From 879bdd12c7d1c219e319def3e961cbef5465cc68 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:05:11 +0000
Subject: [PATCH 001/136] app-admin/eselect: Sync with Gentoo

It's from Gentoo commit 24b12ca2228f3d414b096d07fe6306f931ccbf00.
---
 .../portage-stable/app-admin/eselect/eselect-1.4.30.ebuild      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/app-admin/eselect/eselect-1.4.30.ebuild b/sdk_container/src/third_party/portage-stable/app-admin/eselect/eselect-1.4.30.ebuild
index 39345cdc44e..e28a805471a 100644
--- a/sdk_container/src/third_party/portage-stable/app-admin/eselect/eselect-1.4.30.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-admin/eselect/eselect-1.4.30.ebuild
@@ -16,7 +16,7 @@ SRC_URI="https://dev.gentoo.org/~ulm/eselect/${P}.tar.xz"
 
 LICENSE="GPL-2+ || ( GPL-2+ CC-BY-SA-4.0 )"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="doc emacs vim-syntax"
 
 # coreutils for realpath

From 432de3eb4e3c8dc7723b417f5442094e5d80d7d9 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:05:34 +0000
Subject: [PATCH 002/136] app-arch/xz-utils: Sync with Gentoo

It's from Gentoo commit 5add0cf7a12634ded95704e0437226f2023caf82.
---
 .../app-arch/xz-utils/xz-utils-5.8.1.ebuild           | 11 +++++++++--
 .../app-arch/xz-utils/xz-utils-9999.ebuild            |  9 ++++++++-
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.8.1.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.8.1.ebuild
index b4b85808bcc..98d24748b06 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.8.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.8.1.ebuild
@@ -6,7 +6,7 @@
 
 EAPI=8
 
-inherit libtool multilib multilib-minimal preserve-libs toolchain-funcs
+inherit dot-a libtool multilib multilib-minimal preserve-libs toolchain-funcs
 
 if [[ ${PV} == 9999 ]] ; then
 	# Per tukaani.org, git.tukaani.org is a mirror of github and
@@ -35,7 +35,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 
 	S="${WORKDIR}/${MY_P}"
@@ -65,6 +65,11 @@ src_prepare() {
 	fi
 }
 
+src_configure() {
+	use static-libs && lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	local myconf=(
 		--enable-threads
@@ -183,6 +188,8 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	strip-lto-bytecode
+
 	find "${ED}" -type f -name '*.la' -delete || die
 
 	if use doc ; then
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild
index b4b85808bcc..dd0bcb3489e 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild
@@ -6,7 +6,7 @@
 
 EAPI=8
 
-inherit libtool multilib multilib-minimal preserve-libs toolchain-funcs
+inherit dot-a libtool multilib multilib-minimal preserve-libs toolchain-funcs
 
 if [[ ${PV} == 9999 ]] ; then
 	# Per tukaani.org, git.tukaani.org is a mirror of github and
@@ -65,6 +65,11 @@ src_prepare() {
 	fi
 }
 
+src_configure() {
+	use static-libs && lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	local myconf=(
 		--enable-threads
@@ -183,6 +188,8 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	strip-lto-bytecode
+
 	find "${ED}" -type f -name '*.la' -delete || die
 
 	if use doc ; then

From dab4656b5a6494a7bf0fa87811256bf4418a04be Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:05:35 +0000
Subject: [PATCH 003/136] app-arch/zstd: Sync with Gentoo

It's from Gentoo commit b6097a3524f823d38cbc34d45deadddd91f1cb7f.
---
 .../portage-stable/app-arch/zstd/Manifest     |  1 -
 .../app-arch/zstd/zstd-1.5.6.ebuild           | 79 -------------------
 .../app-arch/zstd/zstd-1.5.7-r1.ebuild        | 12 ++-
 3 files changed, 11 insertions(+), 81 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.6.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/app-arch/zstd/Manifest b/sdk_container/src/third_party/portage-stable/app-arch/zstd/Manifest
index 5996706b0a4..b0dd3d3d669 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/zstd/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-arch/zstd/Manifest
@@ -1,2 +1 @@
-DIST zstd-1.5.6.tar.gz 2406875 BLAKE2B fe17cf0950f8ee2cc07bfa2b41e97f36a1832e396386cb94a55bede975dc974920578cf147b39eecbc5b53ff06fe0dc1fe781a4cab9bc9f767ea28c0e786422e SHA512 54a578f2484da0520a6e9a24f501b9540a3fe3806785d6bc9db79fc095b7c142a7c121387c7eecd460ca71446603584ef1ba4d29a33ca90873338c9ffbd04f14
 DIST zstd-1.5.7.tar.gz 2434947 BLAKE2B ef6bcf13bbb79edce2de21ef4860b01dcb4d2dd47ebd03657d5331c3bb1a207ef128e99ed907a32e787dca7bb51df225ebd8abb2097d03d02c003ca713e1e271 SHA512 b4de208f179b68d4c6454139ca60d66ed3ef3893a560d6159a056640f83d3ee67cdf6ffb88971cdba35449dba4b597eaa8b4ae908127ef7fd58c89f40bf9a705
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.6.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.6.ebuild
deleted file mode 100644
index a2c7a56db95..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.6.ebuild
+++ /dev/null
@@ -1,79 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit flag-o-matic meson-multilib
-
-DESCRIPTION="zstd fast compression library"
-HOMEPAGE="https://facebook.github.io/zstd/"
-SRC_URI="https://github.com/facebook/zstd/releases/download/v${PV}/${P}.tar.gz"
-S="${WORKDIR}"/${P}/build/meson
-
-LICENSE="|| ( BSD GPL-2 )"
-SLOT="0/1"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="+lzma lz4 static-libs test zlib"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	lzma? ( app-arch/xz-utils )
-	lz4? ( app-arch/lz4:= )
-	zlib? ( sys-libs/zlib )
-"
-DEPEND="${RDEPEND}"
-
-MESON_PATCHES=(
-	# Workaround until Valgrind bugfix lands
-	"${FILESDIR}"/${PN}-1.5.4-no-find-valgrind.patch
-)
-
-PATCHES=(
-)
-
-src_prepare() {
-	cd "${WORKDIR}"/${P} || die
-	default
-
-	cd "${S}" || die
-	eapply "${MESON_PATCHES[@]}"
-}
-
-multilib_src_configure() {
-	local native_file="${T}"/meson.${CHOST}.${ABI}.ini.local
-
-	# This replaces the no-find-valgrind patch once bugfix lands in a meson
-	# release + we can BDEPEND on it (https://github.com/mesonbuild/meson/pull/11372)
-	cat >> ${native_file} <<-EOF || die
-	[binaries]
-	valgrind='valgrind-falseified'
-	EOF
-
-	# Test suite validates that stack is not executable.  Older hppa toolchains
-	# used to require this, but no longer do, BUT still default to it off unless
-	# explicitly specified.  See #903923
-	# The cmake build sets these, but the meson build doesn't, so set it manually.
-	# https://github.com/facebook/zstd/blob/979b047/build/cmake/CMakeModules/AddZstdCompilationFlags.cmake#L77-L82
-	append-flags $(test-flags-CCLD "-Wa,--noexecstack")
-	append-ldflags $(test-flags-CCLD "-Wl,-z,noexecstack")
-
-	local emesonargs=(
-		-Ddefault_library=$(multilib_native_usex static-libs both shared)
-
-		$(meson_native_true bin_programs)
-		$(meson_native_true bin_contrib)
-		$(meson_use test bin_tests)
-
-		$(meson_native_use_feature zlib)
-		$(meson_native_use_feature lzma)
-		$(meson_native_use_feature lz4)
-
-		--native-file "${native_file}"
-	)
-
-	meson_src_configure
-}
-
-multilib_src_test() {
-	meson_src_test --timeout-multiplier=2
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.7-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.7-r1.ebuild
index 3a2543b064b..236702ff608 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.7-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.7-r1.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit meson-multilib
+inherit dot-a meson-multilib
 
 DESCRIPTION="zstd fast compression library"
 HOMEPAGE="https://facebook.github.io/zstd/"
@@ -40,6 +40,11 @@ src_prepare() {
 	eapply "${MESON_PATCHES[@]}"
 }
 
+src_configure() {
+	use static-libs && lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	local native_file="${T}"/meson.${CHOST}.${ABI}.ini.local
 
@@ -70,3 +75,8 @@ multilib_src_configure() {
 multilib_src_test() {
 	meson_src_test --timeout-multiplier=2
 }
+
+multilib_src_install_all() {
+	einstalldocs
+	strip-lto-bytecode
+}

From 147237f84788aa19d4ce1db57c7f028ca409ba31 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:05:37 +0000
Subject: [PATCH 004/136] app-containers/cri-tools: Sync with Gentoo

It's from Gentoo commit 1a55476abc9439417dcf61827148f7ac2b05bab6.
---
 .../app-containers/cri-tools/Manifest         |  1 +
 .../cri-tools/cri-tools-1.33.0.ebuild         | 38 +++++++++++++++++++
 2 files changed, 39 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/app-containers/cri-tools/cri-tools-1.33.0.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/app-containers/cri-tools/Manifest b/sdk_container/src/third_party/portage-stable/app-containers/cri-tools/Manifest
index 797cfd9fdb5..f5d4cefaa7d 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/cri-tools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-containers/cri-tools/Manifest
@@ -1,2 +1,3 @@
 DIST cri-tools-1.27.0.tar.gz 8465050 BLAKE2B d6c0429271ebc4085e75b54d7f3b9f75ab796e63bc9ae7562105296b13bbad8b512293a7d25abf1ab946f4bf54e672016fdb72696c12c730d21ac74724da465c SHA512 b94122e6401eb0c33b9c3d112274b7ab20cbbad05e76a54933e79d2e42ded2d684771cb9ed703a6c1afa381844142b6f1b4dc77d17e915f9a42c236fd8426b9b
 DIST cri-tools-1.32.0.tar.gz 7682096 BLAKE2B 125fc9014942e681353ef49d4d397af4fc77500c0fb37d2d1be0850839c37f51f2ef41b5c7d9ca422e814d1fe50f985bfd42d2bba11d391cea66b3bec381dc08 SHA512 654cfd4d546932d48c02e19071e137fa7565a5134ba1845498d61f2dfef45fca722a51dbadb7a467214f7424290c53cb79a2908684d1fbd3820836b55640f66d
+DIST cri-tools-1.33.0.tar.gz 7754304 BLAKE2B 42011726997a07842fd3c9769335a71e37e1689e443a0d1a99916b5729cc22092593928a6b94bbc3718a0e5f89f3818c3b6d6155970de21e8eee30fc979a294d SHA512 0252243147e32e06328c192f77397461a729aec621bee92083dcf3899e9ffbb62386a944795535cc4a0deb5c88d1017082db8bf221f6627feb7dcd100dc70457
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/cri-tools/cri-tools-1.33.0.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/cri-tools/cri-tools-1.33.0.ebuild
new file mode 100644
index 00000000000..92307d9fb67
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-containers/cri-tools/cri-tools-1.33.0.ebuild
@@ -0,0 +1,38 @@
+# Copyright 2021-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-env go-module shell-completion toolchain-funcs
+
+DESCRIPTION="CLI and validation tools for Kubelet Container Runtime (CRI)"
+HOMEPAGE="https://github.com/kubernetes-sigs/cri-tools"
+SRC_URI="https://github.com/kubernetes-sigs/cri-tools/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64"
+RESTRICT="test"
+
+DOCS=( docs {README,RELEASE,CHANGELOG,CONTRIBUTING}.md )
+
+src_compile() {
+	local GOOS=$(go-env_goos)
+	CRICTL="build/bin/${GOOS}/${GOARCH}/crictl"
+	emake VERSION="${PV}"
+
+	if ! tc-is-cross-compiler; then
+		"${CRICTL}" completion bash > crictl.bash || die
+		"${CRICTL}" completion zsh > crictl.zsh || die
+	fi
+}
+
+src_install() {
+	einstalldocs
+	dobin "${CRICTL}"
+
+	if ! tc-is-cross-compiler; then
+		newbashcomp crictl.bash crictl
+		newzshcomp crictl.zsh _crictl
+	fi
+}

From d9ff15341021ca5a59e540c2a7cc57542f9f92cf Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:05:50 +0000
Subject: [PATCH 005/136] app-doc/eclass-manpages: Sync with Gentoo

It's from Gentoo commit 378aa6c62227f31b799e1c7d0e650305495ffd96.
---
 .../app-doc/eclass-manpages/Manifest          |  1 +
 .../eclass-manpages-20250506.ebuild           | 24 +++++++++++++++++++
 2 files changed, 25 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250506.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/Manifest b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/Manifest
index e01ec1807ef..0f9e1ab9501 100644
--- a/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/Manifest
@@ -2,3 +2,4 @@ DIST eclass-manpages-20241115.tar.xz 456160 BLAKE2B eeaa4c964dbc784ae6351b89c4a8
 DIST eclass-manpages-20241117.tar.xz 456132 BLAKE2B 7111d9817b32ede80fb1e917f43e94b9342573684b715b874a2d880121840bbe67fa7c5aff95f5e7c99a25f2ae5beebadb3326c3a0df7117e99c0903cdcf3052 SHA512 73e28a2c40e89bbe2ba6611dc70c0b0320c8cf981b479ba3be86165d0b90c75f84c209d203d0ad612544709da881f7549d66560b4bccdb73209586d1a2cf8590
 DIST eclass-manpages-20241210.tar.xz 459680 BLAKE2B 076038d98bfae109ceaa1b14eff7f3e5ba575622243c60f59e7102d23d80e640c5e2932e2c614200cf3f653fc6cf4d0041dc4cc3011207273a690fc930e06091 SHA512 c3252f797ca71e9ca89b6d45715d763031733deb0f220aef65ddf750343693757f51d6535a22536b973c1c189b7cbe11306408c9c160e6ee3864e89af060ed8d
 DIST eclass-manpages-20250105.tar.xz 471540 BLAKE2B f21e783d233611349e036bb2e9ec52e3a8293891dcc56be15c628e9507b6bf5b650184eb7d57296a006f2a9764ac586257b61e1b810622bffff52c78708dfb9d SHA512 13c6ec0ad7251d287ba18dff6a362088c7e4f80036e225d1dc993cb467536566d88e588df0983207f26a06e39450c3072c436e391431df8d3e2b8a595a809022
+DIST eclass-manpages-20250506.tar.xz 483068 BLAKE2B e4c2aacd5e2b1416c9deb337a0b8d74b664b1f38e7f0555f812c25de494d8c18628f08e065738e6cfd2082769fc8367478a53849f1923d461027acca16f2a66a SHA512 99a361f0c4a144bf89f3dfdd02d298ef6c3a7138cd2b4e151449559fafaf6e83403ad73334494239c827bbc25eef30e701945b1783c9cc16aeff94fdf29679bb
diff --git a/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250506.ebuild b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250506.ebuild
new file mode 100644
index 00000000000..0e318cc5afd
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250506.ebuild
@@ -0,0 +1,24 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Instructions to make a dist tarball:
+# git clone https://github.com/projg2/eclass-to-manpage.git
+# cd eclass-to-manpage
+# make dist ECLASSDIR=~/g/eclass/
+
+DESCRIPTION="Collection of Gentoo eclass manpages"
+HOMEPAGE="https://github.com/projg2/eclass-to-manpage"
+SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
+
+LICENSE="GPL-2"
+SLOT="0"
+# Keep the keywords stable. No need to change to ~arch.
+KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~x64-macos"
+
+BDEPEND="sys-apps/gawk"
+
+src_install() {
+	emake install DESTDIR="${D}" PREFIX="${EPREFIX}/usr"
+}

From 3f5722c807a19610b75e1d13f445d61bee66ebed Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:05:51 +0000
Subject: [PATCH 006/136] app-editors/nano: Sync with Gentoo

It's from Gentoo commit 2a625ad76d28d0801fd1cc61d46686286a20224e.
---
 .../third_party/portage-stable/app-editors/nano/nano-8.4.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-8.4.ebuild b/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-8.4.ebuild
index 0bc01680eb5..bda4a0eadd3 100644
--- a/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-8.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-8.4.ebuild
@@ -9,7 +9,7 @@ if [[ ${PV} == 9999 ]] ; then
 else
 	MY_P="${PN}-${PV/_}"
 	SRC_URI="https://www.nano-editor.org/dist/v${PV:0:1}/${MY_P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 DESCRIPTION="GNU GPL'd Pico clone with more functionality"

From 62cf0c0633e645159b0d012c62aed4cf8a8fb6be Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:05:51 +0000
Subject: [PATCH 007/136] app-emulation/qemu: Sync with Gentoo

It's from Gentoo commit 1f5a19d78df2e9553a62c72a9ea4491229a5dced.
---
 .../app-emulation/qemu/Manifest               |    2 +
 .../qemu/files/qemu-9.2.3-virtio-net.patch    |  221 ++++
 ...emu-9.2.3-r1.ebuild => qemu-10.0.0.ebuild} |    6 +-
 ...mu-7.2.15.ebuild => qemu-7.2.15-r1.ebuild} |    2 +-
 ...mu-7.2.16.ebuild => qemu-7.2.16-r1.ebuild} |    2 +-
 ...mu-7.2.17.ebuild => qemu-7.2.17-r1.ebuild} |    4 +-
 ...mu-8.2.10.ebuild => qemu-8.2.10-r1.ebuild} |    2 +-
 ...qemu-8.2.7.ebuild => qemu-8.2.7-r1.ebuild} |    2 +-
 ...qemu-8.2.9.ebuild => qemu-8.2.9-r1.ebuild} |    2 +-
 ...u-9.1.2-r1.ebuild => qemu-9.1.2-r2.ebuild} |    2 +-
 ...u-9.1.3-r1.ebuild => qemu-9.1.3-r2.ebuild} |    4 +-
 ...qemu-9.2.2.ebuild => qemu-9.2.2-r1.ebuild} |    2 +-
 .../app-emulation/qemu/qemu-9.2.3-r3.ebuild   | 1001 +++++++++++++++++
 .../app-emulation/qemu/qemu-9999.ebuild       |    4 +-
 14 files changed, 1240 insertions(+), 16 deletions(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-9.2.3-virtio-net.patch
 rename sdk_container/src/third_party/portage-stable/app-emulation/qemu/{qemu-9.2.3-r1.ebuild => qemu-10.0.0.ebuild} (99%)
 rename sdk_container/src/third_party/portage-stable/app-emulation/qemu/{qemu-7.2.15.ebuild => qemu-7.2.15-r1.ebuild} (99%)
 rename sdk_container/src/third_party/portage-stable/app-emulation/qemu/{qemu-7.2.16.ebuild => qemu-7.2.16-r1.ebuild} (99%)
 rename sdk_container/src/third_party/portage-stable/app-emulation/qemu/{qemu-7.2.17.ebuild => qemu-7.2.17-r1.ebuild} (99%)
 rename sdk_container/src/third_party/portage-stable/app-emulation/qemu/{qemu-8.2.10.ebuild => qemu-8.2.10-r1.ebuild} (99%)
 rename sdk_container/src/third_party/portage-stable/app-emulation/qemu/{qemu-8.2.7.ebuild => qemu-8.2.7-r1.ebuild} (99%)
 rename sdk_container/src/third_party/portage-stable/app-emulation/qemu/{qemu-8.2.9.ebuild => qemu-8.2.9-r1.ebuild} (99%)
 rename sdk_container/src/third_party/portage-stable/app-emulation/qemu/{qemu-9.1.2-r1.ebuild => qemu-9.1.2-r2.ebuild} (99%)
 rename sdk_container/src/third_party/portage-stable/app-emulation/qemu/{qemu-9.1.3-r1.ebuild => qemu-9.1.3-r2.ebuild} (99%)
 rename sdk_container/src/third_party/portage-stable/app-emulation/qemu/{qemu-9.2.2.ebuild => qemu-9.2.2-r1.ebuild} (99%)
 create mode 100644 sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r3.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
index 62545c62295..12e6b659d69 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
@@ -1,6 +1,8 @@
 DIST berkeley-softfloat-3-b64af41c3276f97f0e181920400ee056b9c88037.tar.bz2 84094 BLAKE2B 396f9df2e6ad559545054e89916915c3a3c8ff80e5e409498fec497b564d8b3ac9dd3cb966e26dce232ddff82af18a0e84e864ca18a80c2a2f4fe47e320249c2 SHA512 93c20d50a356c90f4293d8c7593611b2e0a9bc7567b6d946319f8ae06962ae1e297c8788f66fd38a1d3a0d44661bff9a07a63eaa84c8bb40ae01a45476be446c
 DIST berkeley-testfloat-3-e7af9751d9f9fd3b47911f51a5cfd08af256a9ab.tar.bz2 90020 BLAKE2B 3dda1ba90c4a5ad5cbce2acf35e93f7adbd387ae0e0f929b2cd4cbdf263f95183103118f32be38e8c80de49d7df44c26319ee2f465061d004ae7e64e43eeeb3e SHA512 65f41f42ea563b2cdceb6c71633f41e6694a79ffd02afed4540353a8e73668ae40118dfc108163aae751acbaa7c49630ed99f423465089503c03aee76b07f221
 DIST keycodemapdb-f5772a62ec52591ff6870b7e8ef32482371f22c6.tar.bz2 27971 BLAKE2B 0ed69ad24c53bd459c8753565814bcc1cd858f20d3a046c38912a35bcb0ba6d388ef5d2b93157cd028959284b330caf5467d82071c3df56a405dd8e08fd177c7 SHA512 8f2cc14e8bd46cb045e3ebfe32e463793ab7472ebda9b57b8ea0b06fa107a1a99c3ebcacb9c4548e30698d8ec154c0e56f789385201182b680819b8068a103f2
+DIST qemu-10.0.0-docs.tar.xz 2651472 BLAKE2B 38be083c0c046e975a829df28089428425904cf66a3ea99cebc99b6f51eebdedf10a60be0c4f6bfb9e6f6cbc5dff1724dcd3b8d0982b5c421158258d869db4f3 SHA512 5f9332340bf68b3c0da4b48174330674f5235b98c3e275792fcbeec4bacca2faa84865c01c0cdd1e95388d9656a5dbf1d6baca2d1c8b2996c42511c966d9edd7
+DIST qemu-10.0.0.tar.xz 135618260 BLAKE2B 3408c7b2a38ace7f0b2e0912411a26cab96cb23bcb03d7095f7b081cb88db55f36b004ff6458281d73190b9cc9006da85dde2a0b4b068c80662a8de205c29fda SHA512 2215458ed8be3ab0b0032fe2a96e79183f5fc2da323d927018412ea3d980b022a07ba87d4f446229eaaa7d1b19a577d438dbcaa3af3bd537c7720b56734a2d8b
 DIST qemu-7.2.0-docs.tar.xz 1984184 BLAKE2B 103900fb7903ed8d75f7f012bf61fa2d6fce345b657c851d0437c3384f5735bd1cfd3129320683ea7846ea0b0940e5af5b2663c9320f12fee74b058523a8ea06 SHA512 a7edd448982865e07533c300d3e44a8b50cefbdde1982b73c24d0b2aa74315439252c59b634c75de312860874c7b06c75aa72629da681b5105f28ee936794585
 DIST qemu-7.2.15.tar.xz 124418604 BLAKE2B 629cb5158cdd790947687a06f4c16bf838ae7b0eb5596bc16bb510dfe838bfcc6ed8e7776962bb6d5ab14379cba1a1f6b12683be370eb4e5debce1ecc446b156 SHA512 e8acc9ea6e70bd4dfb0956e01ee212c592c7b99f5dc0676824eb7cba0aeeb863c1d41df9174771fa775f58ca368c745b2fd7356a3c3fa901a11a33dae24d781a
 DIST qemu-7.2.16.tar.xz 124427328 BLAKE2B 25b69d3f47eef164b5bcb990edad7634f4602d08867cf62470b05005c5de496126064ad2eedfdf9b2d78eb724ae7832b93bc4d302140f14e5d77246cd04086eb SHA512 75623733f39396222e549498fd5dbbc1430593033f7480aa3a34c7e1c765eb5f7776d8827ee47b4b9c52cc1061232637742a8e31c5e5a9019945171d0c65ca7e
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-9.2.3-virtio-net.patch b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-9.2.3-virtio-net.patch
new file mode 100644
index 00000000000..7adff23b255
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-9.2.3-virtio-net.patch
@@ -0,0 +1,221 @@
+https://bugs.gentoo.org/955587
+https://gitlab.com/qemu-project/qemu/-/commit/ff765e490eef83480d07673e115060228b01d55e
+https://gitlab.com/qemu-project/qemu/-/commit/af01cf195ba106fe039ab320ce9e8074b4ddd841
+
+From ff765e490eef83480d07673e115060228b01d55e Mon Sep 17 00:00:00 2001
+From: Akihiko Odaki <akihiko.odaki@daynix.com>
+Date: Wed, 8 Jan 2025 21:13:29 +0900
+Subject: [PATCH] virtio-net: Fix num_buffers for version 1
+
+The specification says the device MUST set num_buffers to 1 if
+VIRTIO_NET_F_MRG_RXBUF has not been negotiated.
+
+Fixes: df91055db5c9 ("virtio-net: enable virtio 1.0")
+Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
+Message-Id: <20250108-buffers-v1-1-a0c85ff31aeb@daynix.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Tested-by: Lei Yang <leiyang@redhat.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+(cherry picked from commit c17ad4b11bd268a35506cd976884562df6ca69d7)
+Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
+---
+ hw/net/virtio-net.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
+index f8c6ccbec45..78b7d88756c 100644
+--- a/hw/net/virtio-net.c
++++ b/hw/net/virtio-net.c
+@@ -1999,6 +1999,8 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
+                                     offsetof(typeof(hdr),
+                                              virtio_net.hdr.num_buffers),
+                                     sizeof(hdr.virtio_net.hdr.num_buffers));
++            } else {
++                hdr.virtio_net.hdr.num_buffers = cpu_to_le16(1);
+             }
+ 
+             guest_offset = n->has_vnet_hdr ?
+-- 
+GitLab
+
+From af01cf195ba106fe039ab320ce9e8074b4ddd841 Mon Sep 17 00:00:00 2001
+From: Antoine Damhet <adamhet@scaleway.com>
+Date: Tue, 8 Apr 2025 16:53:33 +0200
+Subject: [PATCH] Revert "virtio-net: Copy received header to buffer"
+
+This reverts commit 7987d2be5a8bc3a502f89ba8cf3ac3e09f64d1ce.
+
+The goal was to remove the need to patch the (const) input buffer
+with a recomputed UDP checksum by copying headers to a RW region and
+inject the checksum there. The patch computed the checksum only from the
+header fields (missing the rest of the payload) producing an invalid one
+and making guests fail to acquire a DHCP lease.
+
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2727
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Antoine Damhet <adamhet@scaleway.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Message-ID: <20250408145345.142947-1-adamhet@scaleway.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+(cherry picked from commit e28fbd1c525db21f0502b85517f49504c9f9dcd8)
+Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
+---
+ hw/net/virtio-net.c | 87 +++++++++++++++++++++------------------------
+ 1 file changed, 40 insertions(+), 47 deletions(-)
+
+diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
+index 78b7d88756c..09ff80c9953 100644
+--- a/hw/net/virtio-net.c
++++ b/hw/net/virtio-net.c
+@@ -1702,44 +1702,41 @@ static void virtio_net_hdr_swap(VirtIODevice *vdev, struct virtio_net_hdr *hdr)
+  * cache.
+  */
+ static void work_around_broken_dhclient(struct virtio_net_hdr *hdr,
+-                                        size_t *hdr_len, const uint8_t *buf,
+-                                        size_t buf_size, size_t *buf_offset)
++                                        uint8_t *buf, size_t size)
+ {
+     size_t csum_size = ETH_HLEN + sizeof(struct ip_header) +
+                        sizeof(struct udp_header);
+ 
+-    buf += *buf_offset;
+-    buf_size -= *buf_offset;
+-
+     if ((hdr->flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) && /* missing csum */
+-        (buf_size >= csum_size && buf_size < 1500) && /* normal sized MTU */
++        (size >= csum_size && size < 1500) && /* normal sized MTU */
+         (buf[12] == 0x08 && buf[13] == 0x00) && /* ethertype == IPv4 */
+         (buf[23] == 17) && /* ip.protocol == UDP */
+         (buf[34] == 0 && buf[35] == 67)) { /* udp.srcport == bootps */
+-        memcpy((uint8_t *)hdr + *hdr_len, buf, csum_size);
+-        net_checksum_calculate((uint8_t *)hdr + *hdr_len, csum_size, CSUM_UDP);
++        net_checksum_calculate(buf, size, CSUM_UDP);
+         hdr->flags &= ~VIRTIO_NET_HDR_F_NEEDS_CSUM;
+-        *hdr_len += csum_size;
+-        *buf_offset += csum_size;
+     }
+ }
+ 
+-static size_t receive_header(VirtIONet *n, struct virtio_net_hdr *hdr,
+-                             const void *buf, size_t buf_size,
+-                             size_t *buf_offset)
++static void receive_header(VirtIONet *n, const struct iovec *iov, int iov_cnt,
++                           const void *buf, size_t size)
+ {
+-    size_t hdr_len = n->guest_hdr_len;
+-
+-    memcpy(hdr, buf, sizeof(struct virtio_net_hdr));
+-
+-    *buf_offset = n->host_hdr_len;
+-    work_around_broken_dhclient(hdr, &hdr_len, buf, buf_size, buf_offset);
++    if (n->has_vnet_hdr) {
++        /* FIXME this cast is evil */
++        void *wbuf = (void *)buf;
++        work_around_broken_dhclient(wbuf, wbuf + n->host_hdr_len,
++                                    size - n->host_hdr_len);
+ 
+-    if (n->needs_vnet_hdr_swap) {
+-        virtio_net_hdr_swap(VIRTIO_DEVICE(n), hdr);
++        if (n->needs_vnet_hdr_swap) {
++            virtio_net_hdr_swap(VIRTIO_DEVICE(n), wbuf);
++        }
++        iov_from_buf(iov, iov_cnt, 0, buf, sizeof(struct virtio_net_hdr));
++    } else {
++        struct virtio_net_hdr hdr = {
++            .flags = 0,
++            .gso_type = VIRTIO_NET_HDR_GSO_NONE
++        };
++        iov_from_buf(iov, iov_cnt, 0, &hdr, sizeof hdr);
+     }
+-
+-    return hdr_len;
+ }
+ 
+ static int receive_filter(VirtIONet *n, const uint8_t *buf, int size)
+@@ -1907,13 +1904,6 @@ static int virtio_net_process_rss(NetClientState *nc, const uint8_t *buf,
+     return (index == new_index) ? -1 : new_index;
+ }
+ 
+-typedef struct Header {
+-    struct virtio_net_hdr_v1_hash virtio_net;
+-    struct eth_header eth;
+-    struct ip_header ip;
+-    struct udp_header udp;
+-} Header;
+-
+ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
+                                       size_t size)
+ {
+@@ -1923,15 +1913,15 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
+     VirtQueueElement *elems[VIRTQUEUE_MAX_SIZE];
+     size_t lens[VIRTQUEUE_MAX_SIZE];
+     struct iovec mhdr_sg[VIRTQUEUE_MAX_SIZE];
+-    Header hdr;
++    struct virtio_net_hdr_v1_hash extra_hdr;
+     unsigned mhdr_cnt = 0;
+     size_t offset, i, guest_offset, j;
+     ssize_t err;
+ 
+-    memset(&hdr.virtio_net, 0, sizeof(hdr.virtio_net));
++    memset(&extra_hdr, 0, sizeof(extra_hdr));
+ 
+     if (n->rss_data.enabled && n->rss_data.enabled_software_rss) {
+-        int index = virtio_net_process_rss(nc, buf, size, &hdr.virtio_net);
++        int index = virtio_net_process_rss(nc, buf, size, &extra_hdr);
+         if (index >= 0) {
+             nc = qemu_get_subqueue(n->nic, index % n->curr_queue_pairs);
+         }
+@@ -1996,20 +1986,23 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
+             if (n->mergeable_rx_bufs) {
+                 mhdr_cnt = iov_copy(mhdr_sg, ARRAY_SIZE(mhdr_sg),
+                                     sg, elem->in_num,
+-                                    offsetof(typeof(hdr),
+-                                             virtio_net.hdr.num_buffers),
+-                                    sizeof(hdr.virtio_net.hdr.num_buffers));
++                                    offsetof(typeof(extra_hdr), hdr.num_buffers),
++                                    sizeof(extra_hdr.hdr.num_buffers));
+             } else {
+-                hdr.virtio_net.hdr.num_buffers = cpu_to_le16(1);
++                extra_hdr.hdr.num_buffers = cpu_to_le16(1);
+             }
+ 
+-            guest_offset = n->has_vnet_hdr ?
+-                           receive_header(n, (struct virtio_net_hdr *)&hdr,
+-                                          buf, size, &offset) :
+-                           n->guest_hdr_len;
+-
+-            iov_from_buf(sg, elem->in_num, 0, &hdr, guest_offset);
+-            total += guest_offset;
++            receive_header(n, sg, elem->in_num, buf, size);
++            if (n->rss_data.populate_hash) {
++                offset = offsetof(typeof(extra_hdr), hash_value);
++                iov_from_buf(sg, elem->in_num, offset,
++                             (char *)&extra_hdr + offset,
++                             sizeof(extra_hdr.hash_value) +
++                             sizeof(extra_hdr.hash_report));
++            }
++            offset = n->host_hdr_len;
++            total += n->guest_hdr_len;
++            guest_offset = n->guest_hdr_len;
+         } else {
+             guest_offset = 0;
+         }
+@@ -2035,11 +2028,11 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
+     }
+ 
+     if (mhdr_cnt) {
+-        virtio_stw_p(vdev, &hdr.virtio_net.hdr.num_buffers, i);
++        virtio_stw_p(vdev, &extra_hdr.hdr.num_buffers, i);
+         iov_from_buf(mhdr_sg, mhdr_cnt,
+                      0,
+-                     &hdr.virtio_net.hdr.num_buffers,
+-                     sizeof hdr.virtio_net.hdr.num_buffers);
++                     &extra_hdr.hdr.num_buffers,
++                     sizeof extra_hdr.hdr.num_buffers);
+     }
+ 
+     for (j = 0; j < i; j++) {
+-- 
+GitLab
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.0.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.0.ebuild
index 91796454d6c..a53f9732ac1 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.0.ebuild
@@ -8,7 +8,7 @@ EAPI=8
 # (the construct below is to allow overriding from env for script)
 QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
 QEMU_DOCS_PREBUILT_DEV=sam
-QEMU_DOCS_VERSION=$(ver_cut 1-2).0
+QEMU_DOCS_VERSION=$(ver_cut 1-3)
 # Default to generating docs (inc. man pages) if no prebuilt; overridden later
 # bug #830088
 QEMU_DOC_USEFLAG="+doc"
@@ -177,7 +177,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
@@ -246,7 +246,7 @@ SEABIOS_VERSION="1.16.3"
 X86_FIRMWARE_DEPEND="
 	pin-upstream-blobs? (
 		~sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
-		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/ipxe-1.21.1_p20230601[binary,qemu]
 		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
 		~sys-firmware/sgabios-0.1_pre10[binary]
 	)
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.15.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.15-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.15.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.15-r1.ebuild
index a76a8cce204..8c601062f67 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.15.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.15-r1.ebuild
@@ -173,7 +173,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.16.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.16-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.16.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.16-r1.ebuild
index a5d40383777..ca3c4258525 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.16.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.16-r1.ebuild
@@ -173,7 +173,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17-r1.ebuild
index 7ed9ddabff2..04e77d0306a 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17-r1.ebuild
@@ -41,7 +41,7 @@ else
 	fi
 
 	S="${WORKDIR}/${MY_P}"
-	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="amd64 ~arm arm64 ~loong ~ppc ppc64 ~riscv x86"
 fi
 
 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
@@ -173,7 +173,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.10.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.10-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.10.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.10-r1.ebuild
index 39674977ab6..0ae89ea3b38 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.10-r1.ebuild
@@ -47,7 +47,7 @@ else
 	fi
 
 	S="${WORKDIR}/${MY_P}"
-	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="amd64 ~arm arm64 ~loong ~ppc ppc64 ~riscv x86"
 fi
 
 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.7.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.7-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.7.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.7-r1.ebuild
index e2772508cea..0baa28f843d 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.7-r1.ebuild
@@ -178,7 +178,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.9.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.9-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.9.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.9-r1.ebuild
index b2853795f01..cbaab97545c 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.9-r1.ebuild
@@ -178,7 +178,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.2-r2.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.2-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.2-r2.ebuild
index 56ee61fd2f4..db34549fb92 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.2-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.2-r2.ebuild
@@ -178,7 +178,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r2.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r2.ebuild
index 22a0b0889e8..19613bf631f 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r2.ebuild
@@ -47,7 +47,7 @@ else
 	fi
 
 	S="${WORKDIR}/${MY_P}"
-	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="amd64 ~arm arm64 ~loong ~ppc ppc64 ~riscv x86"
 fi
 
