9999.ebuild
index cee600c71e7..bc9e2e7b7b0 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.9999.ebuild
@@ -4,6 +4,7 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="14.1.0"
 MUSL_GCC_VER="14.1.0"
 PYTHON_COMPAT=( python3_{10..12} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240825.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240929-r1.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240825.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240929-r1.ebuild
index 65d6a54537e..fe87c4b3471 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240825.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240929-r1.ebuild
@@ -4,8 +4,9 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="15.0.0"
-PATCH_VER="11"
+PATCH_VER="14"
 MUSL_VER="2"
 MUSL_GCC_VER="15.0.0"
 PYTHON_COMPAT=( python3_{10..12} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240901.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240929.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240901.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240929.ebuild
index 251b75fc96a..32c163ef2dd 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240901.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240929.ebuild
@@ -4,8 +4,9 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="15.0.0"
-PATCH_VER="12"
+PATCH_VER="13"
 MUSL_VER="2"
 MUSL_GCC_VER="15.0.0"
 PYTHON_COMPAT=( python3_{10..12} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240908.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20241006.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240908.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20241006.ebuild
index 251b75fc96a..9df1dbf6b88 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240908.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20241006.ebuild
@@ -4,8 +4,9 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="15.0.0"
-PATCH_VER="12"
+PATCH_VER="15"
 MUSL_VER="2"
 MUSL_GCC_VER="15.0.0"
 PYTHON_COMPAT=( python3_{10..12} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.9999.ebuild
index 54390309a35..01eae230d75 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.9999.ebuild
@@ -4,6 +4,7 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="15.0.0"
 MUSL_GCC_VER="15.0.0"
 PYTHON_COMPAT=( python3_{10..12} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r1.ebuild
index 13197fafa7d..c1ae8df4017 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r1.ebuild
@@ -5,6 +5,7 @@ EAPI="7"
 
 TOOLCHAIN_PATCH_SUFFIX="xz"
 TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
 PATCH_VER="4"
 PYTHON_COMPAT=( python3_{10..12} )
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild
index 3e1ae186c50..db195459e4a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild
@@ -4,6 +4,7 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="9.5.0"
 PATCH_VER="2"
 PYTHON_COMPAT=( python3_{10..12} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.5.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.5.ebuild
index da6578623e0..86a1334a2c4 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.5.ebuild
@@ -23,7 +23,7 @@ else
 		mirror://gnu/${PN}/${P}.tar.xz
 		verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )
 	"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 # Only libasprintf is under the LGPL (and libintl is in a sep package),
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20240728.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20240728.ebuild
index 7b634d96a34..f6a1f2f14c8 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20240728.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20240728.ebuild
@@ -9,7 +9,7 @@ if [[ ${PV} == 99999999 ]] ; then
 	inherit git-r3
 else
 	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	S="${WORKDIR}"
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20240910_p20240915.ebuild b/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20240910_p20240915.ebuild
index 947e22ff9bc..3af9d1741d1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20240910_p20240915.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20240910_p20240915.ebuild
@@ -43,7 +43,7 @@ S="${WORKDIR}"
 
 LICENSE="intel-ucode"
 SLOT="0"
-KEYWORDS="-* ~amd64 ~x86"
+KEYWORDS="-* amd64 x86"
 IUSE="dist-kernel hostonly +initramfs +split-ucode vanilla"
 REQUIRED_USE="
 	|| ( initramfs split-ucode )
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/Manifest b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/Manifest
index 752d1443696..a606681f00a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/Manifest
@@ -2,5 +2,7 @@ DIST btrfs-progs-v6.10.1.tar.sign 566 BLAKE2B dc18c0048716e422475c6630c26c74e09b
 DIST btrfs-progs-v6.10.1.tar.xz 2670604 BLAKE2B 7a2631b8462bb02be0936861a42b868907bd4f4e365293f9c95744b963e769b81248ba0a290fca517d689ff9f93d8709cc37e217264b2dac1469a47349f97e8c SHA512 cd10747d1f5f9377abfdf209b517791d3eb13b417c0be65fd5c0c044b01063125b4176c178345387bb3deda7a3a379953f31d46d7834854455a5dbfbf967aa97
 DIST btrfs-progs-v6.10.tar.sign 566 BLAKE2B 493260b4854616eabce943135b4990de4a724ad00f8cba43e9d864e5c67e5896890831d17c742456d422ed15267a753c4eaf18ac30a4c7c3da0b254b01becf8b SHA512 62d9721702eec6eec2c0e51eee4624324c4604d3bc76016cde1ade0572c22b46ede71fcb3d9e4ca14ea0196e84116ce4ef9222b399f8bbdf8e5259c18f3a82e8
 DIST btrfs-progs-v6.10.tar.xz 2669760 BLAKE2B 24b66cc6f7118da817e9abca69e8de9a9496de1ec4eb6800fa8f6b13b677e37a553d90562a38618a63b68b71457ab10ff72541dd3e0c169a1fe05509fd62402c SHA512 aa5af67f3816dcd1a128b69bc6f4bd83423c6c2289e3dd3abe2a07bdccb6b7d5e49426a5a0ece643709c23cdcb0908ca52b271f058fee3a3d810cdfcb9c36639
+DIST btrfs-progs-v6.11.tar.sign 566 BLAKE2B 15db44b5db3265eff9d5195ad4842cef5d001c46e1170f219784fca8d049756dccbc1bd95f20fc343fbdf1078c610a166921c043828cdc5f64c0f465323ca0e4 SHA512 a2fdd9100ad3ddd30cb923a72a2b4f70634277e5fbbf0d2cf912c00dc876dad6cd2c24e624f41dbb83aabdda4e3c08aea9c0ae39084bb3481700491df3d47fd5
+DIST btrfs-progs-v6.11.tar.xz 2695752 BLAKE2B 6dec219394e39a821f29858eddf1d501537d3cebad2dc83f0cea6d88d0b0e94c4fe2e660a48a27942ccfb6f3ac0630d5930f44e083168de65b60af36e895b2af SHA512 fad3c7e908e2020a3983f9737a7e87367023e2ad35aea14197e2bfa71c1e0435bc3da3f7e6ef463de47c033323163f8b1b7933013042c6fcea673d0f4723ade1
 DIST btrfs-progs-v6.9.2.tar.sign 566 BLAKE2B 4cd95496d355444c7d3e582a7e6c05fbb55683008b1585a26f38aef6cceb1afd5e80c9611518d6bd92dc1167798d4012c4bcab2f9bda752c459d94cfa6f3c477 SHA512 3fb04e1894e231abde388a39d2f0c90f43c1a1494622c2158fab9b94bb340e064404bcf96e24d913c60aaf5e06ade42fbb91a479949109b329682bb089f66bf2
 DIST btrfs-progs-v6.9.2.tar.xz 2661684 BLAKE2B 38ab189ac8271ba8d68b74e82569159c671cca1cb946f56ccab28b6b206cb6ee5b330d83afc3536b7e0d7399da3fb01e368809c1ef4a64b843ea88796ebd28bd SHA512 1df9d5456d07a035c38c17795996a4fc621eeaa244ef54383d4387205826d2a6e971910e55031d20bb1baf23193efa7439e110312ffd8471f07aaf8c0baca20a
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.10.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.10.1.ebuild
index 3a777a5c58b..5f200767c98 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.10.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.10.1.ebuild
@@ -26,7 +26,7 @@ else
 	S="${WORKDIR}"/${PN}-${MY_PV}
 
 	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+		KEYWORDS="~alpha amd64 arm ~arm64 ~loong ~mips ~ppc ppc64 ~riscv ~sparc x86"
 	fi
 fi
 
@@ -102,7 +102,7 @@ if [[ ${PV} != 9999 ]]; then
 		if use verify-sig; then
 			einfo "Unpacking ${MY_P}.tar.xz ..."
 			verify-sig_verify_detached - "${DISTDIR}"/${MY_P}.tar.sign \
-				< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -x))
+				< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -xf -))
 			assert "Unpack failed"
 		else
 			default
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.10.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.10.ebuild
index 3a777a5c58b..757755270ab 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.10.ebuild
@@ -102,7 +102,7 @@ if [[ ${PV} != 9999 ]]; then
 		if use verify-sig; then
 			einfo "Unpacking ${MY_P}.tar.xz ..."
 			verify-sig_verify_detached - "${DISTDIR}"/${MY_P}.tar.sign \
-				< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -x))
+				< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -xf -))
 			assert "Unpack failed"
 		else
 			default
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.11.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.11.ebuild
new file mode 100644
index 00000000000..757755270ab
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.11.ebuild
@@ -0,0 +1,188 @@
+# Copyright 2008-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Please bump with dev-python/btrfsutil
+
+PYTHON_COMPAT=( python3_{10..13} )
+inherit bash-completion-r1 python-any-r1 udev
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://github.com/kdave/btrfs-progs.git"
+	EGIT_BRANCH="devel"
+	WANT_LIBTOOL="none"
+	inherit autotools git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/dsterba.asc
+	inherit verify-sig
+
+	MY_PV="v${PV/_/-}"
+	MY_P="${PN}-${MY_PV}"
+	SRC_URI="
+		https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/${PN}/${MY_P}.tar.xz
+		verify-sig? ( https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/${PN}/${MY_P}.tar.sign )
+	"
+	S="${WORKDIR}"/${PN}-${MY_PV}
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	fi
+fi
+
+DESCRIPTION="Btrfs filesystem utilities"
+HOMEPAGE="https://btrfs.readthedocs.io/en/latest/"
+
+LICENSE="GPL-2"
+SLOT="0/0" # libbtrfs soname
+IUSE="+convert +man experimental reiserfs static static-libs udev +zstd"
+# Could support it with just !systemd => eudev, see mdadm, but let's
+# see if someone asks for it first.
+REQUIRED_USE="static? ( !udev )"
+
+# Tries to mount repaired filesystems
+RESTRICT="test"
+
+RDEPEND="
+	dev-libs/lzo:2=
+	sys-apps/util-linux:=[static-libs(+)?]
+	sys-libs/zlib:=
+	convert? (
+		sys-fs/e2fsprogs:=
+		reiserfs? (
+			>=sys-fs/reiserfsprogs-3.6.27
+		)
+	)
+	udev? ( virtual/libudev:= )
+	zstd? ( app-arch/zstd:= )
+"
+DEPEND="
+	${RDEPEND}
+	>=sys-kernel/linux-headers-5.10
+	convert? ( sys-apps/acl )
+	static? (
+		dev-libs/lzo:2[static-libs(+)]
+		sys-apps/util-linux:0[static-libs(+)]
+		sys-libs/zlib:0[static-libs(+)]
+		convert? (
+			sys-fs/e2fsprogs[static-libs(+)]
+			reiserfs? (
+				>=sys-fs/reiserfsprogs-3.6.27[static-libs(+)]
+			)
+		)
+		zstd? ( app-arch/zstd[static-libs(+)] )
+	)
+"
+BDEPEND="
+	virtual/pkgconfig
+	man? (
+		$(python_gen_any_dep 'dev-python/sphinx[${PYTHON_USEDEP}]
+			dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]')
+	)
+"
+
+python_check_deps() {
+	python_has_version "dev-python/sphinx[${PYTHON_USEDEP}]" &&
+	python_has_version "dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]"
+}
+
+if [[ ${PV} == 9999 ]]; then
+	BDEPEND+=" sys-devel/gnuconfig"
+else
+	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-dsterba )"
+fi
+
+pkg_setup() {
+	: # Prevent python-any-r1_python_setup
+}
+
+if [[ ${PV} != 9999 ]]; then
+	src_unpack() {
+		# Upstream sign the decompressed .tar
+		if use verify-sig; then
+			einfo "Unpacking ${MY_P}.tar.xz ..."
+			verify-sig_verify_detached - "${DISTDIR}"/${MY_P}.tar.sign \
+				< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -xf -))
+			assert "Unpack failed"
+		else
+			default
+		fi
+	}
+fi
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]]; then
+		local AT_M4DIR=config
+		eautoreconf
+
+		local automakedir="$(autotools_run_tool --at-output automake --print-libdir)"
+		[[ -e ${automakedir} ]] || die "Could not locate automake directory"
+
+		ln -s "${automakedir}"/install-sh config/install-sh || die
+		ln -s "${BROOT}"/usr/share/gnuconfig/config.guess config/config.guess || die
+		ln -s "${BROOT}"/usr/share/gnuconfig/config.sub config/config.sub || die
+	fi
+}
+
+src_configure() {
+	local myeconfargs=(
+		--bindir="${EPREFIX}"/sbin
+
+		--enable-lzo
+		$(use_enable experimental)
+		--disable-python
+		$(use_enable convert)
+		$(use_enable man documentation)
+		$(use_enable elibc_glibc backtrace)
+		$(use_enable static-libs static)
+		$(use_enable udev libudev)
+		$(use_enable zstd)
+
+		# Could support libgcrypt, libsodium, libkcapi, openssl, botan
+		--with-crypto=builtin
+		--with-convert=ext2$(usev reiserfs ',reiserfs')
+	)
+
+	export EXTRA_PYTHON_CFLAGS="${CFLAGS}"
+	export EXTRA_PYTHON_LDFLAGS="${LDFLAGS}"
+
+	if use man; then
+		python_setup
+	fi
+
+	# bash as a temporary workaround for https://github.com/kdave/btrfs-progs/pull/721
+	CONFIG_SHELL="${BROOT}"/bin/bash econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	emake V=1 all $(usev static)
+}
+
+src_test() {
+	emake V=1 -j1 -C tests test
+}
+
+src_install() {
+	local makeargs=(
+		$(usev static install-static)
+	)
+
+	emake V=1 DESTDIR="${D}" install "${makeargs[@]}"
+
+	if use experimental; then
+		exeinto /sbin
+		doexe btrfs-corrupt-block
+	fi
+
+	newbashcomp btrfs-completion btrfs
+}
+
+pkg_postinst() {
+	udev_reload
+}
+
+pkg_postrm() {
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.9.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.9.2.ebuild
index 7fa0ffa3634..89de2ab69fa 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.9.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.9.2.ebuild
@@ -102,7 +102,7 @@ if [[ ${PV} != 9999 ]]; then
 		if use verify-sig; then
 			einfo "Unpacking ${MY_P}.tar.xz ..."
 			verify-sig_verify_detached - "${DISTDIR}"/${MY_P}.tar.sign \
-				< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -x))
+				< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -xf -))
 			assert "Unpack failed"
 		else
 			default
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-9999.ebuild
index 3a777a5c58b..757755270ab 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-9999.ebuild
@@ -102,7 +102,7 @@ if [[ ${PV} != 9999 ]]; then
 		if use verify-sig; then
 			einfo "Unpacking ${MY_P}.tar.xz ..."
 			verify-sig_verify_detached - "${DISTDIR}"/${MY_P}.tar.sign \
-				< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -x))
+				< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -xf -))
 			assert "Unpack failed"
 		else
 			default
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/Manifest b/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/Manifest
index 3494e32bbc0..9bbd8064cf1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/Manifest
@@ -2,3 +2,4 @@ DIST cryptsetup-2.6.1.tar.xz 11402380 BLAKE2B efd7a64d89d863876de68ff3e89d8c94ad
 DIST cryptsetup-2.7.2.tar.xz 11637316 BLAKE2B 466d7818cf8b6e23f802291ccad205d09f128572c21a85d6ca8e518d2198e49c9d95066c58560ffcb7df5a483aa27592b0e931db1e4daeabd102db9a5543da20 SHA512 06f42f443b91d1f8af8af999dfedd4051ecb12ba5ef291cf2b44b6a5676e2c5cf1e686e19687f5cb6b1fd524dfc1a208cd25a3798367a480d80eac954aa8d6d4
 DIST cryptsetup-2.7.3.tar.xz 11689300 BLAKE2B 6de2c5eb4a0e1108eedb9c81c69ef70696b166ee592641927a0f8e11e566d644e0f7db3436b0446d5df33b3fab55af9592b869bb54d5fa94e67c5003404bc9b8 SHA512 08cff21873aeb7cc5b2561abf5d33cdf0fa814eeaabf6a01f858461726ea9faeef651357da33bce7b347ca2f12d6d02bccdb279893f3749cb781ce1fe5c1571c
 DIST cryptsetup-2.7.4.tar.xz 11695292 BLAKE2B a7e9397342482e83a21177699aedbd7a59c2f841512cdf9c8fdcec34d8d448056b2aca89cceae55e8d01654cf5a6ea260ec44879fc7b7fd15fe613c0ad95bc6a SHA512 3cc601ab1c4d5fd282f990529d7cb95f59c8aa9beb0ebd11de7ebf78cb35c352bcb8c945a2033cb6c53540b37156fdf2824070d431c752f9f7b029e4ec930c21
+DIST cryptsetup-2.7.5.tar.xz 11697476 BLAKE2B 7df7b53f74cbf1a009d2804b8d85c9fea27be994bb4171e1ded70e3666635fd8f265819321bee0d1977548626029ebf75b87225a68cb38b3b79910f991c813dd SHA512 13eca93cdb00a143d2ca60b6f66ede5adc4072ca0c4bfebd8454a3541e69d269fcdb4afc97ad799e87a999b2bd46c1f31fa924a3d616d72a3337970b1e718d55
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.7.5.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.7.5.ebuild
new file mode 100644
index 00000000000..d09dd78f2b6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.7.5.ebuild
@@ -0,0 +1,149 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# TODO: meson
+inherit linux-info tmpfiles
+
+DESCRIPTION="Tool to setup encrypted devices with dm-crypt"
+HOMEPAGE="https://gitlab.com/cryptsetup/cryptsetup"
+SRC_URI="https://www.kernel.org/pub/linux/utils/${PN}/v$(ver_cut 1-2)/${P/_/-}.tar.xz"
+S="${WORKDIR}"/${P/_/-}
+
+LICENSE="GPL-2+"
+SLOT="0/12" # libcryptsetup.so version
+if [[ ${PV} != *_rc* ]] ; then
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+fi
+
+CRYPTO_BACKENDS="gcrypt kernel nettle +openssl"
+# we don't support nss since it doesn't allow cryptsetup to be built statically
+# and it's missing ripemd160 support so it can't provide full backward compatibility
+IUSE="${CRYPTO_BACKENDS} +argon2 fips nls pwquality ssh static static-libs test +udev urandom"
+RESTRICT="!test? ( test )"
+# bug #496612, bug #832711, bug #843863
+REQUIRED_USE="
+	^^ ( ${CRYPTO_BACKENDS//+/} )
+	static? ( !ssh !udev !fips )
+	fips? ( !kernel !nettle )
+"
+
+LIB_DEPEND="
+	dev-libs/json-c:=[static-libs(+)]
+	dev-libs/popt[static-libs(+)]
+	>=sys-apps/util-linux-2.31-r1[static-libs(+)]
+	argon2? ( app-crypt/argon2:=[static-libs(+)] )
+	gcrypt? (
+		dev-libs/libgcrypt:0=[static-libs(+)]
+		dev-libs/libgpg-error[static-libs(+)]
+	)
+	nettle? ( >=dev-libs/nettle-2.4[static-libs(+)] )
+	openssl? ( dev-libs/openssl:0=[static-libs(+)] )
+	pwquality? ( dev-libs/libpwquality[static-libs(+)] )
+	ssh? ( net-libs/libssh[static-libs(+)] )
+	sys-fs/lvm2[static-libs(+)]
+"
+# We have to always depend on ${LIB_DEPEND} rather than put behind
+# !static? () because we provide a shared library which links against
+# these other packages. bug #414665
+RDEPEND="
+	static-libs? ( ${LIB_DEPEND} )
+	${LIB_DEPEND//\[static-libs\([+-]\)\]}
+	udev? ( virtual/libudev:= )
+"
+DEPEND="
+	${RDEPEND}
+	static? ( ${LIB_DEPEND} )
+"
+# vim-core needed for xxd in tests
+BDEPEND="
+	virtual/pkgconfig
+	test? ( app-editors/vim-core )
+"
+
+pkg_setup() {
+	local CONFIG_CHECK="~DM_CRYPT ~CRYPTO ~CRYPTO_CBC ~CRYPTO_SHA256"
+	local WARNING_DM_CRYPT="CONFIG_DM_CRYPT:\tis not set (required for cryptsetup)\n"
+	local WARNING_CRYPTO_SHA256="CONFIG_CRYPTO_SHA256:\tis not set (required for cryptsetup)\n"
+	local WARNING_CRYPTO_CBC="CONFIG_CRYPTO_CBC:\tis not set (required for kernel 2.6.19)\n"
+	local WARNING_CRYPTO="CONFIG_CRYPTO:\tis not set (required for cryptsetup)\n"
+	check_extra_config
+}
+
+src_prepare() {
+	default
+
+	sed -i '/^LOOPDEV=/s:$: || exit 0:' tests/{compat,mode}-test || die
+}
+
+src_configure() {
+	local myeconfargs=(
+		--disable-internal-argon2
+		--disable-asciidoc
+		--enable-shared
+		--sbindir="${EPREFIX}"/sbin
+		# for later use
+		--with-default-luks-format=LUKS2
+		--with-tmpfilesdir="${EPREFIX}/usr/lib/tmpfiles.d"
+		--with-crypto_backend=$(for x in ${CRYPTO_BACKENDS//+/} ; do usev ${x} ; done)
+		$(use_enable argon2 libargon2)
+		$(use_enable nls)
+		$(use_enable pwquality)
+		$(use_enable !static external-tokens)
+		$(use_enable static static-cryptsetup)
+		$(use_enable static-libs static)
+		$(use_enable udev)
+		$(use_enable !urandom dev-random)
+		$(use_enable ssh ssh-token)
+		$(usev !argon2 '--with-luks2-pbkdf=pbkdf2')
+		$(use_enable fips)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	if [[ ! -e /dev/mapper/control ]] ; then
+		ewarn "No /dev/mapper/control found -- skipping tests"
+		return 0
+	fi
+
+	local p
+	for p in /dev/mapper /dev/loop* ; do
+		addwrite ${p}
+	done
+
+	default
+}
+
+src_install() {
+	default
+
+	if use static ; then
+		mv "${ED}"/sbin/cryptsetup{.static,} || die
+		mv "${ED}"/sbin/veritysetup{.static,} || die
+		mv "${ED}"/sbin/integritysetup{.static,} || die
+
+		if use ssh ; then
+			mv "${ED}"/sbin/cryptsetup-ssh{.static,} || die
+		fi
+	fi
+
+	find "${ED}" -type f -name "*.la" -delete || die
+
+	dodoc docs/v*ReleaseNotes
+
+	newconfd "${FILESDIR}"/2.4.3-dmcrypt.confd dmcrypt
+	newinitd "${FILESDIR}"/2.4.3-dmcrypt.rc dmcrypt
+}
+
+pkg_postinst() {
+	tmpfiles_process cryptsetup.conf
+
+	if use kernel ; then
+		ewarn "Note that kernel backend is very slow for this type of operation"
+		ewarn "and is provided mainly for embedded systems wanting to avoid"
+		ewarn "userspace crypto libraries."
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/quota/quota-4.09-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/quota/quota-4.09-r1.ebuild
index 47c0029fea4..e14163a2cbb 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/quota/quota-4.09-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/quota/quota-4.09-r1.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://downloads.sourceforge.net/linuxquota/${P}.tar.gz"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~mips ~ppc ppc64 ~riscv ~sparc x86"
 IUSE="ldap netlink nls rpc selinux tcpd"
 
 RDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/Manifest b/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/Manifest
index a635a3c7f3d..d8111034d34 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/Manifest
@@ -1 +1,2 @@
 DIST squashfs-tools-ng-1.3.1.tar.xz 585916 BLAKE2B 697131ddb9959bed388534f90c93e2e7495ef5aec9facf97e7d17475cff64d7a4badb709a16ae5e6da3ee89b1a1e3a49833bd15b9a0b4b364e15a565bd18e480 SHA512 0a433f7c3633cd5d8646d990744e31ed59c7012d5f8bb4fdb7892b892631f22a8fd0969f7d81de68f53e44670e71cb8e29729cd925a93b98ab3b6942bbc30662
+DIST squashfs-tools-ng-1.3.2.tar.xz 585380 BLAKE2B 43e8e7c189a9e3a23964a9ae17666eba7ff362d7ed011ee09e342d9ef777de2ce8e326cd38fa0932ace33929cf75bab81786ca56411053c08041300459262076 SHA512 6f14d90875ef3f3d36d3cd38932ade6b0da7284922c914bd655e3f0a4abb17ba75d4bc052a1d4244c1b4ff96b3798d83d5a7b3263b8e1b96c112f4cdf967400f
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/squashfs-tools-ng-1.3.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/squashfs-tools-ng-1.3.2.ebuild
new file mode 100644
index 00000000000..e768bb9ae94
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/squashfs-tools-ng-1.3.2.ebuild
@@ -0,0 +1,57 @@
+# Copyright 2019-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="A new set of tools for working with SquashFS images"
+HOMEPAGE="https://github.com/AgentD/squashfs-tools-ng"
+if [[ ${PV} = 9999* ]]; then
+	inherit autotools git-r3
+	EGIT_REPO_URI="https://github.com/AgentD/${PN}.git"
+else
+	inherit libtool
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	SRC_URI="https://infraroot.at/pub/squashfs/${P}.tar.xz"
+fi
+
+LICENSE="LGPL-3+ BSD-2 MIT tools? ( GPL-3+ )"
+SLOT="0"
+IUSE="lz4 +lzma lzo selinux +tools zstd"
+
+DEPEND="
+	app-arch/bzip2:=
+	sys-libs/zlib:=
+	lz4?     ( app-arch/lz4:= )
+	lzma?    ( app-arch/xz-utils )
+	lzo?     ( dev-libs/lzo:2 )
+	selinux? ( sys-libs/libselinux:= )
+	zstd?    ( app-arch/zstd:= )
+"
+RDEPEND="${DEPEND}"
+
+src_prepare() {
+	default
+	if [[ ${PV} = "9999" ]]; then
+		eautoreconf
+	else
+		elibtoolize
+	fi
+}
+
+src_configure() {
+	local myconf=(
+		--disable-static
+		$(use_with lz4)
+		$(use_with lzo)
+		$(use_with selinux)
+		$(use_with tools)
+		$(use_with lzma xz)
+		$(use_with zstd)
+	)
+	econf "${myconf[@]}"
+}
+
+src_install() {
+	default
+	find "${D}" -name "*.la" -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/Manifest b/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/Manifest
index 5923efb090d..75738786437 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/Manifest
@@ -1,3 +1,4 @@
 DIST xfsprogs-6.10.0.tar.xz 1449872 BLAKE2B dc02fb14cd07e20d618070358700003a0990125ce3d8b15fa0248c6d494a89bbfb51c267583fc863edeee0d84069c7016f7992e750faa357618cd0d7f5748d2e SHA512 ec80eedfd3471c836e99eb8507c0de2895f261d36316145b02f2effbcc1bb5a52eae3ad2148d45bc49f1a30e0267aa4e3f3176a5e01ec84b2da24b3fb430ffce
+DIST xfsprogs-6.10.1.tar.xz 1449932 BLAKE2B e9ed15b2d4a9026e0079adfb38578721e13498290a5d9590edae1fd41c9ee0338f9b823568677394952709d82bdc8ade36905a2266ffe64803901adbadfa5643 SHA512 b9fd7b7eaf038772ee4a9602bf38f714db7077731ec8904e0959d28b0103d443be8ae67720869012b90737c1ff440fbce44b3b23b662939c9a90c6d3be3fab08
 DIST xfsprogs-6.8.0.tar.xz 1367196 BLAKE2B 8c296698da1170bb7ff369c2bf5f156e812ddf43ee817369029ad951d6c1e18c20d093db385b9a523f6cb7ba3e01f8924eb3540b71efa4bec8bf3defe2418562 SHA512 f5b5c6d8da70cc0f3361b3420982aabfabb0bc54b9eb60b93a9aaeedb33a9ecede4061d5c1300b96d7aba7d44a4207672c4a33e115bf0f5c711a151f3fc65e0d
 DIST xfsprogs-6.9.0.tar.xz 1383116 BLAKE2B d952603716cc4022a935c426630b0b7838573476a730c6832f36ef0274a640e64667d3e3a2dd9fd2c5f2c12cdb348fd93abfef5c49e5c5fe2d5a83945dfc7894 SHA512 c597453759c400690810971f0b2daf0e4e22c74270b0f9800e2235da5e5c1383b59bc1176c5bba0023f74b623020fb51c62f0e98a74885cf3a8336e0b81c9023
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/files/xfsprogs-5.18.0-docdir.patch b/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/files/xfsprogs-5.18.0-docdir.patch
deleted file mode 100644
index 480f44cf607..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/files/xfsprogs-5.18.0-docdir.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/scrub/Makefile
-+++ b/scrub/Makefile
-@@ -25,7 +25,7 @@
- CRONTABS = xfs_scrub_all.cron
- OPTIONAL_TARGETS += $(CRONTABS)
- # Don't enable the crontab by default for now
--CROND_DIR = $(PKG_LIB_SCRIPT_DIR)/$(PKG_NAME)
-+CROND_DIR = $(PKG_DOC_DIR)
- endif
- 
- endif	# scrub_prereqs
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/xfsprogs-6.10.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/xfsprogs-6.10.1.ebuild
new file mode 100644
index 00000000000..30de84a18b5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/xfsprogs-6.10.1.ebuild
@@ -0,0 +1,110 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic systemd udev
+
+DESCRIPTION="XFS filesystem utilities"
+HOMEPAGE="https://xfs.wiki.kernel.org/ https://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/"
+SRC_URI="https://www.kernel.org/pub/linux/utils/fs/xfs/${PN}/${P}.tar.xz"
+
+LICENSE="LGPL-2.1"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="icu libedit nls selinux static-libs"
+
+RDEPEND="
+	dev-libs/inih
+	dev-libs/userspace-rcu:=
+	>=sys-apps/util-linux-2.17.2
+	icu? ( dev-libs/icu:= )
+	libedit? ( dev-libs/libedit )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="nls? ( sys-devel/gettext )"
+RDEPEND+=" selinux? ( sec-policy/selinux-xfs )"
+
+src_prepare() {
+	default
+
+	# Fix doc dir
+	sed -i \
+		-e "/^PKG_DOC_DIR/s:@pkg_name@:${PF}:" \
+		include/builddefs.in || die
+
+	# Don't install compressed docs
+	sed 's@\(CHANGES\)\.gz[[:space:]]@\1 @' -i doc/Makefile || die
+}
+
+src_configure() {
+	# include/builddefs.in will add FCFLAGS to CFLAGS which will
+	# unnecessarily clutter CFLAGS (and fortran isn't used)
+	unset FCFLAGS
+
+	# If set in user env, this breaks configure
+	unset PLATFORM
+
+	export DEBUG=-DNDEBUG
+
+	# Package is honoring CFLAGS; No need to use OPTIMIZER anymore.
+	# However, we have to provide an empty value to avoid default
+	# flags.
+	export OPTIMIZER=" "
+
+	# Avoid automagic on libdevmapper (bug #709694)
+	export ac_cv_search_dm_task_create=no
+
+	# bug 903611
+	use elibc_musl && append-flags -D_LARGEFILE64_SOURCE
+
+	# Build fails with -O3 (bug #712698)
+	replace-flags -O3 -O2
+
+	# Upstream does NOT support --disable-static anymore,
+	# https://www.spinics.net/lists/linux-xfs/msg30185.html
+	# https://www.spinics.net/lists/linux-xfs/msg30272.html
+	local myconf=(
+		--enable-static
+		# Doesn't do anything beyond adding -flto (bug #930947).
+		--disable-lto
+		# The default value causes double 'lib'
+		--localstatedir="${EPREFIX}/var"
+		--with-crond-dir="${EPREFIX}/etc/cron.d"
+		--with-systemd-unit-dir="$(systemd_get_systemunitdir)"
+		--with-udev-rule-dir="$(get_udevdir)/rules.d"
+		$(use_enable icu libicu)
+		$(use_enable nls gettext)
+		$(use_enable libedit editline)
+	)
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	emake V=1
+}
+
+src_install() {
+	# XXX: There's a missing dep in the install-dev target, so split it
+	emake DIST_ROOT="${ED}" HAVE_ZIPPED_MANPAGES=false install
+	emake DIST_ROOT="${ED}" HAVE_ZIPPED_MANPAGES=false install-dev
+
+	# Not actually used but --localstatedir causes this empty dir
+	# to be installed.
+	rmdir "${ED}"/var/lib/xfsprogs "${ED}"/var/lib || die
+
+	if ! use static-libs; then
+		rm "${ED}/usr/$(get_libdir)/libhandle.a" || die
+	fi
+
+	find "${ED}" -name '*.la' -delete || die
+}
+
+pkg_postrm() {
+	udev_reload
+}
+
+pkg_postinst() {
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/Manifest b/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/Manifest
index 6a58959b824..9b9fdd0b90e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/Manifest
@@ -1,14 +1,8 @@
-DIST zfs-2.1.14.tar.gz 35167471 BLAKE2B a7b22eaf05e4fbf416ebe4d7b884c515942fc9375c1dd322cefa00c19c550b9318a4192d6a909d49d58523c8f1a6eaf00189dd58e6543fae17cf8cc35042f469 SHA512 4a65c8b7d5576fa2dcc14e7ccaa93191c1d3791479cf89bd02c2bd04434ff5e93709b328796d4f9ba93da19f12772e359df373f40919350a3e1e4c52758b47c8
-DIST zfs-2.1.14.tar.gz.asc 836 BLAKE2B f01bc58bf6c3d367c494ed4ea9f3fb1141f3aafdbf4f913b9e0d60d31557076d5ae0e25ca93b013f5fd85e21ba5ae9f61e1a03af54bb0c743869c0ce3d5519df SHA512 be0f386cce952b4047dc2448e356078668e8d4392802dd3bb1a426741f15f4d9fb689cd1cb09972bdbc9fe2e4e782ec4b4754fe811c5657bc1f5308bd38e3926
 DIST zfs-2.1.15.tar.gz 35209038 BLAKE2B 61f9e14c54d43d1c51269917bb3ffde0530166126ea0467103ff1171dffc537315fd21c270d12f73d677e121b8094af39dd0a1fe3f80986bb42dc16d627dff52 SHA512 24096f2a6ecb3cc51f3d2f11cc69ad134d6fc33667007277c50cf798be2b19b6ddfa9be6923ca53d8b09f0bebae14c44d74811ec776e5aaf4ea0e810844c1f3d
 DIST zfs-2.1.15.tar.gz.asc 836 BLAKE2B 897c05a8870cd0418493b42fe854ef5b28f9a31513ac262a25631089defa59190808b51bd31e43412b01171bcac0dff0608d417dfdacfeee0b0f067e0627d48f SHA512 a6c5a9d214070a220716075455eb1cb85a53fb20b5fe4319f112cde0653a25f87b66d0f0bcf0ca641e3ac38239759cb9df6ed7f4700056a2732cc8c1ccd9ce05
-DIST zfs-2.2.2.tar.gz 33816541 BLAKE2B f0619ae42d898d18077096217d0a9ddd7c7378424707aa51d3645661b2889a1459bc4a5e9fe42b6860b2d26e4600da35765b0e741725dafacc2ead2370cad866 SHA512 bba252cbf7986f2cce154dd18a34aa478cf98f70106337188dc894de2446d60a58fa643706927757d1787506b44d4ff404897a2d0e16aacb0a7bf27765703332
-DIST zfs-2.2.2.tar.gz.asc 836 BLAKE2B bdc86492b2bf45d329e34e89ea7796f5cbf518d32ab114c909321b1d0d8040b9ce4e25b3b85fcbc5ea62ee10a2d716b5b27e37c2c005b307c0b593815c49d625 SHA512 110be1aa90f4749106717165a3cb5116379e2d170146a2b3d2601f04212450da9327e028d6e1e5de7f8a46c6bb7a15e2bcdd09e3e760590fbc695f9562f1440b
-DIST zfs-2.2.3.tar.gz 33854765 BLAKE2B f83439aa929609191a048dd326b2a15e0f57c72d2901cbfb205b81a29aa42dab49b42eb61647ca3eaed17518b8c907e81343364bfecf83ed441271648f8efd4b SHA512 e6c3df531a33f4bd198429e61b7630f1e965a03fd60d1b847bdf0d55c6d2af3abc38b5e8a63aa9ef9f969cc7eca36cb24a7641f6fb8c41ef2fa024d76cd28f3d
-DIST zfs-2.2.3.tar.gz.asc 836 BLAKE2B 86e1adc393d1f4643a6fd8c188b555e9dc0fdf7e25690f37ff0a04ff8826eb4fe3c125b54f0c5b9ab33f1daff43c4b44373ee9a4df506f6714f98d77782e6c3c SHA512 fe23ddb9bde78416776411d66a56aa662fa051c8544b4be01ba238b8c1a85ccde1c55329f228fe8ab2681b54a4e4cb08d4e927c597c117242f0b536a40921dc9
-DIST zfs-2.2.4.tar.gz 33882933 BLAKE2B f0026a12b7c1252bf8941e39f23d3e165750034707dfddf034d8aac942a749cb7f0108478797ca978704a22743d9928240b29cf78fe89eda9f873f40102413f0 SHA512 1d17e30573d594fb5c9ea77cde104616dca362fed7530296816d1b55173594f66170fcfb23ab57c27074f85b79d3eb557b4ee9a1c420e507b2434a7902d8dcc1
-DIST zfs-2.2.4.tar.gz.asc 836 BLAKE2B 7fde4232c25056eac2fae76abec4d6749c91d285d79ae6dce4ae4880fa90a26c9fb370dfa4daaf8a849f30fcc1b63eeb215444bfca724f6750bf7e4344f35fa7 SHA512 0cb3caf01b9e4d1f0c35d9f7933a4b11560b9bbf6c05494d8a1775b0a52ac1d642aebd77ef1c7b23a0a06f92e2b1ab3d8afacce41017eb07745d148af7f76a17
 DIST zfs-2.2.5.tar.gz 33896824 BLAKE2B ec73c866bf931e4af63a35b3e61e1254d681d21aadba304ea95c147a3911c3d92db686591147036848ceae1683f31f6f81e04a24df6cb11a91a8abaed179567f SHA512 8e288620ce78fb235fa0c9929fc97150987a64091a8a5209209f1e0975d4d6213b8b307e32b3c89d934e83dc8468a1998b797fcdff5bbbbd023f07674877b0c6
 DIST zfs-2.2.5.tar.gz.asc 836 BLAKE2B ae6e47ce82ffda8834047e03f361ca096448f98ea811a09c0c68b202996c613e6524501cda49873acc4bca9f60c298635f89e5d7fe8f00ffa05b192fc98e16ef SHA512 0a397471c3f1ee9675eb9fcd589409c5085f8692930275ea15d92042fadaf1d3772666a3cca5adb1730c953464e0ec00f501cc5333a303d322c636020c2a7060
 DIST zfs-2.2.6.tar.gz 33900138 BLAKE2B 0bbe36df779aaf19460a75725af9c9b13e64e77a6020974ad18d60d9fd52db2ddd6ea98b3e6c7451195bdfb347b8aab51db9b3f9a7c15c77bff47329bbd07dd2 SHA512 c217a3397b67d7239bc30bc492d58fff96bb29c9cf73e390d1787a4fb787cb297557e594a926453fed11faaab80363d40853af271f8ee18ce9a317dfde4c6745
 DIST zfs-2.2.6.tar.gz.asc 836 BLAKE2B db66f3e2e629ab8a344a8e0c2609bcbb98d69d110fc9e064760ee0c5c25cd67421a71764c4b65d7005e8ff66167bf24beb4be2560a47318eabffa888c1539f26 SHA512 d09f343b3acc3a81e96c069072cfb16d0b490ee77562f50e14524faf05560f9e1d1325ec4bc1760c86ed29186d5860d59646d4ea07385ee3b28d879f2374b9b4
+DIST zfs-2.3.0-rc1.tar.gz 33887119 BLAKE2B dd4e159bef6de216cc51c1dd22620e6edb5b7503d95402022d0b9439471fe432181b1e5df2142e63cdac812a74b62657a96573b3bf48ad78bd6fd885a5f8913e SHA512 fe7de046dd48dbb67545726482a501788a1d5601e6e9a17deeb29047946689d9c8deb95f72b2b47c26a205a3c94fa1f0123437479a06b1376b9dac3dd6faf463
+DIST zfs-2.3.0-rc1.tar.gz.asc 195 BLAKE2B f70e6223e94a3f79d6d685b2b06254fba845d79768c82b7a3fedb865b6e6c97499c497def0f4c3e4a2869fed88b0965650ae88d5eb72c0ffaed43c4479d3bf96 SHA512 26b395feaf03e2be20b75ef64e573aa98a0706c46a1eb57503925731bf0cb9bf7fef8a2cdcf163233bccd7da9f5aedc0cae73f0183f39e0f13dcf315b4a5d809
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/files/zfs-kmod-2.2.2-arm64-neon.patch b/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/files/zfs-kmod-2.2.2-arm64-neon.patch
deleted file mode 100644
index 54121adcdca..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/files/zfs-kmod-2.2.2-arm64-neon.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-https://bugs.gentoo.org/904657
-https://github.com/openzfs/zfs/issues/14555
-https://github.com/openzfs/zfs/commit/976bf9b6a61919638d42ed79cd207132785d128a
-
-From 976bf9b6a61919638d42ed79cd207132785d128a Mon Sep 17 00:00:00 2001
-From: Shengqi Chen <harry-chen@outlook.com>
-Date: Tue, 9 Jan 2024 08:05:24 +0800
-Subject: [PATCH] Linux 6.2 compat: add check for kernel_neon_* availability
-
-This patch adds check for `kernel_neon_*` symbols on arm and arm64
-platforms to address the following issues:
-
-1. Linux 6.2+ on arm64 has exported them with `EXPORT_SYMBOL_GPL`, so
-   license compatibility must be checked before use.
-2. On both arm and arm64, the definitions of these symbols are guarded
-   by `CONFIG_KERNEL_MODE_NEON`, but their declarations are still
-   present. Checking in configuration phase only leads to MODPOST
-   errors (undefined references).
-
-Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
-Signed-off-by: Shengqi Chen <harry-chen@outlook.com>
-Closes #15711
-Closes #14555
-Closes: #15401
---- a/config/kernel-fpu.m4
-+++ b/config/kernel-fpu.m4
-@@ -79,6 +79,12 @@ AC_DEFUN([ZFS_AC_KERNEL_SRC_FPU], [
- 		__kernel_fpu_end();
- 	], [], [ZFS_META_LICENSE])
- 
-+	ZFS_LINUX_TEST_SRC([kernel_neon], [
-+		#include <asm/neon.h>
-+	], [
-+		kernel_neon_begin();
-+		kernel_neon_end();
-+	], [], [ZFS_META_LICENSE])
- ])
- 
- AC_DEFUN([ZFS_AC_KERNEL_FPU], [
-@@ -105,9 +111,20 @@ AC_DEFUN([ZFS_AC_KERNEL_FPU], [
- 			AC_DEFINE(KERNEL_EXPORTS_X86_FPU, 1,
- 			    [kernel exports FPU functions])
- 		],[
--			AC_MSG_RESULT(internal)
--			AC_DEFINE(HAVE_KERNEL_FPU_INTERNAL, 1,
--			    [kernel fpu internal])
-+			dnl #
-+			dnl # ARM neon symbols (only on arm and arm64)
-+			dnl # could be GPL-only on arm64 after Linux 6.2
-+			dnl #
-+			ZFS_LINUX_TEST_RESULT([kernel_neon_license],[
-+				AC_MSG_RESULT(kernel_neon_*)
-+				AC_DEFINE(HAVE_KERNEL_NEON, 1,
-+				    [kernel has kernel_neon_* functions])
-+			],[
-+				# catch-all
-+				AC_MSG_RESULT(internal)
-+				AC_DEFINE(HAVE_KERNEL_FPU_INTERNAL, 1,
-+				    [kernel fpu internal])
-+			])
- 		])
- 	])
- ])
---- a/include/os/linux/kernel/linux/simd_aarch64.h
-+++ b/include/os/linux/kernel/linux/simd_aarch64.h
-@@ -71,9 +71,15 @@
- #define	ID_AA64PFR0_EL1		sys_reg(3, 0, 0, 1, 0)
- #define	ID_AA64ISAR0_EL1	sys_reg(3, 0, 0, 6, 0)
- 
-+#if (defined(HAVE_KERNEL_NEON) && defined(CONFIG_KERNEL_MODE_NEON))
- #define	kfpu_allowed()		1
- #define	kfpu_begin()		kernel_neon_begin()
- #define	kfpu_end()		kernel_neon_end()
-+#else
-+#define	kfpu_allowed()		0
-+#define	kfpu_begin()		do {} while (0)
-+#define	kfpu_end()		do {} while (0)
-+#endif
- #define	kfpu_init()		(0)
- #define	kfpu_fini()		do {} while (0)
- 
---- a/include/os/linux/kernel/linux/simd_arm.h
-+++ b/include/os/linux/kernel/linux/simd_arm.h
-@@ -53,9 +53,15 @@
- #include <asm/elf.h>
- #include <asm/hwcap.h>
- 
-+#if (defined(HAVE_KERNEL_NEON) && defined(CONFIG_KERNEL_MODE_NEON))
- #define	kfpu_allowed()		1
- #define	kfpu_begin()		kernel_neon_begin()
- #define	kfpu_end()		kernel_neon_end()
-+#else
-+#define	kfpu_allowed()		0
-+#define	kfpu_begin()		do {} while (0)
-+#define	kfpu_end()		do {} while (0)
-+#endif
- #define	kfpu_init()		(0)
- #define	kfpu_fini()		do {} while (0)
- 
-
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/files/zfs-kmod-2.2.2-autotrim.patch b/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/files/zfs-kmod-2.2.2-autotrim.patch
deleted file mode 100644
index 6d72389fdb2..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/files/zfs-kmod-2.2.2-autotrim.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-https://bugs.gentoo.org/923745
-https://github.com/openzfs/zfs/issues/15453
-https://github.com/openzfs/zfs/pull/15781
-https://github.com/openzfs/zfs/pull/15789
-
-From a0aa7a2ee3b56d7b6d69c2081034ec8293a6d605 Mon Sep 17 00:00:00 2001
-From: Kevin Jin <33590050+jxdking@users.noreply.github.com>
-Date: Wed, 17 Jan 2024 12:03:58 -0500
-Subject: [PATCH] Autotrim High Load Average Fix
-
-Switch from cv_wait() to cv_wait_idle() in vdev_autotrim_wait_kick(),
-which should mitigate the high load average while waiting.
-
-Reviewed-by: Brian Atkinson <batkinson@lanl.gov>
-Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
-Reviewed-by: Alexander Motin <mav@FreeBSD.org>
-Signed-off-by: jxdking <lostking2008@hotmail.com>
-Closes #15781
---- a/module/zfs/vdev_trim.c
-+++ b/module/zfs/vdev_trim.c
-@@ -194,7 +194,8 @@ vdev_autotrim_wait_kick(vdev_t *vd, int num_of_kick)
- 	for (int i = 0; i < num_of_kick; i++) {
- 		if (vd->vdev_autotrim_exit_wanted)
- 			break;
--		cv_wait(&vd->vdev_autotrim_kick_cv, &vd->vdev_autotrim_lock);
-+		cv_wait_idle(&vd->vdev_autotrim_kick_cv,
-+		    &vd->vdev_autotrim_lock);
- 	}
- 	boolean_t exit_wanted = vd->vdev_autotrim_exit_wanted;
- 	mutex_exit(&vd->vdev_autotrim_lock);
-
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.1.14.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.1.14.ebuild
deleted file mode 100644
index 5b5d9f647ee..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.1.14.ebuild
+++ /dev/null
@@ -1,167 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-MODULES_INITRAMFS_IUSE=+initramfs
-inherit autotools flag-o-matic linux-mod-r1 multiprocessing
-
-DESCRIPTION="Linux ZFS kernel module for sys-fs/zfs"
-HOMEPAGE="https://github.com/openzfs/zfs"
-
-MODULES_KERNEL_MAX=6.5
-MODULES_KERNEL_MIN=3.10
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://github.com/openzfs/zfs.git"
-	inherit git-r3
-	unset MODULES_KERNEL_MAX
-else
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openzfs.asc
-	inherit verify-sig
-
-	MY_PV=${PV/_rc/-rc}
-	SRC_URI="https://github.com/openzfs/zfs/releases/download/zfs-${MY_PV}/zfs-${MY_PV}.tar.gz"
-	SRC_URI+=" verify-sig? ( https://github.com/openzfs/zfs/releases/download/zfs-${MY_PV}/zfs-${MY_PV}.tar.gz.asc )"
-	S="${WORKDIR}/zfs-${PV%_rc?}"
-
-	ZFS_KERNEL_COMPAT="${MODULES_KERNEL_MAX}"
-	# Increments minor eg 5.14 -> 5.15, and still supports override.
-	ZFS_KERNEL_DEP="${ZFS_KERNEL_COMPAT_OVERRIDE:-${ZFS_KERNEL_COMPAT}}"
-	ZFS_KERNEL_DEP="${ZFS_KERNEL_DEP%%.*}.$(( ${ZFS_KERNEL_DEP##*.} + 1))"
-
-	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="amd64 arm64 ppc64 ~riscv ~sparc"
-	fi
-fi
-
-LICENSE="CDDL MIT debug? ( GPL-2+ )"
-SLOT="0/${PVR}"
-IUSE="custom-cflags debug +rootfs"
-RESTRICT="test"
-
-BDEPEND="
-	dev-lang/perl
-	app-alternatives/awk
-"
-
-if [[ ${PV} != 9999 ]] ; then
-	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-openzfs )"
-
-	IUSE+=" +dist-kernel-cap"
-	RDEPEND="
-		dist-kernel-cap? ( dist-kernel? (
-			<virtual/dist-kernel-${ZFS_KERNEL_DEP}
-		) )
-	"
-fi
-
-# Used to suggest matching USE, but without suggesting to disable
-PDEPEND="dist-kernel? ( ~sys-fs/zfs-${PV}[dist-kernel] )"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-2.1.11-gentoo.patch
-)
-
-pkg_pretend() {
-	use rootfs || return 0
-}
-
-pkg_setup() {
-	local CONFIG_CHECK="
-		EFI_PARTITION
-		ZLIB_DEFLATE
-		ZLIB_INFLATE
-		!DEBUG_LOCK_ALLOC
-		!PAX_KERNEXEC_PLUGIN_METHOD_OR
-	"
-	use debug && CONFIG_CHECK+="
-		DEBUG_INFO
-		FRAME_POINTER
-		!DEBUG_INFO_REDUCED
-	"
-	use rootfs && CONFIG_CHECK+="
-		BLK_DEV_INITRD
-		DEVTMPFS
-	"
-
-	kernel_is -lt 5 && CONFIG_CHECK+=" IOSCHED_NOOP"
-
-	if [[ ${PV} != 9999 ]] ; then
-		local kv_major_max kv_minor_max zcompat
-		zcompat="${ZFS_KERNEL_COMPAT_OVERRIDE:-${ZFS_KERNEL_COMPAT}}"
-		kv_major_max="${zcompat%%.*}"
-		zcompat="${zcompat#*.}"
-		kv_minor_max="${zcompat%%.*}"
-		kernel_is -le "${kv_major_max}" "${kv_minor_max}" || die \
-			"Linux ${kv_major_max}.${kv_minor_max} is the latest supported version"
-	fi
-
-	linux-mod-r1_pkg_setup
-}
-
-src_prepare() {
-	default
-
-	# Run unconditionally (bug #792627)
-	eautoreconf
-
-	if [[ ${PV} != 9999 ]] ; then
-		# Set module revision number
-		sed -Ei "s/(Release:.*)1/\1${PR}-gentoo/" META || die
-	fi
-}
-
-src_configure() {
-	use custom-cflags || strip-flags
-	filter-ldflags -Wl,*
-
-	local myconf=(
-		--bindir="${EPREFIX}"/bin
-		--sbindir="${EPREFIX}"/sbin
-		--with-config=kernel
-		--with-linux="${KV_DIR}"
-		--with-linux-obj="${KV_OUT_DIR}"
-		$(use_enable debug)
-
-		# See gentoo.patch
-		GENTOO_MAKEARGS_EVAL="${MODULES_MAKEARGS[*]@Q}"
-		TEST_JOBS="$(makeopts_jobs)"
-	)
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	emake "${MODULES_MAKEARGS[@]}"
-}
-
-src_install() {
-	emake "${MODULES_MAKEARGS[@]}" DESTDIR="${ED}" install
-	modules_post_process
-
-	dodoc AUTHORS COPYRIGHT META README.md
-}
-
-pkg_postinst() {
-	linux-mod-r1_pkg_postinst
-
-	if use x86 || use arm ; then
-		ewarn "32-bit kernels will likely require increasing vmalloc to"
-		ewarn "at least 256M and decreasing zfs_arc_max to some value less than that."
-	fi
-
-	if has_version sys-boot/grub ; then
-		ewarn "This version of OpenZFS includes support for new feature flags"
-		ewarn "that are incompatible with previous versions. GRUB2 support for"
-		ewarn "/boot with the new feature flags is not yet available."
-		ewarn "Do *NOT* upgrade root pools to use the new feature flags."
-		ewarn "Any new pools will be created with the new feature flags by default"
-		ewarn "and will not be compatible with older versions of OpenZFS. To"
-		ewarn "create a new pool that is backward compatible wih GRUB2, use "
-		ewarn
-		ewarn "zpool create -o compatibility=grub2 ..."
-		ewarn
-		ewarn "Refer to /usr/share/zfs/compatibility.d/grub2 for list of features."
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.2.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.2.2-r1.ebuild
deleted file mode 100644
index 6f4cf5107e3..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.2.2-r1.ebuild
+++ /dev/null
@@ -1,209 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-MODULES_INITRAMFS_IUSE=+initramfs
-inherit autotools flag-o-matic linux-mod-r1 multiprocessing
-
-DESCRIPTION="Linux ZFS kernel module for sys-fs/zfs"
-HOMEPAGE="https://github.com/openzfs/zfs"
-
-MODULES_KERNEL_MAX=6.6
-MODULES_KERNEL_MIN=3.10
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://github.com/openzfs/zfs.git"
-	inherit git-r3
-	unset MODULES_KERNEL_MAX
-else
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openzfs.asc
-	inherit verify-sig
-
-	MY_PV=${PV/_rc/-rc}
-	SRC_URI="https://github.com/openzfs/zfs/releases/download/zfs-${MY_PV}/zfs-${MY_PV}.tar.gz"
-	SRC_URI+=" verify-sig? ( https://github.com/openzfs/zfs/releases/download/zfs-${MY_PV}/zfs-${MY_PV}.tar.gz.asc )"
-	S="${WORKDIR}/zfs-${MY_PV}"
-
-	ZFS_KERNEL_COMPAT="${MODULES_KERNEL_MAX}"
-	# Increments minor eg 5.14 -> 5.15, and still supports override.
-	ZFS_KERNEL_DEP="${ZFS_KERNEL_COMPAT_OVERRIDE:-${ZFS_KERNEL_COMPAT}}"
-	ZFS_KERNEL_DEP="${ZFS_KERNEL_DEP%%.*}.$(( ${ZFS_KERNEL_DEP##*.} + 1))"
-
-	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv ~sparc"
-	fi
-fi
-
-LICENSE="CDDL MIT debug? ( GPL-2+ )"
-SLOT="0/${PVR}"
-IUSE="custom-cflags debug +rootfs"
-RESTRICT="test"
-
-BDEPEND="
-	app-alternatives/awk
-	dev-lang/perl
-"
-
-if [[ ${PV} != 9999 ]] ; then
-	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-openzfs )"
-
-	IUSE+=" +dist-kernel-cap"
-	RDEPEND="
-		dist-kernel-cap? ( dist-kernel? (
-			<virtual/dist-kernel-${ZFS_KERNEL_DEP}
-		) )
-	"
-fi
-
-# Used to suggest matching USE, but without suggesting to disable
-PDEPEND="dist-kernel? ( ~sys-fs/zfs-${PV}[dist-kernel] )"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-2.1.11-gentoo.patch
-	"${FILESDIR}"/${PN}-2.2.2-arm64-neon.patch
-	"${FILESDIR}"/${PN}-2.2.2-autotrim.patch
-)
-
-pkg_pretend() {
-	use rootfs || return 0
-}
-
-pkg_setup() {
-	local CONFIG_CHECK="
-		EFI_PARTITION
-		ZLIB_DEFLATE
-		ZLIB_INFLATE
-		!DEBUG_LOCK_ALLOC
-		!PAX_KERNEXEC_PLUGIN_METHOD_OR
-	"
-	use debug && CONFIG_CHECK+="
-		DEBUG_INFO
-		FRAME_POINTER
-		!DEBUG_INFO_REDUCED
-	"
-	use rootfs && CONFIG_CHECK+="
-		BLK_DEV_INITRD
-		DEVTMPFS
-	"
-
-	kernel_is -lt 5 && CONFIG_CHECK+=" IOSCHED_NOOP"
-
-	if [[ ${PV} != 9999 ]] ; then
-		local kv_major_max kv_minor_max zcompat
-		zcompat="${ZFS_KERNEL_COMPAT_OVERRIDE:-${ZFS_KERNEL_COMPAT}}"
-		kv_major_max="${zcompat%%.*}"
-		zcompat="${zcompat#*.}"
-		kv_minor_max="${zcompat%%.*}"
-		kernel_is -le "${kv_major_max}" "${kv_minor_max}" || die \
-			"Linux ${kv_major_max}.${kv_minor_max} is the latest supported version"
-	fi
-
-	linux-mod-r1_pkg_setup
-}
-
-src_prepare() {
-	default
-
-	# Run unconditionally (bug #792627)
-	eautoreconf
-
-	if [[ ${PV} != 9999 ]] ; then
-		# Set module revision number
-		sed -Ei "s/(Release:.*)1/\1${PR}-gentoo/" META || die
-	fi
-}
-
-src_configure() {
-	use custom-cflags || strip-flags
-	filter-ldflags -Wl,*
-
-	local myconf=(
-		--bindir="${EPREFIX}"/bin
-		--sbindir="${EPREFIX}"/sbin
-		--with-config=kernel
-		--with-linux="${KV_DIR}"
-		--with-linux-obj="${KV_OUT_DIR}"
-		$(use_enable debug)
-
-		# See gentoo.patch
-		GENTOO_MAKEARGS_EVAL="${MODULES_MAKEARGS[*]@Q}"
-		TEST_JOBS="$(makeopts_jobs)"
-	)
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	emake "${MODULES_MAKEARGS[@]}"
-}
-
-src_install() {
-	emake "${MODULES_MAKEARGS[@]}" DESTDIR="${ED}" install
-	modules_post_process
-
-	dodoc AUTHORS COPYRIGHT META README.md
-}
-
-_old_layout_cleanup() {
-	# new files are just extra/{spl,zfs}.ko with no subdirs.
-	local olddir=(
-		avl/zavl
-		icp/icp
-		lua/zlua
-		nvpair/znvpair
-		spl/spl
-		unicode/zunicode
-		zcommon/zcommon
-		zfs/zfs
-		zstd/zzstd
-	)
-
-	# kernel/module/Kconfig contains possible compressed extentions.
-	local kext kextfiles
-		for kext in .ko{,.{gz,xz,zst}}; do
-		kextfiles+=( "${olddir[@]/%/${kext}}" )
-	done
-
-	local oldfile oldpath
-	for oldfile in "${kextfiles[@]}"; do
-		oldpath="${EROOT}/lib/modules/${KV_FULL}/extra/${oldfile}"
-		if [[ -f "${oldpath}" ]]; then
-			ewarn "Found obsolete zfs module ${oldfile} for current kernel ${KV_FULL}, removing."
-			rm -rv "${oldpath}" || die
-			# we do not remove non-empty directories just for safety in case there's something else.
-			# also it may fail if there are both compressed and uncompressed modules installed.
-			rmdir -v --ignore-fail-on-non-empty "${oldpath%/*.*}" || die
-		fi
-	done
-}
-
-pkg_postinst() {
-	# Check for old module layout before doing anything else.
-	# only attempt layout cleanup if new .ko location is used.
-	local newko=( "${EROOT}/lib/modules/${KV_FULL}/extra"/{zfs,spl}.ko* )