 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
@@ -178,7 +178,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.2.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.2-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.2.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.2-r1.ebuild
index cc9db9b0a73..e184adcd746 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.2-r1.ebuild
@@ -177,7 +177,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r3.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r3.ebuild
new file mode 100644
index 00000000000..d2aa81b37ec
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r3.ebuild
@@ -0,0 +1,1001 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
+QEMU_DOCS_PREBUILT_DEV=sam
+QEMU_DOCS_VERSION=$(ver_cut 1-2).0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# bug #830088
+QEMU_DOC_USEFLAG="+doc"
+
+PYTHON_COMPAT=( python3_{11..13} )
+PYTHON_REQ_USE="ensurepip(-),ncurses,readline"
+
+FIRMWARE_ABI_VERSION="7.2.0"
+
+inherit eapi9-ver flag-o-matic linux-info toolchain-funcs python-r1 udev fcaps \
+		readme.gentoo-r1 pax-utils xdg-utils
+
+if [[ ${PV} == *9999* ]]; then
+	QEMU_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
+	EGIT_SUBMODULES=()
+	inherit git-r3
+	SRC_URI=""
+	declare -A SUBPROJECTS=(
+		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
+		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
+		[berkeley-testfloat-3]="e7af9751d9f9fd3b47911f51a5cfd08af256a9ab"
+	)
+
+	for proj in "${!SUBPROJECTS[@]}"; do
+		c=${SUBPROJECTS[${proj}]}
+		SRC_URI+=" https://gitlab.com/qemu-project/${proj}/-/archive/${c}/${proj}-${c}.tar.bz2"
+	done
+else
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+
+	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="amd64 ~arm arm64 ~loong ~ppc ppc64 ~riscv x86"
+fi
+
+DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
+HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
+
+LICENSE="GPL-2 LGPL-2 BSD-2"
+SLOT="0"
+
+[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
+
+IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg keyutils
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs pipewire
+	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
+	+slirp
+	smartcard snappy spice ssh static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte wayland X xattr xdp xen
+	zstd"
+
+COMMON_TARGETS="
+	aarch64
+	alpha
+	arm
+	hppa
+	i386
+	loongarch64
+	m68k
+	microblaze
+	microblazeel
+	mips
+	mips64
+	mips64el
+	mipsel
+	or1k
+	ppc
+	ppc64
+	riscv32
+	riscv64
+	s390x
+	sh4
+	sh4eb
+	sparc
+	sparc64
+	x86_64
+	xtensa
+	xtensaeb
+"
+IUSE_SOFTMMU_TARGETS="
+	${COMMON_TARGETS}
+	avr
+	rx
+	tricore
+"
+IUSE_USER_TARGETS="
+	${COMMON_TARGETS}
+	aarch64_be
+	armeb
+	hexagon
+	mipsn32
+	mipsn32el
+	ppc64le
+	sparc32plus
+"
+
+use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
+use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
+IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
+
+RESTRICT="!test? ( test )"
+
+# Allow no targets to be built so that people can get a tools-only build.
+# Block USE flag configurations known to not work.
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	qemu_softmmu_targets_arm? ( fdt )
+	qemu_softmmu_targets_microblaze? ( fdt )
+	qemu_softmmu_targets_mips64el? ( fdt )
+	qemu_softmmu_targets_ppc64? ( fdt )
+	qemu_softmmu_targets_ppc? ( fdt )
+	qemu_softmmu_targets_riscv32? ( fdt )
+	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
+	sdl-image? ( sdl )
+	static-user? ( !plugins )
+	virgl? ( opengl )
+	virtfs? ( xattr )
+	vnc? ( gnutls )
+	vte? ( gtk )
+	multipath? ( udev )
+	plugins? ( !static-user )
+	xdp? ( bpf )
+"
+for smname in ${IUSE_SOFTMMU_TARGETS} ; do
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( kernel_linux? ( seccomp ) )"
+done
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# and user/softmmu targets (qemu-*, qemu-system-*).
+#
+# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
+#
+# The attr lib isn't always linked in (although the USE flag is always
+# respected).  This is because qemu supports using the C library's API
+# when available rather than always using the external library.
+ALL_DEPEND="
+	dev-libs/glib:2[static-libs(+)]
+	sys-libs/zlib[static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	systemtap? ( dev-debug/systemtap )
+	xattr? ( sys-apps/attr[static-libs(+)] )
+"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# softmmu targets (qemu-system-*).
+SOFTMMU_TOOLS_DEPEND="
+	>=x11-libs/pixman-0.28.0[static-libs(+)]
+	accessibility? (
+		app-accessibility/brltty[api]
+		app-accessibility/brltty[static-libs(+)]
+	)
+	aio? ( dev-libs/libaio[static-libs(+)] )
+	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
+	bzip2? ( app-arch/bzip2[static-libs(+)] )
+	capstone? ( dev-libs/capstone:=[static-libs(+)] )
+	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
+	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
+	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
+	gnutls? (
+		>=net-libs/gnutls-3.0:=[static-libs(+)]
+		dev-libs/nettle:=[static-libs(+)]
+	)
+	gtk? (
+		x11-libs/gtk+:3[wayland?,X?]
+		vte? ( x11-libs/vte:2.91 )
+	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
+	iscsi? ( net-libs/libiscsi )
+	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
+	jack? ( virtual/jack )
+	jemalloc? ( dev-libs/jemalloc )
+	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	kernel_linux? ( sys-libs/libcap-ng[static-libs(+)] )
+	keyutils? ( sys-apps/keyutils[static-libs(+)] )
+	lzo? ( dev-libs/lzo:2[static-libs(+)] )
+	multipath? ( sys-fs/multipath-tools )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)]
+		sys-libs/ncurses:=[static-libs(+)]
+	)
+	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
+	numa? ( sys-process/numactl[static-libs(+)] )
+	opengl? (
+		virtual/opengl
+		media-libs/libepoxy[static-libs(+)]
+		media-libs/mesa[static-libs(+)]
+		media-libs/mesa[egl(+),gbm(+)]
+	)
+	pam? ( sys-libs/pam )
+	pipewire? ( >=media-video/pipewire-0.3.60 )
+	png? ( >=media-libs/libpng-1.6.34:=[static-libs(+)] )
+	pulseaudio? ( media-libs/libpulse )
+	rbd? ( sys-cluster/ceph )
+	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
+	sdl? (
+		media-libs/libsdl2[video]
+		media-libs/libsdl2[static-libs(+)]
+	)
+	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
+	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
+	slirp? ( net-libs/libslirp[static-libs(+)] )
+	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
+	snappy? ( app-arch/snappy:= )
+	spice? (
+		>=app-emulation/spice-protocol-0.14.0
+		>=app-emulation/spice-0.14.0[static-libs(+)]
+	)
+	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
+	udev? ( virtual/libudev:= )
+	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
+	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
+	vde? ( net-misc/vde[static-libs(+)] )
+	virgl? ( media-libs/virglrenderer[static-libs(+)] )
+	virtfs? ( sys-libs/libcap )
+	xdp? ( net-libs/xdp-tools )
+	xen? ( app-emulation/xen-tools:= )
+	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
+"
+
+EDK2_OVMF_VERSION="202202"
+SEABIOS_VERSION="1.16.3"
+
+X86_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
+		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		~sys-firmware/sgabios-0.1_pre10[binary]
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/edk2-${EDK2_OVMF_VERSION}
+			>=sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
+		)
+		sys-firmware/ipxe[qemu]
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+		sys-firmware/sgabios
+	)
+"
+PPC_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+	)
+"
+
+# See bug #913084 for pip dep
+BDEPEND="
+	$(python_gen_impl_dep)
+	dev-lang/perl
+	>=dev-build/meson-0.63.0
+	app-alternatives/ninja
+	virtual/pkgconfig
+	doc? (
+		>=dev-python/sphinx-1.6.0[${PYTHON_USEDEP}]
+		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+	)
+	gtk? ( nls? ( sys-devel/gettext ) )
+	test? (
+		app-alternatives/bc
+		dev-libs/glib[utils]
+		dev-python/pycotap[${PYTHON_USEDEP}]
+	)
+"
+CDEPEND="
+	${ALL_DEPEND//\[static-libs(+)]}
+	${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
+	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
+"
+DEPEND="
+	${CDEPEND}
+	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
+	static-user? ( ${ALL_DEPEND} )
+"
+RDEPEND="
+	${CDEPEND}
+	acct-group/kvm
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-9.0.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-9.2.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
+	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
+	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
+	"${FILESDIR}"/${PN}-9.2.3-virtio-net.patch
+)
+
+QA_PREBUILT="
+	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/hppa-firmware64.img
+	usr/share/qemu/openbios-ppc
+	usr/share/qemu/openbios-sparc64
+	usr/share/qemu/openbios-sparc32
+	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
+	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
+	usr/share/qemu/palcode-clipper
+	usr/share/qemu/s390-ccw.img
+	usr/share/qemu/s390-netboot.img
+	usr/share/qemu/u-boot.e500
+"
+
+QA_WX_LOAD="
+	usr/bin/qemu-i386
+	usr/bin/qemu-x86_64
+	usr/bin/qemu-alpha
+	usr/bin/qemu-arm
+	usr/bin/qemu-cris
+	usr/bin/qemu-m68k
+	usr/bin/qemu-microblaze
+	usr/bin/qemu-microblazeel
+	usr/bin/qemu-mips
+	usr/bin/qemu-mipsel
+	usr/bin/qemu-or1k
+	usr/bin/qemu-ppc
+	usr/bin/qemu-ppc64
+	usr/bin/qemu-sh4
+	usr/bin/qemu-sh4eb
+	usr/bin/qemu-sparc
+	usr/bin/qemu-sparc64
+	usr/bin/qemu-armeb
+	usr/bin/qemu-sparc32plus
+	usr/bin/qemu-s390x
+	usr/bin/qemu-unicore32
+"
+
+DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
+kernel module loaded before running kvm. The easiest way to ensure that the
+kernel module is loaded is to load it on boot.
+	For AMD CPUs the module is called 'kvm-amd'.
+	For Intel CPUs the module is called 'kvm-intel'.
+Please review /etc/conf.d/modules for how to load these.
+
+Make sure your user is in the 'kvm' group. Just run
+	$ gpasswd -a <USER> kvm
+then have <USER> re-login.
+
+For brand new installs, the default permissions on /dev/kvm might not let
+you access it.  You can tell udev to reset ownership/perms:
+	$ udevadm trigger -c add /dev/kvm
+
+If you want to register binfmt handlers for qemu user targets:
+For openrc:
+	# rc-update add qemu-binfmt
+For systemd:
+	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
+
+pkg_pretend() {
+	if use kernel_linux && kernel_is lt 2 6 25; then
+		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
+	elif use kernel_linux; then
+		if ! linux_config_exists; then
+			eerror "Unable to check your kernel for KVM support"
+		else
+			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
+			ERROR_KVM="You must enable KVM in your kernel to continue"
+			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
+			ERROR_KVM_AMD+=" your kernel configuration."
+			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
+			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
+			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
+			ERROR_TUN+=" into your kernel or loaded as a module to use the"
+			ERROR_TUN+=" virtual network device if using -net tap."
+			ERROR_BRIDGE="You will also need support for 802.1d"
+			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
+			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
+			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
+			ERROR_VHOST_NET+=" support"
+			use test && CONFIG_CHECK+=" IP_MULTICAST"
+			ERROR_IP_MULTICAST="Test suite requires IP_MULTICAST"
+
+			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
+				if grep -q AuthenticAMD /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_AMD"
+				elif grep -q GenuineIntel /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_INTEL"
+				fi
+			fi
+
+			use python && CONFIG_CHECK+=" ~DEBUG_FS"
+			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
+
+			# Now do the actual checks setup above
+			check_extra_config
+		fi
+	fi
+
+	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
+		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
+		eerror "instances are still pointing to it.  Please update your"
+		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
+		eerror "and the right system binary (e.g. qemu-system-x86_64)."
+		die "update your virt configs to not use qemu-kvm"
+	fi
+}
+
+# Sanity check to make sure target lists are kept up-to-date.
+check_targets() {
+	local var=$1 mak=$2
+	local detected sorted
+
+	pushd "${S}"/configs/targets/ >/dev/null || die
+
+	# Force C locale until glibc is updated. #564936
+	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
+	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
+	if [[ ${sorted} != "${detected}" ]] ; then
+		eerror "The ebuild needs to be kept in sync."
+		eerror "${var}: ${sorted}"
+		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
+		die "sync ${var} to the list of targets"
+	fi
+
+	popd >/dev/null
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		for file in ${A}; do
+			unpack "${file}"
+		done
+		cd "${WORKDIR}" || die
+		for proj in "${!SUBPROJECTS[@]}"; do
+			mv "${proj}-${SUBPROJECTS[${proj}]}" "${S}/subprojects/${proj}" || die
+		done
+		cd "${S}" || die
+		meson subprojects packagefiles --apply || die
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	check_targets IUSE_SOFTMMU_TARGETS softmmu
+	check_targets IUSE_USER_TARGETS linux-user
+
+	default
+
+	# Use correct toolchain to fix cross-compiling
+	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
+	export WINDRES=${CHOST}-windres
+
+	# defang automagic dependencies
+	use X || append-flags -DGENTOO_GTK_HIDE_X11
+	use wayland || append-flags -DGENTOO_GTK_HIDE_WAYLAND
+
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		cat >> "${S}"/configs/meson/linux.txt <<-EOF || die
+		[binaries]
+		dtrace='stap-dtrace'
+		EOF
+	fi
+
+	# Verbose builds
+	MAKEOPTS+=" V=1"
+
+	# Remove bundled modules
+	rm -r roms/*/ || die
+}
+
+##
+# configures qemu based on the build directory and the build type
+# we are using.
+#
+qemu_src_configure() {
+	debug-print-function ${FUNCNAME} "$@"
+
+	local buildtype=$1
+	local builddir="${S}/${buildtype}-build"
+
+	mkdir "${builddir}" || die
+
+	local conf_opts=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--bindir=/usr/bin
+		--libdir=/usr/$(get_libdir)
+		--datadir=/usr/share
+		--docdir=/usr/share/doc/${PF}/html
+		--mandir=/usr/share/man
+		--localstatedir=/var
+		--disable-bsd-user
+		--disable-containers # bug #732972
+		--disable-guest-agent
+		--disable-strip
+		--disable-download
+		--python="${PYTHON}"
+
+		# bug #746752: TCG interpreter has a few limitations:
+		# - it does not support FPU
+		# - it's generally slower on non-self-modifying code
+		# It's advantage is support for host architectures
+		# where native codegeneration is not implemented.
+		# Gentoo has qemu keyworded only on targets with
+		# native code generation available. Avoid the interpreter.
+		--disable-tcg-interpreter
+
+		--disable-werror
+		# We support gnutls/nettle for crypto operations.  It is possible
+		# to use gcrypt when gnutls/nettle are disabled (but not when they
+		# are enabled), but it's not really worth the hassle.  Disable it
+		# all the time to avoid automatically detecting it. #568856
+		--disable-gcrypt
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--objcc="$(tc-getCC)"
+		--host-cc="$(tc-getBUILD_CC)"
+
+		$(use_enable alsa)
+		$(use_enable debug debug-info)
+		$(use_enable debug debug-tcg)
+		$(use_enable jack)
+		$(use_enable nls gettext)
+		$(use_enable oss)
+		$(use_enable pipewire)
+		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
+		$(use_enable xattr attr)
+	)
+
+	# Disable options not used by user targets. This simplifies building
+	# static user targets (USE=static-user) considerably.
+	conf_notuser() {
+		if [[ ${buildtype} == "user" ]] ; then
+			echo "--disable-${2:-$1}"
+		else
+			use_enable "$@"
+		fi
+	}
+	# Enable option only for softmmu build, but not 'user' or 'tools'
+	conf_softmmu() {
+		if [[ ${buildtype} == "softmmu" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Enable option only for tools build, but not 'user' or 'softmmu'
+	conf_tools() {
+		if [[ ${buildtype} == "tools" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
+	conf_opts+=(
+		$(conf_notuser accessibility brlapi)
+		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
+		$(conf_notuser bzip2)
+		$(conf_notuser capstone)
+		$(conf_notuser curl)
+		$(conf_tools doc docs)
+		$(conf_notuser fdt)
+		$(conf_notuser fuse)
+		$(conf_notuser glusterfs)
+		$(conf_notuser gnutls)
+		$(conf_notuser gnutls nettle)
+		$(conf_notuser gtk)
+		$(conf_notuser infiniband rdma)
+		$(conf_notuser iscsi libiscsi)
+		$(conf_notuser io-uring linux-io-uring)
+		$(conf_malloc jemalloc)
+		$(conf_notuser jpeg vnc-jpeg)
+		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser keyutils libkeyutils)
+		$(conf_notuser lzo)
+		$(conf_notuser multipath mpath)
+		$(conf_notuser ncurses curses)
+		$(conf_notuser nfs libnfs)
+		$(conf_notuser numa)
+		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
+		$(conf_notuser png)
+		$(conf_notuser rbd)
+		$(conf_notuser sasl vnc-sasl)
+		$(conf_notuser sdl)
+		$(conf_softmmu sdl-image)
+		$(conf_notuser seccomp)
+		$(conf_notuser slirp)
+		$(conf_notuser smartcard)
+		$(conf_notuser snappy)
+		$(conf_notuser spice)
+		$(conf_notuser ssh libssh)
+		$(conf_notuser udev libudev)
+		$(conf_notuser usb libusb)
+		$(conf_notuser usbredir usb-redir)
+		$(conf_notuser vde)
+		$(conf_notuser vhost-net)
+		$(conf_notuser virgl virglrenderer)
+		$(conf_softmmu virtfs)
+		$(conf_notuser vnc)
+		$(conf_notuser vte)
+		$(conf_softmmu xdp af-xdp)
+		$(conf_notuser xen)
+		$(conf_notuser xen xen-pci-passthrough)
+		# use prebuilt keymaps, bug #759604
+		--disable-xkbcommon
+		$(conf_notuser zstd)
+	)
+
+	if [[ ! ${buildtype} == "user" ]] ; then
+		# audio options
+		local audio_opts=(
+			# Note: backend order matters here: #716202
+			# We iterate from higher-level to lower level.
+			$(usex pulseaudio pa "")
+			$(usev pipewire)
+			$(usev jack)
+			$(usev sdl)
+			$(usev alsa)
+			$(usev oss)
+		)
+		conf_opts+=(
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
+		)
+	fi
+
+	case ${buildtype} in
+	user)
+		conf_opts+=(
+			--enable-linux-user
+			--disable-system
+			--disable-tools
+			--disable-cap-ng
+			--disable-seccomp
+		)
+		local static_flag="static-user"
+		;;
+	softmmu)
+		conf_opts+=(
+			--disable-linux-user
+			--enable-system
+			--disable-tools
+			--enable-cap-ng
+			--enable-seccomp
+			--disable-libcbor
+		)
+		local static_flag="none"
+		;;
+	tools)
+		conf_opts+=(
+			--disable-linux-user
+			--disable-system
+			--enable-tools
+			--enable-cap-ng
+		)
+		local static_flag="none"
+		;;
+	esac
+
+	local targets="${buildtype}_targets"
+	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
+
+	# Add support for SystemTap
+	use systemtap && conf_opts+=( --enable-trace-backends="dtrace" )
+
+	# We always want to attempt to build with PIE support as it results
+	# in a more secure binary. But it doesn't work with static or if
+	# the current GCC doesn't have PIE support.
+	if [[ ${static_flag} != "none" ]] && use ${static_flag}; then
+		conf_opts+=( --static --disable-pie )
+	else
+		tc-enables-pie && conf_opts+=( --enable-pie )
+	fi
+
+	# Meson will not use a cross-file unless cross_prefix is set.
+	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
+
+	# Plumb through equivalent of EXTRA_ECONF to allow experiments
+	# like bug #747928.
+	conf_opts+=( ${EXTRA_CONF_QEMU} )
+
+	echo "../configure ${conf_opts[*]}"
+	cd "${builddir}"
+	../configure "${conf_opts[@]}" || die "configure failed"
+}
+
+src_configure() {
+	local target
+
+	python_setup
+
+	softmmu_targets= softmmu_bins=()
+	user_targets= user_bins=()
+
+	for target in ${IUSE_SOFTMMU_TARGETS} ; do
+		if use "qemu_softmmu_targets_${target}"; then
+			softmmu_targets+=",${target}-softmmu"
+			softmmu_bins+=( "qemu-system-${target}" )
+		fi
+	done
+
+	for target in ${IUSE_USER_TARGETS} ; do
+		if use "qemu_user_targets_${target}"; then
+			user_targets+=",${target}-linux-user"
+			user_bins+=( "qemu-${target}" )
+		fi
+	done
+
+	softmmu_targets=${softmmu_targets#,}
+	user_targets=${user_targets#,}
+
+	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
+	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
+	qemu_src_configure "tools"
+}
+
+src_compile() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build" || die
+		default
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		default
+	fi
+
+	cd "${S}/tools-build" || die
+	default
+}
+
+src_test() {
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		pax-mark m */qemu-system-* #515550
+		emake check
+	fi
+}
+
+qemu_python_install() {
+	python_domodule "${S}/python/qemu"
+
+	python_doscript "${S}/scripts/kvm/vmxcap"
+	python_doscript "${S}/scripts/qmp/qmp-shell"
+	python_doscript "${S}/scripts/qmp/qemu-ga-client"
+}
+
+# Generate binfmt support files.
+#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
+#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
+generate_initd() {
+	local out="${T}/qemu-binfmt"
+	local out_systemd="${T}/qemu.conf"
+	local d="${T}/binfmt.d"
+
+	einfo "Generating qemu binfmt scripts and configuration files"
+
+	# Generate the debian fragments first.
+	mkdir -p "${d}"
+	"${S}"/scripts/qemu-binfmt-conf.sh \
+		--debian \
+		--exportdir "${d}" \
+		--qemu-path "${EPREFIX}/usr/bin" \
+		|| die
+	# Then turn the fragments into a shell script we can source.
+	sed -E -i \
+		-e 's:^([^ ]+) (.*)$:\1="\2":' \
+		"${d}"/* || die
+
+	# Generate the init.d script by assembling the fragments from above.
+	local f qcpu package interpreter magic mask
+	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
+	for f in "${d}"/qemu-* ; do
+		source "${f}"
+
+		# Normalize the cpu logic like we do in the init.d for the native cpu.
+		qcpu=${package#qemu-}
+		case ${qcpu} in
+		arm*)   qcpu="arm";;
+		mips*)  qcpu="mips";;
+		ppc*)   qcpu="ppc";;
+		s390*)  qcpu="s390";;
+		sh*)    qcpu="sh";;
+		sparc*) qcpu="sparc";;
+		esac
+
+		# we use 'printf' here to be portable across 'sh'
+		# implementations: #679168
+		cat <<EOF >>"${out}"
+	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
+		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
+	fi
+EOF
+
+		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
+
+	done
+	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
+}
+
+src_install() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		emake DESTDIR="${ED}" install
+
+		# Install binfmt handler init script for user targets.
+		generate_initd
+		doinitd "${T}/qemu-binfmt"
+
+		# Install binfmt/qemu.conf.
+		insinto "/usr/share/qemu/binfmt.d"
+		doins "${T}/qemu.conf"
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		emake DESTDIR="${ED}" install
+
+		# This might not exist if the test failed. #512010
+		[[ -e check-report.html ]] && dodoc check-report.html
+
+		if use kernel_linux; then
+			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
+		fi
+
+		if use python; then
+			python_foreach_impl qemu_python_install
+		fi
+	fi
+
+	cd "${S}/tools-build" || die
+	emake DESTDIR="${ED}" install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
+	fi
+
+	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
+	pushd "${ED}"/usr/bin >/dev/null || die
+	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
+	popd >/dev/null || die
+
+	# Install config file example for qemu-bridge-helper
+	insinto "/etc/qemu"
+	doins "${FILESDIR}/bridge.conf"
+
+	cd "${S}" || die
+	dodoc MAINTAINERS
+	newdoc pc-bios/README README.pc-bios
+
+	# Disallow stripping of prebuilt firmware files.
+	dostrip -x ${QA_PREBUILT}
+
+	if [[ -n ${softmmu_targets} ]]; then
+		# Remove SeaBIOS since we're using the SeaBIOS packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
+		fi
+
+		# Remove vgabios since we're using the seavgabios packaged one
+		rm "${ED}/usr/share/qemu/vgabios.bin"
+		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
+		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
+		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
+		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
+		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
+
+		# PPC/PPC64 loads vgabios-stdvga
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
+			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
+			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
+			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
+			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
+			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
+			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
+		fi
+
+		# Remove sgabios since we're using the sgabios packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
+		fi
+
+		# Remove iPXE since we're using the iPXE packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
+			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
+			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
+			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
+			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
+			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
+		fi
+	fi
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+pkg_postinst() {
+	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
+		udev_reload
+	fi
+
+	xdg_icon_cache_update
+
+	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
+		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_print_elog
+
+	if use pin-upstream-blobs && ver_replacing -lt ${FIRMWARE_ABI_VERSION}; then
+		ewarn "This version of qemu pins new versions of firmware blobs:"
+
+		if has_version 'sys-firmware/edk2-bin'; then
+			ewarn "	$(best_version sys-firmware/edk2-bin)"
+		else
+			ewarn " $(best_version sys-firmware/edk2)"
+		fi
+
+		if has_version 'sys-firmware/seabios-bin'; then
+			ewarn "	$(best_version sys-firmware/seabios-bin)"
+		else
+			ewarn " $(best_version sys-firmware/seabios)"
+		fi
+
+		ewarn "	$(best_version sys-firmware/ipxe)"
+		ewarn "	$(best_version sys-firmware/sgabios)"
+		ewarn "This might break resume of hibernated guests (started with a different"
+		ewarn "firmware version) and live migration to/from qemu versions with different"
+		ewarn "firmware. Please (cold) restart all running guests. For functional"
+		ewarn "guest migration ensure that all"
+		ewarn "hosts run at least"
+		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
+	fi
+}
+
+pkg_info() {
+	echo "Using:"
+	echo "  $(best_version app-emulation/spice-protocol)"
+
+	if has_version 'sys-firmware/edk2-bin'; then
+		echo "  $(best_version sys-firmware/edk2-bin)"
+	else
+		echo "  $(best_version sys-firmware/edk2)"
+	fi
+
+	if has_version 'sys-firmware/seabios-bin'; then
+		echo "  $(best_version sys-firmware/seabios-bin)"
+	else
+		echo "  $(best_version sys-firmware/seabios)"
+	fi
+
+	echo "  $(best_version sys-firmware/ipxe)"
+	echo "  $(best_version sys-firmware/sgabios)"
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
index da8cc2f4a1e..a53f9732ac1 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
@@ -177,7 +177,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
@@ -320,7 +320,7 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-9.2.0-capstone-include-path.patch
 	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
 	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
-
+	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
 )
 
 QA_PREBUILT="

From 16c2a00ffabf2f75666b5a0cd113050210a7dcda Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:07 +0000
Subject: [PATCH 008/136] app-shells/bash: Sync with Gentoo

It's from Gentoo commit b614863f02f4b89e7e178ff79784d9a8b581bf13.
---
 .../portage-stable/app-shells/bash/Manifest   |   4 +-
 .../app-shells/bash/bash-5.2_p37-r1.ebuild    | 408 -----------------
 ...2_p37-r2.ebuild => bash-5.2_p37-r3.ebuild} |   0
 .../app-shells/bash/bash-5.3_rc1.ebuild       |   1 +
 .../bash/bash-5.3_rc1_p20250419.ebuild        | 410 ------------------
 .../bash/bash-5.3_rc1_p20250422.ebuild        | 410 ------------------
 ...build => bash-5.3_rc1_p20250430-r1.ebuild} |  10 +-
 ...build => bash-5.3_rc1_p20250504-r1.ebuild} |  14 +-
 .../app-shells/bash/bash-9999.ebuild          |  11 +-
 ...roneous-delimiter-pushback-condition.patch |   6 +-
 ...inuation-byte-ignored-as-delimiter-2.patch |  19 +-
 .../files/bashrc.d/10-gentoo-color-r1.bash    |  73 ----
 12 files changed, 31 insertions(+), 1335 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r1.ebuild
 rename sdk_container/src/third_party/portage-stable/app-shells/bash/{bash-5.2_p37-r2.ebuild => bash-5.2_p37-r3.ebuild} (100%)
 delete mode 100644 sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250419.ebuild
 delete mode 100644 sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250422.ebuild
 rename sdk_container/src/third_party/portage-stable/app-shells/bash/{bash-5.3_rc1_p20250430.ebuild => bash-5.3_rc1_p20250430-r1.ebuild} (97%)
 rename sdk_container/src/third_party/portage-stable/app-shells/bash/{bash-5.3_rc1_p20250409.ebuild => bash-5.3_rc1_p20250504-r1.ebuild} (96%)
 delete mode 100644 sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc.d/10-gentoo-color-r1.bash

diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest b/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
index 8134a3ebcfe..8105eb517cd 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
@@ -24,10 +24,8 @@ DIST bash-5.2.tar.gz 10950833 BLAKE2B 51b196e710794ebad8eac28c31c93eb99ac1a7db30
 DIST bash-5.2.tar.gz.sig 95 BLAKE2B 2991b7c46ef1cdca08062f419be47fca7551f4c5d9aad8a5c1da74974f5e7707d23914b4cecf9b6c9610471146b2c49b611bb62a5d974f1c37cceb77b719851c SHA512 a161664f124f906be32709f66702f8f780e6d52e558ea45e71ec60a959c9435ff68477ee65a0a9f6c0051d5592f5044fb3b410cf3cd3ae5a8a323789b01be258
 DIST bash-5.3-rc1.tar.gz 10742642 BLAKE2B 846414fe545da1ee62b541a8861d68e1dc57114276d40c6af2a9ab1f91cedb220d060f1bd81a811d6dacd841cd1b66e0ed7d8462b3c7066ad204f3786d6af0ec SHA512 16a74fcb31a8ea20cf9505a8cee584a02baed1d2c47b75556e4ae6752712db8f9e0b4b202d2cbe77990fec1ff141ff35e410d4495887ed90f5457c032079c5e5
 DIST bash-5.3-rc1.tar.gz.sig 95 BLAKE2B cc7916f92eddd881ac4d791918b7bb579396df4badbd671a7d0664fd814cee37327dce31d288a8fb03bc66a23536873b5fcd72f2e08e294b9ff9f2ef889741e3 SHA512 a275ff17f9318b5626450eeeb9f49157c9b20df974e004adb26f6585c84deea8d68fc0e1670f990096675ecadd652b58895f74c4e40c8e142a3c2ed414145248
-DIST bash-5.3_rc1_p20250409-42c6cbd459a121e98d9ac43c477a5daf6c3d4f0c.tar.gz 15866668 BLAKE2B 472b67d397dd0f4ba070d4899bb1ecde08a90a7d2f5fc16b8f79c7113d2ca66cbc353e128ace17128069ebc7f8560605dda1441019174a942abb0dd345629746 SHA512 43614445ac11d25258ba6c47f020a1b87d8fa33b139e4d2237683ea0465bf24b03cf84e7e2771de4b038bbecab44c923bb307e4a60b9590b42936ea4e7c86e73
-DIST bash-5.3_rc1_p20250419-482872ed8b51408066c3275a18350436f4d0ee41.tar.gz 16004323 BLAKE2B 936b2bf45e90be658105a2755b9a0be046cd5ae50b6d34624ff20199fa93c1de4a8f9ab669c2c9cf86e2e4d6379f124d91141354d41d437536931cd157491626 SHA512 f04eb6c45124a66fc894c4a1f217351a0247ddd870cfcbbcd01bcff77369d022c6ca82f693c6f2fcd035ce5a67ab3fdbc902b30a4c76e84fdaddd25eeb7c407f
-DIST bash-5.3_rc1_p20250422-7731dc5c4d405ab147fc562e3af2a375ca593554.tar.gz 15996966 BLAKE2B 6a9c720b2747ccff7d8d198354163b6e0645b8a8e436a65e5d1f86ad509b8f197d95ba7cd4097ec4558911d73f98817da65f90a879215b8ad243388e1fdd75df SHA512 21847abf8019776f310c1de8f7469823c233039fa95ca1f872071580f917c728ac767f6daa778dfcfa0fd7583edf07b7928075d5086f3711d68a45ea3133857f
 DIST bash-5.3_rc1_p20250430-15df5993542463ba9798e4ea5e488dfddf83c276.tar.gz 15996459 BLAKE2B 013768ddce578a50845f1709a276b80474999e83172d32d4ba1978a795c17fbd2c77d3812a631ade937afa9a0850ee40f45dcd8b02251fce8c3d0619b82de33d SHA512 e86edefd13e9863c059411587377393b5dc290bf42d1bb5f3684e4a881a0ea10f554b22752f3632b1fc29ff8be08ec1ace8f729639b55ec97eb77968886856fd
+DIST bash-5.3_rc1_p20250504-535a8150b65ee6888f54f602274dbbdcd77c788e.tar.gz 15998986 BLAKE2B 61591119702903fdaf52ce143299c136b77c435315f368d4ea1b0ba9b2cf8dd390859d5ae250fe381b285d96be6bf66464ecdb34f86ca0d2dd8dfbcfe8308130 SHA512 3ff4ad11a716318b429806cf859fd5d2f7e63948f0f53386a09ef915851c27da47f7f7a61d3b35fe586d08825e3db0c78e44401de66408ae282483d85470cc26
 DIST bash205b-001 1132 BLAKE2B 0c5eef29777d54ef05957ea3d63b1556fb380bd20c238dc28993d822b37bc4e78ff4048ad069f6b8cd25da77ccdeb7aecd86c4349cb9d81e5e94c7001eeae5e6 SHA512 5ce4357468821b05e747201f3aa57225ad8f540c9e2c87051720490e039c30b478b9b662a68f14a0800fefe40184e4495e2645665200f9d75e9a115b2ac08071
 DIST bash205b-002 755 BLAKE2B 6a6ed5679d451f02f8104b345c1722d11718ce3b4043b581c17786d40d8da69a34786fb56d0c363dba277b8e9dd33f12f70c9cc73a9fc39ba4a8319406f0458d SHA512 46947b0229478d5c2cfeff68b8ebc00e4ef0c8b94e336ca12f72b4490ba3622c0240c01c17c1641c3b07adc2c64ec94d6d780365e8990768ec8888f3a9526883
 DIST bash205b-003 2356 BLAKE2B b7887d00d92fd298cd07a15e1c73b516dabd22ecd74c97091636dd97a0cd55024ed698e5cc924c4311d994dd326b1ad074bea35e7650cf9cf4e25c60d2713fa7 SHA512 74528ca5d165b812d299f1c69b47757bd677c0b22ce4217e155cd641708b02364a93c6709fb57b546b376b36da74429a61493921c7c199563da40ddcf1c1f399
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r1.ebuild
deleted file mode 100644
index b3ac276e72d..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r1.ebuild
+++ /dev/null
@@ -1,408 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
-inherit flag-o-matic toolchain-funcs prefix verify-sig
-
-# Uncomment if we have a patchset.
-#GENTOO_PATCH_DEV="sam"
-#GENTOO_PATCH_VER="${PV}"
-
-MY_PV=${PV/_p*}
-MY_PV=${MY_PV/_/-}
-MY_P=${PN}-${MY_PV}
-MY_PATCHES=()
-
-# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
-case ${PV} in
-	*_p*)
-		PLEVEL=${PV##*_p}
-		;;
-	9999|*_alpha*|*_beta*|*_rc*)
-		# Set a negative patchlevel to indicate that it's a pre-release.
-		PLEVEL=-1
-		;;
-	*)
-		PLEVEL=0
-esac
-
-# The version of readline this bash normally ships with. Note that we only use
-# the bundled copy of readline for pre-releases.
-READLINE_VER="8.2_p1"
-
-DESCRIPTION="The standard GNU Bourne again shell"
-HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
-
-if [[ ${PV} == 9999 ]]; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
-	EGIT_BRANCH=devel
-	inherit git-r3
-else
-	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
-
-	# bash-5.1 -> bash51
-	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
-
-	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
-		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
-		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
-		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
-	done
-
-	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
-
-	unset -v my_urls my_p my_patch_idx my_patch_ver
-fi
-
-if [[ ${GENTOO_PATCH_VER} ]]; then
-	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
-fi
-
-S=${WORKDIR}/${MY_P}
-
-LICENSE="GPL-3+"
-SLOT="0"
-if (( PLEVEL >= 0 )); then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
-
-DEPEND="
-	>=sys-libs/ncurses-5.2-r2:=
-	nls? ( virtual/libintl )
-"
-if (( PLEVEL >= 0 )); then
-	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
-fi
-RDEPEND="
-	${DEPEND}
-"
-# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
-BDEPEND="
-	pgo? ( dev-util/gperf )
-	verify-sig? ( sec-keys/openpgp-keys-chetramey )
-"
-
-# EAPI 8 tries to append it but it doesn't exist here.
-QA_CONFIGURE_OPTIONS="--disable-static"
-
-PATCHES=(
-	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
-
-	# Patches to or from Chet, posted to the bug-bash mailing list.
-	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
-	"${FILESDIR}/${PN}-5.2_p15-random-ub.patch"
-	"${FILESDIR}/${PN}-5.2_p15-configure-clang16.patch"
-	"${FILESDIR}/${PN}-5.2_p21-wpointer-to-int.patch"
-	"${FILESDIR}/${PN}-5.2_p32-memory-leaks.patch"
-	"${FILESDIR}/${PN}-5.2_p32-invalid-continuation-byte-ignored-as-delimiter-1.patch"
-	"${FILESDIR}/${PN}-5.2_p32-invalid-continuation-byte-ignored-as-delimiter-2.patch"
-	"${FILESDIR}/${PN}-5.2_p32-erroneous-delimiter-pushback-condition.patch"
-)
-
-pkg_setup() {
-	# bug #7332
-	if is-flag -malign-double; then
-		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
-		eerror "as it breaks LFS (struct stat64) on x86."
-		die "remove -malign-double from your CFLAGS mr ricer"
-	fi
-
-	if use bashlogger; then
-		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
-		ewarn "This will log ALL output you enter into the shell, you have been warned."
-	fi
-}
-
-src_unpack() {
-	local patch
-
-	if [[ ${PV} == 9999 ]]; then
-		git-r3_src_unpack
-	else
-		if use verify-sig; then
-			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
-
-			for patch in "${MY_PATCHES[@]}"; do
-				verify-sig_verify_detached "${patch}"{,.sig}
-			done
-		fi
-
-		unpack "${MY_P}.tar.gz"
-
-		if [[ ${GENTOO_PATCH_VER} ]]; then
-			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
-		fi
-	fi
-}
-
-src_prepare() {
-	# Include official patches.
-	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
-
-	# Clean out local libs so we know we use system ones w/releases. The
-	# touch utility is invoked for the benefit of config.status.
-	if (( PLEVEL >= 0 )); then
-		rm -rf lib/{readline,termcap}/* \
-		&& touch lib/{readline,termcap}/Makefile.in \
-		&& sed -i -E 's:\$[{(](RL|HIST)_LIBSRC[)}]/[[:alpha:]_-]*\.h::g' Makefile.in \
-		|| die
-	fi
-
-	# Prefixify hardcoded path names. No-op for non-prefix.
-	hprefixify pathnames.h.in
-
-	# Avoid regenerating docs after patches, bug #407985.
-	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
-	&& touch -r . doc/* \
-	|| die
-
-	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
-	rm tests/run-jobs || die
-
-	eapply -p0 "${PATCHES[@]}"
-	eapply_user
-}
-
-src_configure() {
-	local -a myconf
-
-	# Upstream only test with Bison and require GNUisms like YYEOF and
-	# YYERRCODE. The former at least may be in POSIX soon:
-	# https://www.austingroupbugs.net/view.php?id=1269.
-	# configure warns on use of non-Bison but doesn't abort. The result
-	# may misbehave at runtime.
-	unset -v YACC
-
-	# bash 5.3 drops unprototyped functions, earlier versions are
-	# incompatible with C23.
-	append-cflags $(test-flags-CC -std=gnu17)
-
-	myconf=(
-		--disable-profiling
-
-		# Force linking with system curses ... the bundled termcap lib
-		# sucks bad compared to ncurses.  For the most part, ncurses
-		# is here because readline needs it.  But bash itself calls
-		# ncurses in one or two small places :(.
-		--with-curses
-
-		$(use_enable mem-scramble)
-		$(use_enable net net-redirections)
-		$(use_enable readline)
-		$(use_enable readline bang-history)
-		$(use_enable readline history)
-		$(use_with afs)
-		$(use_with mem-scramble bash-malloc)
-	)
-
-	# For descriptions of these, see config-top.h.
-	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
-	append-cppflags \
-		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
-		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
-		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
-		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
-		-DNON_INTERACTIVE_LOGIN_SHELLS \
-		-DSSH_SOURCE_BASHRC \
-		$(use bashlogger && echo -DSYSLOG_HISTORY)
-
-	use nls || myconf+=( --disable-nls )
-
-	if (( PLEVEL >= 0 )); then
-		# Historically, we always used the builtin readline, but since
-		# our handling of SONAME upgrades has gotten much more stable
-		# in the PM (and the readline ebuild itself preserves the old
-		# libs during upgrades), linking against the system copy should
-		# be safe.
-		# Exact cached version here doesn't really matter as long as it
-		# is at least what's in the DEPEND up above.
-		export ac_cv_rl_version=${READLINE_VER%%_*}
-
-		# Use system readline only with released versions.
-		myconf+=( --with-installed-readline=. )
-	fi
-
-	if use plugins; then
-		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
-	else
-		# Disable the plugins logic by hand since bash doesn't provide
-		# a way of doing it.
-		export ac_cv_func_dl{close,open,sym}=no \
-			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
-
-		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
-	fi
-
-	# bug #444070
-	tc-export AR
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	local -a pgo_generate_flags pgo_use_flags
-	local flag
-
-	# -fprofile-partial-training because upstream notes the test suite isn't
-	# super comprehensive.
-	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
-	if use pgo; then
-		pgo_generate_flags=(
-			-fprofile-update=atomic
-			-fprofile-dir="${T}"/pgo
-			-fprofile-generate="${T}"/pgo
-		)
-		pgo_use_flags=(
-			-fprofile-use="${T}"/pgo
-			-fprofile-dir="${T}"/pgo
-		)
-		if flag=$(test-flags-CC -fprofile-partial-training); then
-			pgo_generate_flags+=( "${flag}" )
-			pgo_use_flags+=( "${flag}" )
-		fi
-	fi
-
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
-	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
-
-	# Build Bash and run its tests to generate profiles.
-	if (( ${#pgo_generate_flags[@]} )); then
-		# Used in test suite.
-		unset -v A
-
-		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
-
-		if tc-is-clang; then
-			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
-		fi
-
-		# Rebuild Bash using the profiling data we just generated.
-		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
-		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
-	fi
-}
-
-src_test() {
-	# Used in test suite.
-	unset -v A
-
-	default
-}
-
-src_install() {
-	local d f
-
-	default
-
-	my_prefixify() {
-		while read -r; do
-			if [[ $REPLY == *$1* ]]; then
-				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
-			fi
-			printf '%s\n' "${REPLY}" || ! break
-		done < "$2" || die
-	}
-
-	dodir /bin
-	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
-	dosym bash /bin/rbash
-
-	insinto /etc/bash
-	doins "${FILESDIR}"/bash_logout
-	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
-
-	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r1.bash | newins - 10-gentoo-color.bash
-	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
-	if [[ ! ${EPREFIX} ]]; then
-		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
-	fi
-
-	insinto /etc/skel
-	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
-	done
-
-	if use plugins; then
-		exeinto "/usr/$(get_libdir)/bash"
-		set -- examples/loadables/*.o
-		doexe "${@%.o}"
-
-		insinto /usr/include/bash-plugins
-		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
-	fi
-
-	if use examples; then
-		for d in examples/{functions,misc,scripts,startup-files}; do
-			exeinto "/usr/share/doc/${PF}/${d}"
-			docinto "${d}"
-			for f in "${d}"/*; do
-				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
-					doexe "${f}"
-				else
-					dodoc "${f}"
-				fi
-			done
-		done
-	fi
-
-	# Install bash_builtins.1 and rbash.1.
-	emake -C doc DESTDIR="${D}" install_builtins
-	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
-	doman "${T}"/rbash.1
-
-	newdoc CWRU/changelog ChangeLog
-	dosym bash.info /usr/share/info/bashref.info
-}
-
-pkg_preinst() {
-	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
-		mkdir -p -- "${EROOT}"/etc/bash \
-		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
-		|| die
-	fi
-}
-
-pkg_postinst() {
-	local old_ver
-
-	# If /bin/sh does not exist, provide it.
-	if [[ ! -e ${EROOT}/bin/sh ]]; then
-		ln -sf -- bash "${EROOT}"/bin/sh || die
-	fi
-
-	read -r old_ver <<<"${REPLACING_VERSIONS}"
-	if [[ ! $old_ver ]]; then
-		:
-	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
-		return
-	fi
-
-	while read -r; do ewarn "${REPLY}"; done <<'EOF'
-Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
-
-Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
-characteristics of the operating environment, it may contain a command to set
-the terminal's window title. Those who were already choosing to customise the
-PROMPT_COMMAND variable are now advised to append their commands like so:
-
-PROMPT_COMMAND+=('custom command goes here')
-
-Gentoo no longer defaults to having bash set the window title in the case
-that the terminal is controlled by sshd(8), unless screen is launched on the
-remote side or the terminal reliably supports saving and restoring the title
-(as alacritty, foot and tmux do). Those wanting for the title to be set
-regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
-drop-in - to set PROMPT_COMMMAND like so:
-
-PROMPT_COMMAND=(genfun_set_win_title)
-
-Those who would prefer for bash never to interfere with the window title may
-now opt out of the default title setting behaviour, either with the "unset -v
-PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
-EOF
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r2.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r3.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r2.ebuild
rename to sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r3.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1.ebuild
index d495d9e3b91..87d04b1c1f2 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1.ebuild
@@ -26,6 +26,7 @@ case ${PV} in
 		;;
 	*)
 		PLEVEL=0
+		;;
 esac
 
 # The version of readline this bash normally ships with. Note that we only use
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250419.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250419.ebuild
deleted file mode 100644
index d6c2f34c71f..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250419.ebuild
+++ /dev/null
@@ -1,410 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
-inherit flag-o-matic toolchain-funcs prefix verify-sig
-
-# Uncomment if we have a patchset.
-#GENTOO_PATCH_DEV="sam"
-#GENTOO_PATCH_VER="${PV}"
-
-MY_PV=${PV/_p*}
-MY_PV=${MY_PV/_/-}
-MY_P=${PN}-${MY_PV}
-MY_PATCHES=()
-
-# Determine the patchlevel.
-case ${PV} in
-	9999|*_alpha*|*_beta*|*_rc*)
-		# Set a negative patchlevel to indicate that it's a pre-release.
-		PLEVEL=-1
-		;;
-	*_p*)
-		PLEVEL=${PV##*_p}
-		;;
-	*)
-		PLEVEL=0
-esac
-
-# The version of readline this bash normally ships with. Note that we only use
-# the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_beta"
-
-DESCRIPTION="The standard GNU Bourne again shell"
-HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
-
-if [[ ${PV} == 9999 ]]; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
-	EGIT_BRANCH=devel
-	inherit git-r3
-elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-	# It can be useful to have snapshots in the pre-release period once
-	# the first alpha is out, as various bugs get reported and fixed from
-	# the alpha, and the next pre-release is usually quite far away.
-	#
-	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="482872ed8b51408066c3275a18350436f4d0ee41"
-	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
-	S=${WORKDIR}/${PN}-${BASH_COMMIT}
-else
-	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
-
-	# bash-5.1 -> bash51
-	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
-
-	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
-		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
-		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
-		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
-	done
-
-	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
-	S=${WORKDIR}/${MY_P}
-
-	unset -v my_urls my_p my_patch_idx my_patch_ver
-fi
-
-if [[ ${GENTOO_PATCH_VER} ]]; then
-	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
-fi
-
-LICENSE="GPL-3+"
-SLOT="0"
-if (( PLEVEL >= 0 )); then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
-
-DEPEND="
-	>=sys-libs/ncurses-5.2-r2:=
-	nls? ( virtual/libintl )
-"
-if (( PLEVEL >= 0 )); then
-	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
-fi
-RDEPEND="
-	${DEPEND}
-"
-# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
-BDEPEND="
-	pgo? ( dev-util/gperf )
-	verify-sig? ( sec-keys/openpgp-keys-chetramey )
-"
-
-# EAPI 8 tries to append it but it doesn't exist here.
-QA_CONFIGURE_OPTIONS="--disable-static"
-
-PATCHES=(
-	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
-
-	# Patches to or from Chet, posted to the bug-bash mailing list.
-	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
-)
-
-pkg_setup() {
-	# bug #7332
-	if is-flag -malign-double; then
-		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
-		eerror "as it breaks LFS (struct stat64) on x86."
-		die "remove -malign-double from your CFLAGS mr ricer"
-	fi
-
-	if use bashlogger; then
-		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
-		ewarn "This will log ALL output you enter into the shell, you have been warned."
-	fi
-}
-
-src_unpack() {
-	local patch
-
-	if [[ ${PV} == 9999 ]]; then
-		git-r3_src_unpack
-	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-		default
-	else
-		if use verify-sig; then
-			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
-
-			for patch in "${MY_PATCHES[@]}"; do
-				verify-sig_verify_detached "${patch}"{,.sig}
-			done
-		fi
-
-		unpack "${MY_P}.tar.gz"
-
-		if [[ ${GENTOO_PATCH_VER} ]]; then
-			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
-		fi
-	fi
-}
-
-src_prepare() {
-	# Include official patches.
-	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
-
-	# Clean out local libs so we know we use system ones w/releases. The
-	# touch utility is invoked for the benefit of config.status.
-	if (( PLEVEL >= 0 )); then
-		rm -rf lib/{readline,termcap}/* \
-		&& touch lib/{readline,termcap}/Makefile.in \
-		&& sed -i -E 's:\$[{(](RL|HIST)_LIBSRC[)}]/[[:alpha:]_-]*\.h::g' Makefile.in \
-		|| die
-	fi
-
-	# Prefixify hardcoded path names. No-op for non-prefix.
-	hprefixify pathnames.h.in
-
-	# Avoid regenerating docs after patches, bug #407985.
-	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
-	&& touch -r . doc/* \
-	|| die
-
-	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
-	rm tests/run-jobs || die
-
-	eapply -p0 "${PATCHES[@]}"
-	eapply_user
-}
-
-src_configure() {
-	local -a myconf
-
-	# Upstream only test with Bison and require GNUisms like YYEOF and
-	# YYERRCODE. The former at least may be in POSIX soon:
-	# https://www.austingroupbugs.net/view.php?id=1269.
-	# configure warns on use of non-Bison but doesn't abort. The result
-	# may misbehave at runtime.
-	unset -v YACC
-
-	myconf=(
-		--disable-profiling
-
-		# Force linking with system curses ... the bundled termcap lib
-		# sucks bad compared to ncurses.  For the most part, ncurses
-		# is here because readline needs it.  But bash itself calls
-		# ncurses in one or two small places :(.
-		--with-curses
-
-		$(use_enable mem-scramble)
-		$(use_enable net net-redirections)
-		$(use_enable readline)
-		$(use_enable readline bang-history)
-		$(use_enable readline history)
-		$(use_with afs)
-		$(use_with mem-scramble bash-malloc)
-	)
-
-	# For descriptions of these, see config-top.h.
-	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
-	append-cppflags \
-		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
-		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
-		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
-		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
-		-DNON_INTERACTIVE_LOGIN_SHELLS \
-		-DSSH_SOURCE_BASHRC \
-		$(use bashlogger && echo -DSYSLOG_HISTORY)
-
-	use nls || myconf+=( --disable-nls )
-
-	if (( PLEVEL >= 0 )); then
-		# Historically, we always used the builtin readline, but since
-		# our handling of SONAME upgrades has gotten much more stable
-		# in the PM (and the readline ebuild itself preserves the old
-		# libs during upgrades), linking against the system copy should
-		# be safe.
-		# Exact cached version here doesn't really matter as long as it
-		# is at least what's in the DEPEND up above.
-		export ac_cv_rl_version=${READLINE_VER%%_*}
-
-		# Use system readline only with released versions.
-		myconf+=( --with-installed-readline=. )
-	fi
-
-	if use plugins; then
-		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
-	else
-		# Disable the plugins logic by hand since bash doesn't provide
-		# a way of doing it.
-		export ac_cv_func_dl{close,open,sym}=no \
-			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
-
-		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
-	fi
-
-	# bug #444070
-	tc-export AR
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	local -a pgo_generate_flags pgo_use_flags
-	local flag
-
-	# -fprofile-partial-training because upstream notes the test suite isn't
-	# super comprehensive.
-	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
-	if use pgo; then
-		pgo_generate_flags=(
-			-fprofile-update=atomic
-			-fprofile-dir="${T}"/pgo
-			-fprofile-generate="${T}"/pgo
-		)
-		pgo_use_flags=(
-			-fprofile-use="${T}"/pgo
-			-fprofile-dir="${T}"/pgo
-		)
-		if flag=$(test-flags-CC -fprofile-partial-training); then
-			pgo_generate_flags+=( "${flag}" )
-			pgo_use_flags+=( "${flag}" )
-		fi
-	fi
-
-	# builtins/evalstring.c needs y.tab.h but can't (easily) specify the dep on it from above
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" y.tab.h
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
-	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
-
-	# Build Bash and run its tests to generate profiles.
-	if (( ${#pgo_generate_flags[@]} )); then
-		# Used in test suite.
-		unset -v A
-
-		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
-
-		if tc-is-clang; then
-			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
-		fi
-
-		# Rebuild Bash using the profiling data we just generated.
-		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" y.tab.h
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
-		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
-	fi
-}
-
-src_test() {
-	# Used in test suite.
-	unset -v A
-
-	default
-}
-
-src_install() {
-	local d f
-
-	default
-
-	my_prefixify() {
-		while read -r; do
-			if [[ $REPLY == *$1* ]]; then
-				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
-			fi
-			printf '%s\n' "${REPLY}" || ! break
-		done < "$2" || die
-	}
-
-	dodir /bin
-	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
-	dosym bash /bin/rbash
-
-	insinto /etc/bash
-	doins "${FILESDIR}"/bash_logout
-	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
-
-	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color.bash | newins - 10-gentoo-color.bash
-	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r1.bash 10-gentoo-title.bash
-	if [[ ! ${EPREFIX} ]]; then
-		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
-	fi
-
-	insinto /etc/skel
-	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
-	done
-
-	if use plugins; then
-		exeinto "/usr/$(get_libdir)/bash"
-		set -- examples/loadables/*.o
-		doexe "${@%.o}"
-
-		insinto /usr/include/bash-plugins
-		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
-	fi
-
-	if use examples; then
-		for d in examples/{functions,misc,scripts,startup-files}; do
-			exeinto "/usr/share/doc/${PF}/${d}"
-			docinto "${d}"
-			for f in "${d}"/*; do
-				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
-					doexe "${f}"
-				else
-					dodoc "${f}"
-				fi
-			done
-		done
-	fi
-
-	# Install bash_builtins.1 and rbash.1.
-	emake -C doc DESTDIR="${D}" install_builtins
-	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
-	doman "${T}"/rbash.1
-
-	newdoc CWRU/changelog ChangeLog
-	dosym bash.info /usr/share/info/bashref.info
-}
-
-pkg_preinst() {
-	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
-		mkdir -p -- "${EROOT}"/etc/bash \
-		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
-		|| die
-	fi
-}
-
-pkg_postinst() {
-	local old_ver
-
-	# If /bin/sh does not exist, provide it.
-	if [[ ! -e ${EROOT}/bin/sh ]]; then
-		ln -sf -- bash "${EROOT}"/bin/sh || die
-	fi
-
-	read -r old_ver <<<"${REPLACING_VERSIONS}"
-	if [[ ! $old_ver ]]; then
-		:
-	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
-		return
-	fi
-
-	while read -r; do ewarn "${REPLY}"; done <<'EOF'
-Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
-
-Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
-characteristics of the operating environment, it may contain a command to set
-the terminal's window title. Those who were already choosing to customise the
-PROMPT_COMMAND variable are now advised to append their commands like so:
-
-PROMPT_COMMAND+=('custom command goes here')
-
-Gentoo no longer defaults to having bash set the window title in the case
-that the terminal is controlled by sshd(8), unless screen is launched on the
-remote side or the terminal reliably supports saving and restoring the title
-(as alacritty, foot and tmux do). Those wanting for the title to be set
-regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
-drop-in - to set PROMPT_COMMMAND like so:
-
-PROMPT_COMMAND=(genfun_set_win_title)
-
-Those who would prefer for bash never to interfere with the window title may
-now opt out of the default title setting behaviour, either with the "unset -v
-PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
-EOF
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250422.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250422.ebuild
deleted file mode 100644
index e9dedb0573e..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250422.ebuild
+++ /dev/null
@@ -1,410 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
-inherit flag-o-matic toolchain-funcs prefix verify-sig
-
-# Uncomment if we have a patchset.
-#GENTOO_PATCH_DEV="sam"
-#GENTOO_PATCH_VER="${PV}"
-
-MY_PV=${PV/_p*}
-MY_PV=${MY_PV/_/-}
-MY_P=${PN}-${MY_PV}
-MY_PATCHES=()
-
-# Determine the patchlevel.
-case ${PV} in
-	9999|*_alpha*|*_beta*|*_rc*)
-		# Set a negative patchlevel to indicate that it's a pre-release.
-		PLEVEL=-1
-		;;
-	*_p*)
-		PLEVEL=${PV##*_p}
-		;;
-	*)
-		PLEVEL=0
-esac
-
-# The version of readline this bash normally ships with. Note that we only use
-# the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_beta"
-
-DESCRIPTION="The standard GNU Bourne again shell"
-HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
-
-if [[ ${PV} == 9999 ]]; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
-	EGIT_BRANCH=devel
-	inherit git-r3
-elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-	# It can be useful to have snapshots in the pre-release period once
-	# the first alpha is out, as various bugs get reported and fixed from
-	# the alpha, and the next pre-release is usually quite far away.
-	#
-	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="7731dc5c4d405ab147fc562e3af2a375ca593554"
-	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
-	S=${WORKDIR}/${PN}-${BASH_COMMIT}
-else
-	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
-
-	# bash-5.1 -> bash51
-	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
-
-	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
-		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
-		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
-		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
-	done
-
-	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
-	S=${WORKDIR}/${MY_P}
-
-	unset -v my_urls my_p my_patch_idx my_patch_ver
-fi
-
-if [[ ${GENTOO_PATCH_VER} ]]; then
-	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
-fi
-
-LICENSE="GPL-3+"
-SLOT="0"
-if (( PLEVEL >= 0 )); then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
-
-DEPEND="
-	>=sys-libs/ncurses-5.2-r2:=
-	nls? ( virtual/libintl )
-"
-if (( PLEVEL >= 0 )); then
-	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
-fi
-RDEPEND="
-	${DEPEND}
-"
-# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
-BDEPEND="
-	pgo? ( dev-util/gperf )
-	verify-sig? ( sec-keys/openpgp-keys-chetramey )
-"
-
-# EAPI 8 tries to append it but it doesn't exist here.
-QA_CONFIGURE_OPTIONS="--disable-static"
-
-PATCHES=(
-	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
-
-	# Patches to or from Chet, posted to the bug-bash mailing list.
-	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
-)
-
-pkg_setup() {
-	# bug #7332
-	if is-flag -malign-double; then
-		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
-		eerror "as it breaks LFS (struct stat64) on x86."
-		die "remove -malign-double from your CFLAGS mr ricer"
-	fi
-
-	if use bashlogger; then
-		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
-		ewarn "This will log ALL output you enter into the shell, you have been warned."
-	fi
-}
-
-src_unpack() {
-	local patch
-
-	if [[ ${PV} == 9999 ]]; then
-		git-r3_src_unpack
-	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-		default
-	else
-		if use verify-sig; then
-			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
-
-			for patch in "${MY_PATCHES[@]}"; do
-				verify-sig_verify_detached "${patch}"{,.sig}
-			done
-		fi
-
-		unpack "${MY_P}.tar.gz"
-
-		if [[ ${GENTOO_PATCH_VER} ]]; then
-			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
-		fi
-	fi
-}
-
-src_prepare() {
-	# Include official patches.
-	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
-
-	# Clean out local libs so we know we use system ones w/releases. The
-	# touch utility is invoked for the benefit of config.status.
-	if (( PLEVEL >= 0 )); then
-		rm -rf lib/{readline,termcap}/* \
-		&& touch lib/{readline,termcap}/Makefile.in \
-		&& sed -i -E 's:\$[{(](RL|HIST)_LIBSRC[)}]/[[:alpha:]_-]*\.h::g' Makefile.in \
-		|| die
-	fi
-
-	# Prefixify hardcoded path names. No-op for non-prefix.
-	hprefixify pathnames.h.in
-
-	# Avoid regenerating docs after patches, bug #407985.
-	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
-	&& touch -r . doc/* \
-	|| die
-
-	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
-	rm tests/run-jobs || die
-
-	eapply -p0 "${PATCHES[@]}"
-	eapply_user
-}
-
-src_configure() {
-	local -a myconf
-
-	# Upstream only test with Bison and require GNUisms like YYEOF and
-	# YYERRCODE. The former at least may be in POSIX soon:
-	# https://www.austingroupbugs.net/view.php?id=1269.
-	# configure warns on use of non-Bison but doesn't abort. The result
-	# may misbehave at runtime.
-	unset -v YACC
-
-	myconf=(
-		--disable-profiling
-
-		# Force linking with system curses ... the bundled termcap lib
-		# sucks bad compared to ncurses.  For the most part, ncurses
-		# is here because readline needs it.  But bash itself calls
-		# ncurses in one or two small places :(.
-		--with-curses
-
-		$(use_enable mem-scramble)
-		$(use_enable net net-redirections)
-		$(use_enable readline)
-		$(use_enable readline bang-history)
-		$(use_enable readline history)
-		$(use_with afs)
-		$(use_with mem-scramble bash-malloc)
-	)
-
-	# For descriptions of these, see config-top.h.
-	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
-	append-cppflags \
-		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
-		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
-		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
-		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
-		-DNON_INTERACTIVE_LOGIN_SHELLS \
-		-DSSH_SOURCE_BASHRC \
-		$(use bashlogger && echo -DSYSLOG_HISTORY)
-
-	use nls || myconf+=( --disable-nls )
-
-	if (( PLEVEL >= 0 )); then
-		# Historically, we always used the builtin readline, but since
-		# our handling of SONAME upgrades has gotten much more stable
-		# in the PM (and the readline ebuild itself preserves the old
-		# libs during upgrades), linking against the system copy should
-		# be safe.
-		# Exact cached version here doesn't really matter as long as it
-		# is at least what's in the DEPEND up above.
-		export ac_cv_rl_version=${READLINE_VER%%_*}
-
-		# Use system readline only with released versions.
-		myconf+=( --with-installed-readline=. )
-	fi
-
-	if use plugins; then
-		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
-	else
-		# Disable the plugins logic by hand since bash doesn't provide
-		# a way of doing it.
-		export ac_cv_func_dl{close,open,sym}=no \
-			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
-
-		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
-	fi
-
-	# bug #444070
-	tc-export AR
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	local -a pgo_generate_flags pgo_use_flags
-	local flag
-
-	# -fprofile-partial-training because upstream notes the test suite isn't
-	# super comprehensive.
-	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
-	if use pgo; then
-		pgo_generate_flags=(
-			-fprofile-update=atomic
-			-fprofile-dir="${T}"/pgo
-			-fprofile-generate="${T}"/pgo
-		)
-		pgo_use_flags=(
-			-fprofile-use="${T}"/pgo
-			-fprofile-dir="${T}"/pgo
-		)
-		if flag=$(test-flags-CC -fprofile-partial-training); then
-			pgo_generate_flags+=( "${flag}" )
-			pgo_use_flags+=( "${flag}" )
-		fi
-	fi
-
-	# builtins/evalstring.c needs y.tab.h but can't (easily) specify the dep on it from above
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" y.tab.h
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
-	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
-
-	# Build Bash and run its tests to generate profiles.
-	if (( ${#pgo_generate_flags[@]} )); then
-		# Used in test suite.
-		unset -v A
-
-		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
-
-		if tc-is-clang; then
-			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
-		fi
-
-		# Rebuild Bash using the profiling data we just generated.
-		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" y.tab.h
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
-		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
-	fi
-}
-
-src_test() {
-	# Used in test suite.
-	unset -v A
-
-	default
-}
-
-src_install() {
-	local d f
-
-	default
-
-	my_prefixify() {
-		while read -r; do
-			if [[ $REPLY == *$1* ]]; then
-				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
-			fi
-			printf '%s\n' "${REPLY}" || ! break
-		done < "$2" || die
-	}
-
-	dodir /bin
-	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
-	dosym bash /bin/rbash
-
-	insinto /etc/bash
-	doins "${FILESDIR}"/bash_logout
-	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
-
-	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color.bash | newins - 10-gentoo-color.bash
-	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r1.bash 10-gentoo-title.bash
-	if [[ ! ${EPREFIX} ]]; then
-		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
-	fi
-
-	insinto /etc/skel
-	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
-	done
-
-	if use plugins; then
-		exeinto "/usr/$(get_libdir)/bash"
-		set -- examples/loadables/*.o
-		doexe "${@%.o}"
-
-		insinto /usr/include/bash-plugins
-		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
-	fi
-
-	if use examples; then
-		for d in examples/{functions,misc,scripts,startup-files}; do
-			exeinto "/usr/share/doc/${PF}/${d}"
-			docinto "${d}"
-			for f in "${d}"/*; do
-				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
-					doexe "${f}"
-				else
-					dodoc "${f}"
-				fi
-			done
-		done
-	fi
-
-	# Install bash_builtins.1 and rbash.1.
-	emake -C doc DESTDIR="${D}" install_builtins
-	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
-	doman "${T}"/rbash.1
-
-	newdoc CWRU/changelog ChangeLog
-	dosym bash.info /usr/share/info/bashref.info
-}
-
-pkg_preinst() {
-	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
-		mkdir -p -- "${EROOT}"/etc/bash \
-		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
-		|| die
-	fi
-}
-
-pkg_postinst() {
-	local old_ver
-
-	# If /bin/sh does not exist, provide it.
-	if [[ ! -e ${EROOT}/bin/sh ]]; then
-		ln -sf -- bash "${EROOT}"/bin/sh || die
-	fi
-
-	read -r old_ver <<<"${REPLACING_VERSIONS}"
-	if [[ ! $old_ver ]]; then
-		:
-	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
-		return
-	fi
-
-	while read -r; do ewarn "${REPLY}"; done <<'EOF'
-Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
-
-Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
-characteristics of the operating environment, it may contain a command to set
-the terminal's window title. Those who were already choosing to customise the
-PROMPT_COMMAND variable are now advised to append their commands like so:
-
-PROMPT_COMMAND+=('custom command goes here')
-
-Gentoo no longer defaults to having bash set the window title in the case
-that the terminal is controlled by sshd(8), unless screen is launched on the
-remote side or the terminal reliably supports saving and restoring the title
-(as alacritty, foot and tmux do). Those wanting for the title to be set
-regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
-drop-in - to set PROMPT_COMMMAND like so:
-
-PROMPT_COMMAND=(genfun_set_win_title)
-
-Those who would prefer for bash never to interfere with the window title may
-now opt out of the default title setting behaviour, either with the "unset -v
-PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
-EOF
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250430.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250430-r1.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250430.ebuild
rename to sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250430-r1.ebuild
index a71d009bc5d..02e45fa7d9b 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250430.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250430-r1.ebuild
@@ -15,7 +15,7 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()
 