-	# We check first array member, if glob above did not exand, it will be "zfs.ko*" and -f will return false.
-	# if glob expanded -f will do correct file precense check.
-	[[ -f ${newko[0]} ]] && _old_layout_cleanup
-
-	linux-mod-r1_pkg_postinst
-
-	if use x86 || use arm ; then
-		ewarn "32-bit kernels will likely require increasing vmalloc to"
-		ewarn "at least 256M and decreasing zfs_arc_max to some value less than that."
-	fi
-
-	if has_version sys-boot/grub ; then
-		ewarn "This version of OpenZFS includes support for new feature flags"
-		ewarn "that are incompatible with previous versions. GRUB2 support for"
-		ewarn "/boot with the new feature flags is not yet available."
-		ewarn "Do *NOT* upgrade root pools to use the new feature flags."
-		ewarn "Any new pools will be created with the new feature flags by default"
-		ewarn "and will not be compatible with older versions of OpenZFS. To"
-		ewarn "create a new pool that is backward compatible wih GRUB2, use "
-		ewarn
-		ewarn "zpool create -o compatibility=grub2 ..."
-		ewarn
-		ewarn "Refer to /usr/share/zfs/compatibility.d/grub2 for list of features."
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.2.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.2.2.ebuild
deleted file mode 100644
index b46dea36c18..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.2.2.ebuild
+++ /dev/null
@@ -1,208 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-MODULES_INITRAMFS_IUSE=+initramfs
-inherit autotools flag-o-matic linux-mod-r1 multiprocessing
-
-DESCRIPTION="Linux ZFS kernel module for sys-fs/zfs"
-HOMEPAGE="https://github.com/openzfs/zfs"
-
-MODULES_KERNEL_MAX=6.6
-MODULES_KERNEL_MIN=3.10
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://github.com/openzfs/zfs.git"
-	inherit git-r3
-	unset MODULES_KERNEL_MAX
-else
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openzfs.asc
-	inherit verify-sig
-
-	MY_PV=${PV/_rc/-rc}
-	SRC_URI="https://github.com/openzfs/zfs/releases/download/zfs-${MY_PV}/zfs-${MY_PV}.tar.gz"
-	SRC_URI+=" verify-sig? ( https://github.com/openzfs/zfs/releases/download/zfs-${MY_PV}/zfs-${MY_PV}.tar.gz.asc )"
-	S="${WORKDIR}/zfs-${MY_PV}"
-
-	ZFS_KERNEL_COMPAT="${MODULES_KERNEL_MAX}"
-	# Increments minor eg 5.14 -> 5.15, and still supports override.
-	ZFS_KERNEL_DEP="${ZFS_KERNEL_COMPAT_OVERRIDE:-${ZFS_KERNEL_COMPAT}}"
-	ZFS_KERNEL_DEP="${ZFS_KERNEL_DEP%%.*}.$(( ${ZFS_KERNEL_DEP##*.} + 1))"
-
-	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="amd64 arm64 ~loong ppc64 ~riscv ~sparc"
-	fi
-fi
-
-LICENSE="CDDL MIT debug? ( GPL-2+ )"
-SLOT="0/${PVR}"
-IUSE="custom-cflags debug +rootfs"
-RESTRICT="test"
-
-BDEPEND="
-	app-alternatives/awk
-	dev-lang/perl
-"
-
-if [[ ${PV} != 9999 ]] ; then
-	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-openzfs )"
-
-	IUSE+=" +dist-kernel-cap"
-	RDEPEND="
-		dist-kernel-cap? ( dist-kernel? (
-			<virtual/dist-kernel-${ZFS_KERNEL_DEP}
-		) )
-	"
-fi
-
-# Used to suggest matching USE, but without suggesting to disable
-PDEPEND="dist-kernel? ( ~sys-fs/zfs-${PV}[dist-kernel] )"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-2.1.11-gentoo.patch
-	"${FILESDIR}"/${PN}-2.2.2-arm64-neon.patch
-)
-
-pkg_pretend() {
-	use rootfs || return 0
-}
-
-pkg_setup() {
-	local CONFIG_CHECK="
-		EFI_PARTITION
-		ZLIB_DEFLATE
-		ZLIB_INFLATE
-		!DEBUG_LOCK_ALLOC
-		!PAX_KERNEXEC_PLUGIN_METHOD_OR
-	"
-	use debug && CONFIG_CHECK+="
-		DEBUG_INFO
-		FRAME_POINTER
-		!DEBUG_INFO_REDUCED
-	"
-	use rootfs && CONFIG_CHECK+="
-		BLK_DEV_INITRD
-		DEVTMPFS
-	"
-
-	kernel_is -lt 5 && CONFIG_CHECK+=" IOSCHED_NOOP"
-
-	if [[ ${PV} != 9999 ]] ; then
-		local kv_major_max kv_minor_max zcompat
-		zcompat="${ZFS_KERNEL_COMPAT_OVERRIDE:-${ZFS_KERNEL_COMPAT}}"
-		kv_major_max="${zcompat%%.*}"
-		zcompat="${zcompat#*.}"
-		kv_minor_max="${zcompat%%.*}"
-		kernel_is -le "${kv_major_max}" "${kv_minor_max}" || die \
-			"Linux ${kv_major_max}.${kv_minor_max} is the latest supported version"
-	fi
-
-	linux-mod-r1_pkg_setup
-}
-
-src_prepare() {
-	default
-
-	# Run unconditionally (bug #792627)
-	eautoreconf
-
-	if [[ ${PV} != 9999 ]] ; then
-		# Set module revision number
-		sed -Ei "s/(Release:.*)1/\1${PR}-gentoo/" META || die
-	fi
-}
-
-src_configure() {
-	use custom-cflags || strip-flags
-	filter-ldflags -Wl,*
-
-	local myconf=(
-		--bindir="${EPREFIX}"/bin
-		--sbindir="${EPREFIX}"/sbin
-		--with-config=kernel
-		--with-linux="${KV_DIR}"
-		--with-linux-obj="${KV_OUT_DIR}"
-		$(use_enable debug)
-
-		# See gentoo.patch
-		GENTOO_MAKEARGS_EVAL="${MODULES_MAKEARGS[*]@Q}"
-		TEST_JOBS="$(makeopts_jobs)"
-	)
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	emake "${MODULES_MAKEARGS[@]}"
-}
-
-src_install() {
-	emake "${MODULES_MAKEARGS[@]}" DESTDIR="${ED}" install
-	modules_post_process
-
-	dodoc AUTHORS COPYRIGHT META README.md
-}
-
-_old_layout_cleanup() {
-	# new files are just extra/{spl,zfs}.ko with no subdirs.
-	local olddir=(
-		avl/zavl
-		icp/icp
-		lua/zlua
-		nvpair/znvpair
-		spl/spl
-		unicode/zunicode
-		zcommon/zcommon
-		zfs/zfs
-		zstd/zzstd
-	)
-
-	# kernel/module/Kconfig contains possible compressed extentions.
-	local kext kextfiles
-		for kext in .ko{,.{gz,xz,zst}}; do
-		kextfiles+=( "${olddir[@]/%/${kext}}" )
-	done
-
-	local oldfile oldpath
-	for oldfile in "${kextfiles[@]}"; do
-		oldpath="${EROOT}/lib/modules/${KV_FULL}/extra/${oldfile}"
-		if [[ -f "${oldpath}" ]]; then
-			ewarn "Found obsolete zfs module ${oldfile} for current kernel ${KV_FULL}, removing."
-			rm -rv "${oldpath}" || die
-			# we do not remove non-empty directories just for safety in case there's something else.
-			# also it may fail if there are both compressed and uncompressed modules installed.
-			rmdir -v --ignore-fail-on-non-empty "${oldpath%/*.*}" || die
-		fi
-	done
-}
-
-pkg_postinst() {
-	# Check for old module layout before doing anything else.
-	# only attempt layout cleanup if new .ko location is used.
-	local newko=( "${EROOT}/lib/modules/${KV_FULL}/extra"/{zfs,spl}.ko* )
-	# We check first array member, if glob above did not exand, it will be "zfs.ko*" and -f will return false.
-	# if glob expanded -f will do correct file precense check.
-	[[ -f ${newko[0]} ]] && _old_layout_cleanup
-
-	linux-mod-r1_pkg_postinst
-
-	if use x86 || use arm ; then
-		ewarn "32-bit kernels will likely require increasing vmalloc to"
-		ewarn "at least 256M and decreasing zfs_arc_max to some value less than that."
-	fi
-
-	if has_version sys-boot/grub ; then
-		ewarn "This version of OpenZFS includes support for new feature flags"
-		ewarn "that are incompatible with previous versions. GRUB2 support for"
-		ewarn "/boot with the new feature flags is not yet available."
-		ewarn "Do *NOT* upgrade root pools to use the new feature flags."
-		ewarn "Any new pools will be created with the new feature flags by default"
-		ewarn "and will not be compatible with older versions of OpenZFS. To"
-		ewarn "create a new pool that is backward compatible wih GRUB2, use "
-		ewarn
-		ewarn "zpool create -o compatibility=grub2 ..."
-		ewarn
-		ewarn "Refer to /usr/share/zfs/compatibility.d/grub2 for list of features."
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.2.4.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.2.4.ebuild
deleted file mode 100644
index c3bb25d6fc5..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.2.4.ebuild
+++ /dev/null
@@ -1,207 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-MODULES_INITRAMFS_IUSE=+initramfs
-inherit autotools flag-o-matic linux-mod-r1 multiprocessing
-
-DESCRIPTION="Linux ZFS kernel module for sys-fs/zfs"
-HOMEPAGE="https://github.com/openzfs/zfs"
-
-MODULES_KERNEL_MAX=6.8
-MODULES_KERNEL_MIN=3.10
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://github.com/openzfs/zfs.git"
-	inherit git-r3
-	unset MODULES_KERNEL_MAX
-else
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openzfs.asc
-	inherit verify-sig
-
-	MY_PV=${PV/_rc/-rc}
-	SRC_URI="https://github.com/openzfs/zfs/releases/download/zfs-${MY_PV}/zfs-${MY_PV}.tar.gz"
-	SRC_URI+=" verify-sig? ( https://github.com/openzfs/zfs/releases/download/zfs-${MY_PV}/zfs-${MY_PV}.tar.gz.asc )"
-	S="${WORKDIR}/zfs-${MY_PV}"
-
-	ZFS_KERNEL_COMPAT="${MODULES_KERNEL_MAX}"
-	# Increments minor eg 5.14 -> 5.15, and still supports override.
-	ZFS_KERNEL_DEP="${ZFS_KERNEL_COMPAT_OVERRIDE:-${ZFS_KERNEL_COMPAT}}"
-	ZFS_KERNEL_DEP="${ZFS_KERNEL_DEP%%.*}.$(( ${ZFS_KERNEL_DEP##*.} + 1))"
-
-	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="amd64 arm64 ~loong ppc64 ~riscv ~sparc"
-	fi
-fi
-
-LICENSE="CDDL MIT debug? ( GPL-2+ )"
-SLOT="0/${PVR}"
-IUSE="custom-cflags debug +rootfs"
-RESTRICT="test"
-
-BDEPEND="
-	app-alternatives/awk
-	dev-lang/perl
-"
-
-if [[ ${PV} != 9999 ]] ; then
-	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-openzfs )"
-
-	IUSE+=" +dist-kernel-cap"
-	RDEPEND="
-		dist-kernel-cap? ( dist-kernel? (
-			<virtual/dist-kernel-${ZFS_KERNEL_DEP}
-		) )
-	"
-fi
-
-# Used to suggest matching USE, but without suggesting to disable
-PDEPEND="dist-kernel? ( ~sys-fs/zfs-${PV}[dist-kernel] )"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-2.1.11-gentoo.patch
-)
-
-pkg_pretend() {
-	use rootfs || return 0
-}
-
-pkg_setup() {
-	local CONFIG_CHECK="
-		EFI_PARTITION
-		ZLIB_DEFLATE
-		ZLIB_INFLATE
-		!DEBUG_LOCK_ALLOC
-		!PAX_KERNEXEC_PLUGIN_METHOD_OR
-	"
-	use debug && CONFIG_CHECK+="
-		DEBUG_INFO
-		FRAME_POINTER
-		!DEBUG_INFO_REDUCED
-	"
-	use rootfs && CONFIG_CHECK+="
-		BLK_DEV_INITRD
-		DEVTMPFS
-	"
-
-	kernel_is -lt 5 && CONFIG_CHECK+=" IOSCHED_NOOP"
-
-	if [[ ${PV} != 9999 ]] ; then
-		local kv_major_max kv_minor_max zcompat
-		zcompat="${ZFS_KERNEL_COMPAT_OVERRIDE:-${ZFS_KERNEL_COMPAT}}"
-		kv_major_max="${zcompat%%.*}"
-		zcompat="${zcompat#*.}"
-		kv_minor_max="${zcompat%%.*}"
-		kernel_is -le "${kv_major_max}" "${kv_minor_max}" || die \
-			"Linux ${kv_major_max}.${kv_minor_max} is the latest supported version"
-	fi
-
-	linux-mod-r1_pkg_setup
-}
-
-src_prepare() {
-	default
-
-	# Run unconditionally (bug #792627)
-	eautoreconf
-
-	if [[ ${PV} != 9999 ]] ; then
-		# Set module revision number
-		sed -Ei "s/(Release:.*)1/\1${PR}-gentoo/" META || die
-	fi
-}
-
-src_configure() {
-	use custom-cflags || strip-flags
-	filter-ldflags -Wl,*
-
-	local myconf=(
-		--bindir="${EPREFIX}"/bin
-		--sbindir="${EPREFIX}"/sbin
-		--with-config=kernel
-		--with-linux="${KV_DIR}"
-		--with-linux-obj="${KV_OUT_DIR}"
-		$(use_enable debug)
-
-		# See gentoo.patch
-		GENTOO_MAKEARGS_EVAL="${MODULES_MAKEARGS[*]@Q}"
-		TEST_JOBS="$(makeopts_jobs)"
-	)
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	emake "${MODULES_MAKEARGS[@]}"
-}
-
-src_install() {
-	emake "${MODULES_MAKEARGS[@]}" DESTDIR="${ED}" install
-	modules_post_process
-
-	dodoc AUTHORS COPYRIGHT META README.md
-}
-
-_old_layout_cleanup() {
-	# new files are just extra/{spl,zfs}.ko with no subdirs.
-	local olddir=(
-		avl/zavl
-		icp/icp
-		lua/zlua
-		nvpair/znvpair
-		spl/spl
-		unicode/zunicode
-		zcommon/zcommon
-		zfs/zfs
-		zstd/zzstd
-	)
-
-	# kernel/module/Kconfig contains possible compressed extentions.
-	local kext kextfiles
-		for kext in .ko{,.{gz,xz,zst}}; do
-		kextfiles+=( "${olddir[@]/%/${kext}}" )
-	done
-
-	local oldfile oldpath
-	for oldfile in "${kextfiles[@]}"; do
-		oldpath="${EROOT}/lib/modules/${KV_FULL}/extra/${oldfile}"
-		if [[ -f "${oldpath}" ]]; then
-			ewarn "Found obsolete zfs module ${oldfile} for current kernel ${KV_FULL}, removing."
-			rm -rv "${oldpath}" || die
-			# we do not remove non-empty directories just for safety in case there's something else.
-			# also it may fail if there are both compressed and uncompressed modules installed.
-			rmdir -v --ignore-fail-on-non-empty "${oldpath%/*.*}" || die
-		fi
-	done
-}
-
-pkg_postinst() {
-	# Check for old module layout before doing anything else.
-	# only attempt layout cleanup if new .ko location is used.
-	local newko=( "${EROOT}/lib/modules/${KV_FULL}/extra"/{zfs,spl}.ko* )
-	# We check first array member, if glob above did not exand, it will be "zfs.ko*" and -f will return false.
-	# if glob expanded -f will do correct file precense check.
-	[[ -f ${newko[0]} ]] && _old_layout_cleanup
-
-	linux-mod-r1_pkg_postinst
-
-	if use x86 || use arm ; then
-		ewarn "32-bit kernels will likely require increasing vmalloc to"
-		ewarn "at least 256M and decreasing zfs_arc_max to some value less than that."
-	fi
-
-	if has_version sys-boot/grub ; then
-		ewarn "This version of OpenZFS includes support for new feature flags"
-		ewarn "that are incompatible with previous versions. GRUB2 support for"
-		ewarn "/boot with the new feature flags is not yet available."
-		ewarn "Do *NOT* upgrade root pools to use the new feature flags."
-		ewarn "Any new pools will be created with the new feature flags by default"
-		ewarn "and will not be compatible with older versions of OpenZFS. To"
-		ewarn "create a new pool that is backward compatible wih GRUB2, use "
-		ewarn
-		ewarn "zpool create -o compatibility=grub2 ..."
-		ewarn
-		ewarn "Refer to /usr/share/zfs/compatibility.d/grub2 for list of features."
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.2.3.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.3.0_rc1.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.2.3.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.3.0_rc1.ebuild
index 903e8e571c0..25ff548135e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.2.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.3.0_rc1.ebuild
@@ -9,8 +9,8 @@ inherit autotools flag-o-matic linux-mod-r1 multiprocessing
 DESCRIPTION="Linux ZFS kernel module for sys-fs/zfs"
 HOMEPAGE="https://github.com/openzfs/zfs"
 
-MODULES_KERNEL_MAX=6.7
-MODULES_KERNEL_MIN=3.10
+MODULES_KERNEL_MAX=6.11
+MODULES_KERNEL_MIN=4.18
 
 if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/openzfs/zfs.git"
@@ -31,7 +31,7 @@ else
 	ZFS_KERNEL_DEP="${ZFS_KERNEL_DEP%%.*}.$(( ${ZFS_KERNEL_DEP##*.} + 1))"
 
 	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="amd64 arm64 ~loong ppc64 ~riscv ~sparc"
+		KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv ~sparc"
 	fi
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/Manifest b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/Manifest
index 6a58959b824..9b9fdd0b90e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/Manifest
@@ -1,14 +1,8 @@
-DIST zfs-2.1.14.tar.gz 35167471 BLAKE2B a7b22eaf05e4fbf416ebe4d7b884c515942fc9375c1dd322cefa00c19c550b9318a4192d6a909d49d58523c8f1a6eaf00189dd58e6543fae17cf8cc35042f469 SHA512 4a65c8b7d5576fa2dcc14e7ccaa93191c1d3791479cf89bd02c2bd04434ff5e93709b328796d4f9ba93da19f12772e359df373f40919350a3e1e4c52758b47c8
-DIST zfs-2.1.14.tar.gz.asc 836 BLAKE2B f01bc58bf6c3d367c494ed4ea9f3fb1141f3aafdbf4f913b9e0d60d31557076d5ae0e25ca93b013f5fd85e21ba5ae9f61e1a03af54bb0c743869c0ce3d5519df SHA512 be0f386cce952b4047dc2448e356078668e8d4392802dd3bb1a426741f15f4d9fb689cd1cb09972bdbc9fe2e4e782ec4b4754fe811c5657bc1f5308bd38e3926
 DIST zfs-2.1.15.tar.gz 35209038 BLAKE2B 61f9e14c54d43d1c51269917bb3ffde0530166126ea0467103ff1171dffc537315fd21c270d12f73d677e121b8094af39dd0a1fe3f80986bb42dc16d627dff52 SHA512 24096f2a6ecb3cc51f3d2f11cc69ad134d6fc33667007277c50cf798be2b19b6ddfa9be6923ca53d8b09f0bebae14c44d74811ec776e5aaf4ea0e810844c1f3d
 DIST zfs-2.1.15.tar.gz.asc 836 BLAKE2B 897c05a8870cd0418493b42fe854ef5b28f9a31513ac262a25631089defa59190808b51bd31e43412b01171bcac0dff0608d417dfdacfeee0b0f067e0627d48f SHA512 a6c5a9d214070a220716075455eb1cb85a53fb20b5fe4319f112cde0653a25f87b66d0f0bcf0ca641e3ac38239759cb9df6ed7f4700056a2732cc8c1ccd9ce05
-DIST zfs-2.2.2.tar.gz 33816541 BLAKE2B f0619ae42d898d18077096217d0a9ddd7c7378424707aa51d3645661b2889a1459bc4a5e9fe42b6860b2d26e4600da35765b0e741725dafacc2ead2370cad866 SHA512 bba252cbf7986f2cce154dd18a34aa478cf98f70106337188dc894de2446d60a58fa643706927757d1787506b44d4ff404897a2d0e16aacb0a7bf27765703332
-DIST zfs-2.2.2.tar.gz.asc 836 BLAKE2B bdc86492b2bf45d329e34e89ea7796f5cbf518d32ab114c909321b1d0d8040b9ce4e25b3b85fcbc5ea62ee10a2d716b5b27e37c2c005b307c0b593815c49d625 SHA512 110be1aa90f4749106717165a3cb5116379e2d170146a2b3d2601f04212450da9327e028d6e1e5de7f8a46c6bb7a15e2bcdd09e3e760590fbc695f9562f1440b
-DIST zfs-2.2.3.tar.gz 33854765 BLAKE2B f83439aa929609191a048dd326b2a15e0f57c72d2901cbfb205b81a29aa42dab49b42eb61647ca3eaed17518b8c907e81343364bfecf83ed441271648f8efd4b SHA512 e6c3df531a33f4bd198429e61b7630f1e965a03fd60d1b847bdf0d55c6d2af3abc38b5e8a63aa9ef9f969cc7eca36cb24a7641f6fb8c41ef2fa024d76cd28f3d
-DIST zfs-2.2.3.tar.gz.asc 836 BLAKE2B 86e1adc393d1f4643a6fd8c188b555e9dc0fdf7e25690f37ff0a04ff8826eb4fe3c125b54f0c5b9ab33f1daff43c4b44373ee9a4df506f6714f98d77782e6c3c SHA512 fe23ddb9bde78416776411d66a56aa662fa051c8544b4be01ba238b8c1a85ccde1c55329f228fe8ab2681b54a4e4cb08d4e927c597c117242f0b536a40921dc9
-DIST zfs-2.2.4.tar.gz 33882933 BLAKE2B f0026a12b7c1252bf8941e39f23d3e165750034707dfddf034d8aac942a749cb7f0108478797ca978704a22743d9928240b29cf78fe89eda9f873f40102413f0 SHA512 1d17e30573d594fb5c9ea77cde104616dca362fed7530296816d1b55173594f66170fcfb23ab57c27074f85b79d3eb557b4ee9a1c420e507b2434a7902d8dcc1
-DIST zfs-2.2.4.tar.gz.asc 836 BLAKE2B 7fde4232c25056eac2fae76abec4d6749c91d285d79ae6dce4ae4880fa90a26c9fb370dfa4daaf8a849f30fcc1b63eeb215444bfca724f6750bf7e4344f35fa7 SHA512 0cb3caf01b9e4d1f0c35d9f7933a4b11560b9bbf6c05494d8a1775b0a52ac1d642aebd77ef1c7b23a0a06f92e2b1ab3d8afacce41017eb07745d148af7f76a17
 DIST zfs-2.2.5.tar.gz 33896824 BLAKE2B ec73c866bf931e4af63a35b3e61e1254d681d21aadba304ea95c147a3911c3d92db686591147036848ceae1683f31f6f81e04a24df6cb11a91a8abaed179567f SHA512 8e288620ce78fb235fa0c9929fc97150987a64091a8a5209209f1e0975d4d6213b8b307e32b3c89d934e83dc8468a1998b797fcdff5bbbbd023f07674877b0c6
 DIST zfs-2.2.5.tar.gz.asc 836 BLAKE2B ae6e47ce82ffda8834047e03f361ca096448f98ea811a09c0c68b202996c613e6524501cda49873acc4bca9f60c298635f89e5d7fe8f00ffa05b192fc98e16ef SHA512 0a397471c3f1ee9675eb9fcd589409c5085f8692930275ea15d92042fadaf1d3772666a3cca5adb1730c953464e0ec00f501cc5333a303d322c636020c2a7060
 DIST zfs-2.2.6.tar.gz 33900138 BLAKE2B 0bbe36df779aaf19460a75725af9c9b13e64e77a6020974ad18d60d9fd52db2ddd6ea98b3e6c7451195bdfb347b8aab51db9b3f9a7c15c77bff47329bbd07dd2 SHA512 c217a3397b67d7239bc30bc492d58fff96bb29c9cf73e390d1787a4fb787cb297557e594a926453fed11faaab80363d40853af271f8ee18ce9a317dfde4c6745
 DIST zfs-2.2.6.tar.gz.asc 836 BLAKE2B db66f3e2e629ab8a344a8e0c2609bcbb98d69d110fc9e064760ee0c5c25cd67421a71764c4b65d7005e8ff66167bf24beb4be2560a47318eabffa888c1539f26 SHA512 d09f343b3acc3a81e96c069072cfb16d0b490ee77562f50e14524faf05560f9e1d1325ec4bc1760c86ed29186d5860d59646d4ea07385ee3b28d879f2374b9b4
+DIST zfs-2.3.0-rc1.tar.gz 33887119 BLAKE2B dd4e159bef6de216cc51c1dd22620e6edb5b7503d95402022d0b9439471fe432181b1e5df2142e63cdac812a74b62657a96573b3bf48ad78bd6fd885a5f8913e SHA512 fe7de046dd48dbb67545726482a501788a1d5601e6e9a17deeb29047946689d9c8deb95f72b2b47c26a205a3c94fa1f0123437479a06b1376b9dac3dd6faf463
+DIST zfs-2.3.0-rc1.tar.gz.asc 195 BLAKE2B f70e6223e94a3f79d6d685b2b06254fba845d79768c82b7a3fedb865b6e6c97499c497def0f4c3e4a2869fed88b0965650ae88d5eb72c0ffaed43c4479d3bf96 SHA512 26b395feaf03e2be20b75ef64e573aa98a0706c46a1eb57503925731bf0cb9bf7fef8a2cdcf163233bccd7da9f5aedc0cae73f0183f39e0f13dcf315b4a5d809
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.1.14.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.1.14.ebuild
deleted file mode 100644
index 5dcfd94d6ae..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.1.14.ebuild
+++ /dev/null
@@ -1,311 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_OPTIONAL=1
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..11} )
-
-inherit autotools bash-completion-r1 dist-kernel-utils distutils-r1 flag-o-matic linux-info pam systemd udev usr-ldscript
-
-DESCRIPTION="Userland utilities for ZFS Linux kernel module"
-HOMEPAGE="https://github.com/openzfs/zfs"
-
-if [[ ${PV} == "9999" ]]; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/openzfs/zfs.git"
-else
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openzfs.asc
-	inherit verify-sig
-
-	MY_P="${P/_rc/-rc}"
-	SRC_URI="https://github.com/openzfs/${PN}/releases/download/${MY_P}/${MY_P}.tar.gz"
-	SRC_URI+=" verify-sig? ( https://github.com/openzfs/${PN}/releases/download/${MY_P}/${MY_P}.tar.gz.asc )"
-	S="${WORKDIR}/${P%_rc?}"
-
-	if [[ ${PV} != *_rc* ]]; then
-		KEYWORDS="amd64 arm64 ppc64 ~riscv ~sparc"
-	fi
-fi
-
-LICENSE="BSD-2 CDDL MIT"
-# just libzfs soname major for now.
-# possible candidates: libuutil, libzpool, libnvpair. Those do not provide stable abi, but are considered.
-# see libsoversion_check() below as well
-SLOT="0/5"
-IUSE="custom-cflags debug dist-kernel kernel-builtin minimal nls pam python +rootfs selinux test-suite"
-
-DEPEND="
-	net-libs/libtirpc:=
-	sys-apps/util-linux
-	sys-libs/zlib
-	virtual/libudev:=
-	dev-libs/openssl:0=
-	!minimal? ( ${PYTHON_DEPS} )
-	pam? ( sys-libs/pam )
-	python? (
-		$(python_gen_cond_dep 'dev-python/cffi[${PYTHON_USEDEP}]' 'python*')
-	)
-"
-
-BDEPEND="app-alternatives/awk
-	virtual/pkgconfig
-	nls? ( sys-devel/gettext )
-	python? (
-		${DISTUTILS_DEPS}
-		|| (
-			dev-python/packaging[${PYTHON_USEDEP}]
-			dev-python/distlib[${PYTHON_USEDEP}]
-		)
-	)
-"
-
-if [[ ${PV} != "9999" ]] ; then
-	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-openzfs )"
-fi
-
-# awk is used for some scripts, completions, and the Dracut module
-RDEPEND="${DEPEND}
-	!kernel-builtin? ( ~sys-fs/zfs-kmod-${PV}:= )
-	!prefix? ( virtual/udev )
-	sys-fs/udev-init-scripts
-	app-alternatives/awk
-	dist-kernel? ( virtual/dist-kernel:= )
-	rootfs? (
-		app-alternatives/cpio
-		app-misc/pax-utils
-	)
-	selinux? ( sec-policy/selinux-zfs )
-	test-suite? (
-		app-shells/ksh
-		sys-apps/kmod[tools]
-		sys-apps/util-linux
-		app-alternatives/bc
-		sys-block/parted
-		sys-fs/lsscsi
-		sys-fs/mdadm
-		sys-process/procps
-	)
-"
-
-# PDEPEND in this form is needed to trick portage suggest
-# enabling dist-kernel if only 1 package have it set, without suggesting to disable
-PDEPEND="dist-kernel? ( ~sys-fs/zfs-kmod-${PV}[dist-kernel] )"
-
-REQUIRED_USE="
-	!minimal? ( ${PYTHON_REQUIRED_USE} )
-	python? ( !minimal )
-	test-suite? ( !minimal )
-"
-
-RESTRICT="test"
-
-PATCHES=(
-	# bug #854333
-	"${FILESDIR}"/2.1.5-r2-dracut-non-root.patch
-
-	"${FILESDIR}"/2.1.5-dracut-zfs-missing.patch
-)
-
-pkg_pretend() {
-	use rootfs || return 0
-
-	if has_version virtual/dist-kernel && ! use dist-kernel; then
-		ewarn "You have virtual/dist-kernel installed, but"
-		ewarn "USE=\"dist-kernel\" is not enabled for ${CATEGORY}/${PN}"
-		ewarn "It's recommended to globally enable dist-kernel USE flag"
-		ewarn "to auto-trigger initrd rebuilds with kernel updates"
-	fi
-}
-
-pkg_setup() {
-	if use kernel_linux; then
-		linux-info_pkg_setup
-
-		if ! linux_config_exists; then
-			ewarn "Cannot check the linux kernel configuration."
-		else
-			if use test-suite; then
-				if linux_chkconfig_present BLK_DEV_LOOP; then
-					eerror "The ZFS test suite requires loop device support enabled."
-					eerror "Please enable it:"
-					eerror "    CONFIG_BLK_DEV_LOOP=y"
-					eerror "in /usr/src/linux/.config or"
-					eerror "    Device Drivers --->"
-					eerror "        Block devices --->"
-					eerror "            [X] Loopback device support"
-				fi
-			fi
-		fi
-	fi
-}
-
-libsoversion_check() {
-	local bugurl libzfs_sover
-	bugurl="https://bugs.gentoo.org/enter_bug.cgi?form_name=enter_bug&product=Gentoo+Linux&component=Current+packages"
-
-	libzfs_sover="$(grep 'libzfs_la_LDFLAGS += -version-info' lib/libzfs/Makefile.am \
-		| grep -Eo '[0-9]+:[0-9]+:[0-9]+')"
-	libzfs_sover="${libzfs_sover%%:*}"
-
-	if [[ ${libzfs_sover} -ne $(ver_cut 2 ${SLOT}) ]]; then
-		echo
-		eerror "BUG BUG BUG BUG BUG BUG BUG BUG"
-		eerror "ebuild subslot does not match libzfs soversion!"
-		eerror "libzfs soversion: ${libzfs_sover}"
-		eerror "ebuild value: $(ver_cut 2 ${SLOT})"
-		eerror "This is a bug in the ebuild, please use the following URL to report it"
-		eerror "${bugurl}&short_desc=${CATEGORY}%2F${P}+update+subslot"
-		echo
-		# we want to abort for releases, but just print a warning for live ebuild
-		# to keep package installable
-		[[  ${PV} == "9999" ]] || die
-	fi
-}
-
-src_prepare() {
-	default
-	libsoversion_check
-
-	# Run unconditionally (bug #792627)
-	eautoreconf
-
-	if [[ ${PV} != "9999" ]]; then
-		# Set revision number
-		sed -i "s/\(Release:\)\(.*\)1/\1\2${PR}-gentoo/" META || die "Could not set Gentoo release"
-	fi
-
-	if use python; then
-		pushd contrib/pyzfs >/dev/null || die
-		distutils-r1_src_prepare
-		popd >/dev/null || die
-	fi
-
-	# prevent errors showing up on zfs-mount stop, #647688
-	# openrc will unmount all filesystems anyway.
-	sed -i "/^ZFS_UNMOUNT=/ s/yes/no/" "etc/default/zfs.in" || die
-}
-
-src_configure() {
-	use custom-cflags || strip-flags
-	use minimal || python_setup
-
-	# All the same issue:
-	# Segfaults w/ GCC 12 and 'zfs send'
-	# bug #856373
-	# https://github.com/openzfs/zfs/issues/13620
-	# https://github.com/openzfs/zfs/issues/13605
-	append-flags -fno-tree-vectorize
-
-	local myconf=(
-		--bindir="${EPREFIX}/bin"
-		--enable-shared
-		--enable-sysvinit
-		--localstatedir="${EPREFIX}/var"
-		--sbindir="${EPREFIX}/sbin"
-		--with-config=user
-		--with-dracutdir="${EPREFIX}/usr/lib/dracut"
-		--with-linux="${KV_DIR}"
-		--with-linux-obj="${KV_OUT_DIR}"
-		--with-udevdir="$(get_udevdir)"
-		--with-pamconfigsdir="${EPREFIX}/unwanted_files"
-		--with-pammoduledir="$(getpam_mod_dir)"
-		--with-systemdunitdir="$(systemd_get_systemunitdir)"
-		--with-systemdpresetdir="$(systemd_get_systempresetdir)"
-		--with-vendor=gentoo
-		# Building zfs-mount-generator.c on musl breaks as strndupa
-		# isn't available. But systemd doesn't support musl anyway, so
-		# just disable building it.
-		# UPDATE: it has been fixed since,
-		# https://github.com/openzfs/zfs/commit/1f19826c9ac85835cbde61a7439d9d1fefe43a4a
-		# but we still leave it as this for now.
-		$(use_enable !elibc_musl systemd)
-		$(use_enable debug)
-		$(use_enable nls)
-		$(use_enable pam)
-		$(use_enable python pyzfs)
-		--disable-static
-		$(usex minimal --without-python --with-python="${EPYTHON}")
-	)
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	default
-	if use python; then
-		pushd contrib/pyzfs >/dev/null || die
-		distutils-r1_src_compile
-		popd >/dev/null || die
-	fi
-}
-
-src_install() {
-	default
-
-	gen_usr_ldscript -a nvpair uutil zfsbootenv zfs zfs_core zpool
-
-	use pam && { rm -rv "${ED}/unwanted_files" || die ; }
-
-	use test-suite || { rm -r "${ED}"/usr/share/zfs/{test-runner,zfs-tests,runfiles,*sh} || die ; }
-
-	find "${ED}" -name '*.la' -delete || die
-
-	dobashcomp contrib/bash_completion.d/zfs
-	bashcomp_alias zfs zpool
-
-	# strip executable bit from conf.d file
-	fperms 0644 /etc/conf.d/zfs
-
-	if use python; then
-		pushd contrib/pyzfs >/dev/null || die
-		distutils-r1_src_install
-		popd >/dev/null || die
-	fi
-
-	# enforce best available python implementation
-	use minimal || python_fix_shebang "${ED}/bin"
-}
-
-pkg_postinst() {
-	udev_reload
-
-	# we always need userspace utils in sync with zfs-kmod
-	# so force initrd update for userspace as well, to avoid
-	# situation when zfs-kmod trigger initrd rebuild before
-	# userspace component is rebuilt
-	# KV_* variables are provided by linux-info.eclass
-	if [[ -z ${ROOT} ]] && use dist-kernel; then
-		dist-kernel_reinstall_initramfs "${KV_DIR}" "${KV_FULL}"
-	fi
-
-	if use rootfs; then
-		if ! has_version sys-kernel/genkernel && ! has_version sys-kernel/dracut; then
-			elog "Root on zfs requires an initramfs to boot"
-			elog "The following packages provide one and are tested on a regular basis:"
-			elog "  sys-kernel/dracut ( preferred, module maintained by zfs developers )"
-			elog "  sys-kernel/genkernel"
-		fi
-	fi
-
-	if systemd_is_booted || has_version sys-apps/systemd; then
-		einfo "Please refer to ${EROOT}/$(systemd_get_systempresetdir)/50-zfs.preset"
-		einfo "for default zfs systemd service configuration"
-	else
-		[[ -e "${EROOT}/etc/runlevels/boot/zfs-import" ]] || \
-			einfo "You should add zfs-import to the boot runlevel."
-		[[ -e "${EROOT}/etc/runlevels/boot/zfs-load-key" ]] || \
-			einfo "You should add zfs-load-key to the boot runlevel."
-		[[ -e "${EROOT}/etc/runlevels/boot/zfs-mount" ]]|| \
-			einfo "You should add zfs-mount to the boot runlevel."
-		[[ -e "${EROOT}/etc/runlevels/default/zfs-share" ]] || \
-			einfo "You should add zfs-share to the default runlevel."
-		[[ -e "${EROOT}/etc/runlevels/default/zfs-zed" ]] || \
-			einfo "You should add zfs-zed to the default runlevel."
-	fi
-}
-
-pkg_postrm() {
-	udev_reload
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.2.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.2.2-r1.ebuild
deleted file mode 100644
index 80914d259c3..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.2.2-r1.ebuild
+++ /dev/null
@@ -1,307 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_OPTIONAL=1
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..11} )
-
-inherit autotools bash-completion-r1 dist-kernel-utils distutils-r1 flag-o-matic linux-info pam systemd udev usr-ldscript
-
-DESCRIPTION="Userland utilities for ZFS Linux kernel module"
-HOMEPAGE="https://github.com/openzfs/zfs"
-
-if [[ ${PV} == "9999" ]]; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/openzfs/zfs.git"
-else
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openzfs.asc
-	inherit verify-sig
-
-	MY_P="${P/_rc/-rc}"
-	SRC_URI="https://github.com/openzfs/${PN}/releases/download/${MY_P}/${MY_P}.tar.gz"
-	SRC_URI+=" verify-sig? ( https://github.com/openzfs/${PN}/releases/download/${MY_P}/${MY_P}.tar.gz.asc )"
-	S="${WORKDIR}/${MY_P}"
-
-	if [[ ${PV} != *_rc* ]]; then
-		KEYWORDS="amd64 arm64 ~loong ppc64 ~riscv ~sparc"
-	fi
-fi
-
-LICENSE="BSD-2 CDDL MIT"
-# just libzfs soname major for now.
-# possible candidates: libuutil, libzpool, libnvpair. Those do not provide stable abi, but are considered.
-# see libsoversion_check() below as well
-SLOT="0/5"
-IUSE="custom-cflags debug dist-kernel kernel-builtin minimal nls pam python +rootfs selinux test-suite"
-
-DEPEND="
-	dev-libs/openssl:=
-	net-libs/libtirpc:=
-	sys-apps/util-linux
-	sys-libs/zlib
-	virtual/libudev:=
-	!minimal? ( ${PYTHON_DEPS} )
-	pam? ( sys-libs/pam )
-	python? (
-		$(python_gen_cond_dep 'dev-python/cffi[${PYTHON_USEDEP}]' 'python*')
-	)
-"
-
-BDEPEND="
-	app-alternatives/awk
-	virtual/pkgconfig
-	nls? ( sys-devel/gettext )
-	python? (
-		${DISTUTILS_DEPS}
-		|| (
-			dev-python/packaging[${PYTHON_USEDEP}]
-			dev-python/distlib[${PYTHON_USEDEP}]
-		)
-	)
-"
-
-if [[ ${PV} != "9999" ]] ; then
-	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-openzfs )"