-# Determine the patchlevel.
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
 case ${PV} in
 	9999|*_alpha*|*_beta*|*_rc*)
 		# Set a negative patchlevel to indicate that it's a pre-release.
@@ -26,11 +26,12 @@ case ${PV} in
 		;;
 	*)
 		PLEVEL=0
+		;;
 esac
 
 # The version of readline this bash normally ships with. Note that we only use
 # the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_beta"
+READLINE_VER="8.3_rc1"
 
 DESCRIPTION="The standard GNU Bourne again shell"
 HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
@@ -264,8 +265,6 @@ src_compile() {
 		fi
 	fi
 
-	# builtins/evalstring.c needs y.tab.h but can't (easily) specify the dep on it from above
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" y.tab.h
 	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
 	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
 
@@ -282,7 +281,6 @@ src_compile() {
 
 		# Rebuild Bash using the profiling data we just generated.
 		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" y.tab.h
 		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
 		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
 	fi
@@ -318,7 +316,7 @@ src_install() {
 	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
 
 	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r1.bash | newins - 10-gentoo-color.bash
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
 	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
 	if [[ ! ${EPREFIX} ]]; then
 		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250409.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250504-r1.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250409.ebuild
rename to sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250504-r1.ebuild
index b8c4d806b78..04dd9c2d72b 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250409.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250504-r1.ebuild
@@ -15,7 +15,7 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()
 
-# Determine the patchlevel.
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
 case ${PV} in
 	9999|*_alpha*|*_beta*|*_rc*)
 		# Set a negative patchlevel to indicate that it's a pre-release.
@@ -26,11 +26,12 @@ case ${PV} in
 		;;
 	*)
 		PLEVEL=0
+		;;
 esac
 
 # The version of readline this bash normally ships with. Note that we only use
 # the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_beta"
+READLINE_VER="8.3_rc1"
 
 DESCRIPTION="The standard GNU Bourne again shell"
 HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
@@ -45,7 +46,7 @@ elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
 	# the alpha, and the next pre-release is usually quite far away.
 	#
 	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="42c6cbd459a121e98d9ac43c477a5daf6c3d4f0c"
+	BASH_COMMIT="535a8150b65ee6888f54f602274dbbdcd77c788e"
 	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
 	S=${WORKDIR}/${PN}-${BASH_COMMIT}
 else
@@ -264,8 +265,6 @@ src_compile() {
 		fi
 	fi
 
-	# builtins/evalstring.c needs y.tab.h but can't (easily) specify the dep on it from above
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" y.tab.h
 	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
 	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
 
@@ -282,7 +281,6 @@ src_compile() {
 
 		# Rebuild Bash using the profiling data we just generated.
 		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" y.tab.h
 		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
 		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
 	fi
@@ -318,8 +316,8 @@ src_install() {
 	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
 
 	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color.bash | newins - 10-gentoo-color.bash
-	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r1.bash 10-gentoo-title.bash
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
+	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
 	if [[ ! ${EPREFIX} ]]; then
 		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
 	fi
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-9999.ebuild
index 48dc6faddf9..04dd9c2d72b 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-9999.ebuild
@@ -15,7 +15,7 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()
 
-# Determine the patchlevel.
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
 case ${PV} in
 	9999|*_alpha*|*_beta*|*_rc*)
 		# Set a negative patchlevel to indicate that it's a pre-release.
@@ -26,11 +26,12 @@ case ${PV} in
 		;;
 	*)
 		PLEVEL=0
+		;;
 esac
 
 # The version of readline this bash normally ships with. Note that we only use
 # the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_alpha"
+READLINE_VER="8.3_rc1"
 
 DESCRIPTION="The standard GNU Bourne again shell"
 HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
@@ -45,8 +46,8 @@ elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
 	# the alpha, and the next pre-release is usually quite far away.
 	#
 	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="d3e86e66ce857a8dc02e3116fd98b6e5b34d6364"
-	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.xz -> ${P}-${BASH_COMMIT}.tar.xz"
+	BASH_COMMIT="535a8150b65ee6888f54f602274dbbdcd77c788e"
+	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
 	S=${WORKDIR}/${PN}-${BASH_COMMIT}
 else
 	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
@@ -315,7 +316,7 @@ src_install() {
 	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
 
 	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r1.bash | newins - 10-gentoo-color.bash
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
 	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
 	if [[ ! ${EPREFIX} ]]; then
 		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-erroneous-delimiter-pushback-condition.patch b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-erroneous-delimiter-pushback-condition.patch
index 6e800095264..e997c37cff1 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-erroneous-delimiter-pushback-condition.patch
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-erroneous-delimiter-pushback-condition.patch
@@ -1,4 +1,4 @@
-From 57fbf1c67f2d89365601f39e72781fba001fe2f3 Mon Sep 17 00:00:00 2001
+From 01463f6ae5a58b7309769596714e76b0d265b622 Mon Sep 17 00:00:00 2001
 From: Kerin Millar <kfm@plushkava.net>
 Date: Mon, 28 Apr 2025 08:13:38 +0100
 Subject: [PATCH 3/3] Backport fix for erroneous delimiter pushback condition
@@ -23,7 +23,7 @@ $'\315'
 ''
 ''
 
-With the upcoming 5.3-rc2, which will incoprorate this patch, all three
+With the upcoming 5.3-rc2, which will incorporate this patch, all three
 records are read correctly.
 
 <FOO>
@@ -47,7 +47,7 @@ Signed-off-by: Kerin Millar <kfm@plushkava.net>
  1 file changed, 6 insertions(+), 6 deletions(-)
 
 diff --git builtins/read.def builtins/read.def
-index 9fd9a74c..8000def3 100644
+index 48351c3c..70a3508b 100644
 --- builtins/read.def
 +++ builtins/read.def
 @@ -1102,14 +1102,14 @@ read_mbchar (fd, string, ind, ch, delim, unbuffered)
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-invalid-continuation-byte-ignored-as-delimiter-2.patch b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-invalid-continuation-byte-ignored-as-delimiter-2.patch
index ff6fdf25414..ea27d3b3d19 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-invalid-continuation-byte-ignored-as-delimiter-2.patch
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-invalid-continuation-byte-ignored-as-delimiter-2.patch
@@ -1,4 +1,4 @@
-From fb31e1965baa732f9e4cdbe3a7d6691d7beb4e03 Mon Sep 17 00:00:00 2001
+From c87aca06c259b6283a499584d95c87f163accba0 Mon Sep 17 00:00:00 2001
 From: Kerin Millar <kfm@plushkava.net>
 Date: Mon, 28 Apr 2025 07:59:25 +0100
 Subject: [PATCH 2/3] Backport fix for invalid continuation bytes above 0x7F
@@ -26,11 +26,11 @@ Link: https://mywiki.wooledge.org/BashPitfalls#IFS.3D_read_-r_-d_.27.27_filename
 Link: https://lists.gnu.org/r/bug-bash/2024-08/msg00100.html
 Signed-off-by: Kerin Millar <kfm@plushkava.net>
 ---
- builtins/read.def | 40 +++++++++++++++++++++++-----------------
- 1 file changed, 23 insertions(+), 17 deletions(-)
+ builtins/read.def | 41 +++++++++++++++++++++++------------------
+ 1 file changed, 23 insertions(+), 18 deletions(-)
 
 diff --git builtins/read.def builtins/read.def
-index 53b4bd81..9fd9a74c 100644
+index 53b4bd81..48351c3c 100644
 --- builtins/read.def
 +++ builtins/read.def
 @@ -142,7 +142,7 @@ sh_timer *read_timeout;
@@ -80,16 +80,17 @@ index 53b4bd81..9fd9a74c 100644
  	      mbchar[--i] = '\0';		/* unget the delimiter */
  	    }
  	  break;		/* invalid multibyte character */
-@@ -1220,6 +1219,8 @@ edit_line (p, itext)
+@@ -1219,7 +1218,8 @@ edit_line (p, itext)
+ 
    len = strlen (ret);
    ret = (char *)xrealloc (ret, len + 2);
-   ret[len++] = delim;
+-  ret[len++] = delim;
 +  if (delim > 0)
 +    ret[len++] = delim;
    ret[len] = '\0';
    return ret;
  }
-@@ -1240,7 +1241,7 @@ static rl_command_func_t *old_delim_func;
+@@ -1240,7 +1240,7 @@ static rl_command_func_t *old_delim_func;
  static int old_newline_ctype;
  static rl_command_func_t *old_newline_func;
  
@@ -98,7 +99,7 @@ index 53b4bd81..9fd9a74c 100644
  
  static void
  set_eol_delim (c)
-@@ -1252,19 +1253,21 @@ set_eol_delim (c)
+@@ -1252,19 +1252,21 @@ set_eol_delim (c)
      initialize_readline ();
    cmap = rl_get_keymap ();
  
@@ -128,7 +129,7 @@ index 53b4bd81..9fd9a74c 100644
  
    delim_char = c;
  }
-@@ -1280,7 +1283,10 @@ reset_eol_delim (cp)
+@@ -1280,7 +1282,10 @@ reset_eol_delim (cp)
    cmap[RETURN].type = old_newline_ctype;
    cmap[RETURN].function = old_newline_func;
  
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc.d/10-gentoo-color-r1.bash b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc.d/10-gentoo-color-r1.bash
deleted file mode 100644
index 72693cb33aa..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc.d/10-gentoo-color-r1.bash
+++ /dev/null
@@ -1,73 +0,0 @@
-# /etc/bash/bashrc.d/10-gentoo-color.bash
-
-if [[ ${NO_COLOR} ]]; then
-	# Respect the user's wish not to use color. See https://no-color.org/.
-	gentoo_color=0
-elif [[ ${COLORTERM@a} == *x* && ${COLORTERM} == @(24bit|truecolor) ]]; then
-	# The COLORTERM environment variable can reasonably be trusted here.
-	# See https://github.com/termstandard/colors for further information.
-	gentoo_color=1
-elif unset -v COLORTERM; ! gentoo_color=$(tput colors 2>/dev/null); then
-	# Either ncurses is not installed or no terminfo database could be
-	# found. Fall back to a whitelist which covers the majority of terminal
-	# emulators and virtual console implementations known to support color
-	# and which remain (somewhat) popular. This will rarely happen, so the
-	# list need not be exhaustive.
-	case ${TERM} in
-		*color*    |\
-		*direct*   |\
-		*ghostty   |\
-		[Ekx]term* |\
-		alacritty  |\
-		aterm      |\
-		contour    |\
-		dtterm     |\
-		foot*      |\
-		jfbterm    |\
-		linux      |\
-		mlterm     |\
-		rxvt*      |\
-		screen*    |\
-		tmux*      |\
-		wsvt25*    ) gentoo_color=1
-	esac
-elif (( gentoo_color == 16777216 )); then
-	# Truecolor support is available. Advertise it.
-	export COLORTERM=truecolor
-fi
-
-# For direxpand to be missing indicates that bash is lacking readline support.
-if (( gentoo_color <= 0 )) || [[ ! $(shopt -p direxpand 2>/dev/null) ]]; then
-	# Define a prompt without color.
-	PS1='\u@\h \w \$ '
-elif (( EUID == 0 )); then
-	# If root, omit the username and print the hostname in red.
-	PS1='\[\e[01;31m\]\h\[\e[01;34m\] \w \$\[\e[00m\] '
-else
-	# Otherwise, print the username and hostname in green.
-	PS1='\[\e[01;32m\]\u@\h\[\e[01;34m\] \w \$\[\e[00m\] '
-fi
-
-if (( gentoo_color > 0 )); then
-	# Colorize the output of diff(1), grep(1) and a few coreutils utilities.
-	# However, do so only where no alias/function by the given name exists.
-	for _ in diff dir grep ls vdir; do
-		if [[ $(type -t "$_") == file ]]; then
-			alias "$_=$_ --color=auto"
-		fi
-	done
-
-	# Enable colors for ls(1) and some other utilities that respect the
-	# LS_COLORS variable. Prefer ~/.dir_colors, per bug #64489.
-	if hash dircolors 2>/dev/null; then
-		if [[ -f ~/.dir_colors ]]; then
-			eval "$(COLORTERM=1 dircolors -b -- ~/.dir_colors)"
-		elif [[ -f /etc/DIR_COLORS ]]; then
-			eval "$(COLORTERM=1 dircolors -b /etc/DIR_COLORS)"
-		else
-			eval "$(COLORTERM=1 dircolors -b)"
-		fi
-	fi
-fi
-
-unset -v gentoo_color

From aa13d031e78a17ab038fe2692d26dc2e9f7b5f0c Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:18 +0000
Subject: [PATCH 009/136] dev-build/autoconf-archive: Sync with Gentoo

It's from Gentoo commit 4ca8fc95c797c8023f7666baf42b855a3932eb7e.
---
 ... => autoconf-archive-2024.10.16-r2.ebuild} |  10 +-
 .../autoconf-archive-2024.10.16-lua.patch     | 209 ++++++++++++++++++
 2 files changed, 218 insertions(+), 1 deletion(-)
 rename sdk_container/src/third_party/portage-stable/dev-build/autoconf-archive/{autoconf-archive-2024.10.16.ebuild => autoconf-archive-2024.10.16-r2.ebuild} (64%)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-build/autoconf-archive/files/autoconf-archive-2024.10.16-lua.patch

diff --git a/sdk_container/src/third_party/portage-stable/dev-build/autoconf-archive/autoconf-archive-2024.10.16.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/autoconf-archive/autoconf-archive-2024.10.16-r2.ebuild
similarity index 64%
rename from sdk_container/src/third_party/portage-stable/dev-build/autoconf-archive/autoconf-archive-2024.10.16.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-build/autoconf-archive/autoconf-archive-2024.10.16-r2.ebuild
index a141f4b96bf..14624175505 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/autoconf-archive/autoconf-archive-2024.10.16.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/autoconf-archive/autoconf-archive-2024.10.16-r2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -6,6 +6,9 @@ EAPI=8
 DESCRIPTION="GNU Autoconf Macro Archive"
 HOMEPAGE="https://www.gnu.org/software/autoconf-archive/"
 SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
+# Temporary patchset for 2024.10.16 because a snapshot is too awkward to make
+# Can be dropped on next release
+SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}-patches.tar.xz"
 
 LICENSE="GPL-3"
 SLOT="0"
@@ -16,3 +19,8 @@ RDEPEND="
 	!=gnome-base/gnome-common-3.14.0-r0
 	!>=gnome-base/gnome-common-3.14.0-r1[-autoconf-archive(+)]
 "
+
+PATCHES=(
+	"${WORKDIR}"/${P}-patches
+	"${FILESDIR}"/${P}-lua.patch
+)
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/autoconf-archive/files/autoconf-archive-2024.10.16-lua.patch b/sdk_container/src/third_party/portage-stable/dev-build/autoconf-archive/files/autoconf-archive-2024.10.16-lua.patch
new file mode 100644
index 00000000000..dc65abc4707
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/autoconf-archive/files/autoconf-archive-2024.10.16-lua.patch
@@ -0,0 +1,209 @@
+https://github.com/autoconf-archive/autoconf-archive/pull/318
+
+From 51056b0e139322d0377b0ecd30efd80ec1290dfe Mon Sep 17 00:00:00 2001
+From: Peter Simons <simons@cryp.to>
+Date: Sat, 9 Nov 2024 09:22:08 +0100
+Subject: [PATCH] Revert "Add LuaJIT support to AX_PROG_LUA macro"
+
+---
+ m4/ax_lua.m4 | 109 ++++++++++++++-------------------------------------
+ 1 file changed, 29 insertions(+), 80 deletions(-)
+
+diff --git a/m4/ax_lua.m4 b/m4/ax_lua.m4
+index 5f63cace..a2f2a2ce 100644
+--- a/m4/ax_lua.m4
++++ b/m4/ax_lua.m4
+@@ -49,14 +49,6 @@
+ #   interpreter. If LUA is blank, the user's path is searched for an
+ #   suitable interpreter.
+ #
+-#   Optionally a LUAJIT option may be set ahead of time to look for and
+-#   validate a LuaJIT install instead of PUC Lua. Usage might look like:
+-#
+-#     AC_ARG_WITH(luajit, [AS_HELP_STRING([--with-luajit],
+-#         [Prefer LuaJIT over PUC Lua, even if the latter is newer. Default: no])
+-#     ])
+-#     AM_CONDITIONAL([LUAJIT], [test "x$with_luajit" != 'xno'])
+-#
+ #   If MINIMUM-VERSION is supplied, then only Lua interpreters with a
+ #   version number greater or equal to MINIMUM-VERSION will be accepted. If
+ #   TOO-BIG-VERSION is also supplied, then only Lua interpreters with a
+@@ -160,7 +152,6 @@
+ #
+ # LICENSE
+ #
+-#   Copyright (c) 2023 Caleb Maclennan <caleb@alerque.com>
+ #   Copyright (c) 2015 Reuben Thomas <rrt@sc3d.org>
+ #   Copyright (c) 2014 Tim Perkins <tprk77@gmail.com>
+ #
+@@ -190,7 +181,7 @@
+ #   modified version of the Autoconf Macro, you may extend this special
+ #   exception to the GPL to apply to your modified version as well.
+ 
+-#serial 47
++#serial 48
+ 
+ dnl =========================================================================
+ dnl AX_PROG_LUA([MINIMUM-VERSION], [TOO-BIG-VERSION],
+@@ -206,14 +197,13 @@ AC_DEFUN([AX_PROG_LUA],
+   AC_ARG_VAR([LUA], [The Lua interpreter, e.g. /usr/bin/lua5.1])
+ 
+   dnl Find a Lua interpreter.
+-  AM_COND_IF([LUAJIT],
+-        [_ax_lua_interpreter_list='luajit luajit-2.1.0-beta3 luajit-2.0.5 luajit-2.0.4 luajit-2.0.3'],
+-        [_ax_lua_interpreter_list='lua lua5.4 lua54 lua5.3 lua53 lua5.2 lua52 lua5.1 lua51 lua5.0 lua50'])
++  m4_define_default([_AX_LUA_INTERPRETER_LIST],
++    [lua lua5.4 lua54 lua5.3 lua53 lua5.2 lua52 lua5.1 lua51 lua50])
+ 
+   m4_if([$1], [],
+   [ dnl No version check is needed. Find any Lua interpreter.
+     AS_IF([test "x$LUA" = 'x'],
+-      [AC_PATH_PROGS([LUA], [$_ax_lua_interpreter_list], [:])])
++      [AC_PATH_PROGS([LUA], [_AX_LUA_INTERPRETER_LIST], [:])])
+     ax_display_LUA='lua'
+ 
+     AS_IF([test "x$LUA" != 'x:'],
+@@ -252,7 +242,7 @@ AC_DEFUN([AX_PROG_LUA],
+         [_ax_check_text="for a Lua interpreter with version >= $1, < $2"])
+       AC_CACHE_CHECK([$_ax_check_text],
+         [ax_cv_pathless_LUA],
+-        [ for ax_cv_pathless_LUA in $_ax_lua_interpreter_list none; do
++        [ for ax_cv_pathless_LUA in _AX_LUA_INTERPRETER_LIST none; do
+             test "x$ax_cv_pathless_LUA" = 'xnone' && break
+             _AX_LUA_CHK_IS_INTRP([$ax_cv_pathless_LUA], [], [continue])
+             _AX_LUA_CHK_VER([$ax_cv_pathless_LUA], [$1], [$2], [break])
+@@ -285,18 +275,6 @@ AC_DEFUN([AX_PROG_LUA],
+     AC_SUBST([LUA_VERSION], [$ax_cv_lua_version])
+     AC_SUBST([LUA_SHORT_VERSION], [`echo "$LUA_VERSION" | $SED 's|\.||'`])
+ 
+-    AM_COND_IF([LUAJIT], [
+-      AC_CACHE_CHECK([for $ax_display_LUA jit version], [ax_cv_luajit_version],
+-        [ ax_cv_luajit_version=[`$LUA -e '
+-          local _, _, ver = string.find(jit and jit.version, "(%d+%..+)")
+-          print(ver or "")'`]
+-        ])
+-      AS_IF([test "x$ax_cv_luajit_version" = 'x'],
+-        [AC_MSG_ERROR([invalid Lua jit version number])])
+-      AC_SUBST([LUAJIT_VERSION], [$ax_cv_luajit_version])
+-      AC_SUBST([LUAJIT_SHORT_VERSION], [$(echo "$LUAJIT_VERSION" | $SED 's|\.|§|;s|\..*||;s|§|.|')])
+-    ])
+-
+     dnl The following check is not supported:
+     dnl At times (like when building shared libraries) you may want to know
+     dnl which OS platform Lua thinks this is.
+@@ -486,50 +464,33 @@ AC_DEFUN([AX_LUA_HEADERS],
+       AC_MSG_ERROR([cannot check Lua headers without knowing LUA_VERSION])
+     ])
+ 
+-  AM_COND_IF([LUAJIT],[
+-    dnl Check for LUAJIT_VERSION.
+-    AC_MSG_CHECKING([if LUAJIT_VERSION is defined])
+-    AS_IF([test "x$LUAJIT_VERSION" != 'x'],
+-      [AC_MSG_RESULT([yes])],
+-      [ AC_MSG_RESULT([no])
+-        AC_MSG_ERROR([cannot check Lua jit headers without knowing LUAJIT_VERSION])
+-      ])
+-  ])
+-
+   dnl Make LUA_INCLUDE a precious variable.
+   AC_ARG_VAR([LUA_INCLUDE], [The Lua includes, e.g. -I/usr/include/lua5.1])
+ 
+-  dnl  Some default directories to search.
+-  AM_COND_IF([LUAJIT],
+-    [_ax_lua_include_list="
+-      /usr/include/luajit-$LUAJIT_VERSION
+-      /usr/include/luajit-$LUAJIT_SHORT_VERSION
+-      /usr/local/include/luajit-$LUAJIT_VERSION
+-      /usr/local/include/luajit-$LUAJIT_SHORT_VERSION"],
+-    [_ax_lua_include_list="
+-      /usr/include/lua$LUA_VERSION
+-      /usr/include/lua-$LUA_VERSION
+-      /usr/include/lua/$LUA_VERSION
+-      /usr/include/lua$LUA_SHORT_VERSION
+-      /usr/local/include/lua$LUA_VERSION
+-      /usr/local/include/lua-$LUA_VERSION
+-      /usr/local/include/lua/$LUA_VERSION
+-      /usr/local/include/lua$LUA_SHORT_VERSION"])
++  dnl Some default directories to search.
++  LUA_SHORT_VERSION=`echo "$LUA_VERSION" | $SED 's|\.||'`
++  m4_define_default([_AX_LUA_INCLUDE_LIST],
++    [ /usr/include/lua$LUA_VERSION \
++      /usr/include/lua-$LUA_VERSION \
++      /usr/include/lua/$LUA_VERSION \
++      /usr/include/lua$LUA_SHORT_VERSION \
++      /usr/local/include/lua$LUA_VERSION \
++      /usr/local/include/lua-$LUA_VERSION \
++      /usr/local/include/lua/$LUA_VERSION \
++      /usr/local/include/lua$LUA_SHORT_VERSION \
++    ])
+ 
+   dnl Try to find the headers.
+   _ax_lua_saved_cppflags=$CPPFLAGS
+   CPPFLAGS="$CPPFLAGS $LUA_INCLUDE"
+   AC_CHECK_HEADERS([lua.h lualib.h lauxlib.h luaconf.h])
+-  AM_COND_IF([LUAJIT], [AC_CHECK_HEADERS([luajit.h])])
+   CPPFLAGS=$_ax_lua_saved_cppflags
+ 
+   dnl Try some other directories if LUA_INCLUDE was not set.
+   AS_IF([test "x$LUA_INCLUDE" = 'x' &&
+-         test "x$ac_cv_header_lua_h" != 'xyes' ||
+-         test "x$with_luajit" != 'xno' &&
+-         test "x$ac_cv_header_luajit_h" != 'xyes'],
++         test "x$ac_cv_header_lua_h" != 'xyes'],
+     [ dnl Try some common include paths.
+-      for _ax_include_path in $_ax_lua_include_list; do
++      for _ax_include_path in _AX_LUA_INCLUDE_LIST; do
+         test ! -d "$_ax_include_path" && continue
+ 
+         AC_MSG_CHECKING([for Lua headers in])
+@@ -539,12 +500,10 @@ AC_DEFUN([AX_LUA_HEADERS],
+         AS_UNSET([ac_cv_header_lualib_h])
+         AS_UNSET([ac_cv_header_lauxlib_h])
+         AS_UNSET([ac_cv_header_luaconf_h])
+-        AS_UNSET([ac_cv_header_luajit_h])
+ 
+         _ax_lua_saved_cppflags=$CPPFLAGS
+         CPPFLAGS="$CPPFLAGS -I$_ax_include_path"
+         AC_CHECK_HEADERS([lua.h lualib.h lauxlib.h luaconf.h])
+-        AM_COND_IF([LUAJIT], [AC_CHECK_HEADERS([luajit.h])])
+         CPPFLAGS=$_ax_lua_saved_cppflags
+ 
+         AS_IF([test "x$ac_cv_header_lua_h" = 'xyes'],
+@@ -662,26 +621,16 @@ AC_DEFUN([AX_LUA_LIBS],
+     dnl Try to find the Lua libs.
+     _ax_lua_saved_libs=$LIBS
+     LIBS="$LIBS $LUA_LIB"
+-    AM_COND_IF([LUAJIT],
+-      [AC_SEARCH_LIBS([lua_load],
+-        [ luajit$LUA_VERSION \
+-          luajit$LUA_SHORT_VERSION \
+-          luajit-$LUA_VERSION \
+-          luajit-$LUA_SHORT_VERSION \
+-          luajit],
+-        [_ax_found_lua_libs='yes'],
+-        [_ax_found_lua_libs='no'],
+-        [$_ax_lua_extra_libs])],
+-      [AC_SEARCH_LIBS([lua_load],
+-        [ lua$LUA_VERSION \
+-          lua$LUA_SHORT_VERSION \
+-          lua-$LUA_VERSION \
+-          lua-$LUA_SHORT_VERSION \
+-          lua \
+-        ],
+-        [_ax_found_lua_libs='yes'],
+-        [_ax_found_lua_libs='no'],
+-        [$_ax_lua_extra_libs])])
++    AC_SEARCH_LIBS([lua_load],
++      [ lua$LUA_VERSION \
++        lua$LUA_SHORT_VERSION \
++        lua-$LUA_VERSION \
++        lua-$LUA_SHORT_VERSION \
++        lua \
++      ],
++      [_ax_found_lua_libs='yes'],
++      [_ax_found_lua_libs='no'],
++      [$_ax_lua_extra_libs])
+     LIBS=$_ax_lua_saved_libs
+ 
+     AS_IF([test "x$ac_cv_search_lua_load" != 'xno' &&
+

From 1039b423b64efd5a2913cedfc53ea8d72de3e85d Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:21 +0000
Subject: [PATCH 010/136] dev-build/cmake: Sync with Gentoo

It's from Gentoo commit e495dda4ca3e4e826efd6c1052520d281b0ef2b7.
---
 .../portage-stable/dev-build/cmake/Manifest   |  9 ++---
 ...ke-4.0.1.ebuild => cmake-3.31.7-r1.ebuild} | 33 +++++++-----------
 ...ake-4.0.0.ebuild => cmake-4.0.2-r1.ebuild} |  3 +-
 .../dev-build/cmake/cmake-9999.ebuild         |  2 +-
 .../cmake/files/cmake-3.31.7-hdf5.patch       | 34 +++++++++++++++++++
 5 files changed, 53 insertions(+), 28 deletions(-)
 rename sdk_container/src/third_party/portage-stable/dev-build/cmake/{cmake-4.0.1.ebuild => cmake-3.31.7-r1.ebuild} (91%)
 rename sdk_container/src/third_party/portage-stable/dev-build/cmake/{cmake-4.0.0.ebuild => cmake-4.0.2-r1.ebuild} (99%)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-build/cmake/files/cmake-3.31.7-hdf5.patch

diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest b/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
index 047c7e2c904..b1326b6698c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
@@ -12,10 +12,7 @@ DIST cmake-3.31.6.tar.gz 11710589 BLAKE2B ea1bee1a98568407dfc164f82bf0e3ab082124
 DIST cmake-3.31.7-SHA-256.txt 1646 BLAKE2B a3b52506b586ee81cb4192ddbfa52c8f2c4456d99ce3e0f1c2e88c22a756d58905219498e41b726bce6258b5bbe44fb2c58bb0c5972303a6ca8c2dc37de59676 SHA512 eb967dbc6a4c18d1b0b97910b89a5e9392e29bd1a8c169c92899215ee15f5a8a4852c06b3643c5ce420a57ef93c9153380d75f68f23092475032850390d1ab4e
 DIST cmake-3.31.7-SHA-256.txt.asc 833 BLAKE2B 9ddb47b9aa26875b294d4e3db27b4c9518c3a01f3a11d1a50afae08ef7871f52367c0d275415cd801613b036ae88f92611d03bb5d576e8bcd324c3ec46d943e1 SHA512 9b7234c8fe122cf458a42c5d5ba71bd7694c2cb610cc989d2ea2a710a5615a0f49f0747b3ab4321d0bb69987321e8256b335a3e5d29de4bc783d683b7dedae93
 DIST cmake-3.31.7.tar.gz 11711975 BLAKE2B 8bf3ea288695f6e1a9f301f8ad471e1007061cb9ed69b8a432d5de7e1779580ffbbd4050a85b1a3df30a85ee971ed0421ce14d9a77b026f7147d73ca8fee7ec9 SHA512 896f29e8e7c897e6e346141496d3f338aeaced8300fb2fd1fedcd0236742bfe4842de1c94253adf54f4847b17c5d9699c92d199cbb4a74c99ee14972c939b09e
-DIST cmake-4.0.0-SHA-256.txt 2015 BLAKE2B 8f3737f51768c61a16543e8d4a4bc6c359f2f2c128b1d7a5b80cae6c09e64d8ed28147619336172b217d0ea264ce424b2ef519b36bc6e30771a7144bee6d67b1 SHA512 50abb18d59e2685ea462d1e4cbafb005172030c1dc7f77a959e178caba744347d67b575318d3a09c1f44966f5efcfdb2fa0dd2dbbddb1fc8487f54c0e4207d69
-DIST cmake-4.0.0-SHA-256.txt.asc 833 BLAKE2B 2e9fe03e6db837dffe703740c76b312fced691ac2b2a5df6c8c199489902ce36ab8bef6ba599734470e5c4ded7ab4ad75eb374578b2204ed72d5711ad8af843d SHA512 93da422a75ce068d26b96e0a50746511f7ee3da6f8fd8d232bf9fd6a95853290ae98858ab8a00719091b79a9a6064bf7c0f840d45fa773baaa48b489ea4f54fc
-DIST cmake-4.0.0.tar.gz 11824527 BLAKE2B 21ab208f663498a4851e312bdee884fae9a711234ffd7da73c56894a51d2cd7a479f18fc0d3f276c9eee964e97965d0d57ccfe9a95a10f1bb7ad319c8fe0b7af SHA512 6892f68a48f428b7d7321e646b75d72f751a20b44e74696d445c90dc0dc8be7894f546d70e3749ff44a1bbea0371e9f4d509a9c116c17c231db65affe60945df
 DIST cmake-4.0.0_rc1-docs.tar.xz 577536 BLAKE2B 74a742ffef8e1af1652746e1c177d4198155145a039635e6a0ea40af463f3a2d45b6c6ce7d3a9b1fee24f0c1cfd1c3aa95c27669ca3c6281d54e701fc0ece202 SHA512 74c20067d3b82493024b2f2711b55b93998ce3b5f35ab5a154f33a8268a35a29d01127c55ce6b85b80ff252d15284ed1065e1338422124f6722a4190a984637c
-DIST cmake-4.0.1-SHA-256.txt 2015 BLAKE2B 3b6f2c889d4e67b459c1cd4a86470f1429f0153ff596bef7deb178050ad79686b4fc3ad0663a243219ebc2d626b3382ec747ee5a0d65c9a030444b8c60e50801 SHA512 f5b23ec12ac172c6d567722ac8d37c1325ad9da6d22944e1ed2cebb77dd645ac948f10f8f2060061990788d82209a1266848f334dd77c6014ce7c11d308aae95
-DIST cmake-4.0.1-SHA-256.txt.asc 833 BLAKE2B 67c5984baf0d3ed4bc263ee39963e9a540bf6328786101d62adebe3cba550e14d291edb0dee40cdabadb6763c02c1959208956b43532f760db878d6796a32f7d SHA512 5a80e483a4f280969ad8f7bf31f3cc3b1b1cb13b4853a1bf1616414e8f2c2cac381658126bfe23aa229eb40af5a423f5e2d0e076b5f02e7e667b4b83d007b7b3
-DIST cmake-4.0.1.tar.gz 11826844 BLAKE2B beedd233ce7a40a694394ec0b23a14e2ad566a98e6c04b0ffa8d66844cf66b4545974635647ffde247021a00378f48d09f0f8fa0d0e100fc6a55b258bb01fe83 SHA512 25f3e93b1fe09b4aacf6f6361942f829c4833075a05ad26a9bdbd1278f5f6a78389e619e478152e2ecc4108a4bccc3ed901f96db0571dc05f1feba4e04f8f516
+DIST cmake-4.0.2-SHA-256.txt 2015 BLAKE2B 19e4be043bd45e0e3ed88a758ef1791f4e8b0164a42e3df72f8451c2321e9e72a305e4bfe146cf1e91a41e987d6e4d137781f12d3331f12d47d7ee9b06ecc8ce SHA512 9b91f2fa6c5bb0323358457b2393d2f3723f175253c6d0154da4defa9d206eabef90c9159f5ad6f465568859b2289ad3bcb3154aac8f9640587894eff231075b
+DIST cmake-4.0.2-SHA-256.txt.asc 833 BLAKE2B 4a7221627af5c9ee0cc6492a126feb48ad47cf654990fb45e0bb124a9bf23243d04081572836904b089f34d13b95f2b8c57c3c1bad32f53afb75881c274cbf6a SHA512 e6f8c372f6be8fca8a2f2b91c143905be173c4d10f2d4102400b07eecb27728591db6687dc89d0781e7c072280b13c4a84c151e0dffc8dd1bcb4792b710f8159
+DIST cmake-4.0.2.tar.gz 11829733 BLAKE2B 3ea56ae2916f60f564a1d630ddff97ccd41ec11753aabde894f9a0369477ae57ed9b9e45f7a6684cca534706554b613bfa95b8105a2a19917d5ca1c76c7ea1c9 SHA512 049138ec2a7d690663d431bcb4d8abd22f18ec2c9e0e58092df6bbfe801a30fef9a3b7cbd9fe88c476c0a95c71147a5b31b0494f04be879a86cbaaa4697f613c
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.0.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.31.7-r1.ebuild
similarity index 91%
rename from sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.0.1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.31.7-r1.ebuild
index 41639c300a5..ea60e33669a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.0.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.31.7-r1.ebuild
@@ -9,9 +9,7 @@ EAPI=8
 : ${CMAKE_DOCS_PREBUILT:=1}
 
 CMAKE_DOCS_PREBUILT_DEV=sam
-CMAKE_DOCS_VERSION=4.0.0_rc1
-#CMAKE_DOCS_VERSION=${PV}
-#CMAKE_DOCS_VERSION=$(ver_cut 1-2).0
+CMAKE_DOCS_VERSION=$(ver_cut 1-2).0
 # Default to generating docs (inc. man pages) if no prebuilt; overridden later
 # See bug #784815
 CMAKE_DOCS_USEFLAG="+doc"
@@ -40,21 +38,19 @@ else
 		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${CMAKE_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${CMAKE_DOCS_VERSION}-docs.tar.xz )"
 	fi
 
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/bradking.asc
-	inherit verify-sig
+	if [[ ${PV} != *_rc* ]] ; then
+		VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/bradking.asc
+		inherit verify-sig
 
-	SRC_URI+=" verify-sig? (
-		https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}-SHA-256.txt
-		https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}-SHA-256.txt.asc
-		https://github.com/Kitware/CMake/releases/download/v${PV/_/-}/${MY_P}-SHA-256.txt
-		https://github.com/Kitware/CMake/releases/download/v${PV/_/-}/${MY_P}-SHA-256.txt.asc
-	)"
+		SRC_URI+=" verify-sig? (
+			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt
+			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt.asc
+		)"
 
-	if [[ ${PV} != *_rc* ]] ; then
 		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-	fi
 
-	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-bradking-20240902 )"
+		BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-bradking-20240902 )"
+	fi
 fi
 
 [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] && CMAKE_DOCS_USEFLAG="doc"
@@ -99,9 +95,10 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-3.27.0_rc1-0004-Ensure-that-the-correct-version-of-Qt-is-always-used.patch
 	"${FILESDIR}"/${PN}-3.27.0_rc1-0005-Respect-Gentoo-s-Python-eclasses.patch
 	# Cuda
-	"${FILESDIR}/${PN}-3.30.3-cudahostld.patch"
+	"${FILESDIR}"/${PN}-3.30.3-cudahostld.patch
 
 	# Upstream fixes (can usually be removed with a version bump)
+	"${FILESDIR}"/${PN}-3.31.7-hdf5.patch
 )
 
 cmake_src_bootstrap() {
@@ -128,7 +125,7 @@ pkg_pretend() {
 		local file
 		local errant_files=()
 
-		# See bug #599684 and  bug #753581 (at least)
+		# See bug #599684 and bug #753581 (at least)
 		for file in /etc/arch-release /etc/redhat-release /etc/debian_version ; do
 			if [[ -e ${file} ]]; then
 				errant_files+=( "${file}" )
@@ -221,10 +218,6 @@ src_prepare() {
 	# https://gitlab.kitware.com/cmake/cmake/-/issues/20740
 	filter-lto
 
-	# 4.0.0_rc1 is missing this, fails to configure
-	# https://gitlab.kitware.com/cmake/cmake/-/issues/26712
-	touch .clang-tidy Utilities/.clang-tidy || die
-
 	if ! has_version -b \>=${CATEGORY}/${PN}-3.13 || ! cmake --version &>/dev/null ; then
 		CMAKE_BINARY="${S}/Bootstrap.cmk/cmake"
 		cmake_src_bootstrap
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.0.2-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.0.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.0.2-r1.ebuild
index 41639c300a5..e1c7d026c0a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.0.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.0.2-r1.ebuild
@@ -102,6 +102,7 @@ PATCHES=(
 	"${FILESDIR}/${PN}-3.30.3-cudahostld.patch"
 
 	# Upstream fixes (can usually be removed with a version bump)
+	"${FILESDIR}"/${PN}-3.31.7-hdf5.patch
 )
 
 cmake_src_bootstrap() {
@@ -128,7 +129,7 @@ pkg_pretend() {
 		local file
 		local errant_files=()
 
-		# See bug #599684 and  bug #753581 (at least)
+		# See bug #599684 and bug #753581 (at least)
 		for file in /etc/arch-release /etc/redhat-release /etc/debian_version ; do
 			if [[ -e ${file} ]]; then
 				errant_files+=( "${file}" )
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-9999.ebuild
index 41639c300a5..d5c57e85205 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-9999.ebuild
@@ -128,7 +128,7 @@ pkg_pretend() {
 		local file
 		local errant_files=()
 
-		# See bug #599684 and  bug #753581 (at least)
+		# See bug #599684 and bug #753581 (at least)
 		for file in /etc/arch-release /etc/redhat-release /etc/debian_version ; do
 			if [[ -e ${file} ]]; then
 				errant_files+=( "${file}" )
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/files/cmake-3.31.7-hdf5.patch b/sdk_container/src/third_party/portage-stable/dev-build/cmake/files/cmake-3.31.7-hdf5.patch
new file mode 100644
index 00000000000..c68c5eeec98
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/files/cmake-3.31.7-hdf5.patch
@@ -0,0 +1,34 @@
+https://bugs.gentoo.org/954378#c14
+https://gitlab.kitware.com/cmake/cmake/-/issues/23261
+https://gitlab.kitware.com/cmake/cmake/-/commit/a869b79c5921412c91fb71a761748ae5f7d3fb23
+
+From a869b79c5921412c91fb71a761748ae5f7d3fb23 Mon Sep 17 00:00:00 2001
+From: Atri Bhattacharya <badshah400@gmail.org>
+Date: Mon, 10 Mar 2025 20:55:36 +0530
+Subject: [PATCH] FindHDF5: Prefer h5hl* compilers for HDF5_FIND_HL
+
+Prefer `h5hlcc`, `h5hlc++`, and `h5hlfc` compilers when HDF5's HL libraries
+are requested. These include the `-lhdf_hl` in the command line, whereas
+the non-hl compilers (like `h5cc`) do not. Using the latter, therefore,
+leads to cmake complaining about not finding the `HDF5_HL` libraries even
+though they are present in the same location as the `hdf5` library itself.
+
+Fixes: #23261
+--- a/Modules/FindHDF5.cmake
++++ b/Modules/FindHDF5.cmake
+@@ -218,6 +218,13 @@ else()
+   set(HDF5_Fortran_COMPILER_NAMES h5fc h5pfc)
+ endif()
+ 
++# Prefer h5hl<LANG> compilers if HDF5_FIND_HL is enabled
++if(HDF5_FIND_HL)
++  list(PREPEND HDF5_C_COMPILER_NAMES h5hlcc)
++  list(PREPEND HDF5_CXX_COMPILER_NAMES h5hlc++)
++  list(PREPEND HDF5_Fortran_COMPILER_NAMES h5hlfc)
++endif()
++
+ # Test first if the current compilers automatically wrap HDF5
+ function(_HDF5_test_regular_compiler_C success version is_parallel)
+   if(NOT ${success} OR
+-- 
+GitLab

From 78021b475ab5acc5f5d8c8c750a1583e4ad989c2 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:30 +0000
Subject: [PATCH 011/136] dev-db/sqlite: Sync with Gentoo