-fi
-
-# awk is used for some scripts, completions, and the Dracut module
-RDEPEND="
-	${DEPEND}
-	!kernel-builtin? ( ~sys-fs/zfs-kmod-${PV}:= )
-	!prefix? ( virtual/udev )
-	app-alternatives/awk
-	sys-fs/udev-init-scripts
-	dist-kernel? ( virtual/dist-kernel:= )
-	rootfs? (
-		app-alternatives/cpio
-		app-misc/pax-utils
-	)
-	selinux? ( sec-policy/selinux-zfs )
-	test-suite? (
-		app-shells/ksh
-		sys-apps/kmod[tools]
-		sys-apps/util-linux
-		app-alternatives/bc
-		sys-block/parted
-		sys-fs/lsscsi
-		sys-fs/mdadm
-		sys-process/procps
-	)
-"
-
-# PDEPEND in this form is needed to trick portage suggest
-# enabling dist-kernel if only 1 package have it set, without suggesting to disable
-PDEPEND="dist-kernel? ( ~sys-fs/zfs-kmod-${PV}[dist-kernel] )"
-
-REQUIRED_USE="
-	!minimal? ( ${PYTHON_REQUIRED_USE} )
-	python? ( !minimal )
-	test-suite? ( !minimal )
-"
-
-RESTRICT="test"
-
-PATCHES=(
-	"${FILESDIR}"/2.1.5-dracut-zfs-missing.patch
-	"${FILESDIR}"/2.2.2-no-USER_NS.patch
-)
-
-pkg_pretend() {
-	use rootfs || return 0
-
-	if has_version virtual/dist-kernel && ! use dist-kernel; then
-		ewarn "You have virtual/dist-kernel installed, but"
-		ewarn "USE=\"dist-kernel\" is not enabled for ${CATEGORY}/${PN}"
-		ewarn "It's recommended to globally enable dist-kernel USE flag"
-		ewarn "to auto-trigger initrd rebuilds with kernel updates"
-	fi
-}
-
-pkg_setup() {
-	if use kernel_linux; then
-		linux-info_pkg_setup
-
-		if ! linux_config_exists; then
-			ewarn "Cannot check the linux kernel configuration."
-		else
-			if use test-suite; then
-				if linux_chkconfig_present BLK_DEV_LOOP; then
-					eerror "The ZFS test suite requires loop device support enabled."
-					eerror "Please enable it:"
-					eerror "    CONFIG_BLK_DEV_LOOP=y"
-					eerror "in /usr/src/linux/.config or"
-					eerror "    Device Drivers --->"
-					eerror "        Block devices --->"
-					eerror "            [X] Loopback device support"
-				fi
-			fi
-		fi
-	fi
-}
-
-libsoversion_check() {
-	local bugurl libzfs_sover
-	bugurl="https://bugs.gentoo.org/enter_bug.cgi?form_name=enter_bug&product=Gentoo+Linux&component=Current+packages"
-
-	libzfs_sover="$(grep 'libzfs_la_LDFLAGS += -version-info' lib/libzfs/Makefile.am \
-		| grep -Eo '[0-9]+:[0-9]+:[0-9]+')"
-	libzfs_sover="${libzfs_sover%%:*}"
-
-	if [[ ${libzfs_sover} -ne $(ver_cut 2 ${SLOT}) ]]; then
-		echo
-		eerror "BUG BUG BUG BUG BUG BUG BUG BUG"
-		eerror "ebuild subslot does not match libzfs soversion!"
-		eerror "libzfs soversion: ${libzfs_sover}"
-		eerror "ebuild value: $(ver_cut 2 ${SLOT})"
-		eerror "This is a bug in the ebuild, please use the following URL to report it"
-		eerror "${bugurl}&short_desc=${CATEGORY}%2F${P}+update+subslot"
-		echo
-		# we want to abort for releases, but just print a warning for live ebuild
-		# to keep package installable
-		[[  ${PV} == "9999" ]] || die
-	fi
-}
-
-src_prepare() {
-	default
-	libsoversion_check
-
-	# Run unconditionally (bug #792627)
-	eautoreconf
-
-	if [[ ${PV} != "9999" ]]; then
-		# Set revision number
-		sed -i "s/\(Release:\)\(.*\)1/\1\2${PR}-gentoo/" META || die "Could not set Gentoo release"
-	fi
-
-	if use python; then
-		pushd contrib/pyzfs >/dev/null || die
-		distutils-r1_src_prepare
-		popd >/dev/null || die
-	fi
-
-	# Tries to use /etc/conf.d which we reserve for OpenRC
-	sed -i -e '/EnvironmentFile/d' etc/systemd/system/zfs*.in || die
-
-	# prevent errors showing up on zfs-mount stop, #647688
-	# openrc will unmount all filesystems anyway.
-	sed -i "/^ZFS_UNMOUNT=/ s/yes/no/" "etc/default/zfs.in" || die
-}
-
-src_configure() {
-	use custom-cflags || strip-flags
-	use minimal || python_setup
-
-	local myconf=(
-		--bindir="${EPREFIX}/bin"
-		--enable-shared
-		--enable-sysvinit
-		--localstatedir="${EPREFIX}/var"
-		--sbindir="${EPREFIX}/sbin"
-		--with-config=user
-		--with-dracutdir="${EPREFIX}/usr/lib/dracut"
-		--with-linux="${KV_DIR}"
-		--with-linux-obj="${KV_OUT_DIR}"
-		--with-udevdir="$(get_udevdir)"
-		--with-pamconfigsdir="${EPREFIX}/unwanted_files"
-		--with-pammoduledir="$(getpam_mod_dir)"
-		--with-systemdunitdir="$(systemd_get_systemunitdir)"
-		--with-systemdpresetdir="$(systemd_get_systempresetdir)"
-		--with-vendor=gentoo
-		# Building zfs-mount-generator.c on musl breaks as strndupa
-		# isn't available. But systemd doesn't support musl anyway, so
-		# just disable building it.
-		# UPDATE: it has been fixed since,
-		# https://github.com/openzfs/zfs/commit/1f19826c9ac85835cbde61a7439d9d1fefe43a4a
-		# but we still leave it as this for now.
-		$(use_enable !elibc_musl systemd)
-		$(use_enable debug)
-		$(use_enable nls)
-		$(use_enable pam)
-		$(use_enable python pyzfs)
-		--disable-static
-		$(usex minimal --without-python --with-python="${EPYTHON}")
-	)
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	default
-	if use python; then
-		pushd contrib/pyzfs >/dev/null || die
-		distutils-r1_src_compile
-		popd >/dev/null || die
-	fi
-}
-
-src_install() {
-	default
-
-	gen_usr_ldscript -a nvpair uutil zfsbootenv zfs zfs_core zpool
-
-	use pam && { rm -rv "${ED}/unwanted_files" || die ; }
-
-	use test-suite || { rm -r "${ED}"/usr/share/zfs/{test-runner,zfs-tests,runfiles,*sh} || die ; }
-
-	find "${ED}" -name '*.la' -delete || die
-
-	dobashcomp contrib/bash_completion.d/zfs
-	bashcomp_alias zfs zpool
-
-	# strip executable bit from conf.d file
-	fperms 0644 /etc/conf.d/zfs
-
-	if use python; then
-		pushd contrib/pyzfs >/dev/null || die
-		distutils-r1_src_install
-		popd >/dev/null || die
-	fi
-
-	# enforce best available python implementation
-	use minimal || python_fix_shebang "${ED}/bin"
-}
-
-pkg_postinst() {
-	udev_reload
-
-	# we always need userspace utils in sync with zfs-kmod
-	# so force initrd update for userspace as well, to avoid
-	# situation when zfs-kmod trigger initrd rebuild before
-	# userspace component is rebuilt
-	# KV_* variables are provided by linux-info.eclass
-	if [[ -z ${ROOT} ]] && use dist-kernel; then
-		dist-kernel_reinstall_initramfs "${KV_DIR}" "${KV_FULL}"
-	fi
-
-	if use rootfs; then
-		if ! has_version sys-kernel/genkernel && ! has_version sys-kernel/dracut; then
-			elog "Root on zfs requires an initramfs to boot"
-			elog "The following packages provide one and are tested on a regular basis:"
-			elog "  sys-kernel/dracut ( preferred, module maintained by zfs developers )"
-			elog "  sys-kernel/genkernel"
-		fi
-	fi
-
-	if systemd_is_booted || has_version sys-apps/systemd; then
-		einfo "Please refer to ${EROOT}/$(systemd_get_systempresetdir)/50-zfs.preset"
-		einfo "for default zfs systemd service configuration"
-	else
-		[[ -e "${EROOT}/etc/runlevels/boot/zfs-import" ]] || \
-			einfo "You should add zfs-import to the boot runlevel."
-		[[ -e "${EROOT}/etc/runlevels/boot/zfs-load-key" ]] || \
-			einfo "You should add zfs-load-key to the boot runlevel."
-		[[ -e "${EROOT}/etc/runlevels/boot/zfs-mount" ]]|| \
-			einfo "You should add zfs-mount to the boot runlevel."
-		[[ -e "${EROOT}/etc/runlevels/default/zfs-share" ]] || \
-			einfo "You should add zfs-share to the default runlevel."
-		[[ -e "${EROOT}/etc/runlevels/default/zfs-zed" ]] || \
-			einfo "You should add zfs-zed to the default runlevel."
-	fi
-}
-
-pkg_postrm() {
-	udev_reload
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.2.3.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.2.3.ebuild
deleted file mode 100644
index 950fccc9ba5..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.2.3.ebuild
+++ /dev/null
@@ -1,308 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_OPTIONAL=1
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..12} )
-
-inherit autotools bash-completion-r1 dist-kernel-utils distutils-r1 flag-o-matic linux-info pam systemd udev usr-ldscript
-
-DESCRIPTION="Userland utilities for ZFS Linux kernel module"
-HOMEPAGE="https://github.com/openzfs/zfs"
-
-if [[ ${PV} == "9999" ]]; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/openzfs/zfs.git"
-else
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openzfs.asc
-	inherit verify-sig
-
-	MY_P="${P/_rc/-rc}"
-	SRC_URI="https://github.com/openzfs/${PN}/releases/download/${MY_P}/${MY_P}.tar.gz"
-	SRC_URI+=" verify-sig? ( https://github.com/openzfs/${PN}/releases/download/${MY_P}/${MY_P}.tar.gz.asc )"
-	S="${WORKDIR}/${MY_P}"
-
-	if [[ ${PV} != *_rc* ]]; then
-		KEYWORDS="amd64 arm64 ~loong ppc64 ~riscv ~sparc"
-	fi
-fi
-
-LICENSE="BSD-2 CDDL MIT"
-# just libzfs soname major for now.
-# possible candidates: libuutil, libzpool, libnvpair. Those do not provide stable abi, but are considered.
-# see libsoversion_check() below as well
-SLOT="0/5"
-IUSE="custom-cflags debug dist-kernel kernel-builtin minimal nls pam python +rootfs selinux test-suite"
-
-DEPEND="
-	dev-libs/openssl:=
-	net-libs/libtirpc:=
-	sys-apps/util-linux
-	sys-libs/zlib
-	virtual/libudev:=
-	!minimal? ( ${PYTHON_DEPS} )
-	pam? ( sys-libs/pam )
-	python? (
-		$(python_gen_cond_dep 'dev-python/cffi[${PYTHON_USEDEP}]' 'python*')
-	)
-"
-
-BDEPEND="
-	app-alternatives/awk
-	virtual/pkgconfig
-	nls? ( sys-devel/gettext )
-	python? (
-		${DISTUTILS_DEPS}
-		|| (
-			dev-python/packaging[${PYTHON_USEDEP}]
-			dev-python/distlib[${PYTHON_USEDEP}]
-		)
-	)
-"
-
-if [[ ${PV} != "9999" ]] ; then
-	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-openzfs )"
-fi
-
-# awk is used for some scripts, completions, and the Dracut module
-RDEPEND="
-	${DEPEND}
-	!kernel-builtin? ( ~sys-fs/zfs-kmod-${PV}:= )
-	!prefix? ( virtual/udev )
-	app-alternatives/awk
-	sys-fs/udev-init-scripts
-	dist-kernel? ( virtual/dist-kernel:= )
-	rootfs? (
-		app-alternatives/cpio
-		app-misc/pax-utils
-	)
-	selinux? ( sec-policy/selinux-zfs )
-	test-suite? (
-		app-shells/ksh
-		sys-apps/kmod[tools]
-		sys-apps/util-linux
-		app-alternatives/bc
-		sys-block/parted
-		sys-fs/lsscsi
-		sys-fs/mdadm
-		sys-process/procps
-	)
-"
-
-# PDEPEND in this form is needed to trick portage suggest
-# enabling dist-kernel if only 1 package have it set, without suggesting to disable
-PDEPEND="dist-kernel? ( ~sys-fs/zfs-kmod-${PV}[dist-kernel] )"
-
-REQUIRED_USE="
-	!minimal? ( ${PYTHON_REQUIRED_USE} )
-	python? ( !minimal )
-	test-suite? ( !minimal )
-"
-
-RESTRICT="test"
-
-PATCHES=(
-	"${FILESDIR}"/2.1.5-dracut-zfs-missing.patch
-	"${FILESDIR}"/2.2.2-no-USER_NS.patch
-	"${FILESDIR}"/2.2.3-musl.patch
-)
-
-pkg_pretend() {
-	use rootfs || return 0
-
-	if has_version virtual/dist-kernel && ! use dist-kernel; then
-		ewarn "You have virtual/dist-kernel installed, but"
-		ewarn "USE=\"dist-kernel\" is not enabled for ${CATEGORY}/${PN}"
-		ewarn "It's recommended to globally enable dist-kernel USE flag"
-		ewarn "to auto-trigger initrd rebuilds with kernel updates"
-	fi
-}
-
-pkg_setup() {
-	if use kernel_linux; then
-		linux-info_pkg_setup
-
-		if ! linux_config_exists; then
-			ewarn "Cannot check the linux kernel configuration."
-		else
-			if use test-suite; then
-				if linux_chkconfig_present BLK_DEV_LOOP; then
-					eerror "The ZFS test suite requires loop device support enabled."
-					eerror "Please enable it:"
-					eerror "    CONFIG_BLK_DEV_LOOP=y"
-					eerror "in /usr/src/linux/.config or"
-					eerror "    Device Drivers --->"
-					eerror "        Block devices --->"
-					eerror "            [X] Loopback device support"
-				fi
-			fi
-		fi
-	fi
-}
-
-libsoversion_check() {
-	local bugurl libzfs_sover
-	bugurl="https://bugs.gentoo.org/enter_bug.cgi?form_name=enter_bug&product=Gentoo+Linux&component=Current+packages"
-
-	libzfs_sover="$(grep 'libzfs_la_LDFLAGS += -version-info' lib/libzfs/Makefile.am \
-		| grep -Eo '[0-9]+:[0-9]+:[0-9]+')"
-	libzfs_sover="${libzfs_sover%%:*}"
-
-	if [[ ${libzfs_sover} -ne $(ver_cut 2 ${SLOT}) ]]; then
-		echo
-		eerror "BUG BUG BUG BUG BUG BUG BUG BUG"
-		eerror "ebuild subslot does not match libzfs soversion!"
-		eerror "libzfs soversion: ${libzfs_sover}"
-		eerror "ebuild value: $(ver_cut 2 ${SLOT})"
-		eerror "This is a bug in the ebuild, please use the following URL to report it"
-		eerror "${bugurl}&short_desc=${CATEGORY}%2F${P}+update+subslot"
-		echo
-		# we want to abort for releases, but just print a warning for live ebuild
-		# to keep package installable
-		[[  ${PV} == "9999" ]] || die
-	fi
-}
-
-src_prepare() {
-	default
-	libsoversion_check
-
-	# Run unconditionally (bug #792627)
-	eautoreconf
-
-	if [[ ${PV} != "9999" ]]; then
-		# Set revision number
-		sed -i "s/\(Release:\)\(.*\)1/\1\2${PR}-gentoo/" META || die "Could not set Gentoo release"
-	fi
-
-	if use python; then
-		pushd contrib/pyzfs >/dev/null || die
-		distutils-r1_src_prepare
-		popd >/dev/null || die
-	fi
-
-	# Tries to use /etc/conf.d which we reserve for OpenRC
-	sed -i -e '/EnvironmentFile/d' etc/systemd/system/zfs*.in || die
-
-	# prevent errors showing up on zfs-mount stop, #647688
-	# openrc will unmount all filesystems anyway.
-	sed -i "/^ZFS_UNMOUNT=/ s/yes/no/" "etc/default/zfs.in" || die
-}
-
-src_configure() {
-	use custom-cflags || strip-flags
-	use minimal || python_setup
-
-	local myconf=(
-		--bindir="${EPREFIX}/bin"
-		--enable-shared
-		--enable-sysvinit
-		--localstatedir="${EPREFIX}/var"
-		--sbindir="${EPREFIX}/sbin"
-		--with-config=user
-		--with-dracutdir="${EPREFIX}/usr/lib/dracut"
-		--with-linux="${KV_DIR}"
-		--with-linux-obj="${KV_OUT_DIR}"
-		--with-udevdir="$(get_udevdir)"
-		--with-pamconfigsdir="${EPREFIX}/unwanted_files"
-		--with-pammoduledir="$(getpam_mod_dir)"
-		--with-systemdunitdir="$(systemd_get_systemunitdir)"
-		--with-systemdpresetdir="$(systemd_get_systempresetdir)"
-		--with-vendor=gentoo
-		# Building zfs-mount-generator.c on musl breaks as strndupa
-		# isn't available. But systemd doesn't support musl anyway, so
-		# just disable building it.
-		# UPDATE: it has been fixed since,
-		# https://github.com/openzfs/zfs/commit/1f19826c9ac85835cbde61a7439d9d1fefe43a4a
-		# but we still leave it as this for now.
-		$(use_enable !elibc_musl systemd)
-		$(use_enable debug)
-		$(use_enable nls)
-		$(use_enable pam)
-		$(use_enable python pyzfs)
-		--disable-static
-		$(usex minimal --without-python --with-python="${EPYTHON}")
-	)
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	default
-	if use python; then
-		pushd contrib/pyzfs >/dev/null || die
-		distutils-r1_src_compile
-		popd >/dev/null || die
-	fi
-}
-
-src_install() {
-	default
-
-	gen_usr_ldscript -a nvpair uutil zfsbootenv zfs zfs_core zpool
-
-	use pam && { rm -rv "${ED}/unwanted_files" || die ; }
-
-	use test-suite || { rm -r "${ED}"/usr/share/zfs/{test-runner,zfs-tests,runfiles,*sh} || die ; }
-
-	find "${ED}" -name '*.la' -delete || die
-
-	dobashcomp contrib/bash_completion.d/zfs
-	bashcomp_alias zfs zpool
-
-	# strip executable bit from conf.d file
-	fperms 0644 /etc/conf.d/zfs
-
-	if use python; then
-		pushd contrib/pyzfs >/dev/null || die
-		distutils-r1_src_install
-		popd >/dev/null || die
-	fi
-
-	# enforce best available python implementation
-	use minimal || python_fix_shebang "${ED}/bin"
-}
-
-pkg_postinst() {
-	udev_reload
-
-	# we always need userspace utils in sync with zfs-kmod
-	# so force initrd update for userspace as well, to avoid
-	# situation when zfs-kmod trigger initrd rebuild before
-	# userspace component is rebuilt
-	# KV_* variables are provided by linux-info.eclass
-	if [[ -z ${ROOT} ]] && use dist-kernel; then
-		dist-kernel_reinstall_initramfs "${KV_DIR}" "${KV_FULL}"
-	fi
-
-	if use rootfs; then
-		if ! has_version sys-kernel/genkernel && ! has_version sys-kernel/dracut; then
-			elog "Root on zfs requires an initramfs to boot"
-			elog "The following packages provide one and are tested on a regular basis:"
-			elog "  sys-kernel/dracut ( preferred, module maintained by zfs developers )"
-			elog "  sys-kernel/genkernel"
-		fi
-	fi
-
-	if systemd_is_booted || has_version sys-apps/systemd; then
-		einfo "Please refer to ${EROOT}/$(systemd_get_systempresetdir)/50-zfs.preset"
-		einfo "for default zfs systemd service configuration"
-	else
-		[[ -e "${EROOT}/etc/runlevels/boot/zfs-import" ]] || \
-			einfo "You should add zfs-import to the boot runlevel."
-		[[ -e "${EROOT}/etc/runlevels/boot/zfs-load-key" ]] || \
-			einfo "You should add zfs-load-key to the boot runlevel."
-		[[ -e "${EROOT}/etc/runlevels/boot/zfs-mount" ]]|| \
-			einfo "You should add zfs-mount to the boot runlevel."
-		[[ -e "${EROOT}/etc/runlevels/default/zfs-share" ]] || \
-			einfo "You should add zfs-share to the default runlevel."
-		[[ -e "${EROOT}/etc/runlevels/default/zfs-zed" ]] || \
-			einfo "You should add zfs-zed to the default runlevel."
-	fi
-}
-
-pkg_postrm() {
-	udev_reload
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.2.4.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.3.0_rc1.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.2.4.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.3.0_rc1.ebuild
index 950fccc9ba5..f0e4486cb2e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.2.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.3.0_rc1.ebuild
@@ -25,7 +25,7 @@ else
 	S="${WORKDIR}/${MY_P}"
 