It's from Gentoo commit e6b89770e6a5a56ac74c96d21e66080ed4a81655.
---
 .../portage-stable/dev-db/sqlite/Manifest     |   2 +
 .../dev-db/sqlite/sqlite-3.49.2.ebuild        | 446 ++++++++++++++++++
 2 files changed, 448 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.49.2.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
index 12e9aee5405..62f47bac441 100644
--- a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
@@ -1,6 +1,8 @@
 DIST sqlite-doc-3460100.zip 10851427 BLAKE2B 7462e83ca84e3e9aac7236f575fd2bdddac7744ae700a63fe8fdc9d2df3157c59fd374d99a0526bd4d9f742005ee7a90f3d78057861d3c3fcba9f897630e48db SHA512 1ad7dfc938d182f69ea9367b4f5ead1d48b991626521249e8b58c9fb4c2553e348ce402de9cc81b0ad699d4c45c467de56a98ee39f9c3555c6fafff15fba41ce
 DIST sqlite-doc-3470200.zip 10957830 BLAKE2B cbc40dd440d1c5af4ad4333090a7306bd54ec43250a478b6900b8f74bd721035018ea7647f3a208d42cc0639827325be26a9412d17af7d390f4e584d4c6acf44 SHA512 48349d512b7cd9bc6f6a5da3a2b2285de159d4653667311adb0f5e6a970060db940a590c2d01b529afc1614065b22434d5b3ac4d8d0122d003d74926745ba56e
 DIST sqlite-doc-3490100.zip 11333315 BLAKE2B 28fe302820898861e404f5c6dd1c05c3ff3ff10a8b713604f0ccec6b21ca7b82d61ba720903d7e9d8e9ec5de701900c5972037c23627ddd1a2734e95a92c5d6a SHA512 0eb6af0483bca7f6efd6baf00210adcca1d23ea5b474728aa96614a93a868ec6f9257d9b5f29c452fed5323c64fc180ee3845695ddbbcd7836dac69aecdfc833
+DIST sqlite-doc-3490200.zip 11340124 BLAKE2B 56c1456f5720ee98553350790232d043caf197ed6b47bee57405561180513db7ed60c517dd9e86c80aced2a630dd7ca4314a0546de39419fafaccd3d8bd14c52 SHA512 0ea707eb52d019f20157a5b5334340169981547b0714ed58912df932fb76dd0d2cabb6ed3afaefcda24e5477ccbc3cdc1fc81a761d792c06dbad3cc3928a3368
 DIST sqlite-src-3460100.zip 14276926 BLAKE2B df16ea944e317df8ed64fdfab289e3699ec71725ce55e2b30450adaeb41c061b4fba1eb8c41ba638b0edcd12b23264a1f9e413b69fd593c2b65fb1037d3fc8b2 SHA512 6d32a0db9f95d3cec34f02f3fd45b453bf7c422d4d4d9570790f641e7d190b8b31be8e8715afacc1b6e4417f15a4d15a0b28e608ae0b4b5f3054b075783b916e
 DIST sqlite-src-3470200.zip 14421983 BLAKE2B dcaea5be0099b2dad1b53403933f0037ace48b1f248040c1b5cc116ac2ad6c9b44c71b8efe3afd16bef01119b440d1a2ec9d553a22f855e0ba55793684f53d8d SHA512 a6280a02304bfae173d9e9ebf376b2d3624658f04af4d8e95d5a042e24cf0405a47c0a4023f4dbc2790716cd85e16b97fcc0a83c1534e6d554f4eb0bfb0a3ed3
 DIST sqlite-src-3490100.zip 14372402 BLAKE2B c7f6a574698512e2fde44e54ed2a101e7307821b0015287bbf5ab151f5f59432fe051fda1d1caec865928717f51c42f1161187fb768180088574ca225cd29250 SHA512 24c81cee52e5655f4e9d6496a366e4787352b5108ea27eb5ce3dc07ef3e1975205bb250584b0758fb2832add84ca922b09a4d925e0dc2f55dd3613a58b414ec3
+DIST sqlite-src-3490200.zip 14377708 BLAKE2B b455388c3c9d0424b7f36b5ab41b7506f524d35c015205eaf164a62494061a308ed419cb75cde6f5c1011a724274980675e4958a9a24d025c7a94ba8f9a13551 SHA512 d07600391df9fd635b1d43cff208021450a18cedad67221e239b0ed86ef287f2f31c040ac413c8a69123615f01658b68f26b6e70a71da39be3ead372a13c8bdc
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.49.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.49.2.ebuild
new file mode 100644
index 00000000000..edfe015e6fd
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.49.2.ebuild
@@ -0,0 +1,446 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic multilib multilib-minimal toolchain-funcs
+
+DESCRIPTION="SQL database engine"
+HOMEPAGE="https://sqlite.org/"
+
+# On version updates, make sure to read the forum (https://sqlite.org/forum/forum)
+# for hints regarding test failures, backports, etc.
+if [[ ${PV} == 9999 ]]; then
+	S="${WORKDIR}"/${PN}
+	PROPERTIES="live"
+else
+	printf -v SRC_PV "%u%02u%02u%02u" $(ver_rs 1- " ")
+	DOC_PV="${SRC_PV}"
+	#printf -v DOC_PV "%u%02u%02u00" $(ver_rs 1-3 " ")
+
+	SRC_URI="
+		https://sqlite.org/2025/${PN}-src-${SRC_PV}.zip
+		doc? ( https://sqlite.org/2025/${PN}-doc-${DOC_PV}.zip )
+	"
+	S="${WORKDIR}/${PN}-src-${SRC_PV}"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="public-domain"
+SLOT="3"
+IUSE="debug doc icu +readline secure-delete static-libs tcl test tools"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/zlib:=[${MULTILIB_USEDEP}]
+	icu? ( dev-libs/icu:=[${MULTILIB_USEDEP}] )
+	readline? ( sys-libs/readline:=[${MULTILIB_USEDEP}] )
+	tcl? ( dev-lang/tcl:=[${MULTILIB_USEDEP}] )
+	tools? ( dev-lang/tcl:= )
+"
+DEPEND="
+	${RDEPEND}
+	test? ( >=dev-lang/tcl-8.6:0[${MULTILIB_USEDEP}] )
+"
+if [[ ${PV} == 9999 ]]; then
+	BDEPEND+=" dev-vcs/fossil"
+else
+	BDEPEND+=" app-arch/unzip"
+fi
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.47.2-hwtime.h-Don-t-use-rdtsc-on-i486.patch
+	# https://sqlite.org/forum/forumpost/f93323a743
+	"${FILESDIR}"/${PN}-3.49.0-icu-tests.patch
+)
+
+_fossil_fetch() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local repo_uri="${2}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	mkdir -p "${T}/fossil/${repo_id}" || die
+	pushd "${T}/fossil/${repo_id}" > /dev/null || die
+
+	if [[ -n "${EVCS_OFFLINE}" ]]; then
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			die "Network activity disabled using EVCS_OFFLINE and clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+		fi
+	else
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			einfo fossil clone --verbose "${repo_uri}" "${repo_id}.fossil"
+			fossil clone --verbose "${repo_uri}" "${repo_id}.fossil" || die
+			echo
+		else
+			cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" . || die
+			einfo fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}"
+			fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}" || die
+			echo
+		fi
+
+		(
+			addwrite "${distdir}"
+			mkdir -p "${distdir}/fossil-src/${repo_id}" || die
+			cp -p "${repo_id}.fossil" "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" || die
+		)
+	fi
+
+	popd > /dev/null || die
+}
+
+_fossil_checkout() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local branch_or_commit="${2}"
+	local target_directory="${3}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+		die "Clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+	fi
+
+	if [[ ! -f "${T}/fossil/${repo_id}/${repo_id}.fossil" ]]; then
+		mkdir -p "${T}/fossil/${repo_id}" || die
+		cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" "${T}/fossil/${repo_id}" || die
+	fi
+
+	mkdir "${target_directory}" || die
+	pushd "${target_directory}" > /dev/null || die
+
+	einfo fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}"
+	fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}" || die
+	echo
+
+	popd > /dev/null || die
+}
+
+fossil_fetch() {
+	local repo_id="${1}"
+	local repo_uri="${2}"
+	local target_directory="${3}"
+
+	local branch_or_commit="${EFOSSIL_COMMIT:-${EFOSSIL_BRANCH:-trunk}}"
+
+	_fossil_fetch "${repo_id}" "${repo_uri}"
+	_fossil_checkout "${repo_id}" "${branch_or_commit}" "${target_directory}"
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]]; then
+		fossil_fetch sqlite https://sqlite.org/src "${WORKDIR}/${PN}"
+		if use doc; then
+			fossil_fetch sqlite-doc https://sqlite.org/docsrc "${WORKDIR}/${PN}-doc"
+		fi
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	default
+
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	local -x CPPFLAGS="${CPPFLAGS}" CFLAGS="${CFLAGS}"
+	local options=()
+
+	options+=(
+		--enable-load-extension
+		--enable-threadsafe
+	)
+
+	# Support detection of misuse of SQLite API.
+	# https://sqlite.org/compile.html#enable_api_armor
+	append-cppflags -DSQLITE_ENABLE_API_ARMOR
+
+	# Support bytecode and tables_used virtual tables.
+	# https://sqlite.org/compile.html#enable_bytecode_vtab
+	# https://sqlite.org/bytecodevtab.html
+	append-cppflags -DSQLITE_ENABLE_BYTECODE_VTAB
+
+	# Support column metadata functions.
+	# https://sqlite.org/compile.html#enable_column_metadata
+	# https://sqlite.org/c3ref/column_database_name.html
+	append-cppflags -DSQLITE_ENABLE_COLUMN_METADATA
+
+	# Support sqlite_dbpage virtual table.
+	# https://sqlite.org/compile.html#enable_dbpage_vtab
+	# https://sqlite.org/dbpage.html
+	append-cppflags -DSQLITE_ENABLE_DBPAGE_VTAB
+
+	# Support dbstat virtual table.
+	# https://sqlite.org/compile.html#enable_dbstat_vtab
+	# https://sqlite.org/dbstat.html
+	append-cppflags -DSQLITE_ENABLE_DBSTAT_VTAB
+
+	# Support sqlite3_serialize() and sqlite3_deserialize() functions.
+	# https://sqlite.org/compile.html#enable_deserialize
+	# https://sqlite.org/c3ref/serialize.html
+	# https://sqlite.org/c3ref/deserialize.html
+	append-cppflags -DSQLITE_ENABLE_DESERIALIZE
+
+	# Support comments in output of EXPLAIN.
+	# https://sqlite.org/compile.html#enable_explain_comments
+	append-cppflags -DSQLITE_ENABLE_EXPLAIN_COMMENTS
+
+	# Support Full-Text Search versions 3, 4 and 5.
+	# https://sqlite.org/compile.html#enable_fts3
+	# https://sqlite.org/compile.html#enable_fts3_parenthesis
+	# https://sqlite.org/compile.html#enable_fts4
+	# https://sqlite.org/compile.html#enable_fts5
+	# https://sqlite.org/fts3.html
+	# https://sqlite.org/fts5.html
+	append-cppflags -DSQLITE_ENABLE_FTS3 -DSQLITE_ENABLE_FTS3_PARENTHESIS
+	options+=( --enable-fts4 )
+	options+=( --enable-fts5 )
+
+	# Support hidden columns.
+	append-cppflags -DSQLITE_ENABLE_HIDDEN_COLUMNS
+
+	# Support memsys5 memory allocator.
+	# https://sqlite.org/compile.html#enable_memsys5
+	# https://sqlite.org/malloc.html#memsys5
+	options+=( --enable-memsys5 )
+
+	# Support sqlite3_normalized_sql() function.
+	# https://sqlite.org/c3ref/expanded_sql.html
+	append-cppflags -DSQLITE_ENABLE_NORMALIZE
+
+	# Support sqlite_offset() function.
+	# https://sqlite.org/compile.html#enable_offset_sql_func
+	# https://sqlite.org/lang_corefunc.html#sqlite_offset
+	append-cppflags -DSQLITE_ENABLE_OFFSET_SQL_FUNC
+
+	# Support pre-update hook functions.
+	# https://sqlite.org/compile.html#enable_preupdate_hook
+	# https://sqlite.org/c3ref/preupdate_count.html
+	append-cppflags -DSQLITE_ENABLE_PREUPDATE_HOOK
+
+	# Support Resumable Bulk Update extension.
+	# https://sqlite.org/compile.html#enable_rbu
+	# https://sqlite.org/rbu.html
+	append-cppflags -DSQLITE_ENABLE_RBU
+
+	# Support R*Trees.
+	# https://sqlite.org/compile.html#enable_rtree
+	# https://sqlite.org/compile.html#enable_geopoly
+	# https://sqlite.org/rtree.html
+	# https://sqlite.org/geopoly.html
+	options+=( --enable-rtree --enable-geopoly )
+
+	# Support Session extension.
+	# https://sqlite.org/compile.html#enable_session
+	# https://sqlite.org/sessionintro.html
+	options+=( --enable-session )
+
+	# Support scan status functions.
+	# https://sqlite.org/compile.html#enable_stmt_scanstatus
+	# https://sqlite.org/c3ref/stmt_scanstatus.html
+	# https://sqlite.org/c3ref/stmt_scanstatus_reset.html
+	append-cppflags -DSQLITE_ENABLE_STMT_SCANSTATUS
+
+	# Support sqlite_stmt virtual table.
+	# https://sqlite.org/compile.html#enable_stmtvtab
+	# https://sqlite.org/stmt.html
+	append-cppflags -DSQLITE_ENABLE_STMTVTAB
+
+	# Support unknown() function.
+	# https://sqlite.org/compile.html#enable_unknown_sql_function
+	append-cppflags -DSQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
+
+	# Support unlock notification.
+	# https://sqlite.org/compile.html#enable_unlock_notify
+	# https://sqlite.org/c3ref/unlock_notify.html
+	# https://sqlite.org/unlock_notify.html
+	append-cppflags -DSQLITE_ENABLE_UNLOCK_NOTIFY
+
+	# Support LIMIT and ORDER BY clauses on DELETE and UPDATE statements.
+	# https://sqlite.org/compile.html#enable_update_delete_limit
+	# https://sqlite.org/lang_delete.html#optional_limit_and_order_by_clauses
+	# https://sqlite.org/lang_update.html#optional_limit_and_order_by_clauses
+	append-cppflags -DSQLITE_ENABLE_UPDATE_DELETE_LIMIT
+
+	# Support soundex() function.
+	# https://sqlite.org/compile.html#soundex
+	# https://sqlite.org/lang_corefunc.html#soundex
+	append-cppflags -DSQLITE_SOUNDEX
+
+	# Support URI filenames.
+	# https://sqlite.org/compile.html#use_uri
+	# https://sqlite.org/uri.html
+	append-cppflags -DSQLITE_USE_URI
+
+	options+=( $(use_enable debug) )
+
+	if use icu; then
+		# Support ICU extension.
+		# https://sqlite.org/compile.html#enable_icu
+		options+=( --with-icu-config )
+	fi
+
+	options+=(
+		--disable-editline
+		$(use_enable readline)
+	)
+
+	if use readline; then
+		options+=( --with-readline-inc="-I${ESYSROOT}/usr/include/readline" )
+	fi
+
+	if use secure-delete; then
+		# Enable secure_delete pragma by default.
+		# https://sqlite.org/compile.html#secure_delete
+		# https://sqlite.org/pragma.html#pragma_secure_delete
+		append-cppflags -DSQLITE_SECURE_DELETE
+	fi
+
+	options+=( $(use_enable static-libs static) )
+
+	# tcl, test, tools USE flags.
+	if use tcl || use test || { use tools && multilib_is_native_abi; }; then
+		options+=(
+			--enable-tcl
+			--with-tcl="${ESYSROOT}/usr/$(get_libdir)"
+		)
+	else
+		options+=( --disable-tcl )
+	fi
+
+	if [[ "${ABI}" == "x86" ]]; then
+		if $(tc-getCC) ${CPPFLAGS} ${CFLAGS} -E -P -dM - < /dev/null 2> /dev/null | grep -q "^#define __SSE__ 1$"; then
+			append-cflags -mfpmath=sse
+		else
+			append-cflags -ffloat-store
+		fi
+	fi
+
+	if [[ ${CHOST} != *-darwin* ]] ; then
+		# set SONAME for the library
+		options+=( --soname=legacy )
+	else
+		# to allow install_name_tool id change
+		append-ldflags -headerpad_max_install_names
+	fi
+
+	# https://sqlite.org/forum/forumpost/4f4d06a9f6683bb9
+	tc-export_build_env BUILD_CC
+
+	CC_FOR_BUILD=${BUILD_CC} econf "${options[@]}"
+}
+
+multilib_src_compile() {
+	emake HAVE_TCL="$(usev tcl 1)" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}"
+
+	if use tools && multilib_is_native_abi; then
+		emake changeset dbdump dbhash dbtotxt index_usage rbu scrub showdb showjournal showshm showstat4 showwal sqldiff sqlite3_analyzer sqlite3_checker sqlite3_expert sqltclsh
+	fi
+
+	if [[ ${PV} == 9999 ]] && use doc && multilib_is_native_abi; then
+		emake tclsqlite3.c
+
+		local build_directory="$(pwd)"
+		build_directory="${build_directory##*/}"
+
+		mkdir "${WORKDIR}/${PN}-doc-build" || die
+		pushd "${WORKDIR}/${PN}-doc-build" > /dev/null || die
+
+		emake -f "../${PN}-doc/Makefile" -j1 SRC="../${PN}" BLD="../${build_directory}" DOC="../${PN}-doc" CC="$(tc-getBUILD_CC)" TCLINC="" TCLFLAGS="$($(tc-getBUILD_PKG_CONFIG) --libs tcl) -ldl -lm" base doc
+		rmdir doc/matrix{/*,} || die
+
+		popd > /dev/null || die
+	fi
+}
+
+multilib_src_test() {
+	if [[ "${EUID}" -eq 0 ]]; then
+		ewarn "Skipping tests due to root permissions"
+		return
+	fi
+
+	local -x SQLITE_HISTORY="${T}/sqlite_history_${ABI}"
+
+	# e_uri.test tries to open files in /.
+	# bug #839798
+	local SANDBOX_PREDICT=${SANDBOX_PREDICT}
+	addpredict "/test.db"
+	addpredict "/ÿ.db"
+
+	emake -Onone $(usex debug 'fulltest' 'test')
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" HAVE_TCL="$(usex tcl 1 "")" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}" install
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# fix install_name, soname=legacy doesn't work for this (but
+		# breaks the build instead)
+		install_name_tool \
+			-id "${EPREFIX}/usr/$(get_libdir)/libsqlite3$(get_libname 0)" \
+			"${ED}/usr/$(get_libdir)/libsqlite3$(get_libname ${PV})" \
+			|| die "failed to fix install_name"
+	fi
+
+	if use tools && multilib_is_native_abi; then
+		install_tool() {
+			if [[ -f ".libs/${1}" ]]; then
+				newbin ".libs/${1}" "${2}"
+			else
+				newbin "${1}" "${2}"
+			fi
+		}
+
+		install_tool changeset sqlite3-changeset
+		install_tool dbdump sqlite3-db-dump
+		install_tool dbhash sqlite3-db-hash
+		install_tool dbtotxt sqlite3-db-to-txt
+		install_tool index_usage sqlite3-index-usage
+		install_tool rbu sqlite3-rbu
+		install_tool scrub sqlite3-scrub
+		install_tool showdb sqlite3-show-db
+		install_tool showjournal sqlite3-show-journal
+		install_tool showshm sqlite3-show-shm
+		install_tool showstat4 sqlite3-show-stat4
+		install_tool showwal sqlite3-show-wal
+		install_tool sqldiff sqlite3-diff
+		install_tool sqlite3_analyzer sqlite3-analyzer
+		install_tool sqlite3_checker sqlite3-checker
+		install_tool sqlite3_expert sqlite3-expert
+		install_tool sqltclsh sqlite3-tclsh
+
+		unset -f install_tool
+	fi
+}
+
+multilib_src_install_all() {
+	find "${ED}" -name "*.la" -delete || die
+
+	doman sqlite3.1
+
+	if use doc; then
+		if [[ ${PV} == 9999 ]]; then
+			pushd "${WORKDIR}/${PN}-doc-build/doc" > /dev/null || die
+		else
+			pushd "${WORKDIR}/${PN}-doc-${DOC_PV}" > /dev/null || die
+		fi
+
+		find "(" -name "*.db" -o -name "*.txt" ")" -delete || die
+		if [[ ${PV} != 9999 ]]; then
+			rm search search.d/admin || die
+			rmdir search.d || die
+			find -name "*~" -delete || die
+		fi
+
+		(
+			docinto html
+			dodoc -r *
+		)
+
+		popd > /dev/null || die
+	fi
+}

From 713e7f91f717409dfadeb57855ccf0d6823524e7 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:30 +0000
Subject: [PATCH 012/136] dev-debug/strace: Sync with Gentoo

It's from Gentoo commit e947f6574fb75f02514df6139d6616435da115e2.
---
 .../portage-stable/dev-debug/strace/strace-6.14.ebuild          | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.14.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.14.ebuild
index c7ff39d3ba9..9f4936a52d4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.14.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.14.ebuild
@@ -16,7 +16,7 @@ else
 		https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz
 		verify-sig? ( https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz.asc )
 	"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
 fi
 
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/strace.asc

From 4360e6f92d044fc3887015f06505d1be018fa1c0 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:32 +0000
Subject: [PATCH 013/136] dev-lang/go: Sync with Gentoo

It's from Gentoo commit 317703b477a3ad10066d39d1cc124235454e9a51.
---
 .../dev-lang/go/go-1.24.2-r2.ebuild           | 133 ------------------
 .../{go-1.24.2.ebuild => go-1.24.2-r3.ebuild} |   8 +-
 2 files changed, 4 insertions(+), 137 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.2-r2.ebuild
 rename sdk_container/src/third_party/portage-stable/dev-lang/go/{go-1.24.2.ebuild => go-1.24.2-r3.ebuild} (95%)

diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.2-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.2-r2.ebuild
deleted file mode 100644
index be97c056577..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.2-r2.ebuild
+++ /dev/null
@@ -1,133 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-export CBUILD=${CBUILD:-${CHOST}}
-export CTARGET=${CTARGET:-${CHOST}}
-
-# See "Bootstrap" in release notes
-GO_BOOTSTRAP_MIN=1.22.12
-MY_PV=${PV/_/}
-
-inherit go-env toolchain-funcs
-
-case ${PV}  in
-*9999*)
-	EGIT_REPO_URI="https://github.com/golang/go.git"
-	inherit git-r3
-	;;
-*)
-	SRC_URI="https://storage.googleapis.com/golang/go${MY_PV}.src.tar.gz "
-	S="${WORKDIR}"/go
-	KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
-	;;
-esac
-
-DESCRIPTION="A concurrent garbage collected and typesafe programming language"
-HOMEPAGE="https://go.dev"
-
-LICENSE="BSD"
-SLOT="0/${PV}"
-IUSE="cpu_flags_x86_sse2"
-
-BDEPEND="|| (
-		>=dev-lang/go-${GO_BOOTSTRAP_MIN}
-		>=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN} )"
-
-# the *.syso files have writable/executable stacks
-QA_EXECSTACK='*.syso'
-
-# Do not complain about CFLAGS, etc, since Go doesn't use them.
-QA_FLAGS_IGNORED='.*'
-
-# The tools in /usr/lib/go should not cause the multilib-strict check to fail.
-QA_MULTILIB_PATHS="usr/lib/go/pkg/tool/.*/.*"
-
-# This package triggers "unrecognized elf file(s)" notices on riscv.
-# https://bugs.gentoo.org/794046
-QA_PREBUILT='.*'
-
-# Do not strip this package. Stripping is unsupported upstream and may
-# fail.
-RESTRICT=" strip"
-
-DOCS=(
-	CONTRIBUTING.md
-	PATENTS
-	README.md
-	SECURITY.md
-)
-
-go_tuple() {
-	echo "$(go-env_goos $@)_$(go-env_goarch $@)"
-}
-
-go_cross_compile() {
-	[[ $(go_tuple ${CBUILD}) != $(go_tuple) ]]
-}
-
-PATCHES=(
-	"${FILESDIR}"/go-1.24-skip-gdb-tests.patch
-	"${FILESDIR}"/go-1.24-vgetrandom.patch
-	"${FILESDIR}"/go-1.24-dont-force-gold-arm.patch
-	"${FILESDIR}"/go-never-download-newer-toolchains.patch
-)
-
-src_compile() {
-	if has_version -b ">=dev-lang/go-${GO_BOOTSTRAP_MIN}"; then
-		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go"
-	elif has_version -b ">=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN}"; then
-		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go-bootstrap"
-	else
-		eerror "Go cannot be built without go or go-bootstrap installed"
-		die "Should not be here, please report a bug"
-	fi
-
-	# Go's build script does not use BUILD/HOST/TARGET consistently. :(
-	export GOHOSTARCH=$(go-env_goarch ${CBUILD})
-	export GOHOSTOS=$(go-env_goos ${CBUILD})
-	export CC=$(tc-getBUILD_CC)
-
-	export GOARCH=$(go-env_goarch)
-	export GOOS=$(go-env_goos)
-	export CC_FOR_TARGET=$(tc-getCC)
-	export CXX_FOR_TARGET=$(tc-getCXX)
-	use arm && export GOARM=$(go-env_goarm)
-	use x86 && export GO386=$(go-env_go386)
-
-	cd src
-	bash -x ./make.bash || die "build failed"
-}
-
-src_test() {
-	go_cross_compile && return 0
-	cd src
-	PATH="${GOBIN}:${PATH}" \
-	./run.bash -no-rebuild -k || die "tests failed"
-}
-
-src_install() {
-	dodir /usr/lib/go
-	# The use of cp is deliberate in order to retain permissions
-	cp -R . "${ED}"/usr/lib/go
-	einstalldocs
-
-	# testdata directories are not needed on the installed system
-	# The other files we remove are installed by einstalldocs
-	rm -r $(find "${ED}"/usr/lib/go -iname testdata -type d -print) || die
-	rm "${ED}"/usr/lib/go/{CONTRIBUTING.md,PATENTS,README.md} || die
-	rm "${ED}"/usr/lib/go/{SECURITY.md,codereview.cfg,LICENSE} || die
-
-	local bin_path
-	if go_cross_compile; then
-		bin_path="bin/$(go_tuple)"
-	else
-		bin_path=bin
-	fi
-	local f x
-	for x in ${bin_path}/*; do
-		f=${x##*/}
-		dosym ../lib/go/${bin_path}/${f} /usr/bin/${f}
-	done
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.2-r3.ebuild
similarity index 95%
rename from sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.2.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.2-r3.ebuild
index 423eda182b2..cbff1a9044b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.2-r3.ebuild
@@ -28,12 +28,10 @@ DESCRIPTION="A concurrent garbage collected and typesafe programming language"
 HOMEPAGE="https://go.dev"
 
 LICENSE="BSD"
-SLOT="0/${PV}"
+# XXX: Drop the .1 after 1.24.2 (added for bug #955451)
+SLOT="0/${PV}.1"
 IUSE="cpu_flags_x86_sse2"
 
-RDEPEND="
-arm? ( sys-devel/binutils[gold(-)] )
-arm64? ( sys-devel/binutils[gold(-)] )"
 BDEPEND="|| (
 		>=dev-lang/go-${GO_BOOTSTRAP_MIN}
 		>=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN} )"
@@ -72,6 +70,8 @@ go_cross_compile() {
 
 PATCHES=(
 	"${FILESDIR}"/go-1.24-skip-gdb-tests.patch
+	"${FILESDIR}"/go-1.24-vgetrandom.patch
+	"${FILESDIR}"/go-1.24-dont-force-gold-arm.patch
 	"${FILESDIR}"/go-never-download-newer-toolchains.patch
 )
 

From abbe9c930bcf4b3793cbd3609566d8ff38b31383 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:34 +0000
Subject: [PATCH 014/136] dev-lang/python: Sync with Gentoo

It's from Gentoo commit fa8873388517f552e437be20607c63f625c0bfe7.
---
 .../portage-stable/dev-lang/python/Manifest   |   3 +
 .../dev-lang/python/metadata.xml              |   5 +
 .../dev-lang/python/python-3.10.17-r1.ebuild  |   1 -
 .../dev-lang/python/python-3.11.12.ebuild     |   1 -
 .../dev-lang/python/python-3.12.10.ebuild     |   3 -
 .../dev-lang/python/python-3.13.3-r100.ebuild |   3 -
 .../dev-lang/python/python-3.13.3.ebuild      |   3 -
 .../python/python-3.14.0_alpha7-r100.ebuild   |   4 -
 .../python/python-3.14.0_alpha7.ebuild        |   4 -
 .../python/python-3.14.0_beta1-r100.ebuild    | 641 ++++++++++++++++++
 .../python/python-3.14.0_beta1.ebuild         | 634 +++++++++++++++++
 .../dev-lang/python/python-3.8.20_p7.ebuild   |   1 -
 .../dev-lang/python/python-3.9.22.ebuild      |   1 -
 13 files changed, 1283 insertions(+), 21 deletions(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_beta1-r100.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_beta1.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
index 08ea74a5f17..4634b017ec5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
@@ -10,6 +10,8 @@ DIST Python-3.13.3.tar.xz 22654240 BLAKE2B 24ac47c13cbfa4dc9ce6ae4d18d7b5310f83a
 DIST Python-3.13.3.tar.xz.asc 963 BLAKE2B 4a98965305b80e985512f54d9ce8ab88a74fe0d3ee48e300fbc2b4e251c0f499f4eb935e0aeb6d5ad8262338643325126f094fff926da1e2b9a2b3a2247701dc SHA512 54f8da5f4a4dcadc9830cb07aecf695a26a2de48ab98e1f42b09fdde1c70989476d07ce7ea81337216f1e5fcbf6b688e0608c88a2545ced416b01640108e94db
 DIST Python-3.14.0a7.tar.xz 23015952 BLAKE2B f12039695a3a7fdd6352adfca803bad066af3b320159faa1d85bdd914732e8170bc2494427151fad140d699db13645066fa41d8e74dc697226957e793a6305ef SHA512 f7e50c201cb1bbc4779d898e65408147637de7b9d9d85a2e6ad4f8dda758ec150dfb95ee1f12c686a3f46c29a986a75b45323bcbab87b81b319d91236989f6b0
 DIST Python-3.14.0a7.tar.xz.sigstore 4795 BLAKE2B ba10cb295cc4ca7eb41783fad9a85994c0ccf53983b19a73afbf32739248d9dd2282e998c15223d45259b780d6b7de25f418563a9c2e6fc2ef4f0d12290de539 SHA512 daee7d607851092e1c8e7b05b5419e464b8d2c4d65a746a206838709d612412680362c9adb3c67751641893e945e2f6b06b4e6e235e7b18ec4a208af9633525a
+DIST Python-3.14.0b1.tar.xz 23358200 BLAKE2B c18329ee73545a3c50fb4d4a56c0888d19e15c9fb53e1e3b6c0bc4b9eb22fc4912f1c934dc6f0f9b24c19b187ddbc76776d84898d5fc371d740c9a499c9294c4 SHA512 46c0792fe4d7beab13403938e51cc73e4cbc90a1d0367ba106f56353fae6e93697aa08d6389fd5a1fffa71d59376aee0196aba82b2c40d2f0cf642f14eefead8
+DIST Python-3.14.0b1.tar.xz.sigstore 5083 BLAKE2B 5192c84b0580af88cbac55f9bc4fb3aa4b018ae384524108bf82e69a986f21a1512bf88298549f23bf9036951bb12fd56fcdd6032f532cb9f7695dcd9baae6ea SHA512 b8f6e4b4f10b50e0d71a5eba9b9ba18660d994c8ae6aff7d46caa706738a4aca0d4f53e29c5ae668c963ec0c9531b91f77aed03c550ffafe69eb6a5a2e5f755e
 DIST Python-3.8.20.tar.xz 18962788 BLAKE2B 715c75e0c0a3d3b77af7f07478311bb0554b80aac72915be703aa2d0dd6459a972e5669808e64da14a0b91bb183e00655055c1726f302dc3ccd8721e3b4ae3e6 SHA512 3c9341ee1fd33cb687958dcf2b7c0c7700489726c4d530c3e9d9537d46a6ab534541a4b312232d8505bea395a07e4518c42d75fb7571103e6b266f8f44115c61
 DIST Python-3.8.20.tar.xz.asc 833 BLAKE2B 5c86c15a1090b42e42bb7512565b1a7ad9d2137d59e9fd1ab0f83fdfc37dfcf184389418d6703db809e9c8c04a169af292665a2b58bf5dc61b7724ecbb4132d9 SHA512 a751ae0407a593d97acac4d5f8a0456580c753efa12a7d960125c219b4897fdb26fc1ffd43d8ea33ad1449162dd3b2904c16b6c51c57561ba73de3ffa62e0eed
 DIST Python-3.9.22.tar.xz 19652572 BLAKE2B 59f2d2cecde8179064115b52205c2195b26cd0f37aec3e88b0fe2a1a7893a7df8ae38a024814d42064d5e4916e4054a76dddeec0a0dcf29af576d52dbcf65f4c SHA512 c5a76c579455626bf40bb41ee99cab6e444aa5d5085dab7cf622c70ded750e31710c2c30f032917f0d4069350c01a889ed9831d77fcc2d52fcec54055dd07496
@@ -20,5 +22,6 @@ DIST python-gentoo-patches-3.11.12.tar.xz 15616 BLAKE2B 5d4a47058fc35c4ae966e3df
 DIST python-gentoo-patches-3.12.10.tar.xz 10744 BLAKE2B 2abf4874018156d6735cf8604c410dc4726ac9365bc7500abe6b82472aad100aac7268957256692f4275b02965773e58178519ed8038e121f1ffa3c53770d238 SHA512 62066405aa00f46f9645e9c747d53bb93bf510fc791d14d49e00edfd79981778e6c8e07bfa7bac88d76407a0ffd8f7321dea89f81d90b01dbf13f4d381b6a1a3
 DIST python-gentoo-patches-3.13.3.tar.xz 8336 BLAKE2B 66393886fbd034eb14732e4f81f5798e77650ea3fe1c4f8176bd93808b711c8977a53c3f52be6c9b97a368299258b851d9bdb6d4c8e0c75695c6aea784d48b44 SHA512 c1ed31d6aaef81addf786c2ccc1013309b122b791c42fe10e467a677d0db8f149e8b1cc21928c146298918c7ceb851b4b19d1e59f491cb161004e1c9386db289
 DIST python-gentoo-patches-3.14.0a7.tar.xz 5680 BLAKE2B 72fdb5debdcae47143724a100736272994298f4b9c7c4954a1a506b247b93fc06f5dc25140c0fd1f5fdc9110d41b93d33451e11fa07219d394728f987324d7b5 SHA512 e4091ff450bf1ba328961c6e9fbfea233ba8027ded4682355129a67767827080ec2cf23995f7fde9517bc65fbc135820bf89578bdccd539e4559c7944345d15a
+DIST python-gentoo-patches-3.14.0b1.tar.xz 5680 BLAKE2B 514b3edc3025e5bf675d371b5ada17dea426856edf1fb6095c2ee400eae95bd4265ef81fe593ae9338e801e7d0a25b1d5ba2d05ca563fd9dd020114b13575746 SHA512 74289e42cf532b54bb1b66a283ec19156f8a36ba38764209c133842314c9efb2ce2ebcba5aa9213bcf7fc0c8a5ca9b6e7adbd5dbfa4397233136d7cd55f53ee7
 DIST python-gentoo-patches-3.8.20_p7.tar.xz 54544 BLAKE2B e31fc9fb5e98b62b0f70165670ec58ed4fa932cfc95d5287c249015a3a372fdbf0d1ba08cb98f63c2dc500700edfd6ffea6db670385d2c86a4fdb92ffb991192 SHA512 a9e7e4976be226931a503af2c986da207d060d4ce436af61f5e8427da513639adbed32bb0061963b83fef275a5de91707ab13b7a9abf3a7472ee0e2c5310eda1
 DIST python-gentoo-patches-3.9.22.tar.xz 35388 BLAKE2B b6acfa681bdb589f74094ea04bd053bfc122ef9f36b3413c33c352cfae4e101027b0348770b47b9fee769eaba8109406acb6418c1cb8c431fbc7cf1c69124dcb SHA512 335c32d696f9660c957dec0c9a54e2f04e34003d2dbb438e6c9e74ce0a6352b5849e8626397939e3ffa7dc3172ac88cfa2168dd0d120be306e8c898dc7b6b3dc
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-lang/python/metadata.xml
index 22ce986e067..ba2d5afe2fd 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/metadata.xml
@@ -26,6 +26,11 @@
 			by running Python's test suite and collecting statistics
 			based on its performance. This will take longer to build.
 		</flag>
+		<flag name="tail-call-interp">
+			Enable the tail call interpreter. May lead to better
+			performance but is still new and dependent on latest
+			toolchain versions (Clang 19, GCC 15).
+		</flag>
 		<flag name="valgrind">
 			Disable pymalloc when running under
 			<pkg>dev-debug/valgrind</pkg> is detected (may incur minor
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.17-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.17-r1.ebuild
index 21a3da35103..dd5e1696bcf 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.17-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.17-r1.ebuild
@@ -213,7 +213,6 @@ src_configure() {
 		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
 	fi
 
-	append-flags -fwrapv
 	filter-flags -malign-double
 
 	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.12.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.12.ebuild
index f0a1c419e83..378131678f9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.12.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.12.ebuild
@@ -208,7 +208,6 @@ src_configure() {
 		local -x ac_cv_header_bluetooth_bluetooth_h=no
 	fi
 
-	append-flags -fwrapv
 	filter-flags -malign-double
 
 	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.10.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.10.ebuild
index 1bba7b9fc57..c1c5804b332 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.10.ebuild
@@ -211,7 +211,6 @@ src_configure() {
 		local -x ac_cv_header_bluetooth_bluetooth_h=no
 	fi
 
-	append-flags -fwrapv
 	filter-flags -malign-double
 
 	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
@@ -398,9 +397,7 @@ src_configure() {
 		$(use_with valgrind)
 	)
 
-	# https://bugs.gentoo.org/700012
 	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
 		myeconfargs+=(
 			--with-lto
 		)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3-r100.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3-r100.ebuild
index a02ac6833e5..41372672b7f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3-r100.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3-r100.ebuild
@@ -244,7 +244,6 @@ src_configure() {
 		local -x ac_cv_header_bluetooth_bluetooth_h=no
 	fi
 
-	append-flags -fwrapv
 	filter-flags -malign-double
 
 	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
@@ -421,9 +420,7 @@ src_configure() {
 		$(use_with valgrind)
 	)
 
-	# https://bugs.gentoo.org/700012
 	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
 		myeconfargs+=(
 			--with-lto
 		)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3.ebuild
index 72516043f5f..2a02ff9b8ea 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3.ebuild
@@ -246,7 +246,6 @@ src_configure() {
 		local -x ac_cv_header_bluetooth_bluetooth_h=no
 	fi
 
-	append-flags -fwrapv
 	filter-flags -malign-double
 
 	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
@@ -423,9 +422,7 @@ src_configure() {
 		$(use_with valgrind)
 	)
 
-	# https://bugs.gentoo.org/700012
 	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
 		myeconfargs+=(
 			--with-lto
 		)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha7-r100.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha7-r100.ebuild
index eff6e9f28d1..76bff7a7b46 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha7-r100.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha7-r100.ebuild
@@ -93,7 +93,6 @@ BDEPEND="
 			llvm-core/llvm:${LLVM_SLOT}
 		')
 	)
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
 "
 RDEPEND+="
 	!build? ( app-misc/mime-types )
@@ -245,7 +244,6 @@ src_configure() {
 		local -x ac_cv_header_bluetooth_bluetooth_h=no
 	fi
 
-	append-flags -fwrapv
 	filter-flags -malign-double
 
 	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
@@ -422,9 +420,7 @@ src_configure() {
 		$(use_with valgrind)
 	)
 
-	# https://bugs.gentoo.org/700012
 	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
 		myeconfargs+=(
 			--with-lto
 		)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha7.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha7.ebuild
index 53ffce4948b..f30d04d3328 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha7.ebuild
@@ -93,7 +93,6 @@ BDEPEND="
 			llvm-core/llvm:${LLVM_SLOT}
 		')
 	)
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
 "
 RDEPEND+="
 	!build? ( app-misc/mime-types )
@@ -247,7 +246,6 @@ src_configure() {
 		local -x ac_cv_header_bluetooth_bluetooth_h=no
 	fi
 
-	append-flags -fwrapv
 	filter-flags -malign-double
 
 	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
@@ -424,9 +422,7 @@ src_configure() {
 		$(use_with valgrind)
 	)
 
-	# https://bugs.gentoo.org/700012
 	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
 		myeconfargs+=(
 			--with-lto
 		)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_beta1-r100.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_beta1-r100.ebuild
new file mode 100644
index 00000000000..886a83b039f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_beta1-r100.ebuild
@@ -0,0 +1,641 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 19 )
+LLVM_OPTIONAL=1
+VERIFY_SIG_METHOD=sigstore
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+MY_PV=${PV/_beta/b}
+MY_P="Python-${MY_PV%_p*}"
+PYVER="$(ver_cut 1-2)t"
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.sigstore
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm jit
+	libedit +ncurses pgo +readline +sqlite +ssl tail-call-interp test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-arch/zstd:=
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+# https://www.python.org/downloads/metadata/sigstore/
+VERIFY_SIG_CERT_IDENTITY=hugo@python.org
+VERIFY_SIG_CERT_OIDC_ISSUER=https://github.com/login/oauth
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	ewarn "Freethreading build is considered experimental upstream.  Using it"
+	ewarn "could lead to unexpected breakage, including race conditions"
+	ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+	ewarn "you can reproduce the problem with dev-lang/python.  Instead,"
+	ewarn "please consider reporting freethreading problems upstream."
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sigstore}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+		# crashes
+		-x test_zstd
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		hppa*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--disable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with tail-call-interp)
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+	# Fix collision with GIL-enabled build.
+	rm "${ED}/usr/bin/python${PYVER%t}" || die
+	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
+	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if use tk; then
+		# rename to avoid collision with dev-lang/python
+		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
+	else
+		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_beta1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_beta1.ebuild
new file mode 100644
index 00000000000..16596b39675
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_beta1.ebuild
@@ -0,0 +1,634 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 19 )
+LLVM_OPTIONAL=1
+VERIFY_SIG_METHOD=sigstore
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+MY_PV=${PV/_beta/b}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.sigstore
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm jit
+	libedit +ncurses pgo +readline +sqlite +ssl tail-call-interp test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-arch/zstd:=
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+# https://www.python.org/downloads/metadata/sigstore/
+VERIFY_SIG_CERT_IDENTITY=hugo@python.org
+VERIFY_SIG_CERT_OIDC_ISSUER=https://github.com/login/oauth
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	if use jit; then
+		ewarn "USE=jit is considered experimental upstream.  Using it"
+		ewarn "could lead to unexpected breakage, including race conditions"
+		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
+		ewarn "please consider reporting JIT problems upstream."
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sigstore}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		hppa*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--enable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with tail-call-interp)
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20_p7.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20_p7.ebuild
index c6e038ea7cd..868acf645bd 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20_p7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20_p7.ebuild
@@ -138,7 +138,6 @@ src_configure() {
 		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
 	fi
 
-	append-flags -fwrapv
 	filter-flags -malign-double
 
 	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.22.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.22.ebuild
index e8160fe107b..90d06175348 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.22.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.22.ebuild
@@ -147,7 +147,6 @@ src_configure() {
 		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
 	fi
 
-	append-flags -fwrapv
 	filter-flags -malign-double
 
 	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.

From fa4be1eebbfb2788cfbd39dbb972bab7b2bbe6a9 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:36 +0000
Subject: [PATCH 015/136] dev-lang/rust: Sync with Gentoo

It's from Gentoo commit 51c2f3dff768cd82af114ce2029110c4b9a2552f.
---
 .../portage-stable/dev-lang/rust/Manifest     |   2 +
 .../rust/rust-1.87.0_beta20250430.ebuild      | 813 ++++++++++++++++++
 2 files changed, 815 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.87.0_beta20250430.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest
index d6eca425508..28a268d3341 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest
@@ -32,3 +32,5 @@ DIST rustc-1.86.0-src.tar.xz 275696736 BLAKE2B 9f33a710a3e567d92f56091920643f5ef
 DIST rustc-1.86.0-src.tar.xz.asc 801 BLAKE2B 3e10a3894c7eee68d37bc5707d797548119f830667e27e652a199d13633199713bd01bd0f41a5f2af3c682561903e36abe27b36ef78d9a1d65bdf485527d2c15 SHA512 0b74dab9ee56d0a08e26e9cd40f722e4d99de63ac678f969f0c54d50737074fb28e170db5a36ce2627ec332e5ce3bb8a92167aefbccff7c70e4cb057bc0a94ac
 DIST rustc-1.87.0_beta20250420-src.tar.xz 283544556 BLAKE2B 70a59c7d695e881a4e21d500f19b7d83e3a86bc8d5dfaaaa28a4cd4631b12937a2743119e3181e84af7b348386c672f4e62675da8cfb399095fcdda527b072e0 SHA512 37e62954c21b0d5c232dca1d0fe476b165eb63b7315c1fcaa18068707f4fd00e2def09968ee1d243f62cb3eae3fbb4381493b8505179342705998dce08e23afe
 DIST rustc-1.87.0_beta20250420-src.tar.xz.asc 801 BLAKE2B c0ed0686d3bc612e8b0edb96817928107905220328af81d2f9200552c3edb58d98ae8844f01b7dd20e59e6c0a173f6da11b2cd58d0c3b5d5f0bd8290528ea86c SHA512 e2e694feec13d8fb8d9b50442c0c2e3de5cef0a249730c945124880220e44d481b2109098c5a8479f765384a4298e293e63743c924e0866ed2e5aece3a35c98f
+DIST rustc-1.87.0_beta20250430-src.tar.xz 283517896 BLAKE2B 5d86aa824662230a843576798a544ef5e3a49e0166b66c9ecc9926832e102562aac3493748085b7f38a71e5954206d27f7ab3e219a27d96b1c55a8ab8419851a SHA512 5c29e7513b70416f97ba7a5f9669600da9b695d8dc6df582aa6ffa017da5c38215d9a27584fa6f6b2309813127571eba49a3fef375a6598c607f007f41f6d3fe
+DIST rustc-1.87.0_beta20250430-src.tar.xz.asc 801 BLAKE2B 4ecdc70a469bce016e7c92a77a8c088ed37375e994a820b24c67269358eed4bc465aa77c4974b1e72586b23737b1d25844394b5de36fd4427978eff20bd07102 SHA512 f8c10cf66e2fb791de7b994bba622d1f8e8df75e48fd8d30795edaa6316b935583b51e235520d2aa2578cfcea1dda17ff2256317c7f4bb1f6606f5afbd6a80d1
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.87.0_beta20250430.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.87.0_beta20250430.ebuild
new file mode 100644
index 00000000000..acfa779e1a7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.87.0_beta20250430.ebuild
@@ -0,0 +1,813 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( 20 )
+PYTHON_COMPAT=( python3_{10..13} )
+
+RUST_MAX_VER=${PV%%_*}
+if [[ ${PV} == *9999* ]]; then
+	RUST_MIN_VER="1.85.0" # Update this as new `beta` releases come out.
+elif [[ ${PV} == *beta* ]]; then
+	# Enforce that `beta` is built from `stable`.
+	# While uncommon it is possible for feature changes within `beta` to result
+	# in an older snapshot being unable to build a newer one without modifying the sources.
+	# 'stable' releases should always be able to build a beta snapshot so just use those.
+	RUST_MAX_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).1"
+	RUST_MIN_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
+else
+	RUST_MIN_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
+fi
+
+inherit check-reqs estack flag-o-matic llvm-r1 multiprocessing optfeature \
+	multilib multilib-build python-any-r1 rust rust-toolchain toolchain-funcs verify-sig
+
+if [[ ${PV} = *9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/rust-lang/rust.git"
+	EGIT_SUBMODULES=(
+		"*"
+		"-src/gcc"
+	)
+elif [[ ${PV} == *beta* ]]; then
+	# Identify the snapshot date of the beta release:
+	# curl -Ls static.rust-lang.org/dist/channel-rust-beta.toml | grep beta-src.tar.xz
+	betaver=${PV//*beta}
+	BETA_SNAPSHOT="${betaver:0:4}-${betaver:4:2}-${betaver:6:2}"
+	MY_P="rustc-beta"
+	SRC_URI="https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz -> rustc-${PV}-src.tar.xz
+		verify-sig? ( https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz.asc
+			-> rustc-${PV}-src.tar.xz.asc )
+	"
+	S="${WORKDIR}/${MY_P}-src"
+else
+	MY_P="rustc-${PV}"
+	SRC_URI="https://static.rust-lang.org/dist/${MY_P}-src.tar.xz
+		verify-sig? ( https://static.rust-lang.org/dist/${MY_P}-src.tar.xz.asc )
+	"
+	S="${WORKDIR}/${MY_P}-src"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+fi
+
+DESCRIPTION="Systems programming language originally developed by Mozilla"
+HOMEPAGE="https://www.rust-lang.org/"
+
+# keep in sync with llvm ebuild of the same version as bundled one.
+ALL_LLVM_TARGETS=( AArch64 AMDGPU ARC ARM AVR BPF CSKY DirectX Hexagon Lanai
+	LoongArch M68k Mips MSP430 NVPTX PowerPC RISCV Sparc SPIRV SystemZ VE
+	WebAssembly X86 XCore Xtensa )
+ALL_LLVM_TARGETS=( "${ALL_LLVM_TARGETS[@]/#/llvm_targets_}" )
+LLVM_TARGET_USEDEPS=${ALL_LLVM_TARGETS[@]/%/(-)?}
+
+# https://github.com/rust-lang/llvm-project/blob/rustc-1.84.0/llvm/CMakeLists.txt
+_ALL_RUST_EXPERIMENTAL_TARGETS=( ARC CSKY DirectX M68k SPIRV Xtensa )
+declare -A ALL_RUST_EXPERIMENTAL_TARGETS
+for _x in "${_ALL_RUST_EXPERIMENTAL_TARGETS[@]}"; do
+	ALL_RUST_EXPERIMENTAL_TARGETS["llvm_targets_${_x}"]=0
+done
+
+LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
+SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
+
+IUSE="big-endian clippy cpu_flags_x86_sse2 debug dist doc llvm-libunwind lto rustfmt rust-analyzer rust-src +system-llvm test wasm ${ALL_LLVM_TARGETS[*]}"
+
+if [[ ${PV} = *9999* ]]; then
+	# These USE flags require nightly rust
+	IUSE+=" miri"
+fi
+
+LLVM_DEPEND=()
+# splitting usedeps needed to avoid CI/pkgcheck's UncheckableDep limitation
+for _x in "${ALL_LLVM_TARGETS[@]}"; do
+	LLVM_DEPEND+=( "	${_x}? ( $(llvm_gen_dep "llvm-core/llvm:\${LLVM_SLOT}[${_x}]") )" )
+	if [[ -v ALL_RUST_EXPERIMENTAL_TARGETS["${_x}"] ]] ; then
+		ALL_RUST_EXPERIMENTAL_TARGETS["${_x}"]=1
+	fi
+done
+LLVM_DEPEND+=( "	wasm? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') )" )
+LLVM_DEPEND+=( "	$(llvm_gen_dep 'llvm-core/llvm:${LLVM_SLOT}')" )
+
+BDEPEND="${PYTHON_DEPS}
+	app-eselect/eselect-rust
+	|| (
+		>=sys-devel/gcc-4.7[cxx]
+		>=llvm-core/clang-3.5
+	)
+	lto? ( system-llvm? (
+		|| (
+			$(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}')
+			sys-devel/mold
+		)
+	) )
+	!system-llvm? (
+		>=dev-build/cmake-3.13.4
+		app-alternatives/ninja
+	)
+	test? ( dev-debug/gdb )
+	verify-sig? ( sec-keys/openpgp-keys-rust )
+"
+
+DEPEND="
+	>=app-arch/xz-utils-5.2
+	net-misc/curl:=[http2,ssl]
+	sys-libs/zlib:=
+	dev-libs/openssl:0=
+	system-llvm? (
+		${LLVM_DEPEND[*]}
+		llvm-libunwind? ( llvm-runtimes/libunwind:= )
+	)
+	!system-llvm? (
+		!llvm-libunwind? (
+			elibc_musl? ( sys-libs/libunwind:= )
+		)
+	)
+"
+
+RDEPEND="${DEPEND}
+	app-eselect/eselect-rust
+	dev-lang/rust-common
+	sys-apps/lsb-release
+	!dev-lang/rust:stable
+	!dev-lang/rust-bin:stable
+"
+
+REQUIRED_USE="|| ( ${ALL_LLVM_TARGETS[*]} )
+	rust-analyzer? ( rust-src )
+	test? ( ${ALL_LLVM_TARGETS[*]} )
+	wasm? ( llvm_targets_WebAssembly )
+	x86? ( cpu_flags_x86_sse2 )
+"
+
+# we don't use cmake.eclass, but can get a warning
+CMAKE_WARN_UNUSED_CLI=no
+
+QA_FLAGS_IGNORED="
+	usr/lib/${PN}/${SLOT}/bin/.*
+	usr/lib/${PN}/${SLOT}/libexec/.*
+	usr/lib/${PN}/${SLOT}/lib/lib.*.so
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/bin/.*
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/lib/lib.*.so
+"
+
+QA_SONAME="
+	usr/lib/${PN}/${SLOT}/lib/lib.*.so.*
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/lib/lib.*.so
+"
+
+QA_PRESTRIPPED="
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/bin/rust-llvm-dwp
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/lib/self-contained/crtn.o
+"
+
+# An rmeta file is custom binary format that contains the metadata for the crate.
+# rmeta files do not support linking, since they do not contain compiled object files.
+# so we can safely silence the warning for this QA check.
+QA_EXECSTACK="usr/lib/${PN}/${SLOT}/lib/rustlib/*/lib*.rlib:lib.rmeta"
+
+# causes double bootstrap
+RESTRICT="test"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/rust.asc
+
+PATCHES=(
+	"${FILESDIR}"/1.85.0-cross-compile-libz.patch
+	"${FILESDIR}"/1.85.0-musl-dynamic-linking.patch
+	"${FILESDIR}"/1.67.0-doc-wasm.patch
+)
+
+clear_vendor_checksums() {
+	sed -i 's/\("files":{\)[^}]*/\1/' "vendor/${1}/.cargo-checksum.json" || die
+}
+
+toml_usex() {
+	usex "${1}" true false
+}
+
+src_unpack() {
+	if [[ ${PV} = *9999* ]]; then
+		git-r3_src_unpack
+		mkdir "${S}/.cargo" || die # The vendor script has a check for .cargo/config{,.toml}
+		touch "${S}/.cargo/config.toml" || die
+		local rust_stage0_root="$(${RUSTC} --print sysroot || die "Can't determine rust's sysroot")"
+		local rust_build=""
+		local rust_host=""
+		# Configure vendor to use the portage-provided toolchain. This prevents it from
+		# attempting to fetch a `beta` toolchain from the internet.
+		cat <<- _EOF_ > "${T}/vendor-config.toml"
+			[build]
+			build = "$(rust_abi "${CBUILD}")"
+			host = ["$(rust_abi "${CHOST}")"]
+			target = ["$(rust_abi "${CHOST}")"]
+			cargo = "${rust_stage0_root}/bin/cargo"
+			rustc = "${rust_stage0_root}/bin/rustc"
+			rustfmt = "${rust_stage0_root}/bin/rustfmt"
+		_EOF_
+		# We're using git sources so we need to run the Vendor script
+		# to ensure that all dependencies are present and up-to-date
+		mkdir "${S}/vendor" || die
+		# This also compiles the 'build helper', there's no way to avoid this.
+		${EPYTHON} "${S}"/x.py vendor -vvv --config="${T}"/vendor-config.toml -j$(makeopts_jobs) ||
+			die "Failed to vendor dependencies"
+		# TODO: This has to be generated somehow, this is from a 1.84.x tarball I had lying around.
+		cat <<- _EOF_ > "${S}/.cargo/config.toml"
+			[source.crates-io]
+			replace-with = "vendored-sources"
+
+			[source."git+https://github.com/rust-lang/team"]
+			git = "https://github.com/rust-lang/team"
+			replace-with = "vendored-sources"
+
+			[source.vendored-sources]
+			directory = "vendor"
+		_EOF_
+	else
+		verify-sig_src_unpack
+	fi
+}
+
+pre_build_checks() {
+	local M=9216
+	# multiply requirements by 1.3 if we are doing x86-multilib
+	if use amd64; then
+		M=$(( $(usex abi_x86_32 13 10) * ${M} / 10 ))
+	fi
+	M=$(( $(usex clippy 128 0) + ${M} ))
+	if [[ ${PV} == *9999* ]]; then
+		M=$(( $(usex miri 128 0) + ${M} ))
+	fi
+	M=$(( $(usex rustfmt 256 0) + ${M} ))
+	# add 2G if we compile llvm and 256M per llvm_target
+	if ! use system-llvm; then
+		M=$(( 2048 + ${M} ))
+		local ltarget
+		for ltarget in ${ALL_LLVM_TARGETS[@]}; do
+			M=$(( $(usex ${ltarget} 256 0) + ${M} ))
+		done
+	fi
+	M=$(( $(usex wasm 256 0) + ${M} ))
+	M=$(( $(usex debug 2 1) * ${M} ))
+	eshopts_push -s extglob
+	if is-flagq '-g?(gdb)?([1-9])'; then
+		M=$(( 15 * ${M} / 10 ))
+	fi
+	eshopts_pop
+	M=$(( $(usex doc 256 0) + ${M} ))
+	CHECKREQS_DISK_BUILD=${M}M check-reqs_pkg_${EBUILD_PHASE}
+}
+
+llvm_check_deps() {
+	has_version -r "llvm-core/llvm:${LLVM_SLOT}[${LLVM_TARGET_USEDEPS// /,}]"
+}
+
+# Is LLVM being linked against libc++?
+is_libcxx_linked() {
+	local code='#include <ciso646>
+#if defined(_LIBCPP_VERSION)
+	HAVE_LIBCXX
+#endif
+'
+	local out=$($(tc-getCXX) ${CXXFLAGS} ${CPPFLAGS} -x c++ -E -P - <<<"${code}") || return 1
+	[[ ${out} == *HAVE_LIBCXX* ]]
+}
+
+pkg_pretend() {
+	pre_build_checks
+}
+
+pkg_setup() {
+	pre_build_checks
+	python-any-r1_pkg_setup
+
+	export LIBGIT2_NO_PKG_CONFIG=1 #749381
+	if tc-is-cross-compiler; then
+		use system-llvm && die "USE=system-llvm not allowed when cross-compiling"
+		local cross_llvm_target="$(llvm_tuple_to_target "${CBUILD}")"
+		use "llvm_targets_${cross_llvm_target}" || \
+			die "Must enable LLVM_TARGETS=${cross_llvm_target} matching CBUILD=${CBUILD} when cross-compiling"
+	fi
+
+	rust_pkg_setup
+
+	if use system-llvm; then
+		llvm-r1_pkg_setup
+
+		local llvm_config="$(get_llvm_prefix)/bin/llvm-config"
+		export LLVM_LINK_SHARED=1
+		export RUSTFLAGS="${RUSTFLAGS} -Lnative=$("${llvm_config}" --libdir)"
+	fi
+}
+
+src_prepare() {
+	if [[ ${PV} = *9999* ]]; then
+		# We need to update / generate lockfiles for the workspace
+		${CARGO} generate-lockfile --offline
+
+	fi
+	# Rust baselines to Pentium4 on x86, this patch lowers the baseline to i586 when sse2 is not set.
+	if use x86; then
+		if ! use cpu_flags_x86_sse2; then
+			eapply "${FILESDIR}/1.82.0-i586-baseline.patch"
+			#grep -rl cmd.args.push\(\"-march=i686\" . | xargs sed  -i 's/march=i686/-march=i586/g' || die
+		fi
+	fi
+
+	if use lto && tc-is-clang && ! tc-ld-is-lld && ! tc-ld-is-mold; then
+		export RUSTFLAGS+=" -C link-arg=-fuse-ld=lld"
+	fi
+
+	default
+}
+
+src_configure() {
+	if tc-is-cross-compiler; then
+		export PKG_CONFIG_ALLOW_CROSS=1
+		export PKG_CONFIG_PATH="${ESYSROOT}/usr/$(get_libdir)/pkgconfig"
+		export OPENSSL_INCLUDE_DIR="${ESYSROOT}/usr/include"
+		export OPENSSL_LIB_DIR="${ESYSROOT}/usr/$(get_libdir)"
+	fi
+
+	filter-lto # https://bugs.gentoo.org/862109 https://bugs.gentoo.org/866231
+
+	local rust_target="" rust_targets="" arch_cflags
+
+	# Collect rust target names to compile standard libs for all ABIs.
+	for v in $(multilib_get_enabled_abi_pairs); do
+		rust_targets+=",\"$(rust_abi $(get_abi_CHOST ${v##*.}))\""
+	done
+	if use wasm; then
+		rust_targets+=",\"wasm32-unknown-unknown\""
+		if use system-llvm; then
+			# un-hardcode rust-lld linker for this target
+			# https://bugs.gentoo.org/715348
+			sed -i '/linker:/ s/rust-lld/wasm-ld/' compiler/rustc_target/src/spec/base/wasm.rs || die
+		fi
+	fi
+	rust_targets="${rust_targets#,}"
+
+	# cargo and rustdoc are mandatory and should always be included
+	local tools='"cargo","rustdoc"'
+	use clippy && tools+=',"clippy"'
+	use rustfmt && tools+=',"rustfmt"'
+	use rust-analyzer && tools+=',"rust-analyzer","rust-analyzer-proc-macro-srv"'
+	use rust-src && tools+=',"src"'
+
+	if [[ ${PV} == *9999* ]]; then
+		use miri && tools+=',"miri"'
+	fi
+
+	local rust_stage0_root="$(${RUSTC} --print sysroot || die "Can't determine rust's sysroot")"
+	# in case of prefix it will be already prefixed, as --print sysroot returns full path
+	[[ -d ${rust_stage0_root} ]] || die "${rust_stage0_root} is not a directory"
+
+	rust_target="$(rust_abi)"
+	rust_build="$(rust_abi "${CBUILD}")"
+	rust_host="$(rust_abi "${CHOST}")"
+
+	RUST_EXPERIMENTAL_TARGETS=()
+	for _x in "${!ALL_RUST_EXPERIMENTAL_TARGETS[@]}"; do
+		if [[ ${ALL_RUST_EXPERIMENTAL_TARGETS[${_x}]} == 1 ]] && use ${_x} ; then
+			RUST_EXPERIMENTAL_TARGETS+=( ${_x#llvm_targets_} )
+		fi
+	done
+	RUST_EXPERIMENTAL_TARGETS=${RUST_EXPERIMENTAL_TARGETS[@]}
+
+	local cm_btype="$(usex debug DEBUG RELEASE)"
+	local build_channel
+	local build_miri="false"
+	case "${PV}" in
+		*9999*)
+			build_channel="nightly"
+			;;
+		*beta*)
+			build_channel="beta"
+			;;
+		*)
+			build_channel="stable"
+			;;
+	esac
+	cat <<- _EOF_ > "${S}"/config.toml
+		# https://github.com/rust-lang/rust/issues/135358 (bug #947897)
+		profile = "dist"
+		[llvm]
+		download-ci-llvm = false
+		optimize = $(toml_usex !debug)
+		release-debuginfo = $(toml_usex debug)
+		assertions = $(toml_usex debug)
+		ninja = true
+		targets = "${LLVM_TARGETS// /;}"
+		experimental-targets = "${RUST_EXPERIMENTAL_TARGETS// /;}"
+		link-shared = $(toml_usex system-llvm)
+		$(if is_libcxx_linked; then
+			# https://bugs.gentoo.org/732632
+			echo "use-libcxx = true"
+			echo "static-libstdcpp = false"
+		fi)
+		$(case "${rust_target}" in
+			i586-*-linux-*)
+				# https://github.com/rust-lang/rust/issues/93059
+				echo 'cflags = "-fcf-protection=none"'
+				echo 'cxxflags = "-fcf-protection=none"'
+				echo 'ldflags = "-fcf-protection=none"'
+				;;
+			*)
+				;;
+		esac)
+		enable-warnings = false
+		[llvm.build-config]
+		CMAKE_VERBOSE_MAKEFILE = "ON"
+		$(if ! tc-is-cross-compiler; then
+			# When cross-compiling, LLVM is compiled twice, once for host and
+			# once for target.  Unfortunately, this build configuration applies
+			# to both, which means any flags applicable to one target but not
+			# the other will break.  Conditionally disable respecting user
+			# flags when cross-compiling.
+			echo "CMAKE_C_FLAGS_${cm_btype} = \"${CFLAGS}\""
+			echo "CMAKE_CXX_FLAGS_${cm_btype} = \"${CXXFLAGS}\""
+			echo "CMAKE_EXE_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
+			echo "CMAKE_MODULE_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
+			echo "CMAKE_SHARED_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
+			echo "CMAKE_STATIC_LINKER_FLAGS_${cm_btype} = \"${ARFLAGS}\""
+		fi)
+		[build]
+		build-stage = 2
+		test-stage = 2
+		build = "${rust_build}"
+		host = ["${rust_host}"]
+		target = [${rust_targets}]
+		cargo = "${rust_stage0_root}/bin/cargo"
+		rustc = "${rust_stage0_root}/bin/rustc"
+		rustfmt = "${rust_stage0_root}/bin/rustfmt"
+		docs = $(toml_usex doc)
+		compiler-docs = false
+		submodules = false
+		python = "${EPYTHON}"
+		locked-deps = true
+		vendor = true
+		extended = true
+		tools = [${tools}]
+		verbose = 2
+		sanitizers = false
+		profiler = true
+		cargo-native-static = false
+		[install]
+		prefix = "${EPREFIX}/usr/lib/${PN}/${SLOT}"
+		sysconfdir = "etc"
+		docdir = "share/doc/rust"
+		bindir = "bin"
+		libdir = "lib"
+		mandir = "share/man"
+		[rust]
+		# https://github.com/rust-lang/rust/issues/54872
+		codegen-units-std = 1
+		optimize = true
+		debug = $(toml_usex debug)
+		debug-assertions = $(toml_usex debug)
+		debug-assertions-std = $(toml_usex debug)
+		debuginfo-level = $(usex debug 2 0)
+		debuginfo-level-rustc = $(usex debug 2 0)
+		debuginfo-level-std = $(usex debug 2 0)
+		debuginfo-level-tools = $(usex debug 2 0)
+		debuginfo-level-tests = 0
+		backtrace = true
+		incremental = false
+		$(if ! tc-is-cross-compiler; then
+			echo "default-linker = \"${CHOST}-cc\""
+		fi)
+		channel = "${build_channel}"
+		description = "gentoo"
+		rpath = true
+		verbose-tests = true
+		optimize-tests = $(toml_usex !debug)
+		codegen-tests = true
+		dist-src = false
+		remap-debuginfo = true
+		lld = $(usex system-llvm false $(toml_usex wasm))
+		$(if use lto && tc-is-clang && ! tc-ld-is-mold; then
+			echo "use-lld = true"
+		fi)
+		# only deny warnings if doc+wasm are NOT requested, documenting stage0 wasm std fails without it
+		# https://github.com/rust-lang/rust/issues/74976
+		# https://github.com/rust-lang/rust/issues/76526
+		deny-warnings = $(usex wasm $(usex doc false true) true)
+		backtrace-on-ice = true
+		jemalloc = false
+		# See https://github.com/rust-lang/rust/issues/121124
+		lto = "$(usex lto thin off)"
+		[dist]
+		src-tarball = false
+		compression-formats = ["xz"]
+		compression-profile = "balanced"
+	_EOF_
+
+	for v in $(multilib_get_enabled_abi_pairs); do
+		rust_target=$(rust_abi $(get_abi_CHOST ${v##*.}))
+		arch_cflags="$(get_abi_CFLAGS ${v##*.})"
+
+		export CFLAGS_${rust_target//-/_}="${arch_cflags}"
+
+		cat <<- _EOF_ >> "${S}"/config.toml
+			[target.${rust_target}]
+			ar = "$(tc-getAR)"
+			cc = "$(tc-getCC)"
+			cxx = "$(tc-getCXX)"
+			linker = "$(tc-getCC)"
+			ranlib = "$(tc-getRANLIB)"
+			llvm-libunwind = "$(usex llvm-libunwind $(usex system-llvm system in-tree) no)"
+		_EOF_
+		if use system-llvm; then
+			cat <<- _EOF_ >> "${S}"/config.toml
+				llvm-config = "$(get_llvm_prefix)/bin/llvm-config"
+			_EOF_
+		fi
+		# by default librustc_target/spec/linux_musl_base.rs sets base.crt_static_default = true;
+		# but we patch it and set to false here as well
+		if use elibc_musl; then
+			cat <<- _EOF_ >> "${S}"/config.toml
+				crt-static = false
+				musl-root = "$($(tc-getCC) -print-sysroot)/usr"
+			_EOF_
+		fi
+	done
+	if use wasm; then
+		wasm_target="wasm32-unknown-unknown"
+		export CFLAGS_${wasm_target//-/_}="$(filter-flags '-mcpu*' '-march*' '-mtune*'; echo "$CFLAGS")"
+		cat <<- _EOF_ >> "${S}"/config.toml
+			[target.wasm32-unknown-unknown]
+			linker = "$(usex system-llvm lld rust-lld)"
+			# wasm target does not have profiler_builtins https://bugs.gentoo.org/848483
+			profiler = false
+		_EOF_
+	fi
+
+	if [[ -n ${I_KNOW_WHAT_I_AM_DOING_CROSS} ]]; then # whitespace intentionally shifted below
+	# experimental cross support
+	# discussion: https://bugs.gentoo.org/679878
+	# TODO: c*flags, clang, system-llvm, cargo.eclass target support
+	# it would be much better if we could split out stdlib
+	# complilation to separate ebuild and abuse CATEGORY to
+	# just install to /usr/lib/rustlib/<target>
+
+	# extra targets defined as a bash array
+	# spec format:  <LLVM target>:<rust-target>:<CTARGET>
+	# best place would be /etc/portage/env/dev-lang/rust
+	# Example:
+	# RUST_CROSS_TARGETS=(
+	#	"AArch64:aarch64-unknown-linux-gnu:aarch64-unknown-linux-gnu"
+	# )
+	# no extra hand holding is done, no target transformations, all
+	# values are passed as-is with just basic checks, so it's up to user to supply correct values
+	# valid rust targets can be obtained with
+	# 	rustc --print target-list
+	# matching cross toolchain has to be installed
+	# matching LLVM_TARGET has to be enabled for both rust and llvm (if using system one)
+	# only gcc toolchains installed with crossdev are checked for now.
+
+	# BUG: we can't pass host flags to cross compiler, so just filter for now
+	# BUG: this should be more fine-grained.
+	filter-flags '-mcpu=*' '-march=*' '-mtune=*'
+
+	local cross_target_spec
+	for cross_target_spec in "${RUST_CROSS_TARGETS[@]}";do
+		# extracts first element form <LLVM target>:<rust-target>:<CTARGET>
+		local cross_llvm_target="${cross_target_spec%%:*}"
+		# extracts toolchain triples, <rust-target>:<CTARGET>
+		local cross_triples="${cross_target_spec#*:}"
+		# extracts first element after before : separator
+		local cross_rust_target="${cross_triples%%:*}"
+		# extracts last element after : separator
+		local cross_toolchain="${cross_triples##*:}"
+		use llvm_targets_${cross_llvm_target} || die "need llvm_targets_${cross_llvm_target} target enabled"
+		command -v ${cross_toolchain}-gcc > /dev/null 2>&1 || die "need ${cross_toolchain} cross toolchain"
+
+		cat <<- _EOF_ >> "${S}"/config.toml
+			[target.${cross_rust_target}]
+			ar = "${cross_toolchain}-ar"
+			cc = "${cross_toolchain}-gcc"
+			cxx = "${cross_toolchain}-g++"
+			linker = "${cross_toolchain}-gcc"
+			ranlib = "${cross_toolchain}-ranlib"
+		_EOF_
+		if use system-llvm; then
+			cat <<- _EOF_ >> "${S}"/config.toml
+				llvm-config = "$(get_llvm_prefix)/bin/llvm-config"
+			_EOF_
+		fi
+		if [[ "${cross_toolchain}" == *-musl* ]]; then
+			cat <<- _EOF_ >> "${S}"/config.toml
+				musl-root = "$(${cross_toolchain}-gcc -print-sysroot)/usr"
+			_EOF_
+		fi
+
+		# append cross target to "normal" target list
+		# example 'target = ["powerpc64le-unknown-linux-gnu"]'
+		# becomes 'target = ["powerpc64le-unknown-linux-gnu","aarch64-unknown-linux-gnu"]'
+
+		rust_targets="${rust_targets},\"${cross_rust_target}\""
+		sed -i "/^target = \[/ s#\[.*\]#\[${rust_targets}\]#" config.toml || die
+
+		ewarn
+		ewarn "Enabled ${cross_rust_target} rust target"
+		ewarn "Using ${cross_toolchain} cross toolchain"
+		ewarn
+		if ! has_version -b 'sys-devel/binutils[multitarget]' ; then
+			ewarn "'sys-devel/binutils[multitarget]' is not installed"
+			ewarn "'strip' will be unable to strip cross libraries"
+			ewarn "cross targets will be installed with full debug information"
+			ewarn "enable 'multitarget' USE flag for binutils to be able to strip object files"
+			ewarn
+			ewarn "Alternatively llvm-strip can be used, it supports stripping any target"
+			ewarn "define STRIP=\"llvm-strip\" to use it (experimental)"
+			ewarn
+		fi
+	done
+	fi # I_KNOW_WHAT_I_AM_DOING_CROSS
+
+	einfo "Rust configured with the following flags:"
+	echo
+	echo RUSTFLAGS="\"${RUSTFLAGS}\""
+	echo RUSTFLAGS_BOOTSTRAP="\"${RUSTFLAGS_BOOTSTRAP}\""
+	echo RUSTFLAGS_NOT_BOOTSTRAP="\"${RUSTFLAGS_NOT_BOOTSTRAP}\""
+	echo MAGIC_EXTRA_RUSTFLAGS="\"${MAGIC_EXTRA_RUSTFLAGS}\""
+	env | grep "CARGO_TARGET_.*_RUSTFLAGS="
+	env | grep "CFLAGS_.*"
+	echo
+	einfo "config.toml contents:"
+	cat "${S}"/config.toml || die
+	echo
+}
+
+src_compile() {
+	RUST_BACKTRACE=1 "${EPYTHON}" ./x.py build -vvv --config="${S}"/config.toml -j$(makeopts_jobs) || die
+}
+
+src_test() {
+	# https://rustc-dev-guide.rust-lang.org/tests/intro.html
+
+	# those are basic and codegen tests.
+	local tests=(
+		codegen
+		codegen-units
+		compile-fail
+		incremental
+		mir-opt
+		pretty
+		run-make
+	)
+
+	# fails if llvm is not built with ALL targets.
+	# and known to fail with system llvm sometimes.
+	use system-llvm || tests+=( assembly )
+
+	# fragile/expensive/less important tests
+	# or tests that require extra builds
+	# TODO: instead of skipping, just make some nonfatal.
+	if [[ ${ERUST_RUN_EXTRA_TESTS:-no} != no ]]; then
+		tests+=(
+			rustdoc
+			rustdoc-js
+			rustdoc-js-std
+			rustdoc-ui
+			run-make-fulldeps
+			ui
+			ui-fulldeps
+		)
+	fi
+
+	local i failed=()
+	einfo "rust_src_test: enabled tests ${tests[@]/#/src/test/}"
+	for i in "${tests[@]}"; do
+		local t="src/test/${i}"
+		einfo "rust_src_test: running ${t}"
+		if ! RUST_BACKTRACE=1 "${EPYTHON}" ./x.py test -vv --config="${S}"/config.toml \
+				-j$(makeopts_jobs) --no-doc --no-fail-fast "${t}"
+		then
+				failed+=( "${t}" )
+				eerror "rust_src_test: ${t} failed"
+		fi
+	done
+
+	if [[ ${#failed[@]} -ne 0 ]]; then
+		eerror "rust_src_test: failure summary: ${failed[@]}"
+		die "aborting due to test failures"
+	fi
+}
+
+src_install() {
+	DESTDIR="${D}" "${EPYTHON}" ./x.py install -vv --config="${S}"/config.toml -j$(makeopts_jobs) || die
+
+	docompress /usr/lib/${PN}/${SLOT}/share/man/
+
+	# bug #689562, #689160
+	rm -v "${ED}/usr/lib/${PN}/${SLOT}/etc/bash_completion.d/cargo" || die
+	rmdir -v "${ED}/usr/lib/${PN}/${SLOT}"/etc{/bash_completion.d,} || die
+
+	local symlinks=(
+		cargo
+		rustc
+		rustdoc
+		rust-gdb
+		rust-gdbgui
+		rust-lldb
+	)
+
+	use clippy && symlinks+=( clippy-driver cargo-clippy )
+	if [[ ${PV} = *9999* ]]; then
+		use miri && symlinks+=( miri cargo-miri )
+	fi
+	use rustfmt && symlinks+=( rustfmt cargo-fmt )
+	use rust-analyzer && symlinks+=( rust-analyzer )
+
+	einfo "installing eselect-rust symlinks and paths: ${symlinks[@]}"
+	local i
+	for i in "${symlinks[@]}"; do
+		# we need realpath on /usr/bin/* symlink return version-appended binary path.
+		# so /usr/bin/rustc should point to /usr/lib/rust/<ver>/bin/rustc-<ver>
+		# need to fix eselect-rust to remove this hack.
+		local ver_i="${i}-${PV%%_*}"
+		if [[ -f "${ED}/usr/lib/${PN}/${SLOT}/bin/${i}" ]]; then
+			einfo "Installing ${i} symlink"
+			ln -v "${ED}/usr/lib/${PN}/${SLOT}/bin/${i}" "${ED}/usr/lib/${PN}/${SLOT}/bin/${ver_i}" || die
+		else
+			ewarn "${i} symlink requested, but source file not found"
+			ewarn "please report this"
+		fi
+		dosym "../lib/${PN}/${SLOT}/bin/${ver_i}" "/usr/bin/${ver_i}"
+	done
+
+	# symlinks to switch components to active rust in eselect
+	dosym "${SLOT}/lib" "/usr/lib/${PN}/lib-${SLOT}"
+	use rust-analyzer && dosym "${SLOT}/libexec" "/usr/lib/${PN}/libexec-${SLOT}"
+	dosym "${SLOT}/share/man" "/usr/lib/${PN}/man-${SLOT}"
+	dosym "rust/${SLOT}/lib/rustlib" "/usr/lib/rustlib-${SLOT}"
+	dosym "../../lib/${PN}/${SLOT}/share/doc/rust" "/usr/share/doc/${P}"
+
+	newenvd - "50${P}" <<-_EOF_
+		MANPATH="${EPREFIX}/usr/lib/rust/man-${SLOT}"
+	_EOF_
+
+	rm -rf "${ED}/usr/lib/${PN}/${SLOT}"/*.old || die
+	rm -rf "${ED}/usr/lib/${PN}/${SLOT}/bin"/*.old || die
+	rm -rf "${ED}/usr/lib/${PN}/${SLOT}/doc"/*.old || die
+
+	# note: eselect-rust adds EROOT to all paths below
+	cat <<-_EOF_ > "${T}/provider-${PN}-${SLOT}"
+		/usr/bin/cargo
+		/usr/bin/rustdoc
+		/usr/bin/rust-gdb
+		/usr/bin/rust-gdbgui
+		/usr/bin/rust-lldb
+		/usr/lib/rustlib
+		/usr/lib/rust/lib
+		/usr/lib/rust/man
+		/usr/share/doc/rust
+	_EOF_
+
+	if use clippy; then
+		echo /usr/bin/clippy-driver >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-clippy >> "${T}/provider-${P}"
+	fi
+	if [[ ${SLOT} == *9999* ]] && use miri; then
+		echo /usr/bin/miri >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-miri >> "${T}/provider-${P}"
+	fi
+	if use rustfmt; then
+		echo /usr/bin/rustfmt >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-fmt >> "${T}/provider-${P}"
+	fi
+	if use rust-analyzer; then
+		echo /usr/lib/rust/libexec >> "${T}/provider-${P}"
+		echo /usr/bin/rust-analyzer >> "${T}/provider-${P}"
+	fi
+
+	insinto /etc/env.d/rust
+	doins "${T}/provider-${PN}-${SLOT}"
+
+	if use dist; then
+		"${EPYTHON}" ./x.py dist -vv --config="${S}"/config.toml -j$(makeopts_jobs) || die
+		insinto "/usr/lib/${PN}/${SLOT}/dist"
+		doins -r "${S}/build/dist/."
+	fi
+}
+
+pkg_postinst() {
+
+	eselect rust update
+
+	if has_version dev-debug/gdb || has_version llvm-core/lldb; then
+		elog "Rust installs helper scripts for calling GDB and LLDB,"
+		elog "for convenience they are installed under /usr/bin/rust-{gdb,lldb}-${PV}."
+	fi
+
+	if has_version app-editors/emacs; then
+		optfeature "emacs support for rust" app-emacs/rust-mode
+	fi
+
+	if has_version app-editors/gvim || has_version app-editors/vim; then
+		optfeature "vim support for rust" app-vim/rust-vim
+	fi
+}
+
+pkg_postrm() {
+	eselect rust cleanup
+}

From 43b9e8508b8d5a85984016b1fb333c650de4d4cb Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:37 +0000
Subject: [PATCH 016/136] dev-lang/rust-bin: Sync with Gentoo

It's from Gentoo commit 0fa175308df33b5ddd4082cc3cb302bdfcfd0d7d.
---
 .../portage-stable/dev-lang/rust-bin/Manifest |  29 ++
 .../rust-bin-1.87.0_beta20250430.ebuild       | 314 ++++++++++++++++++
 2 files changed, 343 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.87.0_beta20250430.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest
index 5c83bf3aee4..eff32e830de 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest
@@ -581,6 +581,34 @@ DIST rust-1.87.0_beta20250420-x86_64-unknown-linux-gnu.tar.xz 198552720 BLAKE2B
 DIST rust-1.87.0_beta20250420-x86_64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 45a0d818111946afc5e6544deea84d649175a0059f6a4574b7d7d2095ff008285ad09945f7e79b02331b13627da51cdea535cf80e4454248572a1fe5524489f2 SHA512 47d46d2c48cbe2a0b72278bf4e60483b889d83371ee35eb568809cd50d1e5058eee62f416e1ba3871016e0a2957be57a3716882eae41eb6c384510f4e523e3af
 DIST rust-1.87.0_beta20250420-x86_64-unknown-linux-musl.tar.xz 293222552 BLAKE2B 167b847bb5f23de2ab1b918976c7abe8cfa9d98b51ffad52aa208d986c9e409f37f72114280dd61a255496502d92d22e0d26c233c4034214d5e9f1565ecd32f1 SHA512 535e5320e11e70b86213146803994b7bf15475c24aa2822cf9f193586b01e8d77de509d9ba08cd6892f43b2caf1c22c657c4a1949582bc10283a47fc014de2d6
 DIST rust-1.87.0_beta20250420-x86_64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B e25674a14e3efdfd95fe2269c9848bd9c78a9f7819d35a6fa54abc50478250eaf1207249719d92b9d8fa104943a3129ff3045cd4e7039febf94ad483098796fd SHA512 f493ca8b9604350e93deec6b698086662b82b8b774d66b7090815755657111255710b04105bff9f72d9d83de0268cb34df4db9c184f1066a364d5c44dda3331f
+DIST rust-1.87.0_beta20250430-aarch64-unknown-linux-gnu.tar.xz 167147580 BLAKE2B 2ec0c7bff468066cfcb8541446db8b3889b0c992941f7d68d5dc8df91fdb8e1e1f42ca057923f258bfd0b18ef83d2abbb554c3d49ef3ba82556049bce58dd0c2 SHA512 24e6a8ec7e3bad6d43d3dd099155face0d394318f6b6316d7e8154461e7e09580e5a92dc558ab02dbb2a8233cf2e60371742c49c31430fb6f1769d948dd34713
+DIST rust-1.87.0_beta20250430-aarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 64910eba90333c5f624c30c72be35b9ff496efd35ffd5fb4360dfdfe7215420ff349c7c027754ec7cd320d1939c98ff0961f8c806a4b8a05d16cd308195f54ef SHA512 6a92e0b4b1cc02c213c22f6edf63d329ece491cf58b61d63592465acd7fdacc7d1a0e276a53518053e55133810eb1a0b5d2753b2bf1125c55b547cd6551c681e
+DIST rust-1.87.0_beta20250430-aarch64-unknown-linux-musl.tar.xz 244234060 BLAKE2B 1679d52281225052cff41fba99336265985a69f4b09c11d7d4920bb5c9f8ca9fd299ef7d62d50a9dfb5609cea0d8113aa7e0ec51efe509fa0d14f710589e1024 SHA512 3c69f7096f2506fe4b794c0ad05815b8a78074b07ce96f6fa7ed8e8df6a792e9744671c631dd486f7aa8f29c539f01503a6d2a4c031cf4265583463ae4f24060
+DIST rust-1.87.0_beta20250430-aarch64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B d1f94c49fc4e5d664eb8b3b0cb532bc6e8d8260f841f294d6b5cdd8800dbd1fbd7e8058f29f8acfaaf079ffe93813870825b498c9747eb58a35e35161f82f12e SHA512 9e394188c89a7e5a63a909976e413d699f29a81c21c53fa140929c788050bee497c2565abb8836b884bec926f7bc9e59b7be5e6bdf7a8c5381171c724c3ff700
+DIST rust-1.87.0_beta20250430-arm-unknown-linux-gnueabi.tar.xz 229441924 BLAKE2B 21b58de7968db77c8f24afe7967dd659a5c1de07496ad8bba0f82b6acecdbd8bac91a0bc5c864d2cb0fe7176e3db3bdf0d16d02a3ad077cdb4668e0f18310a26 SHA512 e19b4067a9feffa70f3f9c34c8da1a83ca57a652225250f8c84a83a1b890d85d3e73b9d34f1428c2a227af231414203e1121642afb546a8c258f07ae3d229ae1
+DIST rust-1.87.0_beta20250430-arm-unknown-linux-gnueabi.tar.xz.asc 801 BLAKE2B e1c4c59e1502335dbe3aa50037e1db033b05a478193b6554f1f9b6b7e982885fd219c4a6274bb2bbd79cfadbefa85fe1f66f6f61650b3b1127760c0839d2918a SHA512 b3ad2a9441eb45c191568c7e395e60f556feb2be99b70e414e67d9282c0e319a3320ad9c26a89355fa190bd0862ef3c0c61b877f1aabbb1fbe406c73bc8d3818
+DIST rust-1.87.0_beta20250430-arm-unknown-linux-gnueabihf.tar.xz 229878332 BLAKE2B 6ef869de529838361bee3b3d38f6e3514a11330fffdaeece39834ed4b7184ab6d7381e7fccc4973f14584983c3e49b4ee32784d6c63c4ce11ac0d405fc294e7e SHA512 febca06c04b7e7a6448cc9a939ab9ad9fa638c42b5c7916a1c01bf5331099806dc707d1a5cb64dca8afe65596eb0fca834ed2cd3e9b4a6084b09f1b868c44f92
+DIST rust-1.87.0_beta20250430-arm-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B 9d9f44ae951e36da32894de8501ed313bf2d37033e83068b7d2876107c9561d79dc608c6b508224c30c12d4557f46babd9198f1c6b7d657d99aab6a9d0747e6a SHA512 1e46482639d61c5e1b26d2e388cde801b102189aed1ff2c19ca04d93062e3e37792f239cdde2488c97ea793d594e610567d629e47466b00e859e4c63229a2c42
+DIST rust-1.87.0_beta20250430-armv7-unknown-linux-gnueabihf.tar.xz 235550796 BLAKE2B d7820490576cdc9c99a120e16c018a29f97d4f6929af5c1b37e0e2619f01f1ab91c1bace836168062f164b5da4488cb02248e4df2d497b451b754e941c2f46cd SHA512 54c5b5a9f335965a01453f029b40de7ef9dda703a94d18176526ecd6677acdded12fab18c692489868f5f766a3bccdf26fddbeca7e22a161a59726edb6c4d7c2
+DIST rust-1.87.0_beta20250430-armv7-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B 0ea8ed089f21dc07a58a6954ddb5ff602a2d5a87d7445ba962151f288d261545417974a66a8d44f8a4953b0b3a0c78385f73b1e199732e2b8cdb86a76314bd73 SHA512 1f94dfb40f307c9063fd4ba48e06eb7e67db8ac87b4a91dd5259db555f9be26637dba98bfa1b0a7d0e3c9c21322d67e9728e34e1af6332c26a5b4d6fb8696b12
+DIST rust-1.87.0_beta20250430-i686-unknown-linux-gnu.tar.xz 263614824 BLAKE2B afbd536a1ba02bdab43531d4819174e618660ab4f0add25cf145c03d8b48ea5e01ebf5148476ccfebdf6f80761f8aa62edf6313775ee751007921b499299fcc4 SHA512 9fe21def3ff36d4415f859cc3cdf2b975df2dfc5dd8656be18c67d0e2ac7136d8906fa0c4d3dd30f5726ef6cbd8a58338dd4d10ea97e09884a4df387a2163997
+DIST rust-1.87.0_beta20250430-i686-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 2b36afb99494f3e68b147da9c72b318515672480d262f38ca96692033de835647d5e99f3deed7ece247efb82b13ed913a8bcda1e4e64a5704356b40ed8b6fef8 SHA512 f1cf97043941981a19624a579b4700e320fc5f029f19fae900a3d6225d6f92d7951f5afb90356e681b585ae03ac1f923ff4d82c5e5d5c3a693684beca77592a7
+DIST rust-1.87.0_beta20250430-loongarch64-unknown-linux-gnu.tar.xz 261199080 BLAKE2B 1d9f5258a232c11f074b48874c11c54f4b6d7fcafb25203300609bcd52668455f8380ef49a17f607d06d050f7152f282778067bd13eda0e7ffa6a5312b26fd47 SHA512 90bb1bbaa8438e713e5f47a28da362ab5f9c685e4b62a4247c5451fb7a32d5a9fa7a46334c49abd905e2148831263226bdbebd1f57867c3538f4b48ff6988952
+DIST rust-1.87.0_beta20250430-loongarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B d3ae6b7e2def424f3c6ccbffdf442bb90c8dd7ec3ba193196c29fecd8f3ce6ad50b55e0a766937c1e63d75d62ebb5a2f1c55fed3817bf4aedaa86fa2fd7a3efc SHA512 a8ac9fd9d4b23af73b36048ec90e37dd2c090ed8107a55f2fc47134dc542334a1037674de994c5a15291696bc272481d5ca38d49a317143926453bcadb59145c
+DIST rust-1.87.0_beta20250430-powerpc-unknown-linux-gnu.tar.xz 255715968 BLAKE2B 9286b725d3d6dc07a5dce972f069d908d08af2680f7fd2986373d2e7abdb4bfaf630303793b08d648a4899adc5f2794d46b2ac1100d822c1f81740c60b32ae18 SHA512 dc87cd8e4ea9f15e3fad80ad26adafbadf29f7b3c9424640559d5f8cd6314d59aaafce189e0b036cf9a8acb071e5b1274462710eb3250e7db01020397e924d7b
+DIST rust-1.87.0_beta20250430-powerpc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 0830fbe1671733020d79d4b7ede135a88f8448ff0e90f17c8019b7e1e55e49f1276c8dfec80598cc48b15cffef4e863dbadf00dd1a636d90b1dfd2233c85c35e SHA512 9b2e0915384a4f0e3314d520aad896ddbf159fe173a4342bb9c16eec15e373177bb07b2cd6270596bbd373d46ee7fec438f7f5421fe86bba0fc022eaa6eaea34
+DIST rust-1.87.0_beta20250430-powerpc64-unknown-linux-gnu.tar.xz 255890928 BLAKE2B a133c38bb5f9dbac8d83bcb4be95b347b5c906f61f8ffe586383748b82d55709dd5f2d18bf364688ff85972cf7112b3a3c14b95d3ce05eabc07cafb17bc89506 SHA512 33d44e20d9a0d0af2225b6c64177e8bb82f6eb2af601f4fc1028413c158d00ba13ff19b0fe9155a4d3820dc9f773d8e298cc627804a6082eb708e680cd36824c
+DIST rust-1.87.0_beta20250430-powerpc64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B fc5990ab276c136a32309898ba4b90598cd94168c2bb596f3f7794b9ce015b3c1bc4b4b011bb03161cc6a41df8fdb9733655852ad6fb3f04df4b61d6a970f391 SHA512 f80a43d76b85aa510bce8ec64d5960c57dfa7faec3a3d7d79a27253db7176e7b9f1b0dfb63aa062d6c7b8910f12500cfc3fcb362ae4c8106c14bc336aec39eae
+DIST rust-1.87.0_beta20250430-powerpc64le-unknown-linux-gnu.tar.xz 271446928 BLAKE2B 3f4ecf61f439cc17564d9df55c550fdd40fff73728d897783af1d7254c372dfc330a0fd347d55563c07f5aea1bd60717876550f6aa260222ac347dd892f44e8e SHA512 ce662c8db1479f7f1d3a497974d0d7dd8575cbd34e51d55350d3ca0eca13d85a0566a9ea3d61970fcf81dcb2e40f690fd1a9aac81d715f8dff9e4024a796ef28
+DIST rust-1.87.0_beta20250430-powerpc64le-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B a81b1fd6118d58b52b3ad790db2b9cd444ed007cc9b9bff96f44b04b6adaedf2e788d84d145c9ec31639aa2ae2e61b2f505274aa00bcfe673288e42ebc489cf9 SHA512 abc90d739d8f2b85e3929dec2b0edfe2566b0154a7111dbf89a4111cfa7b863ce4c6058de402e1c33667792051120b40efc4995145a6b5d27493cf2437c99873
+DIST rust-1.87.0_beta20250430-riscv64gc-unknown-linux-gnu.tar.xz 250452368 BLAKE2B aeb063f9a7e2c2334f8f00a84362f6de67dfbc632ab498465603ce29dab4a7d1d63ba361f1e2f696bf9609272dac3507e979546358694eedaf83db7220c49d78 SHA512 5b63d6f3d9a9cb6dee0e93eed4de407bc9b5cb099006e74ca37334bd135441fd8f4dff8ed1b2b981a3a9b1857ef7610826c96f1fad7222d242b259f5f3e0d58a
+DIST rust-1.87.0_beta20250430-riscv64gc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B ad7de23d30dc3c1ce452682e473fc697f8b6b0d75a77c83a2a74631d4c5737e19ea3cd5b9f6928bbda65e80cbe968461b60e9fc80085a64e2397271c5a01dbf7 SHA512 c8dcba3349a3ed4edb5adfc6b814c1b11280557768bdbd414b823b4fcd6cd1851b29092e03677a80d0757e5790e584ccc0feaba3a3306a3e064dc543109e9a5b
+DIST rust-1.87.0_beta20250430-s390x-unknown-linux-gnu.tar.xz 240130080 BLAKE2B 242119b30483591e791a6a2254c1f1c296053918c7c4b7892b3d5a1191b5c71f41905c7ad1f25fc1f389da2801f897ce62915dc0cbd9f2638d339340efb2674b SHA512 a80e8b1b1f158d90f1869ec7f40c53037ef7b2cf55b48bfaf542ddad6d5fb3ea60197a09945efa90026fab6d7f4d8705e281b83b88ac1161a4f7375efa637d56
+DIST rust-1.87.0_beta20250430-s390x-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 4cb889b42ee0a539fcc016ebb7a4a78c1cced09fe491b0957c69fba4d77b790d0978c5fdd5cdf3fcb8ad59cd0b6a7a36a385baddc99b8f30da643099a4ddfc3b SHA512 9c01c300c5f30a77b51a775cba44084e7ddc1991230e70878f574274e3cbd970b2166c7f4c11e7dc181b99b7d8dd67ee3ad5e10d97b57c8a823e14cf97b0f326
+DIST rust-1.87.0_beta20250430-x86_64-unknown-linux-gnu.tar.xz 198597356 BLAKE2B 2a0fb1356e7eecc7e955351d98614c81b290321af5d6d16b4bfdf080b350123fd0abe8ae84b7eb46af0dfdc204ec584e78a723f5bc50b53dd561aaecb1474cbc SHA512 efcf10a2e4d8738b7eb6e88a0b2a3cb91599a146093f091839884614ede03e4be0b3c8fa111c9e221af6dd1bee3a99676c1d3fb70db8dd4360ec89a0c78098cd
+DIST rust-1.87.0_beta20250430-x86_64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 731e7e8ffceee0ca02d0ff18d424218dd4171976658e6aefce924a11d1673a188bbf229770ece27660d2116c1325eda719a46b6dfa1f66d7e85ad03647f8a2ce SHA512 82fef82947875aef78b0def48e6bfc64160b65bf833832d5520cbfe61ae7459142e85f596d12c3699b1c65e45bcf9fcf01603764be4742846b002aefb3873f91
+DIST rust-1.87.0_beta20250430-x86_64-unknown-linux-musl.tar.xz 293260544 BLAKE2B 46a12a9cf153bb2c24fe80f2ed1f6f0228ef18aa80009c5522a131ba27af72e492d4157f4d3f4de61b27c0fcc475d0bcc09685c02212bab89078996c5b6557f0 SHA512 dafe582800d4f9b6e1f699713642429b32797baad80614d8bfe8142943d6ac899b72734fb2e502b68b6dd4d8618bae359a62e60d1880ec5b51693cca636ec679
+DIST rust-1.87.0_beta20250430-x86_64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B d64405eb306408924b9b606494be3c34f5daf8d99fabcd36ee992e314df449f519e4bf35284b791db9080806999a7341c603bf3e452b6539080aefc491318b61 SHA512 e356ab9e5d3e55a0fd9c896db4401a4a0306e4d86aae06f01bb9f79e9df4ef25bdf3d41d767a057271d8d8c8d96fd102a3c35fcbac1aa0987cb79d4a99439ca1
 DIST rust-src-1.71.1.tar.xz 2460244 BLAKE2B e3a5b5bfb808310f96e760aab55310c7a790fa551d248c9c5dbb407e0a80653563d8df73a9e0973aa63d3286aad6c755b78098dd8db2dc1a2ed3cadb926b40e1 SHA512 659cc46e1ece2ddbcf5ab748bae48843bd36353cc633b59e4ac062d843af66919e8d5c39ccb72ebdbf94a0e26a8056ade6bd1c8fe9a936469bd405122a8ae35d
 DIST rust-src-1.74.1.tar.xz 2544036 BLAKE2B d95431b69f102782f51878ff73ce8802cac6dab7909497c3231d1c479b95dc2a618cc6efd8bac9c6bd59a2b10dc6be05199f1e1bd74e45cc640ee52352c29268 SHA512 11467d0936193c5a5be8c2eba1aefe2b7028af48494698863de2c4057d68ce33dcee1fc66dc2d68b1d32f0202ce49e9b906727849de8f8d904dd07930e76d5a4
 DIST rust-src-1.75.0.tar.xz 2570256 BLAKE2B 9db7ccff07ffe6991233e9f530321fd6ba48c561dcf1226537afa70c7d045421d8e83c5300b0866ec6fccfaae96dd67b9f204e9e0e12108c0c766d467cd78909 SHA512 e7565cea2f1658a05237a698e38880df2544319b41b6d8b0805db5f1f94fd3bb4f986967d0440fcdfe3a135e33246f3c747665b964f57ff5942f56133af78cdd
@@ -598,3 +626,4 @@ DIST rust-src-1.85.0.tar.xz 3036988 BLAKE2B b7281b23eef60cf052e1641a29915c02c590
 DIST rust-src-1.85.1.tar.xz 3036412 BLAKE2B f137ffcebd2d231d8b3dc5c9072f6afe39a071bc9608ac468bca364fafaa9c277b91e40da870a083c802cc13b9b876a548d7fa8ae67ad9552321a7412b7d8cd8 SHA512 d230cbb1daae3e2f5168abef94c5b99fb118c34a980f018d5df3e43f6ead4e0a17d6ea29bcfbcd0fb745e215f7a4d0282a99a714dba77b98a16254bb27c2d2ad
 DIST rust-src-1.86.0.tar.xz 3053544 BLAKE2B 2d1d8a4be4f9dc9355ce9a2d1599e0a57c5d1cb32f7b2eb413f6009dbce7d63db2533dc038cf50f5277a2d7bf4434f2076632c12a6fd33335ccf3a9f2ab685d1 SHA512 2818d94412bb0766ce53383932cd8ce96275a8e923f916c4bf7116fbcb7c2053cfb9714667add1a9d50b18366c973ba3ab4fe55d49c8abc8cc57656635c59f63
 DIST rust-src-1.87.0_beta20250420.tar.xz 3118744 BLAKE2B 44c32b7b91c1b8440eaa64ec22422775fcc47581b0620bb51fcf738fa9e73ee938c40df578885db095cd4b442f50d972c2ec44c64a77a6093c7cf65bcee04a70 SHA512 cb08ad457250112c696e5ea82606ecf1f49d0196bfac81d743587458dc1c23a728afcd33c2651690a107c9fb45c15033648c2a7e0228aa00860b9b21b3b1e9a6
+DIST rust-src-1.87.0_beta20250430.tar.xz 3118724 BLAKE2B 2ae0e29368f8d54d6d63d885983bfe2471e237444e5caefb38b64e3ad47c00fa656f3740a1defbeaee042450234c9dc8bcf75fd9453547a2e9c6f17053f1ad5d SHA512 b3e6f2d3ce0c3c3705a8fbf0a41869d1d33abb3125f9469a374701a4b97f4b987b548d1beff578973e9cd228d1097a010dc2ca8ef6a2d5f2d7fce48ad4746189
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.87.0_beta20250430.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.87.0_beta20250430.ebuild
new file mode 100644
index 00000000000..e00494d54b3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.87.0_beta20250430.ebuild
@@ -0,0 +1,314 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( 20 )
+LLVM_OPTIONAL="yes"
+
+inherit edo llvm-r1 multilib prefix rust-toolchain verify-sig multilib-minimal optfeature
+
+if [[ ${PV} == *9999* ]]; then
+	# We need to fetch a tarball in src_unpack
+	PROPERTIES+=" live"
+elif [[ ${PV} == *beta* ]]; then
+	# curl -Ls static.rust-lang.org/dist/channel-rust-beta.toml | grep "xz_url.*rust-src"
+	betaver=${PV//*beta}
+	BETA_SNAPSHOT="${betaver:0:4}-${betaver:4:2}-${betaver:6:2}"
+	RUST_TOOLCHAIN_BASEURL=https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/
+	SRC_URI="$(rust_all_arch_uris rust-beta rust-${PV})
+		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/rust-src-beta.tar.xz -> rust-src-${PV}.tar.xz )
+	"
+else
+	# curl -Ls static.rust-lang.org/dist/channel-rust-${PV}.toml | grep "xz_url.*rust-src"
+	SRC_URI="$(rust_all_arch_uris "${PV}")
+		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/2025-01-30/rust-src-${PV}.tar.xz )
+	"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+GENTOO_BIN_BASEURI="https://github.com/projg2/rust-bootstrap/releases/download/${PVR}" # omit trailing slash
+
+DESCRIPTION="Systems programming language from Mozilla"
+HOMEPAGE="https://www.rust-lang.org/"
+
+if [[ ${PV} != *9999* && ${PV} != *beta* ]] ; then
+	# Keep this separate to allow easy commenting out if not yet built
+	SRC_URI+=" sparc? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-sparc64-unknown-linux-gnu.tar.xz ) "
+	SRC_URI+=" mips? (
+		abi_mips_o32? (
+			big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips-unknown-linux-gnu.tar.xz )
+			!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mipsel-unknown-linux-gnu.tar.xz )
+		)
+		abi_mips_n64? (
+			big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips64-unknown-linux-gnuabi64.tar.xz )
+			!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips64el-unknown-linux-gnuabi64.tar.xz )
+		)
+	)"
+	SRC_URI+=" riscv? (
+		elibc_musl? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-riscv64gc-unknown-linux-musl.tar.xz )
+	)"
+	SRC_URI+=" ppc64? ( elibc_musl? (
+		big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64-unknown-linux-musl.tar.xz )
+		!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64le-unknown-linux-musl.tar.xz )
+	) )"
+fi
+
+LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
+SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
+IUSE="big-endian clippy cpu_flags_x86_sse2 doc prefix rust-analyzer rust-src rustfmt"
+
+RDEPEND="
+	>=app-eselect/eselect-rust-20190311
+	dev-libs/openssl
+	sys-apps/lsb-release
+	|| (
+		llvm-runtimes/libgcc
+		sys-devel/gcc:*
+	)
+	!dev-lang/rust:stable
+	!dev-lang/rust-bin:stable
+"
+BDEPEND="
+	prefix? ( dev-util/patchelf )
+	verify-sig? ( sec-keys/openpgp-keys-rust )
+"
+[[ ${PV} == *9999* ]] && BDEPEND+=" net-misc/curl"
+
+REQUIRED_USE="x86? ( cpu_flags_x86_sse2 )"
+
+# stripping rust may break it (at least on x86_64)
+# https://github.com/rust-lang/rust/issues/112286
+RESTRICT="strip"
+
+QA_PREBUILT="
+	opt/rust-bin-${SLOT}/bin/.*
+	opt/rust-bin-${SLOT}/lib/.*.so*
+	opt/rust-bin-${SLOT}/libexec/.*
+	opt/rust-bin-${SLOT}/lib/rustlib/.*/bin/.*
+	opt/rust-bin-${SLOT}/lib/rustlib/.*/lib/.*
+"
+
+# An rmeta file is custom binary format that contains the metadata for the crate.
+# rmeta files do not support linking, since they do not contain compiled object files.
+# so we can safely silence the warning for this QA check.
+QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
+
+VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
+
+src_unpack() {
+	if [[ ${PV} == *9999* ]]; then
+		# We need to fetch the latest nightly listing and get the apprapriate src_uri for our arch
+		local rust_bin_url rustc_src_url
+		# Cut down on webrequests by fetching the nightly toml once
+		curl -Ls static.rust-lang.org/dist/channel-rust-nightly.toml > "${WORKDIR}/channel-rust-nightly.toml" ||
+			die "Failed to fetch nightly revision info"
+		rustc_src_url=$(grep 'xz_url.*rust-src' "${WORKDIR}/channel-rust-nightly.toml" | cut -d '"' -f 2)
+		rust_bin_url=$(grep "xz_url.*rust-nightly-$(rust_abi)" "${WORKDIR}/channel-rust-nightly.toml" | cut -d '"' -f 2)
+		einfo "Using nightly Rust from: ${rust_bin_url}"
+
+		if use rust-src; then
+			einfo "Using nightly Rust-src from: ${rustc_src_url}"
+			# We need to fetch the rust-src tarball
+			einfo "Fetching nightly rust-src tarball ..."
+			curl --progress-bar -L "${rustc_src_url}" -o "${WORKDIR}/rust-src-${PV}.tar.xz" ||
+				die "Failed to fetch nightly rust-src tarball."
+			# no verify-sig here, just unpack it
+			tar -xf "${WORKDIR}/rust-src-${PV}.tar.xz" || die "Failed to unpack nightly rust-src tarball"
+		fi
+
+		einfo "Fetching nightly Rust tarball ..."
+		curl --progress-bar -L "${rust_bin_url}" -O || die "Failed to fetch nightly tarball"
+		if use verify-sig; then
+			einfo "Fetching nightly signature ..."
+			curl --progress-bar -L "${rust_bin_url}.asc" -O || die "Failed to fetch nightly signature"
+			verify-sig_verify_detached "${WORKDIR}/rust-nightly-$(rust_abi).tar.xz" \
+				"${WORKDIR}/rust-nightly-$(rust_abi).tar.xz.asc"
+		fi
+		tar -xf "${WORKDIR}/rust-nightly-$(rust_abi).tar.xz" || die "Failed to unpack nightly tarball"
+	else
+		# sadly rust-src tarball does not have corresponding .asc file
+		# so do partial verification
+		if use verify-sig; then
+			for f in ${A}; do
+				if [[ -f ${DISTDIR}/${f}.asc ]]; then
+					verify-sig_verify_detached "${DISTDIR}/${f}" "${DISTDIR}/${f}.asc"
+				fi
+			done
+		fi
+
+		default_src_unpack
+
+	fi
+	case ${PV} in
+		*9999*)
+			mv "${WORKDIR}/rust-nightly-$(rust_abi)" "${S}" || die
+			;;
+		*beta*)
+			mv "${WORKDIR}/rust-beta-$(rust_abi)" "${S}" || die
+			;;
+		*)
+			mv "${WORKDIR}/rust-${PV}-$(rust_abi)" "${S}" || die
+			;;
+	esac
+}
+
+patchelf_for_bin() {
+	local filetype=$(file -b ${1})
+	if [[ ${filetype} == *ELF*interpreter* ]]; then
+		einfo "${1}'s interpreter changed"
+		patchelf ${1} --set-interpreter ${2} || die
+	elif [[ ${filetype} == *script* ]]; then
+		hprefixify ${1}
+	fi
+}
+
+rust_native_abi_install() {
+	pushd "${S}" >/dev/null || die
+	local analysis="$(grep 'analysis' ./components || die "analysis not found in components")"
+	local std="$(grep 'std' ./components || die "std not found in components")"
+	local components=( "rustc" "cargo" "${std}" )
+	use doc && components+=( "rust-docs" )
+	use clippy && components+=( "clippy-preview" )
+	use rustfmt && components+=( "rustfmt-preview" )
+	use rust-analyzer && components+=( "rust-analyzer-preview" "${analysis}" )
+	# Rust component 'rust-src' is extracted from separate archive
+	if use rust-src; then
+		einfo "Combining rust and rust-src installers"
+		case ${PV} in
+			*9999*)
+				mv -v "${WORKDIR}/rust-src-nightly/rust-src" "${S}" || die
+				;;
+			*beta*)
+				mv -v "${WORKDIR}/rust-src-beta/rust-src" "${S}" || die
+				;;
+			*)
+				mv -v "${WORKDIR}/rust-src-${PV}/rust-src" "${S}" || die
+				;;
+		esac
+		echo rust-src >> ./components || die
+		components+=( "rust-src" )
+	fi
+	edo ./install.sh \
+		--components="$(IFS=,; echo "${components[*]}")" \
+		--disable-verify \
+		--prefix="${ED}/opt/rust-bin-${SLOT}" \
+		--mandir="${ED}/opt/rust-bin-${SLOT}/man" \
+		--disable-ldconfig
+
+	docompress /opt/${P}/man/
+
+	if use prefix; then
+		local interpreter=$(patchelf --print-interpreter "${EPREFIX}"/bin/bash)
+		ebegin "Changing interpreter to ${interpreter} for Gentoo prefix at ${ED}/opt/${SLOT}/bin"
+		find "${ED}/opt/${SLOT}/bin" -type f -print0 | \
+			while IFS=  read -r -d '' filename; do
+				patchelf_for_bin ${filename} ${interpreter} \; || die
+			done
+		eend $?
+	fi
+
+	local symlinks=(
+		cargo
+		rustc
+		rustdoc
+		rust-gdb
+		rust-gdbgui
+		rust-lldb
+	)
+
+	use clippy && symlinks+=( clippy-driver cargo-clippy )
+	use rustfmt && symlinks+=( rustfmt cargo-fmt )
+	use rust-analyzer && symlinks+=( rust-analyzer )
+
+	einfo "installing eselect-rust symlinks and paths"
+	local i
+	for i in "${symlinks[@]}"; do
+		# we need realpath on /usr/bin/* symlink return version-appended binary path.
+		# so /usr/bin/rustc should point to /opt/rust-bin-<ver>/bin/rustc-<ver>
+		local ver_i="${i}-bin-${SLOT}"
+		ln -v "${ED}/opt/rust-bin-${SLOT}/bin/${i}" "${ED}/opt/rust-bin-${SLOT}/bin/${ver_i}" || die
+		dosym -r "/opt/rust-bin-${SLOT}/bin/${ver_i}" "/usr/bin/${ver_i}"
+	done
+
+	# symlinks to switch components to active rust in eselect
+	dosym -r "/opt/rust-bin-${SLOT}/lib" "/usr/lib/rust/lib-bin-${SLOT}"
+	dosym -r "/opt/rust-bin-${SLOT}/man" "/usr/lib/rust/man-bin-${SLOT}"
+	dosym -r "/opt/rust-bin-${SLOT}/lib/rustlib" "/usr/lib/rustlib-bin-${SLOT}"
+	dosym -r "/opt/rust-bin-${SLOT}/share/doc/rust" "/usr/share/doc/rust-bin-${SLOT}"
+
+	# make all capital underscored variable
+	local CARGO_TRIPLET="$(rust_abi)"
+	CARGO_TRIPLET="${CARGO_TRIPLET//-/_}"
+	CARGO_TRIPLET="${CARGO_TRIPLET^^}"
+	cat <<-_EOF_ > "${T}/50${P}"
+		MANPATH="${EPREFIX}/usr/lib/rust/man-bin-${SLOT}"
+	$(usev elibc_musl "CARGO_TARGET_${CARGO_TRIPLET}_RUSTFLAGS=\"-C target-feature=-crt-static\"")
+	_EOF_
+	doenvd "${T}/50${P}"
+
+	# note: eselect-rust adds EROOT to all paths below
+	cat <<-_EOF_ > "${T}/provider-${PN}-${SLOT}"
+	/usr/bin/cargo
+	/usr/bin/rustdoc
+	/usr/bin/rust-gdb
+	/usr/bin/rust-gdbgui
+	/usr/bin/rust-lldb
+	/usr/lib/rustlib
+	/usr/lib/rust/lib
+	/usr/lib/rust/man
+	/usr/share/doc/rust
+	_EOF_
+
+	if use clippy; then
+		echo /usr/bin/clippy-driver >> "${T}/provider-${PN}-${SLOT}"
+		echo /usr/bin/cargo-clippy >> "${T}/provider-${PN}-${SLOT}"
+	fi
+	if use rustfmt; then
+		echo /usr/bin/rustfmt >> "${T}/provider-${PN}-${SLOT}"
+		echo /usr/bin/cargo-fmt >> "${T}/provider-${PN}-${SLOT}"
+	fi
+	if use rust-analyzer; then
+		echo /usr/bin/rust-analyzer >> "${T}/provider-${PN}-${SLOT}"
+	fi
+
+	insinto /etc/env.d/rust
+	doins "${T}/provider-${PN}-${SLOT}"
+	popd >/dev/null || die
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi; then
+		rust_native_abi_install
+	else
+		local rust_target
+		rust_target="$(rust_abi $(get_abi_CHOST ${v##*.}))"
+		dodir "/opt/${P}/lib/rustlib"
+		cp -vr "${WORKDIR}/rust-${PV}-${rust_target}/rust-std-${rust_target}/lib/rustlib/${rust_target}"\
+			"${ED}/opt/${P}/lib/rustlib" || die
+	fi
+
+	# BUG: installs x86_64 binary on other arches
+	rm -f "${ED}/opt/${P}/lib/rustlib/"*/bin/rust-llvm-dwp || die
+}
+
+pkg_postinst() {
+	eselect rust update
+
+	if has_version dev-debug/gdb || has_version llvm-core/lldb; then
+		elog "Rust installs helper scripts for calling GDB and LLDB,"
+		elog "for convenience they are installed under /usr/bin/rust-{gdb,lldb}-${PV}."
+	fi
+
+	if has_version app-editors/emacs; then
+		optfeature "emacs support for rust" app-emacs/rust-mode
+	fi
+
+	if has_version app-editors/gvim || has_version app-editors/vim; then
+		optfeature "vim support for rust" app-vim/rust-vim
+	fi
+}
+
+pkg_postrm() {
+	eselect rust cleanup
+}