 	if [[ ${PV} != *_rc* ]]; then
-		KEYWORDS="amd64 arm64 ~loong ppc64 ~riscv ~sparc"
+		KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv ~sparc"
 	fi
 fi
 
@@ -34,7 +34,7 @@ LICENSE="BSD-2 CDDL MIT"
 # possible candidates: libuutil, libzpool, libnvpair. Those do not provide stable abi, but are considered.
 # see libsoversion_check() below as well
 SLOT="0/5"
-IUSE="custom-cflags debug dist-kernel kernel-builtin minimal nls pam python +rootfs selinux test-suite"
+IUSE="custom-cflags debug dist-kernel kernel-builtin minimal nls pam python +rootfs selinux test-suite unwind"
 
 DEPEND="
 	dev-libs/openssl:=
@@ -47,6 +47,7 @@ DEPEND="
 	python? (
 		$(python_gen_cond_dep 'dev-python/cffi[${PYTHON_USEDEP}]' 'python*')
 	)
+	unwind? ( sys-libs/libunwind:= )
 "
 
 BDEPEND="
@@ -105,7 +106,6 @@ RESTRICT="test"
 
 PATCHES=(
 	"${FILESDIR}"/2.1.5-dracut-zfs-missing.patch
-	"${FILESDIR}"/2.2.2-no-USER_NS.patch
 	"${FILESDIR}"/2.2.3-musl.patch
 )
 
@@ -222,6 +222,7 @@ src_configure() {
 		$(use_enable nls)
 		$(use_enable pam)
 		$(use_enable python pyzfs)
+		$(use_with unwind libunwind)
 		--disable-static
 		$(usex minimal --without-python --with-python="${EPYTHON}")
 	)
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.42-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.42-r2.ebuild
index e7f9573e674..7ea1df476af 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.42-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.42-r2.ebuild
@@ -24,7 +24,7 @@ LICENSE="|| ( GPL-3 LGPL-3 )"
 SLOT="0/${PV%_p?}.0"
 
 IUSE="64-bit-bfd cet multitarget nls static-libs test"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
 RESTRICT="!test? ( test )"
 
 BDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/cracklib/cracklib-2.10.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/cracklib/cracklib-2.10.2.ebuild
index 13f5dab1a07..076b8431624 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/cracklib/cracklib-2.10.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/cracklib/cracklib-2.10.2.ebuild
@@ -18,7 +18,7 @@ S="${WORKDIR}"/${MY_P}
 
 LICENSE="LGPL-2.1"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~ppc-macos"
 IUSE="nls python static-libs zlib"
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/efivar/efivar-39-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/efivar/efivar-39-r1.ebuild
index c82f78add1f..cda2f210556 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/efivar/efivar-39-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/efivar/efivar-39-r1.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/rhboot/efivar/archive/refs/tags/${PV}.tar.gz -> ${P}
 
 LICENSE="GPL-2"
 SLOT="0/1"
-KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 arm ~arm64 ~loong ppc64 ~riscv x86"
 IUSE="test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.9.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.9.1.ebuild
index 06d1b7fd2e0..0d48b56509b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.9.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.9.1.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 PYTHON_REQ_USE="threads(+)"
 inherit python-single-r1 waf-utils multilib-minimal
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libblockdev/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/libblockdev/Manifest
index 301c93b4bf6..48a35a4524c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libblockdev/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libblockdev/Manifest
@@ -1,5 +1,3 @@
 DIST libblockdev-2.28.tar.gz 925698 BLAKE2B 63ac7ab5bd02c1ef1848d0b252e09fe721cfe86258f063b7bab616766cbc56311707dcb2dd3a1fadf0e0840187f121aa178fd5959500cd590b846238a9d3e36e SHA512 9e01c41db4f728c8e81e710c6bb4725bbe34b3a7de25ff7f57b7b88ca6b7b5debbe858947585d314770036b2c3c533f9f8ff3d038b7ca50eee3d18f9fbe0d392
 DIST libblockdev-2.29.tar.gz 935117 BLAKE2B 774062459602a6f3730ac6e694b3f535daf0258cc5f509ff138bb8c15f44ff46bdc08e32ae1957909b51a191726cf5e9cb418c0317e5178300687947704cf5e0 SHA512 0d9637800b189f3824483010d2ff079da11b15ed0b42c578352a0d3cd9c35dab4e5945a3cc31c17ea6f88637548151fc7cf237ac8e9c98edfc7b7bce1a756e01
-DIST libblockdev-3.0.3.tar.gz 1048628 BLAKE2B c26a806797effc7231a0eb92f1b8cd74e548da5b1800cddd75a21e7df327be8371edabc2e9a39a727291f365b6a4f6242f78b66396adc4526b41749219f0429f SHA512 f2cc6fbe1df6fd9886016177a4a94984d704f3b402c7090344c581afb89f7cb050c9516c52974157a99ea6c6239f6a1f6079cde0b43a2336af0daca7311ca788
-DIST libblockdev-3.0.4.tar.gz 1050971 BLAKE2B e31ecb04310c2c66cbe432c1e003b3c3241f318f78916d5c61c0efca37fa677e5f857eab9b7c3bfc7c5a589350cdef12402940d28af68ab9fc95e5da6852ddf1 SHA512 82b574c1f8e301d6e9ff07f8c3d2a351a5bc966b5d65a3b578c214e03e48b54270b54176d646ac15e8119c79536d08b36415de478ffd34c8b3fe536300fc5172
 DIST libblockdev-3.1.1.tar.gz 1056270 BLAKE2B b3dbdc7226524d544193b609ced8a9fee725268ba2201b639c22103fcae6d047c94fb1b848e489525300242cb235d688934193894a06279a4dc0e0b33dff6e96 SHA512 44628d9e68a467f8a5d5e65e12d5d6ffb4d9b953c846acd9f6da257eab5ccd79309651d6b20092fa700fb4340f1f718ceef11141203da676d088824aa9d03481
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libblockdev/libblockdev-3.0.3.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libblockdev/libblockdev-3.0.3.ebuild
deleted file mode 100644
index 88cfcd76553..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libblockdev/libblockdev-3.0.3.ebuild
+++ /dev/null
@@ -1,131 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..11} )
-inherit autotools python-single-r1 toolchain-funcs xdg-utils
-
-DESCRIPTION="A library for manipulating block devices"
-HOMEPAGE="https://github.com/storaged-project/libblockdev"
-if [[ "${PV}" == *9999 ]] ; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/storaged-project/libblockdev.git"
-	BDEPEND="
-		dev-build/autoconf-archive
-	"
-else
-	MY_PV="${PV}-1"
-	SRC_URI="https://github.com/storaged-project/${PN}/releases/download/${MY_PV}/${P}.tar.gz"
-	KEYWORDS="~alpha amd64 arm arm64 ~loong ~mips ppc64 ~riscv x86"
-fi
-LICENSE="LGPL-2+"
-SLOT="0/3"	# subslot is SOVERSION
-IUSE="+cryptsetup device-mapper escrow gtk-doc introspection lvm +nvme test +tools"
-# Tests require root. In a future release, we may be able to run a smaller
-# subset with new run_tests.py arguments.
-RESTRICT="!test? ( test ) test"
-
-RDEPEND="
-	>=dev-libs/glib-2.42.2
-	dev-libs/libbytesize
-	sys-apps/gptfdisk
-	>=sys-apps/kmod-19
-	>=sys-apps/util-linux-2.27
-	>=sys-block/parted-3.1
-	cryptsetup? (
-		escrow? (
-			>=dev-libs/nss-3.18.0
-			dev-libs/volume_key
-		)
-		>=sys-apps/keyutils-1.5.0:=
-		>=sys-fs/cryptsetup-2.3.0:=
-	)
-	device-mapper? ( sys-fs/lvm2 )
-	lvm? (
-		sys-fs/lvm2
-		virtual/udev
-	)
-	nvme? ( sys-libs/libnvme )
-	${PYTHON_DEPS}
-	$(python_gen_cond_dep '
-		dev-python/pygobject:3[${PYTHON_USEDEP}]
-	')
-"
-
-DEPEND="${RDEPEND}"
-
-BDEPEND+="
-	dev-build/gtk-doc-am
-	gtk-doc? ( dev-util/gtk-doc )
-	introspection? ( >=dev-libs/gobject-introspection-1.3.0 )
-	test? (
-		$(python_gen_cond_dep '
-			dev-libs/libbytesize[python,${PYTHON_USEDEP}]
-		')
-		sys-block/targetcli-fb
-	)
-"
-
-REQUIRED_USE="${PYTHON_REQUIRED_USE}
-		escrow? ( cryptsetup )"
-
-pkg_setup() {
-	python-single-r1_pkg_setup
-}
-
-src_prepare() {
-	xdg_environment_reset #623992
-	default
-
-	# https://bugs.gentoo.org/744289
-	find -type f \( -name "Makefile.am" -o -name "configure.ac" \) -print0 \
-		| xargs --null sed "s@ -Werror@@" -i || die
-
-	eautoreconf
-}
-
-src_configure() {
-	# Bug #910487
-	if tc-ld-is-lld; then
-		tc-ld-force-bfd
-	fi
-
-	local myeconfargs=(
-		--with-btrfs
-		--with-fs
-		--with-part
-		--with-python3
-		--without-mpath
-		--without-nvdimm
-		$(use_enable introspection)
-		$(use_enable test tests)
-		$(use_with cryptsetup crypto)
-		$(use_with device-mapper dm)
-		$(use_with escrow)
-		$(use_with gtk-doc)
-		$(use_with lvm lvm)
-		$(use_with lvm lvm-dbus)
-		$(use_with nvme)
-		$(use_with tools)
-	)
-	econf "${myeconfargs[@]}"
-}
-
-src_test() {
-	# See http://storaged.org/libblockdev/ch03.html
-	# The 'check' target just does Pylint.
-	# ... but it needs root.
-	emake test
-}
-
-src_install() {
-	default
-	find "${ED}" -type f -name "*.la" -delete || die
-	# This is installed even with USE=-lvm, but libbd_lvm are omitted so it
-	# doesn't work at all.
-	if ! use lvm ; then
-		rm -f "${ED}"/usr/bin/lvm-cache-stats || die
-	fi
-	python_optimize #718576
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libblockdev/libblockdev-3.0.4.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libblockdev/libblockdev-3.0.4.ebuild
deleted file mode 100644
index b478e441d22..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libblockdev/libblockdev-3.0.4.ebuild
+++ /dev/null
@@ -1,132 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..12} )
-inherit autotools python-single-r1 xdg-utils
-
-DESCRIPTION="A library for manipulating block devices"
-HOMEPAGE="https://github.com/storaged-project/libblockdev"
-if [[ "${PV}" == *9999 ]] ; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/storaged-project/libblockdev.git"
-	BDEPEND="
-		dev-build/autoconf-archive
-	"
-else
-	MY_PV="${PV}-1"
-	SRC_URI="https://github.com/storaged-project/${PN}/releases/download/${MY_PV}/${P}.tar.gz"
-	KEYWORDS="~alpha amd64 arm arm64 ~loong ~mips ~ppc ppc64 ~riscv x86"
-fi
-LICENSE="LGPL-2+"
-SLOT="0/3"	# subslot is SOVERSION
-IUSE="+cryptsetup device-mapper escrow gtk-doc introspection lvm +nvme test +tools"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	>=dev-libs/glib-2.42.2
-	dev-libs/libbytesize
-	sys-apps/gptfdisk
-	>=sys-apps/kmod-19
-	>=sys-apps/util-linux-2.27
-	>=sys-block/parted-3.1
-	cryptsetup? (
-		escrow? (
-			>=dev-libs/nss-3.18.0
-			dev-libs/volume_key
-		)
-		>=sys-apps/keyutils-1.5.0:=
-		>=sys-fs/cryptsetup-2.3.0:=
-	)
-	device-mapper? ( sys-fs/lvm2 )
-	lvm? (
-		sys-fs/lvm2
-		virtual/udev
-	)
-	nvme? ( sys-libs/libnvme )
-	${PYTHON_DEPS}
-	$(python_gen_cond_dep '
-		dev-python/pygobject:3[${PYTHON_USEDEP}]
-	')
-"
-
-DEPEND="${RDEPEND}"
-
-BDEPEND+="
-	dev-build/gtk-doc-am
-	gtk-doc? ( dev-util/gtk-doc )
-	introspection? ( >=dev-libs/gobject-introspection-1.3.0 )
-	test? (
-		$(python_gen_cond_dep '
-			dev-libs/libbytesize[python,${PYTHON_USEDEP}]
-			dev-python/dbus-python[${PYTHON_USEDEP}]
-			dev-python/pyyaml[${PYTHON_USEDEP}]
-		')
-		sys-apps/lsb-release
-		sys-block/targetcli-fb
-	)
-"
-
-REQUIRED_USE="${PYTHON_REQUIRED_USE}
-		escrow? ( cryptsetup )
-		test? ( introspection lvm )
-"
-
-PATCHES=(
-	"${FILESDIR}/libblockdev-3.0.4-add-non-systemd-method-for-distro-info.patch"
-)
-
-pkg_setup() {
-	python-single-r1_pkg_setup
-}
-
-src_prepare() {
-	xdg_environment_reset #623992
-	default
-
-	# https://bugs.gentoo.org/744289
-	find -type f \( -name "Makefile.am" -o -name "configure.ac" \) -print0 \
-		| xargs --null sed "s@ -Werror@@" -i || die
-
-	eautoreconf
-}
-
-src_configure() {
-	local myeconfargs=(
-		--with-btrfs
-		--with-fs
-		--with-part
-		--with-python3
-		--without-mpath
-		--without-nvdimm
-		$(use_enable introspection)
-		$(use_enable test tests)
-		$(use_with cryptsetup crypto)
-		$(use_with device-mapper dm)
-		$(use_with escrow)
-		$(use_with gtk-doc)
-		$(use_with lvm lvm)
-		$(use_with lvm lvm-dbus)
-		$(use_with nvme)
-		$(use_with tools)
-	)
-	econf "${myeconfargs[@]}"
-}
-
-src_test() {
-	# See http://storaged.org/libblockdev/ch03.html
-	# Largest subset which doesn't require root priviledges
-	${EPYTHON} tests/run_tests.py --include-tags extradeps sourceonly || die
-}
-
-src_install() {
-	default
-	find "${ED}" -type f -name "*.la" -delete || die
-	# This is installed even with USE=-lvm, but libbd_lvm are omitted so it
-	# doesn't work at all.
-	if ! use lvm ; then
-		rm -f "${ED}"/usr/bin/lvm-cache-stats || die
-	fi
-	python_optimize #718576
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libblockdev/libblockdev-3.1.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libblockdev/libblockdev-3.1.1.ebuild
index 57aa820341d..b4747c3f7f9 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libblockdev/libblockdev-3.1.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libblockdev/libblockdev-3.1.1.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 inherit autotools python-single-r1 xdg-utils
 