From 39441f797b0b2ad8e28d8aab481a861d36216756 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:37 +0000
Subject: [PATCH 017/136] dev-lang/rust-common: Sync with Gentoo

It's from Gentoo commit 135a111fbefa0b3595d3e8569977cb660d355730.
---
 .../dev-lang/rust-common/Manifest             |  2 +
 .../rust-common-1.87.0_beta20250430.ebuild    | 73 +++++++++++++++++++
 2 files changed, 75 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.87.0_beta20250430.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/Manifest
index 1a87c2a9eff..5e165feae1d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/Manifest
@@ -12,3 +12,5 @@ DIST rustc-1.86.0-src.tar.xz 275696736 BLAKE2B 9f33a710a3e567d92f56091920643f5ef
 DIST rustc-1.86.0-src.tar.xz.asc 801 BLAKE2B 3e10a3894c7eee68d37bc5707d797548119f830667e27e652a199d13633199713bd01bd0f41a5f2af3c682561903e36abe27b36ef78d9a1d65bdf485527d2c15 SHA512 0b74dab9ee56d0a08e26e9cd40f722e4d99de63ac678f969f0c54d50737074fb28e170db5a36ce2627ec332e5ce3bb8a92167aefbccff7c70e4cb057bc0a94ac
 DIST rustc-1.87.0_beta20250420-src.tar.xz 283544556 BLAKE2B 70a59c7d695e881a4e21d500f19b7d83e3a86bc8d5dfaaaa28a4cd4631b12937a2743119e3181e84af7b348386c672f4e62675da8cfb399095fcdda527b072e0 SHA512 37e62954c21b0d5c232dca1d0fe476b165eb63b7315c1fcaa18068707f4fd00e2def09968ee1d243f62cb3eae3fbb4381493b8505179342705998dce08e23afe
 DIST rustc-1.87.0_beta20250420-src.tar.xz.asc 801 BLAKE2B c0ed0686d3bc612e8b0edb96817928107905220328af81d2f9200552c3edb58d98ae8844f01b7dd20e59e6c0a173f6da11b2cd58d0c3b5d5f0bd8290528ea86c SHA512 e2e694feec13d8fb8d9b50442c0c2e3de5cef0a249730c945124880220e44d481b2109098c5a8479f765384a4298e293e63743c924e0866ed2e5aece3a35c98f
+DIST rustc-1.87.0_beta20250430-src.tar.xz 283517896 BLAKE2B 5d86aa824662230a843576798a544ef5e3a49e0166b66c9ecc9926832e102562aac3493748085b7f38a71e5954206d27f7ab3e219a27d96b1c55a8ab8419851a SHA512 5c29e7513b70416f97ba7a5f9669600da9b695d8dc6df582aa6ffa017da5c38215d9a27584fa6f6b2309813127571eba49a3fef375a6598c607f007f41f6d3fe
+DIST rustc-1.87.0_beta20250430-src.tar.xz.asc 801 BLAKE2B 4ecdc70a469bce016e7c92a77a8c088ed37375e994a820b24c67269358eed4bc465aa77c4974b1e72586b23737b1d25844394b5de36fd4427978eff20bd07102 SHA512 f8c10cf66e2fb791de7b994bba622d1f8e8df75e48fd8d30795edaa6316b935583b51e235520d2aa2578cfcea1dda17ff2256317c7f4bb1f6606f5afbd6a80d1
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.87.0_beta20250430.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.87.0_beta20250430.ebuild
new file mode 100644
index 00000000000..26c4792d0fb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.87.0_beta20250430.ebuild
@@ -0,0 +1,73 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/rust.asc
+inherit shell-completion verify-sig
+
+DESCRIPTION="Common files shared between multiple slots of Rust"
+HOMEPAGE="https://www.rust-lang.org/"
+
+if [[ ${PV} = *9999* ]]; then
+	inherit git-r3
+	# In case cargo is not in sync we'll fetch it as a submodule
+	# Nightly users will probably already have the repo cloned and up-to-date anyway.
+	EGIT_REPO_URI="https://github.com/rust-lang/rust.git"
+	EGIT_SUBMODULES=( "-*" "src/tools/cargo" )
+elif [[ ${PV} == *beta* ]]; then
+	# Identify the snapshot date of the beta release:
+	# curl -Ls static.rust-lang.org/dist/channel-rust-beta.toml | grep beta-src.tar.xz
+	MY_PV=beta
+	betaver=${PV//*beta}
+	BETA_SNAPSHOT="${betaver:0:4}-${betaver:4:2}-${betaver:6:2}"
+	SRC_URI="https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz -> rustc-${PV}-src.tar.xz
+		verify-sig? ( https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz.asc
+			-> rustc-${PV}-src.tar.xz.asc )
+	"
+	S="${WORKDIR}/rustc-${MY_PV}-src"
+else
+	MY_PV=${PV}
+	SRC_URI="https://static.rust-lang.org/dist/rustc-${PV}-src.tar.xz
+		verify-sig? ( https://static.rust-lang.org/dist/rustc-${PV}-src.tar.xz.asc )
+	"
+	S="${WORKDIR}/rustc-${MY_PV}-src"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+fi
+
+LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
+SLOT="0"
+
+# Legacy non-slotted versions bash completions will collide.
+RDEPEND="
+	!dev-lang/rust:stable
+	!dev-lang/rust-bin:stable
+"
+BDEPEND="verify-sig? ( sec-keys/openpgp-keys-rust )"
+
+src_unpack() {
+	if [[ ${PV} == *9999* ]]; then
+		git-r3_src_unpack
+	else
+		if use verify-sig ; then
+			verify-sig_verify_detached "${DISTDIR}"/rustc-${PV}-src.tar.xz "${DISTDIR}"/rustc-${PV}-src.tar.xz.asc
+		fi
+
+		# Avoid unpacking the whole tarball which would need check-reqs
+		tar -xf "${DISTDIR}"/rustc-${PV}-src.tar.xz \
+			"rustc-${MY_PV}-src/src/tools/cargo/src/etc/"{_cargo,cargo.bashcomp.sh} || die
+	fi
+}
+
+src_configure() {
+	:
+}
+
+src_compile() {
+	:
+}
+
+src_install() {
+	newbashcomp src/tools/cargo/src/etc/cargo.bashcomp.sh cargo
+	dozshcomp src/tools/cargo/src/etc/_cargo
+}

From a0e239388a1d2d76ce2f4a4dab34d2371e2d1742 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:37 +0000
Subject: [PATCH 018/136] dev-lang/tcl: Sync with Gentoo

It's from Gentoo commit 69cb9708281acf0d1efea6f9231872fa6f62c57b.
---
 .../third_party/portage-stable/dev-lang/tcl/tcl-8.6.16.ebuild   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/tcl/tcl-8.6.16.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/tcl/tcl-8.6.16.ebuild
index 59ff88d02e2..83a553240a1 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/tcl/tcl-8.6.16.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/tcl/tcl-8.6.16.ebuild
@@ -18,7 +18,7 @@ S="${SPARENT}"/unix
 
 LICENSE="tcltk Spencer-99"
 SLOT="0/8.6"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="debug +threads"
 
 RDEPEND=">=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}]"

From a1ddb3178ca88ddd5d8613a597c132a2799c06df Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:37 +0000
Subject: [PATCH 019/136] dev-lang/yasm: Sync with Gentoo

It's from Gentoo commit f3bd66f5e7c9c24f427f94f013ae3afbf7b9b9c5.
---
 .../portage-stable/dev-lang/yasm/yasm-1.3.0-r2.ebuild | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/yasm/yasm-1.3.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/yasm/yasm-1.3.0-r2.ebuild
index 34648241675..f489f09a68a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/yasm/yasm-1.3.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/yasm/yasm-1.3.0-r2.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-inherit flag-o-matic toolchain-funcs
+inherit dot-a flag-o-matic toolchain-funcs
 
 if [[ ${PV} == 9999* ]] ; then
 	EGIT_REPO_URI="https://github.com/yasm/yasm.git"
@@ -51,6 +51,8 @@ src_prepare() {
 }
 
 src_configure() {
+	lto-guarantee-fat
+
 	# bug #943747
 	append-flags -std=gnu17
 
@@ -70,3 +72,8 @@ src_test() {
 	# https://bugs.gentoo.org/718870
 	emake -j1 check
 }
+
+src_install() {
+	default
+	strip-lto-bytecode
+}

From 6bb03c5c460ac527021887432f8b7c8fe6a66aaf Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:38 +0000
Subject: [PATCH 020/136] dev-libs/dbus-glib: Sync with Gentoo

It's from Gentoo commit 41c192979dcb215554f324b27953b5fe19d983ae.
---
 .../portage-stable/dev-libs/dbus-glib/dbus-glib-0.112.ebuild | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/dbus-glib/dbus-glib-0.112.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/dbus-glib/dbus-glib-0.112.ebuild
index 7faec8fb4b0..f2ed1b0bde5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/dbus-glib/dbus-glib-0.112.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/dbus-glib/dbus-glib-0.112.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -46,6 +46,9 @@ multilib_src_configure() {
 	# bug #943768
 	append-cflags -std=gnu17
 
+	# bug #923801
+	append-lfs-flags
+
 	local myconf=(
 		--localstatedir="${EPREFIX}"/var
 		--enable-bash-completion

From 0887fe66da1135f76c95df28074a54e55b1d5c78 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:40 +0000
Subject: [PATCH 021/136] dev-libs/elfutils: Sync with Gentoo

It's from Gentoo commit 3f171f5cdba3205beb661623a1fb0322c2624967.
---
 .../dev-libs/elfutils/elfutils-0.193.ebuild   |  1 +
 .../elfutils/files/elfutils-0.193-perf.patch  | 53 +++++++++++++++++++
 2 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.193-perf.patch

diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.193.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.193.ebuild
index cdd63bff7f4..1ad8bec40d5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.193.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.193.ebuild
@@ -65,6 +65,7 @@ BDEPEND+="
 PATCHES=(
 	"${FILESDIR}"/${PN}-0.189-musl-aarch64-regs.patch
 	"${FILESDIR}"/${PN}-0.191-musl-macros.patch
+	"${FILESDIR}"/${P}-perf.patch
 )
 
 src_prepare() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.193-perf.patch b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.193-perf.patch
new file mode 100644
index 00000000000..d256d258650
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.193-perf.patch
@@ -0,0 +1,53 @@
+https://sourceware.org/git/?p=elfutils.git;a=commit;h=d05241ce690018548857199bd34d7734c7164679
+https://bugs.gentoo.org/955065
+
+From d05241ce690018548857199bd34d7734c7164679 Mon Sep 17 00:00:00 2001
+From: Serhei Makarov <serhei@serhei.io>
+Date: Mon, 5 May 2025 12:08:55 -0400
+Subject: [PATCH] PR32930 backends/: guard asm/perf_regs.h include
+
+asm/perf_regs.h is an arch-specific linux include, not present on
+architectures like hppa and m68k that lack perf_events support.
+
+Only one place we need to fix; others already guard the include by
+architecture, or use architecture-independent headers (e.g.
+linux/perf_events.h).
+
+* backends/libebl_PERF_FLAGS.h: Only include asm/perf_regs.h on
+  architectures where we use it.
+
+Signed-off-by: Serhei Makarov <serhei@serhei.io>
+---
+ backends/libebl_PERF_FLAGS.h | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/backends/libebl_PERF_FLAGS.h b/backends/libebl_PERF_FLAGS.h
+index 2ed45f0f..51c20ea6 100644
+--- a/backends/libebl_PERF_FLAGS.h
++++ b/backends/libebl_PERF_FLAGS.h
+@@ -32,8 +32,12 @@
+ #define _LIBEBL_PERF_FLAGS_H 1
+ 
+ #if defined(__linux__)
++/* XXX Need to exclude __linux__ arches without perf_regs.h. */
++#if defined(__x86_64__) || defined(__i386__)
++/* || defined(other_architecture)... */
+ # include <asm/perf_regs.h>
+ #endif
++#endif
+ 
+ #if defined(_ASM_X86_PERF_REGS_H)
+ /* See the code in x86_initreg_sample.c for list of required regs and
+@@ -49,8 +53,8 @@
+    see the code in tools/perf/util/intel-pt.c intel_pt_add_gp_regs()
+    and note how regs are added in the same order as the perf_regs.h enum.  */
+ #else
+-/* Since asm/perf_regs.h gives the register layout for a different arch,
+-   we can't unwind x86_64 frames.  */
++/* Since asm/perf_regs.h is absent, or gives the register layout for a
++   different arch, we can't unwind i386 and x86_64 frames. */
+ #define PERF_FRAME_REGISTERS_I386 0
+ #define PERF_FRAME_REGISTERS_X86_64 0
+ #endif
+-- 
+2.43.5

From 6e8681a4542c721692fecec38d3adcc81af08ab0 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:40 +0000
Subject: [PATCH 022/136] dev-libs/glib: Sync with Gentoo

It's from Gentoo commit 1c1c59bec9a9f029c55e00c9ba8de4c831b6eeaa.
---
 .../dev-libs/glib/glib-2.78.6.ebuild          |  9 +++++++-
 .../dev-libs/glib/glib-2.80.5-r1.ebuild       | 21 ++++++++++++++++++-
 .../dev-libs/glib/glib-2.82.5.ebuild          | 21 ++++++++++++++++++-
 .../dev-libs/glib/glib-2.84.0.ebuild          | 21 ++++++++++++++++++-
 .../dev-libs/glib/glib-2.84.1.ebuild          | 21 ++++++++++++++++++-
 5 files changed, 88 insertions(+), 5 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.78.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.78.6.ebuild
index e7fad17bc48..3b5d51599f5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.78.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.78.6.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 PYTHON_REQ_USE="xml(+)"
 PYTHON_COMPAT=( python3_{11..13} )
 
-inherit gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
+inherit dot-a gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
 
 DESCRIPTION="The GLib library of C routines"
 HOMEPAGE="https://www.gtk.org/"
@@ -173,6 +173,11 @@ src_prepare() {
 	# TODO: python_name sedding for correct python shebang? Might be relevant mainly for glib-utils only
 }
 
+src_configure() {
+	lto-guarantee-fat
+	meson-multilib_src_configure
+}
+
 multilib_src_configure() {
 	# TODO: figure a way to pass appropriate values for all cross properties
 	# that glib uses (search for get_cross_property)
@@ -245,6 +250,8 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	strip-lto-bytecode
+
 	# These are installed by dev-util/glib-utils
 	# TODO: With patching we might be able to get rid of the python-any deps
 	# and removals, and test depend on glib-utils instead; revisit now with
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.80.5-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.80.5-r1.ebuild
index 246b5d60c86..d9251be8853 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.80.5-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.80.5-r1.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 PYTHON_REQ_USE="xml(+)"
 PYTHON_COMPAT=( python3_{11..13} )
 
-inherit gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
+inherit dot-a gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
 
 DESCRIPTION="The GLib library of C routines"
 HOMEPAGE="https://www.gtk.org/"
@@ -210,6 +210,11 @@ src_prepare() {
 	# TODO: python_name sedding for correct python shebang? Might be relevant mainly for glib-utils only
 }
 
+src_configure() {
+	lto-guarantee-fat
+	meson-multilib_src_configure
+}
+
 multilib_src_configure() {
 	# TODO: figure a way to pass appropriate values for all cross properties
 	# that glib uses (search for get_cross_property)
@@ -237,6 +242,18 @@ multilib_src_configure() {
 			return 0
 		fi
 
+		# Do we somehow have a dev-libs/gobject-introspection installed
+		# with an unsatisfied dependency? (bug #951487)
+		if ! $(tc-getPKG_CONFIG) --cflags gobject-introspection-1.0 &> /dev/null ; then
+			return 0
+		fi
+
+		# Make sure has_version didn't lie to us while at it as well,
+		# given bug #951487.
+		if ! $(tc-getPKG_CONFIG) --atleast-version=${INTROSPECTION_PV} gobject-introspection-1.0 &> /dev/null ; then
+			return 0
+		fi
+
 		return 1
 	}
 
@@ -388,6 +405,8 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	strip-lto-bytecode
+
 	# These are installed by dev-util/glib-utils
 	# TODO: With patching we might be able to get rid of the python-any deps
 	# and removals, and test depend on glib-utils instead; revisit now with
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.82.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.82.5.ebuild
index a134d8d3560..db2270f0b02 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.82.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.82.5.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 PYTHON_REQ_USE="xml(+)"
 PYTHON_COMPAT=( python3_{11..13} )
 
-inherit eapi9-ver gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
+inherit dot-a eapi9-ver gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
 
 DESCRIPTION="The GLib library of C routines"
 HOMEPAGE="https://www.gtk.org/"
@@ -198,6 +198,11 @@ src_prepare() {
 	# TODO: python_name sedding for correct python shebang? Might be relevant mainly for glib-utils only
 }
 
+src_configure() {
+	lto-guarantee-fat
+	meson-multilib_src_configure
+}
+
 multilib_src_configure() {
 	# TODO: figure a way to pass appropriate values for all cross properties
 	# that glib uses (search for get_cross_property)
@@ -225,6 +230,18 @@ multilib_src_configure() {
 			return 0
 		fi
 
+		# Do we somehow have a dev-libs/gobject-introspection installed
+		# with an unsatisfied dependency? (bug #951487)
+		if ! $(tc-getPKG_CONFIG) --cflags gobject-introspection-1.0 &> /dev/null ; then
+			return 0
+		fi
+
+		# Make sure has_version didn't lie to us while at it as well,
+		# given bug #951487.
+		if ! $(tc-getPKG_CONFIG) --atleast-version=${INTROSPECTION_PV} gobject-introspection-1.0 &> /dev/null ; then
+			return 0
+		fi
+
 		return 1
 	}
 
@@ -376,6 +393,8 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	strip-lto-bytecode
+
 	# These are installed by dev-util/glib-utils
 	# TODO: With patching we might be able to get rid of the python-any deps
 	# and removals, and test depend on glib-utils instead; revisit now with
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.84.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.84.0.ebuild
index 0ec8e828545..ed8c98dbf27 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.84.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.84.0.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 PYTHON_REQ_USE="xml(+)"
 PYTHON_COMPAT=( python3_{11..13} )
 
-inherit eapi9-ver gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
+inherit dot-a eapi9-ver gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
 
 DESCRIPTION="The GLib library of C routines"
 HOMEPAGE="https://www.gtk.org/"
@@ -202,6 +202,11 @@ src_prepare() {
 	# TODO: python_name sedding for correct python shebang? Might be relevant mainly for glib-utils only
 }
 
+src_configure() {
+	lto-guarantee-fat
+	meson-multilib_src_configure
+}
+
 multilib_src_configure() {
 	# TODO: figure a way to pass appropriate values for all cross properties
 	# that glib uses (search for get_cross_property)
@@ -229,6 +234,18 @@ multilib_src_configure() {
 			return 0
 		fi
 
+		# Do we somehow have a dev-libs/gobject-introspection installed
+		# with an unsatisfied dependency? (bug #951487)
+		if ! $(tc-getPKG_CONFIG) --cflags gobject-introspection-1.0 &> /dev/null ; then
+			return 0
+		fi
+
+		# Make sure has_version didn't lie to us while at it as well,
+		# given bug #951487.
+		if ! $(tc-getPKG_CONFIG) --atleast-version=${INTROSPECTION_PV} gobject-introspection-1.0 &> /dev/null ; then
+			return 0
+		fi
+
 		return 1
 	}
 
@@ -380,6 +397,8 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	strip-lto-bytecode
+
 	# These are installed by dev-util/glib-utils
 	# TODO: With patching we might be able to get rid of the python-any deps
 	# and removals, and test depend on glib-utils instead; revisit now with
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.84.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.84.1.ebuild
index fb9437f28ee..ea49a52a6f2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.84.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.84.1.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 PYTHON_REQ_USE="xml(+)"
 PYTHON_COMPAT=( python3_{11..13} )
 
-inherit eapi9-ver gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
+inherit dot-a eapi9-ver gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
 
 DESCRIPTION="The GLib library of C routines"
 HOMEPAGE="https://www.gtk.org/"
@@ -203,6 +203,11 @@ src_prepare() {
 	# TODO: python_name sedding for correct python shebang? Might be relevant mainly for glib-utils only
 }
 
+src_configure() {
+	lto-guarantee-fat
+	meson-multilib_src_configure
+}
+
 multilib_src_configure() {
 	# TODO: figure a way to pass appropriate values for all cross properties
 	# that glib uses (search for get_cross_property)
@@ -230,6 +235,18 @@ multilib_src_configure() {
 			return 0
 		fi
 
+		# Do we somehow have a dev-libs/gobject-introspection installed
+		# with an unsatisfied dependency? (bug #951487)
+		if ! $(tc-getPKG_CONFIG) --cflags gobject-introspection-1.0 &> /dev/null ; then
+			return 0
+		fi
+
+		# Make sure has_version didn't lie to us while at it as well,
+		# given bug #951487.
+		if ! $(tc-getPKG_CONFIG) --atleast-version=${INTROSPECTION_PV} gobject-introspection-1.0 &> /dev/null ; then
+			return 0
+		fi
+
 		return 1
 	}
 
@@ -381,6 +398,8 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	strip-lto-bytecode
+
 	# These are installed by dev-util/glib-utils
 	# TODO: With patching we might be able to get rid of the python-any deps
 	# and removals, and test depend on glib-utils instead; revisit now with

From d2fd26457e3b8b0145bc05fcc9e7292cc93e5e4b Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:42 +0000
Subject: [PATCH 023/136] dev-libs/inih: Sync with Gentoo

It's from Gentoo commit 6d4bd2bb5dff583408a4b3bc7250663a484c6b3c.
---
 .../src/third_party/portage-stable/dev-libs/inih/inih-59.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/inih/inih-59.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/inih/inih-59.ebuild
index f5614b08d6b..c0da723e9fc 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/inih/inih-59.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/inih/inih-59.ebuild
@@ -12,7 +12,7 @@ S="${WORKDIR}"/inih-r${PV}
 
 LICENSE="BSD"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
 
 DOCS=( README.md )
 

From c7b4c3113a0cbe90b833df53382eb0856ab8f7ec Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:46 +0000
Subject: [PATCH 024/136] dev-libs/libbsd: Sync with Gentoo

It's from Gentoo commit 364bead27d48aee14736e76d03c3ce6f72f73e9f.
---
 .../dev-libs/libbsd/libbsd-0.11.8.ebuild            | 13 +++++++++++--
 .../dev-libs/libbsd/libbsd-0.12.1.ebuild            | 13 +++++++++++--
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libbsd/libbsd-0.11.8.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libbsd/libbsd-0.11.8.ebuild
index 37651c71198..bb710483294 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libbsd/libbsd-0.11.8.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libbsd/libbsd-0.11.8.ebuild
@@ -1,10 +1,10 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/guillemjover.asc
-inherit flag-o-matic multilib multilib-minimal verify-sig
+inherit dot-a flag-o-matic libtool multilib multilib-minimal verify-sig
 
 DESCRIPTION="Library to provide useful functions commonly found on BSD systems"
 HOMEPAGE="https://libbsd.freedesktop.org/wiki/ https://gitlab.freedesktop.org/libbsd/libbsd"
@@ -23,7 +23,14 @@ DEPEND="
 "
 BDEPEND="verify-sig? ( sec-keys/openpgp-keys-guillemjover )"
 
+src_prepare() {
+	default
+	elibtoolize
+}
+
 multilib_src_configure() {
+	lto-guarantee-fat
+
 	# Broken (still) with lld-17 (bug #922342, bug #915068)
 	append-ldflags $(test-flags-CCLD -Wl,--undefined-version)
 
@@ -38,6 +45,8 @@ multilib_src_configure() {
 
 multilib_src_install() {
 	emake DESTDIR="${D}" install
+	# always strip due to libbsd-ctor.a
+	strip-lto-bytecode #"${ED}"
 
 	find "${ED}" -type f -name "*.la" -delete || die
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libbsd/libbsd-0.12.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libbsd/libbsd-0.12.1.ebuild
index 182fa14cff1..9f2517d30bf 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libbsd/libbsd-0.12.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libbsd/libbsd-0.12.1.ebuild
@@ -1,10 +1,10 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/guillemjover.asc
-inherit flag-o-matic multilib multilib-minimal verify-sig
+inherit dot-a flag-o-matic libtool multilib multilib-minimal verify-sig
 
 DESCRIPTION="Library to provide useful functions commonly found on BSD systems"
 HOMEPAGE="https://libbsd.freedesktop.org/wiki/ https://gitlab.freedesktop.org/libbsd/libbsd"
@@ -24,7 +24,14 @@ DEPEND="
 "
 BDEPEND="verify-sig? ( sec-keys/openpgp-keys-guillemjover )"
 
+src_prepare() {
+	default
+	elibtoolize
+}
+
 multilib_src_configure() {
+	lto-guarantee-fat
+
 	# bug #911726
 	filter-flags -fno-semantic-interposition
 
@@ -36,6 +43,8 @@ multilib_src_configure() {
 
 multilib_src_install() {
 	emake DESTDIR="${D}" install
+	# always strip due to libbsd-ctor.a
+	strip-lto-bytecode #"${ED}"
 
 	find "${ED}" -type f -name "*.la" -delete || die
 

From ee0d744434e546a041fc8b2afe3aca606aed7f38 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:48 +0000
Subject: [PATCH 025/136] dev-libs/libffi: Sync with Gentoo

It's from Gentoo commit 1c2e87534ac3075a381a5993a43c67413f3a416b.
---
 .../portage-stable/dev-libs/libffi/Manifest   |   2 -
 ...ffi-3.4.4-hppa-closure-function-ptrs.patch | 170 -----------
 .../files/libffi-3.4.4-hppa-jump-table.patch  | 289 ------------------
 .../libffi-3.4.4-hppa-large-struct.patch      |  36 ---
 .../libffi/files/libffi-3.4.4-lld-17.patch    |  34 ---
 .../files/libffi-3.4.4-sparc-float-typo.patch |  28 --
 .../files/libffi-3.4.4-trampoline-c99.patch   |  39 ---
 ...fi64-calls-with-6-gp-and-some-sse-re.patch |  38 ---
 .../dev-libs/libffi/libffi-3.4.4-r4.ebuild    |  83 -----
 .../dev-libs/libffi/libffi-3.4.6-r2.ebuild    |  96 ------
 .../dev-libs/libffi/libffi-3.4.6-r3.ebuild    |  10 +-
 .../dev-libs/libffi/libffi-3.4.6.ebuild       |  73 -----
 .../dev-libs/libffi/libffi-3.4.7.ebuild       |  87 ------
 .../dev-libs/libffi/libffi-3.4.8-r1.ebuild    |   8 +-
 .../dev-libs/libffi/libffi-3.4.8.ebuild       |  83 -----
 .../dev-libs/libffi/libffi-9999.ebuild        |   8 +-
 16 files changed, 22 insertions(+), 1062 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-hppa-closure-function-ptrs.patch
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-hppa-jump-table.patch
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-hppa-large-struct.patch
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-lld-17.patch
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-sparc-float-typo.patch
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-trampoline-c99.patch
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.7-Revert-Fix-x86-ffi64-calls-with-6-gp-and-some-sse-re.patch
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.4-r4.ebuild
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.6-r2.ebuild
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.6.ebuild
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.7.ebuild
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.8.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/Manifest
index 703f69f6861..b1d6b56ba60 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/Manifest
@@ -1,4 +1,2 @@
-DIST libffi-3.4.4.tar.gz 1362394 BLAKE2B 189fe1ffe9507f204581b0ab09995dc7e7b761bb4eac7e338e9f5ff81431aebcef6c182c1839c9f9acb2706697a260c67e6d1351cf7e2aed7c4eb5d694f6f8fd SHA512 88680aeb0fa0dc0319e5cd2ba45b4b5a340bc9b4bcf20b1e0613b39cd898f177a3863aa94034d8e23a7f6f44d858a53dcd36d1bb8dee13b751ef814224061889
 DIST libffi-3.4.6.tar.gz 1391684 BLAKE2B af8402a09bdbd59b4e9400d2d71bd5ce98f6f1d981d35d1ab40d77a831b13b32c5bd34ca54ff75999e39f0d8a9c066381fae7a8d6c5216d955e064f929f08b88 SHA512 033d2600e879b83c6bce0eb80f69c5f32aa775bf2e962c9d39fbd21226fa19d1e79173d8eaa0d0157014d54509ea73315ad86842356fc3a303c0831c94c6ab39
-DIST libffi-3.4.7.tar.gz 1393979 BLAKE2B 0dd17b4fd358beb9842889168437443137445a5dba1f0a7e8669ae420d8efb927815c08602c1b1b141acfdfdbaa12b417863402a5c8df5f36519fd3e772d3f37 SHA512 d19f59a5b5d61bd7d9e8a7a74b8bf2e697201a19c247c410c789e93ca8678a4eb9f13c9bee19f129be80ade8514f6b1acb38d66f44d86edd32644ed7bbe31dd6
 DIST libffi-3.4.8.tar.gz 1397992 BLAKE2B 10b3d970dc598fb8689bca49751cda499ddc5216baf89d38625385b0d42d57f10d15cce3c4c044c9c73a4fce384c26f2a8e1b99269e9db1174c2631201c6bfd4 SHA512 05344c6c1a1a5b44704f6cf99277098d1ea3ac1dc11c2a691c501786a214f76184ec0637135588630db609ce79e49df3dbd00282dd61e7f21137afba70e24ffe
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-hppa-closure-function-ptrs.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-hppa-closure-function-ptrs.patch
deleted file mode 100644
index 065f35e7c4c..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-hppa-closure-function-ptrs.patch
+++ /dev/null
@@ -1,170 +0,0 @@
-https://github.com/libffi/libffi/commit/e58e22b22386ed0e0a95e97eb8eed016e3f01b02
-
-From e58e22b22386ed0e0a95e97eb8eed016e3f01b02 Mon Sep 17 00:00:00 2001
-From: Anthony Green <green@moxielogic.com>
-Date: Thu, 2 Feb 2023 07:02:53 -0500
-Subject: [PATCH] From Dave Anglin:
-
-A couple of years ago the 32-bit hppa targets were converted from using a trampoline executed on the stack to the function descriptor technique used by ia64. This is more efficient and avoids having to have an executable stack. However, function pointers on 32-bit need the PLABEL bit set in the pointer. It distinguishes between pointers that point directly to the executable code and pointer that point to a function descriptor. We need the later for libffi. But as a result, it is not possible to convert using casts data pointers to function pointers.
-
-The solution at the time was to set the PLABEL bit in hppa closure pointers using FFI_CLOSURE_PTR. However, I realized recently that this was a bad choice. Packages like python-cffi allocate their own closure pointers, so this isn't going to work well there.
-
-A better solution is to leave closure pointers unchanged and only set the PLABEL bit in pointers used to point to executable code.
-
-The attached patch drops the FFI_CLOSURE_PTR and FFI_RESTORE_PTR defines. This allows some cleanup in the hppa closure routines. The FFI_FN define is now used to set the PLABEL bit on hppa. ffi_closure_alloc is modified to set the PLABEL bit in the value set in *code.
-
-I also added a FFI_CL define to convert a function pointer to a closure pointer. It is only used in one test case.
---- a/include/ffi.h.in
-+++ b/include/ffi.h.in
-@@ -361,14 +361,6 @@ typedef struct {
- FFI_API void *ffi_closure_alloc (size_t size, void **code);
- FFI_API void ffi_closure_free (void *);
- 
--#if defined(PA_LINUX) || defined(PA_HPUX)
--#define FFI_CLOSURE_PTR(X) ((void *)((unsigned int)(X) | 2))
--#define FFI_RESTORE_PTR(X) ((void *)((unsigned int)(X) & ~3))
--#else
--#define FFI_CLOSURE_PTR(X) (X)
--#define FFI_RESTORE_PTR(X) (X)
--#endif
--
- FFI_API ffi_status
- ffi_prep_closure (ffi_closure*,
- 		  ffi_cif *,
-@@ -515,8 +507,14 @@ FFI_API
- ffi_status ffi_get_struct_offsets (ffi_abi abi, ffi_type *struct_type,
- 				   size_t *offsets);
- 
--/* Useful for eliminating compiler warnings.  */
-+/* Convert between closure and function pointers.  */
-+#if defined(PA_LINUX) || defined(PA_HPUX)
-+#define FFI_FN(f) ((void (*)(void))((unsigned int)(f) | 2))
-+#define FFI_CL(f) ((void *)((unsigned int)(f) & ~3))
-+#else
- #define FFI_FN(f) ((void (*)(void))f)
-+#define FFI_CL(f) ((void *)(f))
-+#endif
- 
- /* ---- Definitions shared with assembly code ---------------------------- */
- 
---- a/src/closures.c
-+++ b/src/closures.c
-@@ -993,23 +993,23 @@ ffi_closure_alloc (size_t size, void **code)
-   if (!code)
-     return NULL;
- 
--  ptr = FFI_CLOSURE_PTR (dlmalloc (size));
-+  ptr = dlmalloc (size);
- 
-   if (ptr)
-     {
-       msegmentptr seg = segment_holding (gm, ptr);
- 
--      *code = add_segment_exec_offset (ptr, seg);
-+      *code = FFI_FN (add_segment_exec_offset (ptr, seg));
-       if (!ffi_tramp_is_supported ())
-         return ptr;
- 
-       ftramp = ffi_tramp_alloc (0);
-       if (ftramp == NULL)
-       {
--        dlfree (FFI_RESTORE_PTR (ptr));
-+        dlfree (ptr);
-         return NULL;
-       }
--      *code = ffi_tramp_get_addr (ftramp);
-+      *code = FFI_FN (ffi_tramp_get_addr (ftramp));
-       ((ffi_closure *) ptr)->ftramp = ftramp;
-     }
- 
-@@ -1050,7 +1050,7 @@ ffi_closure_free (void *ptr)
-   if (ffi_tramp_is_supported ())
-     ffi_tramp_free (((ffi_closure *) ptr)->ftramp);
- 
--  dlfree (FFI_RESTORE_PTR (ptr));
-+  dlfree (ptr);
- }
- 
- int
-@@ -1070,16 +1070,20 @@ ffi_tramp_is_present (void *ptr)
- void *
- ffi_closure_alloc (size_t size, void **code)
- {
-+  void *c;
-+
-   if (!code)
-     return NULL;
- 
--  return *code = FFI_CLOSURE_PTR (malloc (size));
-+  c = malloc (size);
-+  *code = FFI_FN (c);
-+  return c;
- }
- 
- void
- ffi_closure_free (void *ptr)
- {
--  free (FFI_RESTORE_PTR (ptr));
-+  free (ptr);
- }
- 
- void *
---- a/src/pa/ffi.c
-+++ b/src/pa/ffi.c
-@@ -445,7 +445,6 @@ ffi_status ffi_closure_inner_pa32(ffi_closure *closure, UINT32 *stack)
-   int i, avn;
-   unsigned int slot = FIRST_ARG_SLOT;
-   register UINT32 r28 asm("r28");
--  ffi_closure *c = (ffi_closure *)FFI_RESTORE_PTR (closure);
- 
-   cif = closure->cif;
- 
-@@ -548,7 +547,7 @@ ffi_status ffi_closure_inner_pa32(ffi_closure *closure, UINT32 *stack)
-     }
- 
-   /* Invoke the closure.  */
--  (c->fun) (cif, rvalue, avalue, c->user_data);
-+  (closure->fun) (cif, rvalue, avalue, closure->user_data);
- 
-   debug(3, "after calling function, ret[0] = %08x, ret[1] = %08x\n", u.ret[0],
- 	u.ret[1]);
-@@ -649,8 +648,6 @@ ffi_prep_closure_loc (ffi_closure* closure,
- 		      void *user_data,
- 		      void *codeloc)
- {
--  ffi_closure *c = (ffi_closure *)FFI_RESTORE_PTR (closure);
--
-   /* The layout of a function descriptor.  A function pointer with the PLABEL
-      bit set points to a function descriptor.  */
-   struct pa32_fd
-@@ -676,14 +673,14 @@ ffi_prep_closure_loc (ffi_closure* closure,
-   fd = (struct pa32_fd *)((UINT32)ffi_closure_pa32 & ~3);
- 
-   /* Setup trampoline.  */
--  tramp = (struct ffi_pa32_trampoline_struct *)c->tramp;
-+  tramp = (struct ffi_pa32_trampoline_struct *)closure->tramp;
-   tramp->code_pointer = fd->code_pointer;
-   tramp->fake_gp = (UINT32)codeloc & ~3;
-   tramp->real_gp = fd->gp;
- 
--  c->cif  = cif;
--  c->user_data = user_data;
--  c->fun  = fun;
-+  closure->cif  = cif;
-+  closure->user_data = user_data;
-+  closure->fun  = fun;
- 
-   return FFI_OK;
- }
---- a/testsuite/libffi.closures/closure_loc_fn0.c
-+++ b/testsuite/libffi.closures/closure_loc_fn0.c
-@@ -85,7 +85,7 @@ int main (void)
- 
- #ifndef FFI_EXEC_STATIC_TRAMP
-   /* With static trampolines, the codeloc does not point to closure */
--  CHECK(memcmp(pcl, codeloc, sizeof(*pcl)) == 0);
-+  CHECK(memcmp(pcl, FFI_CL(codeloc), sizeof(*pcl)) == 0);
- #endif
- 
-   res = (*((closure_loc_test_type0)codeloc))
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-hppa-jump-table.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-hppa-jump-table.patch
deleted file mode 100644
index 822a7eb893e..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-hppa-jump-table.patch
+++ /dev/null
@@ -1,289 +0,0 @@
-https://github.com/libffi/libffi/commit/222abd0c65babe2174b21753217145f5031a8b91
-
-From 222abd0c65babe2174b21753217145f5031a8b91 Mon Sep 17 00:00:00 2001
-From: Anthony Green <green@moxielogic.com>
-Date: Thu, 2 Feb 2023 07:04:55 -0500
-Subject: [PATCH] From Dave Anglin:
-
-This patch is derived from the work done in implementing libffi for 64-bit hppa64-hpux target. Currently, the 32-bit hppa targets do a linear search for the return type of an ffi_call. This is slow and inefficient. A jump table can used to jump directly to the code used to process the return value. In most common cases, the return value can be processed in the jump table itself.
-
-The patch also fixes return handling for FFI_TYPE_UINT8, FFI_TYPE_SINT8, FFI_TYPE_UINT16 and FFI_TYPE_SINT16.
---- a/src/pa/ffi.c
-+++ b/src/pa/ffi.c
-@@ -56,27 +56,12 @@ static inline int ffi_struct_type(ffi_type *t)
-   size_t sz = t->size;
- 
-   /* Small structure results are passed in registers,
--     larger ones are passed by pointer.  Note that
--     small structures of size 2, 4 and 8 differ from
--     the corresponding integer types in that they have
--     different alignment requirements.  */
--
--  if (sz <= 1)
--    return FFI_TYPE_UINT8;
--  else if (sz == 2)
--    return FFI_TYPE_SMALL_STRUCT2;
--  else if (sz == 3)
--    return FFI_TYPE_SMALL_STRUCT3;
--  else if (sz == 4)
--    return FFI_TYPE_SMALL_STRUCT4;
--  else if (sz == 5)
--    return FFI_TYPE_SMALL_STRUCT5;
--  else if (sz == 6)
--    return FFI_TYPE_SMALL_STRUCT6;
--  else if (sz == 7)
--    return FFI_TYPE_SMALL_STRUCT7;
--  else if (sz <= 8)
--    return FFI_TYPE_SMALL_STRUCT8;
-+     larger ones are passed by pointer.  Note that small
-+     structures differ from the corresponding integer
-+     types in that they have different alignment requirements.  */
-+
-+  if (sz <= 8)
-+    return -sz;
-   else
-     return FFI_TYPE_STRUCT; /* else, we pass it by pointer.  */
- }
-@@ -556,16 +541,16 @@ ffi_status ffi_closure_inner_pa32(ffi_closure *closure, UINT32 *stack)
-   switch (cif->flags)
-     {
-     case FFI_TYPE_UINT8:
--      *(stack - FIRST_ARG_SLOT) = (UINT8)(u.ret[0] >> 24);
-+      *(stack - FIRST_ARG_SLOT) = (UINT8)u.ret[0];
-       break;
-     case FFI_TYPE_SINT8:
--      *(stack - FIRST_ARG_SLOT) = (SINT8)(u.ret[0] >> 24);
-+      *(stack - FIRST_ARG_SLOT) = (SINT8)u.ret[0];
-       break;
-     case FFI_TYPE_UINT16:
--      *(stack - FIRST_ARG_SLOT) = (UINT16)(u.ret[0] >> 16);
-+      *(stack - FIRST_ARG_SLOT) = (UINT16)u.ret[0];
-       break;
-     case FFI_TYPE_SINT16:
--      *(stack - FIRST_ARG_SLOT) = (SINT16)(u.ret[0] >> 16);
-+      *(stack - FIRST_ARG_SLOT) = (SINT16)u.ret[0];
-       break;
-     case FFI_TYPE_INT:
-     case FFI_TYPE_SINT32:
-@@ -590,6 +575,7 @@ ffi_status ffi_closure_inner_pa32(ffi_closure *closure, UINT32 *stack)
-       /* Don't need a return value, done by caller.  */
-       break;
- 
-+    case FFI_TYPE_SMALL_STRUCT1:
-     case FFI_TYPE_SMALL_STRUCT2:
-     case FFI_TYPE_SMALL_STRUCT3:
-     case FFI_TYPE_SMALL_STRUCT4:
---- a/src/pa/ffitarget.h
-+++ b/src/pa/ffitarget.h
-@@ -73,11 +73,22 @@ typedef enum ffi_abi {
- #define FFI_TRAMPOLINE_SIZE 12
- #endif
- 
--#define FFI_TYPE_SMALL_STRUCT2 -1
--#define FFI_TYPE_SMALL_STRUCT3 -2
--#define FFI_TYPE_SMALL_STRUCT4 -3
--#define FFI_TYPE_SMALL_STRUCT5 -4
--#define FFI_TYPE_SMALL_STRUCT6 -5
--#define FFI_TYPE_SMALL_STRUCT7 -6
--#define FFI_TYPE_SMALL_STRUCT8 -7
-+#define FFI_TYPE_SMALL_STRUCT1 -1
-+#define FFI_TYPE_SMALL_STRUCT2 -2
-+#define FFI_TYPE_SMALL_STRUCT3 -3
-+#define FFI_TYPE_SMALL_STRUCT4 -4
-+#define FFI_TYPE_SMALL_STRUCT5 -5
-+#define FFI_TYPE_SMALL_STRUCT6 -6
-+#define FFI_TYPE_SMALL_STRUCT7 -7
-+#define FFI_TYPE_SMALL_STRUCT8 -8
-+
-+/* linux.S and hpux32.S expect FFI_TYPE_COMPLEX is the last generic type.  */
-+#define FFI_PA_TYPE_LAST FFI_TYPE_COMPLEX
-+
-+/* If new generic types are added, the jump tables in linux.S and hpux32.S
-+   likely need updating.  */
-+#if FFI_TYPE_LAST != FFI_PA_TYPE_LAST
-+# error "You likely have broken jump tables"
-+#endif
-+
- #endif
-
---- a/src/pa/linux.S
-+++ b/src/pa/linux.S
-@@ -103,51 +103,103 @@ ffi_call_pa32:
- 
- 	/* Prepare to store the result; we need to recover flags and rvalue.  */
- 	ldw -48(%r3), %r21                      /* r21 <- flags */
--	ldw -52(%r3), %r20                      /* r20 <- rvalue */
- 
--	/* Store the result according to the return type.  */
-+	/* Adjust flags range from [-8, 15] to  [0, 23].  */
-+	addi 8, %r21, %r21
- 
--.Lcheckint:
--	comib,<>,n FFI_TYPE_INT, %r21, .Lcheckint8
--	b	.Ldone
--	stw	%ret0, 0(%r20)
-+	blr %r21, %r0
-+	ldw -52(%r3), %r20                      /* r20 <- rvalue */
- 
--.Lcheckint8:
--	comib,<>,n FFI_TYPE_UINT8, %r21, .Lcheckint16
-+	/* Giant jump table */
-+	/* 8-byte small struct */
-+	b,n	.Lsmst8
-+	nop
-+	/* 7-byte small struct */
-+	b,n	.Lsmst7
-+	nop
-+	/* 6-byte small struct */
-+	b,n	.Lsmst6
-+	nop
-+	/* 5-byte small struct */
-+	b,n	.Lsmst5
-+	nop
-+	/* 4-byte small struct */
-+	b,n	.Lsmst4
-+	nop
-+	/* 3-byte small struct */
-+	b,n	.Lsmst3
-+	nop
-+	/* 2-byte small struct */
-+	b,n	.Lsmst2
-+	nop
-+	/* 1-byte small struct */
- 	b	.Ldone
- 	stb	%ret0, 0(%r20)
--
--.Lcheckint16:
--	comib,<>,n FFI_TYPE_UINT16, %r21, .Lcheckdbl
-+	/* void */
-+	b,n	.Ldone
-+	nop
-+	/* int */
- 	b	.Ldone
--	sth	%ret0, 0(%r20)
--
--.Lcheckdbl:
--	comib,<>,n FFI_TYPE_DOUBLE, %r21, .Lcheckfloat
-+	stw	%ret0, 0(%r20)
-+	/* float */
-+	b	.Ldone
-+	fstw	%fr4L,0(%r20)
-+	/* double */
- 	b	.Ldone
- 	fstd	%fr4,0(%r20)
--
--.Lcheckfloat:
--	comib,<>,n FFI_TYPE_FLOAT, %r21, .Lcheckll
-+	/* long double */
- 	b	.Ldone
--	fstw	%fr4L,0(%r20)
-+	fstd	%fr4,0(%r20)
-+	/* unsigned int8 */
-+	b	.Ldone
-+	stw	%ret0, 0(%r20)
-+	/* sint8 */
-+	b	.Ldone
-+	stw	%ret0, 0(%r20)
-+	/* unsigned int16 */
-+	b	.Ldone
-+	stw	%ret0, 0(%r20)
-+	/* sint16 */
-+	b	.Ldone
-+	stw	%ret0, 0(%r20)
-+	/* unsigned int32 */
-+	b	.Ldone
-+	stw	%ret0, 0(%r20)
-+	/* sint32 */
-+	b	.Ldone
-+	stw	%ret0, 0(%r20)
-+	/* unsigned int64 */
-+	b,n	.Luint64
-+	nop
-+	/* signed int64 */
-+	b,n	.Lsint64
-+	nop
-+	/* large struct */
-+	b,n	.Ldone
-+	nop
-+	/* pointer */
-+	b	.Ldone
-+	stw	%ret0, 0(%r20)
-+	/* complex */
-+	b,n	.Ldone
-+	nop
-+
-+	/* Store the result according to the return type.  */
- 
--.Lcheckll:
--	comib,<>,n FFI_TYPE_UINT64, %r21, .Lchecksmst2
-+.Luint64:
-+.Lsint64:
- 	stw	%ret0, 0(%r20)
- 	b	.Ldone
- 	stw	%ret1, 4(%r20)
- 
--.Lchecksmst2:
--	comib,<>,n FFI_TYPE_SMALL_STRUCT2, %r21, .Lchecksmst3
-+.Lsmst2:
- 	/* 2-byte structs are returned in ret0 as ????xxyy.  */
- 	extru	%ret0, 23, 8, %r22
- 	stbs,ma	%r22, 1(%r20)
- 	b	.Ldone
- 	stb	%ret0, 0(%r20)
- 
--.Lchecksmst3:
--	comib,<>,n FFI_TYPE_SMALL_STRUCT3, %r21, .Lchecksmst4
-+.Lsmst3:
- 	/* 3-byte structs are returned in ret0 as ??xxyyzz.  */
- 	extru	%ret0, 15, 8, %r22
- 	stbs,ma	%r22, 1(%r20)
-@@ -156,8 +208,7 @@ ffi_call_pa32:
- 	b	.Ldone
- 	stb	%ret0, 0(%r20)
- 
--.Lchecksmst4:
--	comib,<>,n FFI_TYPE_SMALL_STRUCT4, %r21, .Lchecksmst5
-+.Lsmst4:
- 	/* 4-byte structs are returned in ret0 as wwxxyyzz.  */
- 	extru	%ret0, 7, 8, %r22
- 	stbs,ma	%r22, 1(%r20)
-@@ -168,8 +219,7 @@ ffi_call_pa32:
- 	b	.Ldone
- 	stb	%ret0, 0(%r20)
- 
--.Lchecksmst5:
--	comib,<>,n FFI_TYPE_SMALL_STRUCT5, %r21, .Lchecksmst6
-+.Lsmst5:
- 	/* 5 byte values are returned right justified:
- 	      ret0     ret1
- 	   5: ??????aa bbccddee */
-@@ -183,8 +233,7 @@ ffi_call_pa32:
- 	b	.Ldone
- 	stb	%ret1, 0(%r20)
- 
--.Lchecksmst6:
--	comib,<>,n FFI_TYPE_SMALL_STRUCT6, %r21, .Lchecksmst7
-+.Lsmst6:
- 	/* 6 byte values are returned right justified:
- 	      ret0     ret1
- 	   6: ????aabb ccddeeff */
-@@ -200,8 +249,7 @@ ffi_call_pa32:
- 	b	.Ldone
- 	stb	%ret1, 0(%r20)
- 
--.Lchecksmst7:
--	comib,<>,n FFI_TYPE_SMALL_STRUCT7, %r21, .Lchecksmst8
-+.Lsmst7:
- 	/* 7 byte values are returned right justified:
- 	      ret0     ret1
- 	   7: ??aabbcc ddeeffgg */
-@@ -219,8 +267,7 @@ ffi_call_pa32:
- 	b	.Ldone
- 	stb	%ret1, 0(%r20)
- 
--.Lchecksmst8:
--	comib,<>,n FFI_TYPE_SMALL_STRUCT8, %r21, .Ldone
-+.Lsmst8:
- 	/* 8 byte values are returned right justified:
- 	      ret0     ret1
- 	   8: aabbccdd eeffgghh */
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-hppa-large-struct.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-hppa-large-struct.patch
deleted file mode 100644
index aaf4af36843..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-hppa-large-struct.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-https://github.com/libffi/libffi/commit/c50c16d0bcb58952840184aa83e62c6d912bf779
-
-From c50c16d0bcb58952840184aa83e62c6d912bf779 Mon Sep 17 00:00:00 2001
-From: Anthony Green <green@moxielogic.com>
-Date: Sun, 20 Nov 2022 12:20:40 -0500
-Subject: [PATCH] Fix large struct passing on PA-RISC
-
---- a/src/pa/ffi.c
-+++ b/src/pa/ffi.c
-@@ -376,10 +376,26 @@ extern void ffi_call_pa32(void (*)(UINT32 *, extended_cif *, unsigned),
- void ffi_call(ffi_cif *cif, void (*fn)(void), void *rvalue, void **avalue)
- {
-   extended_cif ecif;
-+  size_t i, nargs = cif->nargs;
-+  ffi_type **arg_types = cif->arg_types;
- 
-   ecif.cif = cif;
-   ecif.avalue = avalue;
- 
-+  /* If we have any large structure arguments, make a copy so we are passing
-+     by value.  */
-+  for (i = 0; i < nargs; i++)
-+    {
-+      ffi_type *at = arg_types[i];
-+      int size = at->size;
-+      if (at->type == FFI_TYPE_STRUCT && size > 8)
-+	{
-+	  char *argcopy = alloca (size);
-+	  memcpy (argcopy, avalue[i], size);
-+	  avalue[i] = argcopy;
-+	}
-+    }
-+
-   /* If the return value is a struct and we don't have a return
-      value address then we need to make one.  */
- 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-lld-17.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-lld-17.patch
deleted file mode 100644
index 8e87814b23b..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-lld-17.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-https://bugs.gentoo.org/915086
-https://github.com/libffi/libffi/pull/800
-
-From 65f6869fd74630a9252ef89971b725b921f17061 Mon Sep 17 00:00:00 2001
-From: Alfred Wingate <parona@protonmail.com>
-Date: Tue, 10 Oct 2023 06:32:02 +0300
-Subject: [PATCH] Put optional symbols behind ifdefs
-
-Signed-off-by: Alfred Wingate <parona@protonmail.com>
---- a/libffi.map.in
-+++ b/libffi.map.in
-@@ -33,7 +33,10 @@ LIBFFI_BASE_8.0 {
- 	ffi_raw_to_ptrarray;
- 	ffi_raw_size;
- 
-+#if !FFI_NATIVE_RAW_API
- 	ffi_java_raw_call;
-+#endif
-+
- 	ffi_java_ptrarray_to_raw;
- 	ffi_java_raw_to_ptrarray;
- 	ffi_java_raw_size;
-@@ -62,8 +65,10 @@ LIBFFI_CLOSURE_8.0 {
- 	ffi_prep_closure_loc;
- 	ffi_prep_raw_closure;
- 	ffi_prep_raw_closure_loc;
-+#if !FFI_NATIVE_RAW_API
- 	ffi_prep_java_raw_closure;
- 	ffi_prep_java_raw_closure_loc;
-+#endif
- } LIBFFI_BASE_8.0;
- #endif
- 
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-sparc-float-typo.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-sparc-float-typo.patch
deleted file mode 100644
index 3768df62df9..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-sparc-float-typo.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-https://github.com/libffi/libffi/issues/778
-https://bugs.gentoo.org/882071
-
-Fix incorrect type for passing floats. Thanks to Petr Sumbera and Richard Henderson
-for figuring it out on the upstream bug.
---- a/src/sparc/ffi64.c
-+++ b/src/sparc/ffi64.c
-@@ -382,13 +382,19 @@ ffi_prep_args_v9(ffi_cif *cif, unsigned long *argp, void *rvalue, void **avalue)
- 	  *argp++ = *(SINT32 *)a;
- 	  break;
- 	case FFI_TYPE_UINT32:
--	case FFI_TYPE_FLOAT:
- 	  *argp++ = *(UINT32 *)a;
- 	  break;
- 	case FFI_TYPE_SINT64:
- 	case FFI_TYPE_UINT64:
- 	case FFI_TYPE_POINTER:
-+          *argp++ = *(UINT64 *)a;
-+          break;
-+       case FFI_TYPE_FLOAT:
-+          flags |= SPARC_FLAG_FP_ARGS;
-+          *argp++ = *(UINT32 *)a;
-+          break;
- 	case FFI_TYPE_DOUBLE:
-+          flags |= SPARC_FLAG_FP_ARGS;
- 	  *argp++ = *(UINT64 *)a;
- 	  break;
- 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-trampoline-c99.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-trampoline-c99.patch
deleted file mode 100644
index a7728331135..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-trampoline-c99.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-https://github.com/libffi/libffi/issues/760
-https://github.com/libffi/libffi/commit/ce077e5565366171aa1b4438749b0922fce887a4
-
-From ce077e5565366171aa1b4438749b0922fce887a4 Mon Sep 17 00:00:00 2001
-From: serge-sans-paille <serge.guelton@telecom-bretagne.eu>
-Date: Thu, 2 Feb 2023 14:46:29 +0000
-Subject: [PATCH] Forward declare open_temp_exec_file (#764)
-
-It's defined in closures.c and used in tramp.c.
-Also declare it as an hidden symbol, as it should be.
-
-Co-authored-by: serge-sans-paille <sguelton@mozilla.com>
---- a/include/ffi_common.h
-+++ b/include/ffi_common.h
-@@ -128,6 +128,10 @@ void *ffi_data_to_code_pointer (void *data) FFI_HIDDEN;
-    static trampoline. */
- int ffi_tramp_is_present (void *closure) FFI_HIDDEN;
- 
-+/* Return a file descriptor of a temporary zero-sized file in a
-+   writable and executable filesystem. */
-+int open_temp_exec_file(void) FFI_HIDDEN;
-+
- /* Extended cif, used in callback from assembly routine */
- typedef struct
- {
---- a/src/tramp.c
-+++ b/src/tramp.c
-@@ -39,6 +39,10 @@
- #ifdef __linux__
- #define _GNU_SOURCE 1
- #endif
-+
-+#include <ffi.h>
-+#include <ffi_common.h>
-+
- #include <stdio.h>
- #include <unistd.h>
- #include <stdlib.h>
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.7-Revert-Fix-x86-ffi64-calls-with-6-gp-and-some-sse-re.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.7-Revert-Fix-x86-ffi64-calls-with-6-gp-and-some-sse-re.patch
deleted file mode 100644
index a8958b2fefd..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.7-Revert-Fix-x86-ffi64-calls-with-6-gp-and-some-sse-re.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 4354fe1434a37b781ff19f5a6be51ec4e982ad5a Mon Sep 17 00:00:00 2001
-Message-ID: <4354fe1434a37b781ff19f5a6be51ec4e982ad5a.1739062746.git.sam@gentoo.org>
-From: Sam James <sam@gentoo.org>
-Date: Sun, 9 Feb 2025 00:54:28 +0000
-Subject: [PATCH] Revert "Fix x86/ffi64 calls with 6 gp and some sse registers
- (#848)"
-
-This reverts commit d21881f55ed4a44d464c9091871e69b0bb47611a.
-
-Bug: https://github.com/libffi/libffi/issues/879
-Bug: https://bugs.gentoo.org/949051
-Signed-off-by: Sam James <sam@gentoo.org>
---- a/src/x86/ffi64.c
-+++ b/src/x86/ffi64.c
-@@ -654,7 +654,7 @@ ffi_call_int (ffi_cif *cif, void (*fn)(void), void *rvalue,
- 		      break;
- 		    default:
- 		      reg_args->gpr[gprcount] = 0;
--		      memcpy (&reg_args->gpr[gprcount], a, sizeof(UINT64));
-+		      memcpy (&reg_args->gpr[gprcount], a, size);
- 		    }
- 		  gprcount++;
- 		  break;
---- a/testsuite/libffi.call/struct_int_float.c
-+++ b/testsuite/libffi.call/struct_int_float.c
-@@ -5,6 +5,7 @@
-    Originator:	kellda  */
- 
- /* { dg-do run } */
-+/* { dg-skip-if "libffi bug #879" { *-*-* } { "*" } } */
- #include "ffitest.h"
- 
- typedef struct
-
-base-commit: 1716f81e9a115d340429504563bc8e7fb2eeef2b
--- 
-2.48.1
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.4-r4.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.4-r4.ebuild
deleted file mode 100644
index 197f9975b8f..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.4-r4.ebuild
+++ /dev/null
@@ -1,83 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit multilib-minimal preserve-libs
-
-MY_PV=${PV/_rc/-rc}
-MY_P=${PN}-${MY_PV}
-
-DESCRIPTION="Portable, high level programming interface to various calling conventions"
-HOMEPAGE="https://sourceware.org/libffi/"
-SRC_URI="https://github.com/libffi/libffi/releases/download/v${MY_PV}/${MY_P}.tar.gz"
-S="${WORKDIR}"/${MY_P}
-
-LICENSE="MIT"
-# This is a core package which is depended on by e.g. Python
-# Please use preserve-libs.eclass in pkg_{pre,post}inst to cover users
-# with FEATURES="-preserved-libs" or another package manager if SONAME
-# changes.
-SLOT="0/8" # SONAME=libffi.so.8
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="debug exec-static-trampoline pax-kernel static-libs test"
-
-RESTRICT="!test? ( test )"
-BDEPEND="test? ( dev-util/dejagnu )"
-
-PATCHES=(
-	"${FILESDIR}"/${P}-hppa-large-struct.patch
-	"${FILESDIR}"/${P}-hppa-closure-function-ptrs.patch
-	"${FILESDIR}"/${P}-hppa-jump-table.patch
-	"${FILESDIR}"/${P}-sparc-float-typo.patch
-	"${FILESDIR}"/${P}-lld-17.patch
-	"${FILESDIR}"/${P}-trampoline-c99.patch
-)
-
-src_prepare() {
-	default
-
-	if [[ ${CHOST} == arm64-*-darwin* ]] ; then
-		# ensure we use aarch64 asm, not x86 on arm64
-		sed -i -e 's/aarch64\*-\*-\*/arm64*-*-*|&/' \
-			configure configure.host || die
-	fi
-}
-
-multilib_src_configure() {
-	# --includedir= path maintains a few properties:
-	# 1. have stable name across libffi versions: some packages like
-	#    dev-lang/ghc or kde-frameworks/networkmanager-qt embed
-	#    ${includedir} at build-time. Don't require those to be
-	#    rebuilt unless SONAME changes. bug #695788
-	#
-	#    We use /usr/.../${PN} (instead of former /usr/.../${P}).
-	#
-	# 2. have ${ABI}-specific location as ffi.h is target-dependent.
-	#
-	#    We use /usr/$(get_libdir)/... to have ABI identifier.
-	ECONF_SOURCE="${S}" econf \
-		--includedir="${EPREFIX}"/usr/$(get_libdir)/${PN}/include \
-		--disable-multi-os-directory \
-		$(use_enable static-libs static) \
-		$(use_enable exec-static-trampoline exec-static-tramp) \
-		$(use_enable pax-kernel pax_emutramp) \
-		$(use_enable debug)
-}
-
-multilib_src_test() {
-	emake -Onone check
-}
-
-multilib_src_install_all() {
-	einstalldocs
-	find "${ED}" -name "*.la" -delete || die
-}
-
-pkg_preinst() {
-	preserve_old_lib /usr/$(get_libdir)/libffi.so.7
-}
-
-pkg_postinst() {
-	preserve_old_lib_notify /usr/$(get_libdir)/libffi.so.7
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.6-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.6-r2.ebuild
deleted file mode 100644
index 1513432cf61..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.6-r2.ebuild
+++ /dev/null
@@ -1,96 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit multilib-minimal preserve-libs
-
-MY_PV=${PV/_rc/-rc}
-MY_P=${PN}-${MY_PV}
-
-DESCRIPTION="Portable, high level programming interface to various calling conventions"
-HOMEPAGE="https://sourceware.org/libffi/"
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://github.com/libffi/libffi"
-	inherit git-r3
-else
-	SRC_URI="https://github.com/libffi/libffi/releases/download/v${MY_PV}/${MY_P}.tar.gz"
-
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-S="${WORKDIR}"/${MY_P}
-
-LICENSE="MIT"
-# This is a core package which is depended on by e.g. Python.
-# Please use preserve-libs.eclass in pkg_{pre,post}inst to cover users
-# with FEATURES="-preserved-libs" or another package manager if SONAME changes.
-SLOT="0/8" # SONAME=libffi.so.8
-IUSE="debug exec-static-trampoline pax-kernel static-libs test"
-
-RESTRICT="!test? ( test )"
-BDEPEND="test? ( dev-util/dejagnu )"
-
-PATCHES=(
-	"${FILESDIR}"/${P}-arm64-bti.patch
-	"${FILESDIR}"/${P}-arm64-bti-spelling.patch
-	"${FILESDIR}"/${P}-arm64-support-pac.patch
-	"${FILESDIR}"/${P}-arm64-fix-build.patch
-	"${FILESDIR}"/${P}-sparc-struct-targs.patch
-	"${FILESDIR}"/${P}-test-typo.patch
-	"${FILESDIR}"/${P}-x86-sse.patch
-	"${FILESDIR}"/${P}-arm64-cfi.patch
-	"${FILESDIR}"/${P}-asan.patch
-	"${FILESDIR}"/${P}-tests.patch
-	"${FILESDIR}"/${P}-regenerate-autotools.patch
-	"${FILESDIR}"/${P}-c23-tests.patch
-)
-
-src_prepare() {
-	default
-
-	if [[ ${CHOST} == arm64-*-darwin* ]] ; then
-		# ensure we use aarch64 asm, not x86 on arm64
-		sed -i -e 's/aarch64\*-\*-\*/arm64*-*-*|&/' \
-			configure configure.host || die
-	fi
-}
-
-multilib_src_configure() {
-	# --includedir= path maintains a few properties:
-	# 1. have stable name across libffi versions: some packages like
-	#    dev-lang/ghc or kde-frameworks/networkmanager-qt embed
-	#    ${includedir} at build-time. Don't require those to be
-	#    rebuilt unless SONAME changes. bug #695788
-	#
-	#    We use /usr/.../${PN} (instead of former /usr/.../${P}).
-	#
-	# 2. have ${ABI}-specific location as ffi.h is target-dependent.
-	#
-	#    We use /usr/$(get_libdir)/... to have ABI identifier.
-	ECONF_SOURCE="${S}" econf \
-		--includedir="${EPREFIX}"/usr/$(get_libdir)/${PN}/include \
-		--disable-multi-os-directory \
-		$(use_enable static-libs static) \
-		$(use_enable exec-static-trampoline exec-static-tramp) \
-		$(use_enable pax-kernel pax_emutramp) \
-		$(use_enable debug)
-}
-
-multilib_src_test() {
-	emake -Onone check
-}
-
-multilib_src_install_all() {
-	einstalldocs
-	find "${ED}" -name "*.la" -delete || die
-}
-
-pkg_preinst() {
-	preserve_old_lib /usr/$(get_libdir)/libffi.so.7
-}
-
-pkg_postinst() {
-	preserve_old_lib_notify /usr/$(get_libdir)/libffi.so.7
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.6-r3.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.6-r3.ebuild
index e71339d70dc..7773456321b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.6-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.6-r3.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit multilib-minimal preserve-libs
+inherit dot-a multilib-minimal preserve-libs
 
 MY_PV=${PV/_rc/-rc}
 MY_P=${PN}-${MY_PV}
@@ -17,7 +17,7 @@ if [[ ${PV} == 9999 ]] ; then
 else
 	SRC_URI="https://github.com/libffi/libffi/releases/download/v${MY_PV}/${MY_P}.tar.gz"
 
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 S="${WORKDIR}"/${MY_P}
@@ -55,6 +55,11 @@ src_prepare() {
 	fi
 }
 
+src_configure() {
+	use static-libs && lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	# --includedir= path maintains a few properties:
 	# 1. have stable name across libffi versions: some packages like
@@ -83,6 +88,7 @@ multilib_src_test() {
 multilib_src_install_all() {
 	einstalldocs
 	find "${ED}" -name "*.la" -delete || die
+	strip-lto-bytecode
 }
 
 pkg_preinst() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.6.ebuild
deleted file mode 100644
index 1877e315196..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.6.ebuild
+++ /dev/null
@@ -1,73 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit multilib-minimal preserve-libs
-
-MY_PV=${PV/_rc/-rc}
-MY_P=${PN}-${MY_PV}
-
-DESCRIPTION="Portable, high level programming interface to various calling conventions"
-HOMEPAGE="https://sourceware.org/libffi/"
-SRC_URI="https://github.com/libffi/libffi/releases/download/v${MY_PV}/${MY_P}.tar.gz"
-S="${WORKDIR}"/${MY_P}
-
-LICENSE="MIT"
-# This is a core package which is depended on by e.g. Python.
-# Please use preserve-libs.eclass in pkg_{pre,post}inst to cover users
-# with FEATURES="-preserved-libs" or another package manager if SONAME changes.
-SLOT="0/8" # SONAME=libffi.so.8
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="debug exec-static-trampoline pax-kernel static-libs test"
-
-RESTRICT="!test? ( test )"
-BDEPEND="test? ( dev-util/dejagnu )"
-
-src_prepare() {
-	default
-
-	if [[ ${CHOST} == arm64-*-darwin* ]] ; then
-		# ensure we use aarch64 asm, not x86 on arm64
-		sed -i -e 's/aarch64\*-\*-\*/arm64*-*-*|&/' \
-			configure configure.host || die
-	fi
-}
-
-multilib_src_configure() {
-	# --includedir= path maintains a few properties:
-	# 1. have stable name across libffi versions: some packages like
-	#    dev-lang/ghc or kde-frameworks/networkmanager-qt embed
-	#    ${includedir} at build-time. Don't require those to be
-	#    rebuilt unless SONAME changes. bug #695788
-	#
-	#    We use /usr/.../${PN} (instead of former /usr/.../${P}).
-	#
-	# 2. have ${ABI}-specific location as ffi.h is target-dependent.
-	#
-	#    We use /usr/$(get_libdir)/... to have ABI identifier.
-	ECONF_SOURCE="${S}" econf \
-		--includedir="${EPREFIX}"/usr/$(get_libdir)/${PN}/include \
-		--disable-multi-os-directory \
-		$(use_enable static-libs static) \
-		$(use_enable exec-static-trampoline exec-static-tramp) \
-		$(use_enable pax-kernel pax_emutramp) \
-		$(use_enable debug)
-}
-
-multilib_src_test() {
-	emake -Onone check
-}
-
-multilib_src_install_all() {
-	einstalldocs
-	find "${ED}" -name "*.la" -delete || die
-}
-
-pkg_preinst() {
-	preserve_old_lib /usr/$(get_libdir)/libffi.so.7
-}
-
-pkg_postinst() {
-	preserve_old_lib_notify /usr/$(get_libdir)/libffi.so.7
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.7.ebuild
deleted file mode 100644
index 072cb92af74..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.7.ebuild
+++ /dev/null
@@ -1,87 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit multilib-minimal preserve-libs
-
-MY_PV=${PV/_rc/-rc}
-MY_P=${PN}-${MY_PV}
-
-DESCRIPTION="Portable, high level programming interface to various calling conventions"
-HOMEPAGE="https://sourceware.org/libffi/"
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://github.com/libffi/libffi"
-	inherit autotools git-r3
-else
-	SRC_URI="https://github.com/libffi/libffi/releases/download/v${MY_PV}/${MY_P}.tar.gz"
-
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-S="${WORKDIR}"/${MY_P}
-
-LICENSE="MIT"
-# This is a core package which is depended on by e.g. Python.
-# Please use preserve-libs.eclass in pkg_{pre,post}inst to cover users
-# with FEATURES="-preserved-libs" or another package manager if SONAME changes.
-SLOT="0/8" # SONAME=libffi.so.8
-IUSE="debug +exec-static-trampoline pax-kernel static-libs test"
-
-RESTRICT="!test? ( test )"
-BDEPEND="test? ( dev-util/dejagnu )"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-3.4.7-Revert-Fix-x86-ffi64-calls-with-6-gp-and-some-sse-re.patch
-)
-
-src_prepare() {
-	default
-
-	[[ ${PV} == 9999 ]] && eautoreconf
-
-	if [[ ${CHOST} == arm64-*-darwin* ]] ; then
-		# ensure we use aarch64 asm, not x86 on arm64
-		sed -i -e 's/aarch64\*-\*-\*/arm64*-*-*|&/' \
-			configure configure.host || die
-	fi
-}
-
-multilib_src_configure() {
-	# --includedir= path maintains a few properties:
-	# 1. have stable name across libffi versions: some packages like
-	#    dev-lang/ghc or kde-frameworks/networkmanager-qt embed
-	#    ${includedir} at build-time. Don't require those to be
-	#    rebuilt unless SONAME changes. bug #695788
-	#
-	#    We use /usr/.../${PN} (instead of former /usr/.../${P}).
-	#
-	# 2. have ${ABI}-specific location as ffi.h is target-dependent.
-	#
-	#    We use /usr/$(get_libdir)/... to have ABI identifier.
-	ECONF_SOURCE="${S}" econf \
-		--includedir="${EPREFIX}"/usr/$(get_libdir)/${PN}/include \
-		--disable-multi-os-directory \
-		$(use_enable static-libs static) \
-		$(use_enable exec-static-trampoline exec-static-tramp) \
-		$(use_enable pax-kernel pax_emutramp) \
-		$(use_enable debug)
-}
-
-multilib_src_test() {
-	emake -Onone check
-}
-
-multilib_src_install_all() {
-	einstalldocs
-	find "${ED}" -name "*.la" -delete || die
-}
-
-pkg_preinst() {
-	preserve_old_lib /usr/$(get_libdir)/libffi.so.7
-}
-
-pkg_postinst() {
-	preserve_old_lib_notify /usr/$(get_libdir)/libffi.so.7
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.8-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.8-r1.ebuild
index b53a7ca31e8..86ce6f2a9d6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.8-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.8-r1.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit multilib-minimal preserve-libs
+inherit dot-a multilib-minimal preserve-libs
 
 MY_PV=${PV/_rc/-rc}
 MY_P=${PN}-${MY_PV}
@@ -48,6 +48,11 @@ src_prepare() {
 	fi
 }
 
+src_configure() {
+	use static-libs && lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	# --includedir= path maintains a few properties:
 	# 1. have stable name across libffi versions: some packages like
@@ -76,6 +81,7 @@ multilib_src_test() {
 multilib_src_install_all() {
 	einstalldocs
 	find "${ED}" -name "*.la" -delete || die
+	strip-lto-bytecode
 }
 
 pkg_preinst() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.8.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.8.ebuild
deleted file mode 100644
index e000b77b4e7..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.8.ebuild
+++ /dev/null
@@ -1,83 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit multilib-minimal preserve-libs
-
-MY_PV=${PV/_rc/-rc}
-MY_P=${PN}-${MY_PV}
-
-DESCRIPTION="Portable, high level programming interface to various calling conventions"
-HOMEPAGE="https://sourceware.org/libffi/"
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://github.com/libffi/libffi"
-	inherit autotools git-r3
-else
-	SRC_URI="https://github.com/libffi/libffi/releases/download/v${MY_PV}/${MY_P}.tar.gz"
-
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-S="${WORKDIR}"/${MY_P}
-
-LICENSE="MIT"
-# This is a core package which is depended on by e.g. Python.
-# Please use preserve-libs.eclass in pkg_{pre,post}inst to cover users
-# with FEATURES="-preserved-libs" or another package manager if SONAME changes.
-SLOT="0/8" # SONAME=libffi.so.8
-IUSE="debug +exec-static-trampoline pax-kernel static-libs test"
-
-RESTRICT="!test? ( test )"
-BDEPEND="test? ( dev-util/dejagnu )"
-
-src_prepare() {
-	default
-
-	[[ ${PV} == 9999 ]] && eautoreconf
-
-	if [[ ${CHOST} == arm64-*-darwin* ]] ; then
-		# ensure we use aarch64 asm, not x86 on arm64
-		sed -i -e 's/aarch64\*-\*-\*/arm64*-*-*|&/' \
-			configure configure.host || die
-	fi
-}
-
-multilib_src_configure() {
-	# --includedir= path maintains a few properties:
-	# 1. have stable name across libffi versions: some packages like
-	#    dev-lang/ghc or kde-frameworks/networkmanager-qt embed
-	#    ${includedir} at build-time. Don't require those to be
-	#    rebuilt unless SONAME changes. bug #695788
-	#
-	#    We use /usr/.../${PN} (instead of former /usr/.../${P}).
-	#
-	# 2. have ${ABI}-specific location as ffi.h is target-dependent.
-	#
-	#    We use /usr/$(get_libdir)/... to have ABI identifier.
-	ECONF_SOURCE="${S}" econf \
-		--includedir="${EPREFIX}"/usr/$(get_libdir)/${PN}/include \
-		--disable-multi-os-directory \
-		$(use_enable static-libs static) \
-		$(use_enable exec-static-trampoline exec-static-tramp) \
-		$(use_enable pax-kernel pax_emutramp) \
-		$(use_enable debug)
-}
-
-multilib_src_test() {
-	emake -Onone check
-}
-
-multilib_src_install_all() {
-	einstalldocs
-	find "${ED}" -name "*.la" -delete || die
-}
-
-pkg_preinst() {
-	preserve_old_lib /usr/$(get_libdir)/libffi.so.7
-}
-
-pkg_postinst() {
-	preserve_old_lib_notify /usr/$(get_libdir)/libffi.so.7
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-9999.ebuild
index e000b77b4e7..c210e2cd608 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-9999.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit multilib-minimal preserve-libs
+inherit dot-a multilib-minimal preserve-libs
 
 MY_PV=${PV/_rc/-rc}
 MY_P=${PN}-${MY_PV}
@@ -44,6 +44,11 @@ src_prepare() {
 	fi
 }
 
+src_configure() {
+	use static-libs && lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	# --includedir= path maintains a few properties:
 	# 1. have stable name across libffi versions: some packages like
@@ -72,6 +77,7 @@ multilib_src_test() {
 multilib_src_install_all() {
 	einstalldocs
 	find "${ED}" -name "*.la" -delete || die
+	strip-lto-bytecode
 }
 
 pkg_preinst() {

From 32e8a3683b2c701dbeba96d53302574d819eb9d9 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:49 +0000
Subject: [PATCH 026/136] dev-libs/libgcrypt: Sync with Gentoo

It's from Gentoo commit 935614768dca5bbc2ff262d966091e07dee69120.
---
 .../dev-libs/libgcrypt/Manifest               |   2 +
 .../libgcrypt/libgcrypt-1.11.1.ebuild         | 178 ++++++++++++++++++
 2 files changed, 180 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.1.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/Manifest
index 8f6a1788ff2..2e4f0d3014f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/Manifest
@@ -4,3 +4,5 @@ DIST libgcrypt-1.10.3.tar.bz2 3783827 BLAKE2B 1a228e02820e886016eb55dee75936c442
 DIST libgcrypt-1.10.3.tar.bz2.sig 238 BLAKE2B 216baebca91b2e940f60d70a4260b6b6b8221ef88cfb42b020bc7b3743a465ef2cf105316648ed1e689cbbf7d79da421aa9f08b5af21c5b862734cf01f377214 SHA512 73795781a458c334ec6daade1b86ae8b788dd5da0b7198b46b8e54a103c5ec4c65a5dd7e6a9d173d136889f24e7f5721992f59117334f39bd1c8a94e3b55a048
 DIST libgcrypt-1.11.0.tar.bz2 4180345 BLAKE2B fe3f42480c0b9a0c50c24f4c54197404b4e1056d8baa9c0c07c671c9c05b90777580b4cbcde931b50ecb4dd93f5ddad89cea99aa36a35f86f796a003e3816f7d SHA512 8e093e69e3c45d30838625ca008e995556f0d5b272de1c003d44ef94633bcc0d0ef5d95e8725eb531bfafb4490ac273488633e0c801200d4666194f86c3e270e
 DIST libgcrypt-1.11.0.tar.bz2.sig 119 BLAKE2B e64d59dae5556e2826f6d297988a3300c36d05aeecfe19544c5092b5f7b777b9b3f37c5ddcfcba5a916ae237cf981efdd9e3bdec482f7c36b12ac5c70f9d4c52 SHA512 8c5ceb50d70ccdedcc1ff4b31a65a07198567b85f582e3e67699cc3e5d012bebf7b1d4903652d11905a9cd845976ad7d3642474804777d0bdc46c6847d92fe38
+DIST libgcrypt-1.11.1.tar.bz2 4233557 BLAKE2B 6416c6a782665e8a8d1c7993d94e620c586cfb65f273bde3d609bd7ca729a92d7ac3e156dabea42c34dbe50af7ce9b16333f63115f968aebb2b4a6dd37d4b99c SHA512 85846d62ce785e4250a2bf8a2b13ec24837e48ab8e10d537ad4a18d650d2cca747f82fd1501feab47ad3114b9593b36c9fa7a892f48139e2a71ef61295a47678
+DIST libgcrypt-1.11.1.tar.bz2.sig 119 BLAKE2B b8d5bca5b903b34f48694a49e6da2c1ce449b0b28a71b9a0a6ce156e413cd19510ae7bc051bbc194bb17eec07501ee58538b45baf89918803077645f22c2244c SHA512 a9b9e2466f32623f417574537656f776baf9a933fba96fd969dda26b6bf13864ee5765112654b269f79a7f20a4a0712cf8cec7be759966088045bca040e01edc
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.1.ebuild
new file mode 100644
index 00000000000..feb27f3ae19
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.1.ebuild
@@ -0,0 +1,178 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
+inherit autotools flag-o-matic linux-info multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="General purpose crypto library based on the code used in GnuPG"
+HOMEPAGE="https://www.gnupg.org/"
+SRC_URI="mirror://gnupg/${PN}/${P}.tar.bz2"
+SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
+
+LICENSE="LGPL-2.1+ GPL-2+ MIT"
+SLOT="0/20" # subslot = soname major version
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="+asm doc +getentropy static-libs"
+IUSE+=" cpu_flags_arm_neon cpu_flags_arm_aes cpu_flags_arm_sha1 cpu_flags_arm_sha2 cpu_flags_arm_sve"
+IUSE+=" cpu_flags_ppc_altivec cpu_flags_ppc_vsx2 cpu_flags_ppc_vsx3"
+IUSE+=" cpu_flags_x86_aes cpu_flags_x86_avx cpu_flags_x86_avx2 cpu_flags_x86_avx512f cpu_flags_x86_padlock cpu_flags_x86_sha cpu_flags_x86_sse4_1"
+
+# Build system only has --disable-arm-crypto-support right now
+# If changing this, update src_configure logic too.
+# ARM CPUs seem to, right now, support all-or-nothing for crypto extensions,
+# but this looks like it might change in future. This is just a safety check
+# in case people somehow do have a CPU which only supports some. They must
+# for now disable them all if that's the case.
+REQUIRED_USE="
+	cpu_flags_arm_aes? ( cpu_flags_arm_sha1 cpu_flags_arm_sha2 )
+	cpu_flags_arm_sha1? ( cpu_flags_arm_aes cpu_flags_arm_sha2 )
+	cpu_flags_arm_sha2? ( cpu_flags_arm_aes cpu_flags_arm_sha1 )
+	cpu_flags_ppc_vsx3? ( cpu_flags_ppc_altivec cpu_flags_ppc_vsx2 )
+	cpu_flags_ppc_vsx2? ( cpu_flags_ppc_altivec )
+"
+
+RDEPEND="
+	>=dev-libs/libgpg-error-1.49[${MULTILIB_USEDEP}]
+	getentropy? (
+		kernel_linux? (
+			elibc_glibc? ( >=sys-libs/glibc-2.25 )
+			elibc_musl? ( >=sys-libs/musl-1.1.20 )
+		)
+	)
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	doc? ( virtual/texi2dvi )
+	verify-sig? ( sec-keys/openpgp-keys-gnupg )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-multilib-syspath.patch
+	"${FILESDIR}"/${PN}-powerpc-darwin.patch
+)
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/libgcrypt-config
+)
+
+pkg_pretend() {
+	if [[ ${MERGE_TYPE} == buildonly ]]; then
+		return
+	fi
+	if use kernel_linux && use getentropy; then
+		unset KV_FULL
+		get_running_version
+		if [[ -n ${KV_FULL} ]] && kernel_is -lt 3 17; then
+			eerror "The getentropy function requires the getrandom syscall."
+			eerror "This was introduced in Linux 3.17."
+			eerror "Your system is currently running Linux ${KV_FULL}."
+			eerror "Disable the 'getentropy' USE flag or upgrade your kernel."
+			die "Kernel is too old for getentropy"
+		fi
+	fi
+}
+
+pkg_setup() {
+	:
+}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	# Sensitive to optimisation; parts of the codebase are built with
+	# -O0 already. Don't risk it with UB.
+	strip-flags
+
+	# Hardcodes the path to FGREP in libgcrypt-config
+	export ac_cv_path_SED="sed"
+	export ac_cv_path_EGREP="grep -E"
+	export ac_cv_path_EGREP_TRADITIONAL="grep -E"
+	export ac_cv_path_FGREP="grep -F"
+	export ac_cv_path_GREP="grep"
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	if [[ ${CHOST} == powerpc* ]] ; then
+		# ./configure does a lot of automagic, prevent that
+		# generic ppc32+ppc64 altivec
+		use cpu_flags_ppc_altivec || local -x gcry_cv_cc_ppc_altivec=no
+		use cpu_flags_ppc_altivec || local -x gcry_cv_cc_ppc_altivec_cflags=no
+		# power8 vector extension, aka arch 2.07 ISA, also checked below via ppc-crypto-support
+		use cpu_flags_ppc_vsx2 || local -x gcry_cv_gcc_inline_asm_ppc_altivec=no
+		# power9 vector extension, aka arch 3.00 ISA
+		use cpu_flags_ppc_vsx3 || local -x gcry_cv_gcc_inline_asm_ppc_arch_3_00=no
+	fi
+
+	append-ldflags $(test-flags-CCLD -Wl,--undefined-version)
+
+	local myeconfargs=(
+		CC_FOR_BUILD="$(tc-getBUILD_CC)"
+
+		--enable-noexecstack
+		$(use_enable cpu_flags_arm_neon neon-support)
+		# See REQUIRED_USE comment above
+		$(use_enable cpu_flags_arm_aes arm-crypto-support)
+		$(use_enable cpu_flags_arm_sve sve-support)
+		$(use_enable cpu_flags_ppc_vsx2 ppc-crypto-support)
+		$(use_enable cpu_flags_x86_aes aesni-support)
+		$(use_enable cpu_flags_x86_avx avx-support)
+		$(use_enable cpu_flags_x86_avx2 avx2-support)
+		$(use_enable cpu_flags_x86_avx512f avx512-support)
+		$(use_enable cpu_flags_x86_padlock padlock-support)
+		$(use_enable cpu_flags_x86_sha shaext-support)
+		$(use_enable cpu_flags_x86_sse4_1 sse41-support)
+		# required for sys-power/suspend[crypt], bug 751568
+		$(use_enable static-libs static)
+
+		# disabled due to various applications requiring privileges
+		# after libgcrypt drops them (bug #468616)
+		--without-capabilities
+
+		$(use asm || echo "--disable-asm")
+
+		GPG_ERROR_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpg-error-config"
+	)
+
+	if use kernel_linux; then
+		# --enable-random=getentropy requires getentropy/getrandom.
+		# --enable-random=linux enables legacy code that tries getrandom
+		# and falls back to reading /dev/random.
+		myeconfargs+=( --enable-random=$(usex getentropy getentropy linux) )
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}" \
+		$("${S}/configure" --help | grep -o -- '--without-.*-prefix')
+}
+
+multilib_src_compile() {
+	default
+	multilib_is_native_abi && use doc && VARTEXFONTS="${T}/fonts" emake -C doc gcrypt.pdf
+}
+
+multilib_src_test() {
+	# t-secmem and t-sexp need mlock which requires extra privileges; nspawn
+	# at least disallows that by default.
+	local -x GCRYPT_IN_ASAN_TEST=1
+	# Avoid running (very) expensive bench-slope test. On hppa, it
+	# takes at least 7 hours.
+	local -x GCRYPT_NO_BENCHMARKS=1
+
+	default
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+	multilib_is_native_abi && use doc && dodoc doc/gcrypt.pdf
+}
+
+multilib_src_install_all() {
+	default
+	find "${ED}" -type f -name '*.la' -delete || die
+}