 DESCRIPTION="A library for manipulating block devices"
@@ -17,7 +17,7 @@ if [[ "${PV}" == *9999 ]] ; then
 else
 	MY_PV="${PV}-1"
 	SRC_URI="https://github.com/storaged-project/${PN}/releases/download/${MY_PV}/${P}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	KEYWORDS="~alpha amd64 arm arm64 ~loong ~mips ppc ppc64 ~riscv ~sparc x86"
 fi
 LICENSE="LGPL-2+"
 SLOT="0/3"	# subslot is SOVERSION
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.10.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.10.ebuild
index 7ada129a3e8..183c7219879 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.10.ebuild
@@ -12,7 +12,7 @@ SRC_URI="https://github.com/linux-nvme/libnvme/archive/refs/tags/v${PV}.tar.gz -
 
 LICENSE="LGPL-2.1+"
 SLOT="0/1"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm arm64 ~loong ~mips ppc ppc64 ~riscv ~sparc x86"
 IUSE="dbus +json keyutils python ssl test +uuid"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/files/libseccomp-2.5.5-aliasing.patch b/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/files/libseccomp-2.5.5-aliasing.patch
new file mode 100644
index 00000000000..60190702d38
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/files/libseccomp-2.5.5-aliasing.patch
@@ -0,0 +1,30 @@
+https://github.com/seccomp/libseccomp/commit/2847f10dddca72167309c04cd09f326fd3b78e2f
+
+From 2847f10dddca72167309c04cd09f326fd3b78e2f Mon Sep 17 00:00:00 2001
+From: Sam James <sam@gentoo.org>
+Date: Sun, 24 Dec 2023 20:38:06 +0100
+Subject: [PATCH] scmp_bpf_sim: fix aliasing UB
+
+See https://github.com/seccomp/libseccomp/pull/425.
+
+Punning sys_data_b between uint32_t* and struct* seccomp_data isn't legal,
+use memcpy to fix the testsuite with Clang 17.
+
+Modern compilers recognise this idiom and optimise it out anyway.
+
+Signed-off-by: Sam James <sam@gentoo.org>
+Acked-by: Tom Hromatka <tom.hromatka@oracle.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+--- a/tools/scmp_bpf_sim.c
++++ b/tools/scmp_bpf_sim.c
+@@ -182,7 +182,8 @@ static void bpf_execute(const struct bpf_program *prg,
+ 		switch (code) {
+ 		case BPF_LD+BPF_W+BPF_ABS:
+ 			if (k < BPF_SYSCALL_MAX) {
+-				uint32_t val = *((uint32_t *)&sys_data_b[k]);
++				uint32_t val;
++				memcpy(&val, &sys_data_b[k], sizeof(val));
+ 				state.acc = ttoh32(arch, val);
+ 			} else
+ 				exit_error(ERANGE, ip_c);
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-2.5.5-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-2.5.5-r2.ebuild
new file mode 100644
index 00000000000..3baf6b3db7a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-2.5.5-r2.ebuild
@@ -0,0 +1,127 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_OPTIONAL=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{10..12} )
+
+inherit distutils-r1 multilib-minimal
+
+DESCRIPTION="High level interface to Linux seccomp filter"
+HOMEPAGE="https://github.com/seccomp/libseccomp"
+
+if [[ ${PV} == *9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/seccomp/libseccomp.git"
+	PRERELEASE="2.6.0"
+	AUTOTOOLS_AUTO_DEPEND=yes
+	inherit autotools git-r3
+else
+	AUTOTOOLS_AUTO_DEPEND=no
+	inherit autotools libtool
+	SRC_URI="https://github.com/seccomp/libseccomp/releases/download/v${PV}/${P}.tar.gz
+		experimental-loong? ( https://github.com/matoro/libseccomp/compare/v${PV}..loongarch-r1.patch
+			-> ${P}-loongarch-r1.patch )"
+	KEYWORDS="-* ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux"
+fi
+
+LICENSE="LGPL-2.1"
+SLOT="0"
+IUSE="experimental-loong python static-libs test"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+# We need newer kernel headers; we don't keep strict control of the exact
+# version here, just be safe and pull in the latest stable ones. bug #551248
+DEPEND="
+	>=sys-kernel/linux-headers-5.15
+	python? ( ${PYTHON_DEPS} )
+"
+RDEPEND="${DEPEND}"
+BDEPEND="
+	${DEPEND}
+	dev-util/gperf
+	experimental-loong? ( ${AUTOTOOLS_DEPEND} )
+	python? (
+		${DISTUTILS_DEPS}
+		dev-python/cython[${PYTHON_USEDEP}]
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}"/libseccomp-python-shared.patch
+	"${FILESDIR}"/libseccomp-2.5.3-skip-valgrind.patch
+	"${FILESDIR}"/libseccomp-2.5.5-which-hunt.patch
+	"${FILESDIR}"/libseccomp-2.5.5-arch-syscall-check.patch
+	"${FILESDIR}"/libseccomp-2.5.5-aliasing.patch
+)
+
+src_prepare() {
+	if use experimental-loong; then
+		PATCHES+=( "${DISTDIR}/${P}-loongarch-r1.patch" )
+	fi
+
+	default
+
+	if [[ ${PV} == *9999 ]] ; then
+		sed -i -e "s/0.0.0/${PRERELEASE}/" configure.ac || die
+	fi
+
+	if use experimental-loong; then
+		# touch generated files to avoid activating maintainer mode
+		# remove when loong-fix-build.patch is no longer necessary
+		touch ./aclocal.m4 ./configure ./configure.h.in || die
+		find . -name Makefile.in -exec touch {} + || die
+	fi
+
+	if [[ ${PV} == *9999 ]] || use experimental-loong; then
+		rm -f "include/seccomp.h" || die
+		eautoreconf
+	else
+		elibtoolize
+	fi
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		$(use_enable static-libs static)
+		--disable-python
+	)
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_compile() {
+	emake
+
+	if multilib_is_native_abi && use python ; then
+		# setup.py expects libseccomp.so to live in "../.libs"
+		# Copy the python files to the right place for this.
+		rm -r "${BUILD_DIR}"/src/python || die
+		cp -r "${S}"/src/python "${BUILD_DIR}"/src/python || die
+		local -x CPPFLAGS="-I\"${BUILD_DIR}/include\" -I\"${S}/include\" ${CPPFLAGS}"
+
+		# setup.py reads VERSION_RELEASE from the environment
+		local -x VERSION_RELEASE=${PRERELEASE-${PV}}
+
+		pushd "${BUILD_DIR}/src/python" >/dev/null || die
+		distutils-r1_src_compile
+		popd >/dev/null || die
+	fi
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+
+	if multilib_is_native_abi && use python ; then
+		distutils-r1_src_install
+	fi
+}
+
+multilib_src_install_all() {
+	find "${ED}" -type f -name "${PN}.la" -delete || die
+
+	einstalldocs
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/liburing/liburing-2.7-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/liburing/liburing-2.7-r1.ebuild
index a469ca0ee19..8623044771f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/liburing/liburing-2.7-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/liburing/liburing-2.7-r1.ebuild
@@ -12,7 +12,7 @@ if [[ "${PV}" == *9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/axboe/liburing.git"
 else
 	SRC_URI="https://git.kernel.dk/cgit/${PN}/snapshot/${P}.tar.bz2"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	QA_PKGCONFIG_VERSION=${PV}
 fi
 LICENSE="MIT"
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36-r3.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36-r3.ebuild
index ac68c09ffad..6bca15f08f6 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36-r3.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 # NEED_BOOTSTRAP is for developers to quickly generate a tarball
 # for publishing to the tree.
 NEED_BOOTSTRAP="no"
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.2_p13.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.2_p13.ebuild
index 38df3c2c67f..5a7a547c569 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.2_p13.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.2_p13.ebuild
@@ -83,7 +83,7 @@ fi
 LICENSE="GPL-3+"
 SLOT="0/8"  # subslot matches SONAME major
 if is_release ; then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 IUSE="static-libs +unicode utils"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.2.ebuild
index 8d98b20fe6d..42d9f93d49b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.2.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 PYTHON_REQ_USE="threads(+)"
 inherit waf-utils python-single-r1 multilib-minimal
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.10.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.10.ebuild
index 151c787ebc8..5f85cdd900a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.10.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 PYTHON_REQ_USE="threads(+)"
 inherit waf-utils multilib-minimal python-single-r1
 
@@ -70,7 +70,7 @@ multilib_src_compile() {
 multilib_src_test() {
 	# the default src_test runs 'make test' and 'make check', letting
 	# the tests fail occasionally (reason: unknown)
-	emake check
+	emake check WAF_BIN="${WAF_BINARY}"
 }
 
 multilib_src_install() {
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/tevent/tevent-0.16.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/tevent/tevent-0.16.1.ebuild
index 725d96c3aa5..16d6030c2f1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/tevent/tevent-0.16.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/tevent/tevent-0.16.1.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 PYTHON_REQ_USE="threads(+)"
 inherit waf-utils multilib-minimal python-single-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/virtual/perl-Data-Dumper/perl-Data-Dumper-2.189.0.ebuild b/sdk_container/src/third_party/portage-stable/virtual/perl-Data-Dumper/perl-Data-Dumper-2.189.0.ebuild
index 26228918ce7..022f82abdd3 100644
--- a/sdk_container/src/third_party/portage-stable/virtual/perl-Data-Dumper/perl-Data-Dumper-2.189.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/virtual/perl-Data-Dumper/perl-Data-Dumper-2.189.0.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 DESCRIPTION="Virtual for ${PN#perl-}"
 SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 RDEPEND="
 	|| ( =dev-lang/perl-5.40* ~perl-core/${PN#perl-}-${PV} )
diff --git a/sdk_container/src/third_party/portage-stable/virtual/perl-Encode/perl-Encode-3.210.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/virtual/perl-Encode/perl-Encode-3.210.0-r1.ebuild
index 26228918ce7..022f82abdd3 100644
--- a/sdk_container/src/third_party/portage-stable/virtual/perl-Encode/perl-Encode-3.210.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/virtual/perl-Encode/perl-Encode-3.210.0-r1.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 DESCRIPTION="Virtual for ${PN#perl-}"
 SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 RDEPEND="
 	|| ( =dev-lang/perl-5.40* ~perl-core/${PN#perl-}-${PV} )
diff --git a/sdk_container/src/third_party/portage-stable/virtual/perl-Exporter/perl-Exporter-5.780.0.ebuild b/sdk_container/src/third_party/portage-stable/virtual/perl-Exporter/perl-Exporter-5.780.0.ebuild
index 26228918ce7..022f82abdd3 100644
--- a/sdk_container/src/third_party/portage-stable/virtual/perl-Exporter/perl-Exporter-5.780.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/virtual/perl-Exporter/perl-Exporter-5.780.0.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 DESCRIPTION="Virtual for ${PN#perl-}"
 SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 RDEPEND="
 	|| ( =dev-lang/perl-5.40* ~perl-core/${PN#perl-}-${PV} )
diff --git a/sdk_container/src/third_party/portage-stable/virtual/perl-File-Spec/perl-File-Spec-3.900.0.ebuild b/sdk_container/src/third_party/portage-stable/virtual/perl-File-Spec/perl-File-Spec-3.900.0.ebuild
index 26228918ce7..022f82abdd3 100644
--- a/sdk_container/src/third_party/portage-stable/virtual/perl-File-Spec/perl-File-Spec-3.900.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/virtual/perl-File-Spec/perl-File-Spec-3.900.0.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 DESCRIPTION="Virtual for ${PN#perl-}"
 SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 RDEPEND="
 	|| ( =dev-lang/perl-5.40* ~perl-core/${PN#perl-}-${PV} )
diff --git a/sdk_container/src/third_party/portage-stable/virtual/perl-Getopt-Long/perl-Getopt-Long-2.570.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/virtual/perl-Getopt-Long/perl-Getopt-Long-2.570.0-r1.ebuild
index 26228918ce7..022f82abdd3 100644
--- a/sdk_container/src/third_party/portage-stable/virtual/perl-Getopt-Long/perl-Getopt-Long-2.570.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/virtual/perl-Getopt-Long/perl-Getopt-Long-2.570.0-r1.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 DESCRIPTION="Virtual for ${PN#perl-}"
 SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 RDEPEND="
 	|| ( =dev-lang/perl-5.40* ~perl-core/${PN#perl-}-${PV} )
diff --git a/sdk_container/src/third_party/portage-stable/virtual/perl-IO/perl-IO-1.550.0.ebuild b/sdk_container/src/third_party/portage-stable/virtual/perl-IO/perl-IO-1.550.0.ebuild
index 26228918ce7..022f82abdd3 100644
--- a/sdk_container/src/third_party/portage-stable/virtual/perl-IO/perl-IO-1.550.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/virtual/perl-IO/perl-IO-1.550.0.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 DESCRIPTION="Virtual for ${PN#perl-}"
 SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 RDEPEND="
 	|| ( =dev-lang/perl-5.40* ~perl-core/${PN#perl-}-${PV} )
diff --git a/sdk_container/src/third_party/portage-stable/virtual/rust/rust-1.81.0.ebuild b/sdk_container/src/third_party/portage-stable/virtual/rust/rust-1.81.0-r1.ebuild
similarity index 89%
rename from sdk_container/src/third_party/portage-stable/virtual/rust/rust-1.81.0.ebuild
rename to sdk_container/src/third_party/portage-stable/virtual/rust/rust-1.81.0-r1.ebuild
index 57e3cc3e651..6f50c94d3e7 100644
--- a/sdk_container/src/third_party/portage-stable/virtual/rust/rust-1.81.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/virtual/rust/rust-1.81.0-r1.ebuild
@@ -15,6 +15,6 @@ KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 IUSE="rustfmt profiler"
 
 RDEPEND="|| (
-	~dev-lang/rust-bin-${PV}[profiler?,rustfmt?,${MULTILIB_USEDEP}]
+	~dev-lang/rust-bin-${PV}[rustfmt?,${MULTILIB_USEDEP}]
 	~dev-lang/rust-${PV}[profiler?,rustfmt?,${MULTILIB_USEDEP}]
 )"