From 1b34db38b214cf22d27249a82ed66a92c1940245 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:51 +0000
Subject: [PATCH 027/136] dev-libs/libnl: Sync with Gentoo

It's from Gentoo commit be6758046dd7d69b8a5f235e1719b0e97f794c0d.
---
 .../src/third_party/portage-stable/dev-libs/libnl/metadata.xml   | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/metadata.xml
index ff40a5ef75a..cb4d98b0f4c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/metadata.xml
@@ -11,5 +11,6 @@
 	</use>
 	<upstream>
 		<remote-id type="github">thom311/libnl</remote-id>
+		<remote-id type="cpe">cpe:/a:libnl_project:libnl</remote-id>
 	</upstream>
 </pkgmetadata>

From c19b33add203c97fcd4b5f116e65e83e96952e72 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:51 +0000
Subject: [PATCH 028/136] dev-libs/libpcre2: Sync with Gentoo

It's from Gentoo commit fe872e9a486c58a572b39b8de540f2e5a65ec18a.
---
 .../dev-libs/libpcre2/libpcre2-10.45.ebuild               | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libpcre2/libpcre2-10.45.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libpcre2/libpcre2-10.45.ebuild
index a21e4729456..9d3b13d8c99 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libpcre2/libpcre2-10.45.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libpcre2/libpcre2-10.45.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/nicholaswilson.asc
-inherit libtool multilib multilib-minimal toolchain-funcs verify-sig
+inherit dot-a libtool multilib multilib-minimal toolchain-funcs verify-sig
 
 MY_P="pcre2-${PV/_rc/-RC}"
 
@@ -55,6 +55,11 @@ src_prepare() {
 	elibtoolize
 }
 
+src_configure() {
+	use static-libs && lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	local myeconfargs=(
 		--enable-pcre2-8
@@ -99,4 +104,5 @@ multilib_src_install() {
 
 multilib_src_install_all() {
 	find "${ED}" -type f -name "*.la" -delete || die
+	strip-lto-bytecode
 }

From 0a6350d061b3bab448a8eec8c5405ca19ca645bc Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:57 +0000
Subject: [PATCH 029/136] dev-libs/libxml2: Sync with Gentoo

It's from Gentoo commit 9302e6747a1e2a100abca96c4dc412ae325026a7.
---
 .../portage-stable/dev-libs/libxml2/Manifest  |   5 +-
 .../files/libxml2-2.11.5-CVE-2023-45322.patch |  71 -------
 .../files/libxml2-2.11.9-icu-pkgconfig.patch  |  19 --
 .../libxml2/files/libxml2-2.14.2-no-git.patch |  34 +++
 .../dev-libs/libxml2/libxml2-2.11.9.ebuild    | 201 ------------------
 ...l2-2.12.9.ebuild => libxml2-2.13.8.ebuild} |  16 +-
 ...2-2.12.10.ebuild => libxml2-2.14.2.ebuild} | 125 +++++------
 .../dev-libs/libxml2/libxml2-9999.ebuild      | 121 +++++------
 8 files changed, 151 insertions(+), 441 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.5-CVE-2023-45322.patch
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.9-icu-pkgconfig.patch
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.14.2-no-git.patch
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.11.9.ebuild
 rename sdk_container/src/third_party/portage-stable/dev-libs/libxml2/{libxml2-2.12.9.ebuild => libxml2-2.13.8.ebuild} (88%)
 rename sdk_container/src/third_party/portage-stable/dev-libs/libxml2/{libxml2-2.12.10.ebuild => libxml2-2.14.2.ebuild} (53%)

diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/Manifest
index 3615728f1b9..6f9695a2c63 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/Manifest
@@ -1,8 +1,7 @@
-DIST libxml2-2.11.9.tar.xz 2627500 BLAKE2B 3ecab5df9017673f31e8bbf737273d72cb4475c3a6f0d0669e7f074b0e4d378460df2e175fe4991c675d8462a2e4d4607c151ed11937a0c8a3a4e81107102f67 SHA512 d5c34ed56525f4c6b61d7055fe4219d7a3337077b4fb27081682e9f8350f1542b4476ac42f2754e590b371a4d9a00921cebf20c10b299371b05b8391e7fa7c33
-DIST libxml2-2.12.10.tar.xz 2483708 BLAKE2B b0e68457650665967936799c5b8f550a74534a820ffa1ebcf580c025681ab7f0a0941aea8e3cec93dc056e9cbe53266864635d991f8ce7662cf7b66b2c49abbd SHA512 7bd04375321a99c9b7a82d6a72d9412ab45f958b923f1e2f75d9dfbb1a053eba3e0fd067a53753f9a343b4dcb2d9ab5cba894d4194a5f9fb7108f7c545224791
-DIST libxml2-2.12.9.tar.xz 2643456 BLAKE2B 769ff564e62c1c0167e5334879ac9e912491c651b6d48a9d21db569002ae86bc4e4490098710a614bc90bbefc44a9dd0af6b02958041dd3bffccf8b5ddc0f7ca SHA512 6e4544ed3ab36d6cb7481d465ceabf223444739d7f41de3e1927309b8716a5eac85520b9bbaf69913f53e052fbfaf68bf27372074daaa24dca9463ce728b4173
 DIST libxml2-2.13.6.tar.xz 2423476 BLAKE2B b21f2946dd6945de4a47c993e93bfbbc785b51a501782bf44c234ad69675a58ccdbf6a255301c4d69e92ba9a9ed6670156e55b4d8100215f2dea015c943931ff SHA512 1d4fc3c58df28834ceeeefd49ab90b263b62823d2f0870ae38d11320da93cfa2a18d979c605293c91ad985cb702e7395ddc0ec00b4785dab35ba6d8c33d5f6a7
 DIST libxml2-2.13.7.tar.xz 2424236 BLAKE2B 464097c4b579f964a42909e26b3c2702d7b40c3029628c8980a1ea7a43867dda3c4bdf38b63557f971b20b125a5fc0ac7031bad5df10b1bc25380e995f7707b4 SHA512 6e69ed38cdf2aaa5df7e26b654a7aadd2d80131619184380bafc6a22811acb6b7286c819175c3b37edb194019a93ba6085852a0281934d6bb36d0b52ce138541
+DIST libxml2-2.13.8.tar.xz 2423128 BLAKE2B 9abe12acb2b619f8649dc4472c39d4c59074a83538bf1a534163737bf9e99e6387fec53404392c325102da1e77f53606f2679c47b7136d7f7541a8fcc6bcd995 SHA512 668e556404693f17e074bc31e2caa5e50bf003ee3cd81b61a51ea25e76efd7eff7ec70ff603eed87b9d9e9b2299673e6e8871798264113e660e703b74b58458f
+DIST libxml2-2.14.2.tar.xz 2324716 BLAKE2B 2331234ed60358168298d04c83162bfe7d08e6fc77091fe1ecf8384e68902ab745f039dc807d12dda3124313724806bd7fb651de975dbc60fdaf963bac043ff8 SHA512 9b54b9cbee76a56f187c0dc18a5303854f8b6383d11da8f92d6c89dde17b2d03f5d242b91abf9e30b50918a748770db6efdc9b3d73069e513ca30b6c2164dfec
 DIST xmlts20130923.tar.gz 641522 BLAKE2B 63a47bc69278ef510cd0b3779aed729e1b309e30efa0015d28ed051cc03f9dfddb447ab57b07b3393e8f47393d15473b0e199c34cb1f5f746b15ddfaa55670be SHA512 d5c4d26b324ed21f4e0641cd7f8b76dbf9de80df8b519982e44d41c960df29fd03618e02e9693b2d11ad06d19c4a965274c95a048ec3b9653eacb919a7f8b733
 DIST xsts-2002-01-16.tar.gz 6894439 BLAKE2B 1e9ec63d2c104655e64249e07440a04d862fcbcd4d4e19745d81b34994319b510a531c9d6df1491fae1e90b5d0764f0f1a827251ca8df5d613178b0eab01ef25 SHA512 43300af6d39c1e2221b0ed7318fe14c7464eeb6eb030ed1e22eb29b4ab17f014e2a4c8887c3a46ae5d243e3072da27f00f4e285498ae6f1288177d38d1108288
 DIST xsts-2004-01-14.tar.gz 2761085 BLAKE2B 41545995fb3a65d053257c376c07d45ffd1041a433bfbdb46d4dd87a5afb60c18c8629a3d988323f9e7a1d709775b5a7e5930276a7121c0725a22705c0976e36 SHA512 32854388d7e720ad67156baf50bf2bae7bd878ca3e35fd7e44e57cad3f434f69d56bbbedd61509f8a1faf01c9eae74a078df8fe130780b182c05c05cb1c39ebe
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.5-CVE-2023-45322.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.5-CVE-2023-45322.patch
deleted file mode 100644
index 190218be3a5..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.5-CVE-2023-45322.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-https://gitlab.gnome.org/GNOME/libxml2/-/issues/583
-https://gitlab.gnome.org/GNOME/libxml2/-/commit/d39f78069dff496ec865c73aa44d7110e429bce9
-https://bugs.gentoo.org/915351
-
-From d39f78069dff496ec865c73aa44d7110e429bce9 Mon Sep 17 00:00:00 2001
-From: Nick Wellnhofer <wellnhofer@aevum.de>
-Date: Wed, 23 Aug 2023 20:24:24 +0200
-Subject: [PATCH] tree: Fix copying of DTDs
-
-- Don't create multiple DTD nodes.
-- Fix UAF if malloc fails.
-- Skip DTD nodes if tree module is disabled.
-
-Fixes #583.
---- a/tree.c
-+++ b/tree.c
-@@ -4471,29 +4471,28 @@ xmlNodePtr
- xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) {
-     xmlNodePtr ret = NULL;
-     xmlNodePtr p = NULL,q;
-+    xmlDtdPtr newSubset = NULL;
- 
-     while (node != NULL) {
--#ifdef LIBXML_TREE_ENABLED
- 	if (node->type == XML_DTD_NODE ) {
--	    if (doc == NULL) {
-+#ifdef LIBXML_TREE_ENABLED
-+	    if ((doc == NULL) || (doc->intSubset != NULL)) {
- 		node = node->next;
- 		continue;
- 	    }
--	    if (doc->intSubset == NULL) {
--		q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node );
--		if (q == NULL) goto error;
--		q->doc = doc;
--		q->parent = parent;
--		doc->intSubset = (xmlDtdPtr) q;
--		xmlAddChild(parent, q);
--	    } else {
--		q = (xmlNodePtr) doc->intSubset;
--		xmlAddChild(parent, q);
--	    }
--	} else
-+            q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node );
-+            if (q == NULL) goto error;
-+            q->doc = doc;
-+            q->parent = parent;
-+            newSubset = (xmlDtdPtr) q;
-+#else
-+            node = node->next;
-+            continue;
- #endif /* LIBXML_TREE_ENABLED */
-+	} else {
- 	    q = xmlStaticCopyNode(node, doc, parent, 1);
--	if (q == NULL) goto error;
-+	    if (q == NULL) goto error;
-+        }
- 	if (ret == NULL) {
- 	    q->prev = NULL;
- 	    ret = p = q;
-@@ -4505,6 +4504,8 @@ xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) {
- 	}
- 	node = node->next;
-     }
-+    if (newSubset != NULL)
-+        doc->intSubset = newSubset;
-     return(ret);
- error:
-     xmlFreeNodeList(ret);
--- 
-GitLab
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.9-icu-pkgconfig.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.9-icu-pkgconfig.patch
deleted file mode 100644
index 6092c63201c..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.9-icu-pkgconfig.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-Needed with icu-76.1 at least. Not clear why it worked before.
-
-/var/tmp/portage/dev-libs/libxml2-2.11.9/work/libxml2-2.11.9-abi_x86_32.x86/.libs/runtest:
-  symbol lookup error: /var/tmp/portage/dev-libs/libxml2-2.11.9/work/libxml2-2.11.9-abi_x86_32.x86/.libs/libxml2.so.2: undefined symbol: UCNV_FROM_U_CALLBACK_STOP
---- a/configure.ac
-+++ b/configure.ac
-@@ -1082,10 +1082,10 @@ if test "$with_icu" != "yes" ; then
- else
-     # Try pkg-config first so that static linking works.
-     # If this succeeeds, we ignore the WITH_ICU directory.
--    PKG_CHECK_MODULES([ICU], [icu-i18n], [
-+    PKG_CHECK_MODULES([ICU], [icu-uc icu-i18n], [
-         WITH_ICU=1
-         m4_ifdef([PKG_CHECK_VAR],
--            [PKG_CHECK_VAR([ICU_DEFS], [icu-i18n], [DEFS])])
-+            [PKG_CHECK_VAR([ICU_DEFS], [icu-uc icu-i18n], [DEFS])])
-         if test "x$ICU_DEFS" != "x"; then
-             ICU_CFLAGS="$ICU_CFLAGS $ICU_DEFS"
-         fi],[:])
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.14.2-no-git.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.14.2-no-git.patch
new file mode 100644
index 00000000000..a74fff7ca25
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.14.2-no-git.patch
@@ -0,0 +1,34 @@
+From 4d6eb90bfdfe347fb1c5fe3151ef9dae80d12866 Mon Sep 17 00:00:00 2001
+From: Alfred Wingate <parona@protonmail.com>
+Date: Sun, 4 May 2025 15:41:31 +0300
+Subject: [PATCH] meson: allow building without git
+
+Signed-off-by: Alfred Wingate <parona@protonmail.com>
+---
+ meson.build | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index a8af753d..b0c99eef 100644
+--- a/meson.build
++++ b/meson.build
+@@ -17,9 +17,13 @@ v_min = v_array[1].to_int()
+ v_mic = v_array[2].to_int()
+ v_nbr = v_maj * 10000 + v_min * 100 + v_mic
+ v_extra = ''
+-r = run_command('git', 'describe', check: false)
+-if (r.returncode() == 0)
+-    v_extra = '-GIT' + r.stdout().strip()
++
++git = find_program('git', required: false)
++if git.found()
++    r = run_command(git, 'describe', check: false)
++    if (r.returncode() == 0)
++        v_extra = '-GIT' + r.stdout().strip()
++    endif
+ endif
+ 
+ # install paths
+-- 
+2.49.0
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.11.9.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.11.9.ebuild
deleted file mode 100644
index 08a3b2e66ac..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.11.9.ebuild
+++ /dev/null
@@ -1,201 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Note: Please bump in sync with dev-libs/libxslt
-
-PYTHON_COMPAT=( python3_{10..12} )
-PYTHON_REQ_USE="xml(+)"
-inherit flag-o-matic python-r1 multilib-minimal
-
-XSTS_HOME="http://www.w3.org/XML/2004/xml-schema-test-suite"
-XSTS_NAME_1="xmlschema2002-01-16"
-XSTS_NAME_2="xmlschema2004-01-14"
-XSTS_TARBALL_1="xsts-2002-01-16.tar.gz"
-XSTS_TARBALL_2="xsts-2004-01-14.tar.gz"
-XMLCONF_TARBALL="xmlts20130923.tar.gz"
-
-DESCRIPTION="XML C parser and toolkit"
-HOMEPAGE="https://gitlab.gnome.org/GNOME/libxml2/-/wikis/home"
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://gitlab.gnome.org/GNOME/libxml2"
-	inherit git-r3
-else
-	inherit autotools gnome.org
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-inherit autotools
-
-SRC_URI+="
-	test? (
-		${XSTS_HOME}/${XSTS_NAME_1}/${XSTS_TARBALL_1}
-		${XSTS_HOME}/${XSTS_NAME_2}/${XSTS_TARBALL_2}
-		https://www.w3.org/XML/Test/${XMLCONF_TARBALL}
-	)
-"
-S="${WORKDIR}/${PN}-${PV%_rc*}"
-
-LICENSE="MIT"
-SLOT="2"
-IUSE="debug examples +ftp icu lzma +python readline static-libs test"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
-
-RDEPEND="
-	virtual/libiconv
-	>=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}]
-	icu? ( >=dev-libs/icu-51.2-r1:=[${MULTILIB_USEDEP}] )
-	lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[${MULTILIB_USEDEP}] )
-	python? ( ${PYTHON_DEPS} )
-	readline? ( sys-libs/readline:= )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="virtual/pkgconfig"
-
-if [[ ${PV} == 9999 ]] ; then
-	BDEPEND+=" dev-build/gtk-doc-am"
-fi
-
-MULTILIB_CHOST_TOOLS=(
-	/usr/bin/xml2-config
-)
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-2.11.5-CVE-2023-45322.patch
-	"${FILESDIR}"/${PN}-2.11.9-icu-pkgconfig.patch
-)
-
-src_unpack() {
-	if [[ ${PV} == 9999 ]] ; then
-		git-r3_src_unpack
-	else
-		local tarname=${P/_rc/-rc}.tar.xz
-
-		# ${A} isn't used to avoid unpacking of test tarballs into ${WORKDIR},
-		# as they are needed as tarballs in ${S}/xstc instead and not unpacked
-		unpack ${tarname}
-
-		if [[ -n ${PATCHSET_VERSION} ]] ; then
-			unpack ${PN}-${PATCHSET_VERSION}.tar.xz
-		fi
-	fi
-
-	cd "${S}" || die
-
-	if use test ; then
-		cp "${DISTDIR}/${XSTS_TARBALL_1}" \
-			"${DISTDIR}/${XSTS_TARBALL_2}" \
-			"${S}"/xstc/ \
-			|| die "Failed to install test tarballs"
-		unpack ${XMLCONF_TARBALL}
-	fi
-}
-
-src_prepare() {
-	default
-
-	# Please do not remove, as else we get references to PORTAGE_TMPDIR
-	# in /usr/lib/python?.?/site-packages/libxml2mod.la among things.
-	#elibtoolize
-
-	eautoreconf
-}
-
-multilib_src_configure() {
-	# Filter seemingly problematic CFLAGS (bug #26320)
-	filter-flags -fprefetch-loop-arrays -funroll-loops
-
-	# Notes:
-	# The meaning of the 'debug' USE flag does not apply to the --with-debug
-	# switch (enabling the libxml2 debug module). See bug #100898.
-	libxml2_configure() {
-		ECONF_SOURCE="${S}" econf \
-			--enable-ipv6 \
-			$(use_with ftp) \
-			$(use_with debug run-debug) \
-			$(use_with icu) \
-			$(use_with lzma) \
-			$(use_enable static-libs static) \
-			$(multilib_native_use_with readline) \
-			$(multilib_native_use_with readline history) \
-			"$@"
-	}
-
-	# Build python bindings separately
-	libxml2_configure --without-python
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_configure --with-python
-}
-
-libxml2_py_emake() {
-	pushd "${BUILD_DIR}"/python >/dev/null || die
-
-	emake top_builddir="${NATIVE_BUILD_DIR}" "$@"
-
-	popd >/dev/null || die
-}
-
-multilib_src_compile() {
-	default
-
-	if multilib_is_native_abi && use python ; then
-		NATIVE_BUILD_DIR="${BUILD_DIR}"
-		python_foreach_impl run_in_build_dir libxml2_py_emake all
-	fi
-}
-
-multilib_src_test() {
-	ln -s "${S}"/xmlconf || die
-
-	emake check
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_py_emake check
-}
-
-multilib_src_install() {
-	emake DESTDIR="${D}" install
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_py_emake DESTDIR="${D}" install
-
-	# Hack until automake release is made for the optimise fix
-	# https://git.savannah.gnu.org/cgit/automake.git/commit/?id=bde43d0481ff540418271ac37012a574a4fcf097
-	multilib_is_native_abi && use python && python_foreach_impl python_optimize
-}
-
-multilib_src_install_all() {
-	einstalldocs
-
-	if ! use examples ; then
-		rm -rf "${ED}"/usr/share/doc/${PF}/examples || die
-		rm -rf "${ED}"/usr/share/doc/${PF}/python/examples || die
-	fi
-
-	rm -rf "${ED}"/usr/share/doc/${PN}-python-${PVR} || die
-
-	find "${ED}" -name '*.la' -delete || die
-}
-
-pkg_postinst() {
-	# We don't want to do the xmlcatalog during stage1, as xmlcatalog will not
-	# be in / and stage1 builds to ROOT=/tmp/stage1root. This fixes bug #208887.
-	if [[ -n "${ROOT}" ]]; then
-		elog "Skipping XML catalog creation for stage building (bug #208887)."
-	else
-		# Need an XML catalog, so no-one writes to a non-existent one
-		CATALOG="${EROOT}/etc/xml/catalog"
-
-		# We don't want to clobber an existing catalog though,
-		# only ensure that one is there
-		# <obz@gentoo.org>
-		if [[ ! -e "${CATALOG}" ]]; then
-			[[ -d "${EROOT}/etc/xml" ]] || mkdir -p "${EROOT}/etc/xml"
-			"${EPREFIX}"/usr/bin/xmlcatalog --create > "${CATALOG}"
-			einfo "Created XML catalog in ${CATALOG}"
-		fi
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.12.9.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.13.8.ebuild
similarity index 88%
rename from sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.12.9.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.13.8.ebuild
index 32d2937863d..b53e73fe002 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.12.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.13.8.ebuild
@@ -7,7 +7,7 @@ EAPI=8
 
 PYTHON_COMPAT=( python3_{10..13} )
 PYTHON_REQ_USE="xml(+)"
-inherit autotools flag-o-matic python-r1 multilib-minimal
+inherit autotools python-r1 multilib-minimal
 
 XSTS_HOME="http://www.w3.org/XML/2004/xml-schema-test-suite"
 XSTS_NAME_1="xmlschema2002-01-16"
@@ -23,7 +23,7 @@ if [[ ${PV} == 9999 ]] ; then
 	inherit git-r3
 else
 	inherit gnome.org
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 SRC_URI+="
@@ -37,7 +37,7 @@ S="${WORKDIR}/${PN}-${PV%_rc*}"
 
 LICENSE="MIT"
 SLOT="2"
-IUSE="debug examples +ftp icu lzma +python readline static-libs test"
+IUSE="examples icu lzma +python readline static-libs test"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
@@ -101,22 +101,14 @@ src_prepare() {
 }
 
 multilib_src_configure() {
-	# Filter seemingly problematic CFLAGS (bug #26320)
-	filter-flags -fprefetch-loop-arrays -funroll-loops
-
-	# Notes:
-	# The meaning of the 'debug' USE flag does not apply to the --with-debug
-	# switch (enabling the libxml2 debug module). See bug #100898.
 	libxml2_configure() {
 		ECONF_SOURCE="${S}" econf \
-			--enable-ipv6 \
-			$(use_with ftp) \
-			$(use_with debug run-debug) \
 			$(use_with icu) \
 			$(use_with lzma) \
 			$(use_enable static-libs static) \
 			$(multilib_native_use_with readline) \
 			$(multilib_native_use_with readline history) \
+			--with-legacy \
 			"$@"
 	}
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.12.10.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.14.2.ebuild
similarity index 53%
rename from sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.12.10.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.14.2.ebuild
index 32d2937863d..dbe8cb03767 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.12.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.14.2.ebuild
@@ -5,9 +5,9 @@ EAPI=8
 
 # Note: Please bump in sync with dev-libs/libxslt
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..13} )
 PYTHON_REQ_USE="xml(+)"
-inherit autotools flag-o-matic python-r1 multilib-minimal
+inherit python-r1 meson-multilib
 
 XSTS_HOME="http://www.w3.org/XML/2004/xml-schema-test-suite"
 XSTS_NAME_1="xmlschema2002-01-16"
@@ -23,7 +23,7 @@ if [[ ${PV} == 9999 ]] ; then
 	inherit git-r3
 else
 	inherit gnome.org
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 SRC_URI+="
@@ -36,8 +36,9 @@ SRC_URI+="
 S="${WORKDIR}/${PN}-${PV%_rc*}"
 
 LICENSE="MIT"
-SLOT="2"
-IUSE="debug examples +ftp icu lzma +python readline static-libs test"
+# see so_version = v_maj + v_min_compat for subslot
+SLOT="2/16"
+IUSE="icu +python readline static-libs test"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
@@ -45,23 +46,18 @@ RDEPEND="
 	virtual/libiconv
 	>=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}]
 	icu? ( >=dev-libs/icu-51.2-r1:=[${MULTILIB_USEDEP}] )
-	lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[${MULTILIB_USEDEP}] )
 	python? ( ${PYTHON_DEPS} )
 	readline? ( sys-libs/readline:= )
 "
 DEPEND="${RDEPEND}"
 BDEPEND="virtual/pkgconfig"
 
-if [[ ${PV} == 9999 ]] ; then
-	BDEPEND+=" dev-build/gtk-doc-am"
-fi
-
 MULTILIB_CHOST_TOOLS=(
 	/usr/bin/xml2-config
 )
 
 PATCHES=(
-	"${FILESDIR}"/${PN}-2.12.9-icu-pkgconfig.patch
+	"${FILESDIR}"/libxml2-2.14.2-no-git.patch
 )
 
 src_unpack() {
@@ -93,88 +89,77 @@ src_unpack() {
 src_prepare() {
 	default
 
-	# Please do not remove, as else we get references to PORTAGE_TMPDIR
-	# in /usr/lib/python?.?/site-packages/libxml2mod.la among things.
-	#elibtoolize
-
-	eautoreconf
+	sed -e "/^dir_doc/ s/meson.project_name()$/\'${PF}\'/" -i meson.build || die
 }
 
-multilib_src_configure() {
-	# Filter seemingly problematic CFLAGS (bug #26320)
-	filter-flags -fprefetch-loop-arrays -funroll-loops
-
-	# Notes:
-	# The meaning of the 'debug' USE flag does not apply to the --with-debug
-	# switch (enabling the libxml2 debug module). See bug #100898.
-	libxml2_configure() {
-		ECONF_SOURCE="${S}" econf \
-			--enable-ipv6 \
-			$(use_with ftp) \
-			$(use_with debug run-debug) \
-			$(use_with icu) \
-			$(use_with lzma) \
-			$(use_enable static-libs static) \
-			$(multilib_native_use_with readline) \
-			$(multilib_native_use_with readline history) \
-			"$@"
-	}
-
-	# Build python bindings separately
-	libxml2_configure --without-python
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_configure --with-python
+python_configure() {
+	local emesonargs=(
+		$(meson_feature icu)
+		$(meson_native_use_feature readline)
+		$(meson_native_use_feature readline history)
+		-Dpython=enabled
+	)
+	mkdir "${BUILD_DIR}" || die
+	pushd "${BUILD_DIR}" >/dev/null || die
+	meson_src_configure
+	popd >/dev/null || die
 }
 
-libxml2_py_emake() {
-	pushd "${BUILD_DIR}"/python >/dev/null || die
+multilib_src_configure() {
+	local emesonargs=(
+		-Ddefault_library=$(multilib_native_usex static-libs both shared)
+		$(meson_feature icu)
+		$(meson_native_use_feature readline)
+		$(meson_native_use_feature readline history)
+		-Dpython=disabled
+
+		# There has been a clean break with a soname bump.
+		# It's time to deal with the breakage.
+		# bug #935452
+		-Dlegacy=disabled
+	)
+	meson_src_configure
 
-	emake top_builddir="${NATIVE_BUILD_DIR}" "$@"
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl python_configure
+	fi
+}
 
+python_compile() {
+	pushd "${BUILD_DIR}" >/dev/null || die
+	meson_src_compile
 	popd >/dev/null || die
 }
 
 multilib_src_compile() {
-	default
+	meson_src_compile
 
 	if multilib_is_native_abi && use python ; then
-		NATIVE_BUILD_DIR="${BUILD_DIR}"
-		python_foreach_impl run_in_build_dir libxml2_py_emake all
+		python_foreach_impl python_compile
 	fi
 }
 
 multilib_src_test() {
-	ln -s "${S}"/xmlconf || die
-
-	emake check
+	meson_src_test
 
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_py_emake check
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl meson_src_test
+	fi
 }
 
-multilib_src_install() {
-	emake DESTDIR="${D}" install
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_py_emake DESTDIR="${D}" install
-
-	# Hack until automake release is made for the optimise fix
-	# https://git.savannah.gnu.org/cgit/automake.git/commit/?id=bde43d0481ff540418271ac37012a574a4fcf097
-	multilib_is_native_abi && use python && python_foreach_impl python_optimize
+python_install() {
+	pushd "${BUILD_DIR}" >/dev/null || die
+	meson_src_install
+	python_optimize
+	popd >/dev/null || die
 }
 
-multilib_src_install_all() {
-	einstalldocs
-
-	if ! use examples ; then
-		rm -rf "${ED}"/usr/share/doc/${PF}/examples || die
-		rm -rf "${ED}"/usr/share/doc/${PF}/python/examples || die
+multilib_src_install() {
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl python_install
 	fi
 
-	rm -rf "${ED}"/usr/share/doc/${PN}-python-${PVR} || die
-
-	find "${ED}" -name '*.la' -delete || die
+	meson_src_install
 }
 
 pkg_postinst() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-9999.ebuild
index 45b054cf891..75a9858dc38 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-9999.ebuild
@@ -1,13 +1,13 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
 # Note: Please bump in sync with dev-libs/libxslt
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..13} )
 PYTHON_REQ_USE="xml(+)"
-inherit python-r1 multilib-minimal
+inherit python-r1 meson-multilib
 
 XSTS_HOME="http://www.w3.org/XML/2004/xml-schema-test-suite"
 XSTS_NAME_1="xmlschema2002-01-16"
@@ -20,9 +20,9 @@ DESCRIPTION="XML C parser and toolkit"
 HOMEPAGE="https://gitlab.gnome.org/GNOME/libxml2/-/wikis/home"
 if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://gitlab.gnome.org/GNOME/libxml2"
-	inherit autotools git-r3
+	inherit git-r3
 else
-	inherit gnome.org libtool
+	inherit gnome.org
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
@@ -36,8 +36,9 @@ SRC_URI+="
 S="${WORKDIR}/${PN}-${PV%_rc*}"
 
 LICENSE="MIT"
-SLOT="2"
-IUSE="examples icu lzma +python readline static-libs test"
+# see so_version = v_maj + v_min_compat for subslot
+SLOT="2/16"
+IUSE="icu +python readline static-libs test"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
@@ -45,17 +46,12 @@ RDEPEND="
 	virtual/libiconv
 	>=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}]
 	icu? ( >=dev-libs/icu-51.2-r1:=[${MULTILIB_USEDEP}] )
-	lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[${MULTILIB_USEDEP}] )
 	python? ( ${PYTHON_DEPS} )
 	readline? ( sys-libs/readline:= )
 "
 DEPEND="${RDEPEND}"
 BDEPEND="virtual/pkgconfig"
 
-if [[ ${PV} == 9999 ]] ; then
-	BDEPEND+=" dev-build/gtk-doc-am"
-fi
-
 MULTILIB_CHOST_TOOLS=(
 	/usr/bin/xml2-config
 )
@@ -89,82 +85,77 @@ src_unpack() {
 src_prepare() {
 	default
 
-	if [[ ${PV} == 9999 ]] ; then
-		eautoreconf
-	else
-		# Please do not remove, as else we get references to PORTAGE_TMPDIR
-		# in /usr/lib/python?.?/site-packages/libxml2mod.la among things.
-		elibtoolize
-	fi
+	sed -e "/^dir_doc/ s/meson.project_name()$/\'${PF}\'/" -i meson.build || die
 }
 
-multilib_src_configure() {
-	libxml2_configure() {
-		ECONF_SOURCE="${S}" econf \
-			$(use_with icu) \
-			$(use_with lzma) \
-			$(use_enable static-libs static) \
-			$(multilib_native_use_with readline) \
-			$(multilib_native_use_with readline history) \
-			--with-legacy \
-			"$@"
-	}
-
-	# Build python bindings separately
-	libxml2_configure --without-python
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_configure --with-python
+python_configure() {
+	local emesonargs=(
+		$(meson_feature icu)
+		$(meson_native_use_feature readline)
+		$(meson_native_use_feature readline history)
+		-Dpython=enabled
+	)
+	mkdir "${BUILD_DIR}" || die
+	pushd "${BUILD_DIR}" >/dev/null || die
+	meson_src_configure
+	popd >/dev/null || die
 }
 
-libxml2_py_emake() {
-	pushd "${BUILD_DIR}"/python >/dev/null || die
+multilib_src_configure() {
+	local emesonargs=(
+		-Ddefault_library=$(multilib_native_usex static-libs both shared)
+		$(meson_feature icu)
+		$(meson_native_use_feature readline)
+		$(meson_native_use_feature readline history)
+		-Dpython=disabled
+
+		# There has been a clean break with a soname bump.
+		# It's time to deal with the breakage.
+		# bug #935452
+		-Dlegacy=disabled
+	)
+	meson_src_configure
 
-	emake top_builddir="${NATIVE_BUILD_DIR}" "$@"
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl python_configure
+	fi
+}
 
+python_compile() {
+	pushd "${BUILD_DIR}" >/dev/null || die
+	meson_src_compile
 	popd >/dev/null || die
 }
 
 multilib_src_compile() {
-	default
+	meson_src_compile
 
 	if multilib_is_native_abi && use python ; then
-		NATIVE_BUILD_DIR="${BUILD_DIR}"
-		python_foreach_impl run_in_build_dir libxml2_py_emake all
+		python_foreach_impl python_compile
 	fi
 }
 
 multilib_src_test() {
-	ln -s "${S}"/xmlconf || die
+	meson_src_test
 
-	emake check
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_py_emake check
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl meson_src_test
+	fi
 }
 
-multilib_src_install() {
-	emake DESTDIR="${D}" install
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_py_emake DESTDIR="${D}" install
-
-	# Hack until automake release is made for the optimise fix
-	# https://git.savannah.gnu.org/cgit/automake.git/commit/?id=bde43d0481ff540418271ac37012a574a4fcf097
-	multilib_is_native_abi && use python && python_foreach_impl python_optimize
+python_install() {
+	pushd "${BUILD_DIR}" >/dev/null || die
+	meson_src_install
+	python_optimize
+	popd >/dev/null || die
 }
 
-multilib_src_install_all() {
-	einstalldocs
-
-	if ! use examples ; then
-		rm -rf "${ED}"/usr/share/doc/${PF}/examples || die
-		rm -rf "${ED}"/usr/share/doc/${PF}/python/examples || die
+multilib_src_install() {
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl python_install
 	fi
 
-	rm -rf "${ED}"/usr/share/doc/${PN}-python-${PVR} || die
-
-	find "${ED}" -name '*.la' -delete || die
+	meson_src_install
 }
 
 pkg_postinst() {

From b965d92c457c50fffc2a7f93736f04bd52f1ae27 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:06:57 +0000
Subject: [PATCH 030/136] dev-libs/libxslt: Sync with Gentoo

It's from Gentoo commit 6e818ac442b67686b49a5d811533a4990fb69a64.
---
 .../portage-stable/dev-libs/libxslt/Manifest  |   2 -
 .../libxslt-1.1.39-libxml2-2.11-tests.patch   |  24 ----
 .../dev-libs/libxslt/libxslt-1.1.39-r1.ebuild | 128 ------------------
 .../dev-libs/libxslt/libxslt-1.1.42.ebuild    | 123 -----------------
 4 files changed, 277 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/libxslt/files/libxslt-1.1.39-libxml2-2.11-tests.patch
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.39-r1.ebuild
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.42.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/Manifest
index d6ddc5434aa..ad41ca7453c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/Manifest
@@ -1,3 +1 @@
-DIST libxslt-1.1.39.tar.xz 1578216 BLAKE2B 7c87b769d345fc99a966bea6b4e94533fa211dc3a987ce013a03eefb05dde73ef75526bdecf7d32d8c77112232096fb22d8ec4f0a781b9f59d0422a2db75df01 SHA512 c0c99dc63f8b2acb6cc3ad7ad684ffa2a427ee8d1740495cbf8a7c9b9c8679f96351b4b676c73ccc191014db4cb4ab42b9a0070f6295565f39dbc665c5c16f89
-DIST libxslt-1.1.42.tar.xz 1573668 BLAKE2B 91b2ca38807ae21b6629b8e19f4ab9d7d19bc0af17f2546e1cf278b2f2fff62b86bbbd996085fff322f3d5ae6c2b20bcfc4e9fb501c301d3fd5d56cf5b205ede SHA512 02a2189b6cd65fa1fb929fc0e6868bc046bdd8827849f0048cdf9267ed9450745158cef0f2713a833e28fb520b312ff86dc5754dd423ce768c457bfd8812bdc7
 DIST libxslt-1.1.43.tar.xz 1518364 BLAKE2B 84d1cff32c78c4eeff4db614214ee1808bcf958d55711b08e7e2191a4343fb61d38d6b3d9b43f6f12be2dc909fced0a5b5905fa2c5ec7761c83125007e1ce265 SHA512 96110b0397a8f5791f489127574e2143845feb61bea0581d7b7e3c1101fd0718483bae81a7ce417b971bd678293bfd95daddad0dadd3e256c87d41a69faed85a
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/files/libxslt-1.1.39-libxml2-2.11-tests.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/files/libxslt-1.1.39-libxml2-2.11-tests.patch
deleted file mode 100644
index 8d7f98e71b9..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/files/libxslt-1.1.39-libxml2-2.11-tests.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-https://bugs.gentoo.org/918973
-https://gitlab.gnome.org/GNOME/libxslt/-/issues/99
-https://gitlab.gnome.org/GNOME/libxslt/-/commit/86ec392efd75ce24b79f4baa9822a1b088f3e47f
-
-From 86ec392efd75ce24b79f4baa9822a1b088f3e47f Mon Sep 17 00:00:00 2001
-From: Nick Wellnhofer <wellnhofer@aevum.de>
-Date: Fri, 1 Dec 2023 21:05:19 +0100
-Subject: [PATCH] tests: Fix build with older libxml2
-
-Fixes #99.
---- a/tests/runtest.c
-+++ b/tests/runtest.c
-@@ -456,7 +456,8 @@ initializeLibxml2(void) {
-     xmlSetExternalEntityLoader(xmlNoNetExternalEntityLoader);
-     xmlSetGenericErrorFunc(NULL, testErrorHandler);
-     xsltSetGenericErrorFunc(NULL, testErrorHandler);
--    xmlSetStructuredErrorFunc(NULL, testStructuredErrorHandler);
-+    xmlSetStructuredErrorFunc(NULL,
-+            (xmlStructuredErrorFunc) testStructuredErrorHandler);
-     exsltRegisterAll();
-     xsltRegisterTestModule();
-     xsltMaxDepth = 200;
--- 
-GitLab
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.39-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.39-r1.ebuild
deleted file mode 100644
index ab5e6b57c5f..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.39-r1.ebuild
+++ /dev/null
@@ -1,128 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Note: Please bump this in sync with dev-libs/libxml2.
-
-PYTHON_COMPAT=( python3_{10..13} )
-inherit flag-o-matic python-r1 multilib-minimal
-
-DESCRIPTION="XSLT libraries and tools"
-HOMEPAGE="https://gitlab.gnome.org/GNOME/libxslt"
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://gitlab.gnome.org/GNOME/libxslt"
-	inherit autotools git-r3
-else
-	inherit libtool gnome.org
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-LICENSE="MIT"
-SLOT="0"
-IUSE="crypt debug examples python static-libs"
-REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
-
-BDEPEND=">=virtual/pkgconfig-1"
-RDEPEND="
-	<dev-libs/libxml2-2.13:2[${MULTILIB_USEDEP}]
-	crypt? ( >=dev-libs/libgcrypt-1.5.3:0=[${MULTILIB_USEDEP}] )
-	python? ( ${PYTHON_DEPS} )
-"
-DEPEND="${RDEPEND}"
-
-MULTILIB_CHOST_TOOLS=(
-	/usr/bin/xslt-config
-)
-
-MULTILIB_WRAPPED_HEADERS=(
-	/usr/include/libxslt/xsltconfig.h
-)
-
-PATCHES=(
-	"${FILESDIR}"/${P}-libxml2-2.11-tests.patch
-)
-
-src_prepare() {
-	default
-
-	if [[ ${PV} == 9999 ]] ; then
-		eautoreconf
-	else
-		# Prefix always needs elibtoolize if not eautoreconf'd.
-		elibtoolize
-	fi
-}
-
-multilib_src_configure() {
-	# Remove this after upstream merge request to add AC_SYS_LARGEFILE lands:
-	# https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/55
-	append-lfs-flags
-
-	libxslt_configure() {
-		ECONF_SOURCE="${S}" econf \
-			--without-python \
-			$(use_with crypt crypto) \
-			$(use_with debug) \
-			$(use_enable static-libs static) \
-			"$@"
-	}
-
-	# Build Python bindings separately
-	libxslt_configure --without-python
-
-	if multilib_is_native_abi && use python ; then
-		NATIVE_BUILD_DIR="${BUILD_DIR}"
-		python_foreach_impl run_in_build_dir libxslt_configure --with-python
-	fi
-}
-
-libxslt_py_emake() {
-	pushd "${BUILD_DIR}"/python >/dev/null || die
-
-	emake top_builddir="${NATIVE_BUILD_DIR}" "$@"
-
-	popd >/dev/null || die
-}
-
-multilib_src_compile() {
-	default
-
-	if multilib_is_native_abi && use python ; then
-		python_foreach_impl run_in_build_dir libxslt_py_emake all
-	fi
-}
-
-multilib_src_test() {
-	default
-
-	if multilib_is_native_abi && use python ; then
-		python_foreach_impl run_in_build_dir libxslt_py_emake check
-	fi
-}
-
-multilib_src_install() {
-	# "default" does not work here - docs are installed by multilib_src_install_all
-	emake DESTDIR="${D}" install
-
-	if multilib_is_native_abi && use python; then
-		python_foreach_impl run_in_build_dir libxslt_py_emake \
-			DESTDIR="${D}" \
-			install
-
-		# Hack until automake release is made for the optimise fix
-		# https://git.savannah.gnu.org/cgit/automake.git/commit/?id=bde43d0481ff540418271ac37012a574a4fcf097
-		python_foreach_impl python_optimize
-	fi
-}
-
-multilib_src_install_all() {
-	einstalldocs
-
-	if ! use examples ; then
-		rm -rf "${ED}"/usr/share/doc/${PF}/tutorial{,2} || die
-		rm -rf "${ED}"/usr/share/doc/${PF}/python/examples || die
-	fi
-
-	find "${ED}" -type f -name "*.la" -delete || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.42.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.42.ebuild
deleted file mode 100644
index 0eb16b11c78..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.42.ebuild
+++ /dev/null
@@ -1,123 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Note: Please bump this in sync with dev-libs/libxml2.
-
-PYTHON_COMPAT=( python3_{10..13} )
-inherit python-r1 multilib-minimal
-
-DESCRIPTION="XSLT libraries and tools"
-HOMEPAGE="https://gitlab.gnome.org/GNOME/libxslt"
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://gitlab.gnome.org/GNOME/libxslt"
-	inherit autotools git-r3
-else
-	inherit libtool gnome.org
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-LICENSE="MIT"
-SLOT="0"
-IUSE="crypt debug examples python static-libs"
-REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
-
-BDEPEND=">=virtual/pkgconfig-1"
-RDEPEND="
-	>=dev-libs/libxml2-2.13:2[${MULTILIB_USEDEP}]
-	crypt? ( >=dev-libs/libgcrypt-1.5.3:=[${MULTILIB_USEDEP}] )
-	python? (
-		${PYTHON_DEPS}
-		>=dev-libs/libxml2-2.13:2[${MULTILIB_USEDEP},python,${PYTHON_USEDEP}]
-	)
-"
-DEPEND="${RDEPEND}"
-
-MULTILIB_CHOST_TOOLS=(
-	/usr/bin/xslt-config
-)
-
-MULTILIB_WRAPPED_HEADERS=(
-	/usr/include/libxslt/xsltconfig.h
-)
-
-src_prepare() {
-	default
-
-	if [[ ${PV} == 9999 ]] ; then
-		eautoreconf
-	else
-		# Prefix always needs elibtoolize if not eautoreconf'd.
-		elibtoolize
-	fi
-}
-
-multilib_src_configure() {
-	libxslt_configure() {
-		ECONF_SOURCE="${S}" econf \
-			--without-python \
-			$(use_with crypt crypto) \
-			$(use_with debug) \
-			$(use_enable static-libs static) \
-			"$@"
-	}
-
-	# Build Python bindings separately
-	libxslt_configure --without-python
-
-	if multilib_is_native_abi && use python ; then
-		NATIVE_BUILD_DIR="${BUILD_DIR}"
-		python_foreach_impl run_in_build_dir libxslt_configure --with-python
-	fi
-}
-
-libxslt_py_emake() {
-	pushd "${BUILD_DIR}"/python >/dev/null || die
-
-	emake top_builddir="${NATIVE_BUILD_DIR}" "$@"
-
-	popd >/dev/null || die
-}
-
-multilib_src_compile() {
-	default
-
-	if multilib_is_native_abi && use python ; then
-		python_foreach_impl run_in_build_dir libxslt_py_emake all
-	fi
-}
-
-multilib_src_test() {
-	default
-
-	if multilib_is_native_abi && use python ; then
-		python_foreach_impl run_in_build_dir libxslt_py_emake check
-	fi
-}
-
-multilib_src_install() {
-	# "default" does not work here - docs are installed by multilib_src_install_all
-	emake DESTDIR="${D}" install
-
-	if multilib_is_native_abi && use python; then
-		python_foreach_impl run_in_build_dir libxslt_py_emake \
-			DESTDIR="${D}" \
-			install
-
-		# Hack until automake release is made for the optimise fix
-		# https://git.savannah.gnu.org/cgit/automake.git/commit/?id=bde43d0481ff540418271ac37012a574a4fcf097
-		python_foreach_impl python_optimize
-	fi
-}
-
-multilib_src_install_all() {
-	einstalldocs
-
-	if ! use examples ; then
-		rm -rf "${ED}"/usr/share/doc/${PF}/tutorial{,2} || die
-		rm -rf "${ED}"/usr/share/doc/${PF}/python/examples || die
-	fi
-
-	find "${ED}" -type f -name "*.la" -delete || die
-}

From 3e74def5d957a9a223fd608eb11b7ed4ead01484 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:02 +0000
Subject: [PATCH 031/136] dev-libs/mpdecimal: Sync with Gentoo

It's from Gentoo commit 5a607bce5de94af97d2bc8c4a6322e642039c11f.
---
 .../dev-libs/mpdecimal/Manifest               |  1 +
 .../dev-libs/mpdecimal/mpdecimal-4.0.1.ebuild | 63 +++++++++++++++++++
 2 files changed, 64 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/mpdecimal/mpdecimal-4.0.1.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/mpdecimal/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/mpdecimal/Manifest
index 925cbb7e68f..05a8896edb7 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/mpdecimal/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/mpdecimal/Manifest
@@ -1,2 +1,3 @@
 DIST dectest.zip 791733 BLAKE2B ba74ee96f6687ce34cac8406fd7fd1f743d72647a5f883f1054829d992d4dc0f61c9e3b88e2529f425cc2fbda14dfc372b3fbfafe6553baabb3244172fed712f SHA512 05f9d12aec1ebfc9ca211b01705b41c5cd1bbc54d9aa6c4799b40fb3ab1835433fd1a277735d26d2530c3793c58b107b3abb1c31f64340e5e9d7856d92c821cf
 DIST mpdecimal-4.0.0.tar.gz 315325 BLAKE2B aed5b6d5c03b12017989bbac9a166366e800ce5ee8d2fad5a1b81def48877126233998df306968902c728776616b1c06ce0ef05ea066c07daf841a53541a09f9 SHA512 7610ac53ac79f7a8a33fa7a3e61515810444ec73ebca859df7a9ddc18e96b990c99323172810c9cc7f6d6e1502c0be308cd443d6c2d5d0c871648e4842e05d59
+DIST mpdecimal-4.0.1.tar.gz 316268 BLAKE2B fcdb89721b0e16ba8cba25fab953e1f0a4b24366d0dfbc11c942e37537a3716699917013ab9e73e809c48174add8da41b4991b0250cbef07966cab81ae85b3eb SHA512 431fa8ab90d6b8cdecc38b1618fd89d040185dec3c1150203e20f40f10a16160058f6b8abddd000f6ecb74f4dc42d9fef8111444f1496ab34c34f6b814ed32b7
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/mpdecimal/mpdecimal-4.0.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/mpdecimal/mpdecimal-4.0.1.ebuild
new file mode 100644
index 00000000000..3217dd9dc40
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/mpdecimal/mpdecimal-4.0.1.ebuild
@@ -0,0 +1,63 @@
+# Copyright 2024-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Correctly-rounded arbitrary precision decimal floating point arithmetic"
+HOMEPAGE="https://www.bytereef.org/mpdecimal/"
+SRC_URI="
+	https://www.bytereef.org/software/mpdecimal/releases/${P}.tar.gz
+	test? (
+		https://speleotrove.com/decimal/dectest.zip
+	)
+"
+
+LICENSE="BSD-2"
+SLOT="$(ver_cut 1)"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+IUSE="cxx test"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	test? (
+		app-arch/unzip
+	)
+"
+
+src_unpack() {
+	unpack "${P}.tar.gz"
+	if use test; then
+		mkdir "${P}/tests/testdata" || die
+		cd "${P}/tests/testdata" || die
+		unpack dectest.zip
+	fi
+}
+
+src_prepare() {
+	default
+
+	# sigh
+	sed -i -e "s:/lib:/$(get_libdir):" lib*/.pc/*.pc.in || die
+}
+
+src_configure() {
+	local myconf=(
+		# just COPYRIGHT.txt
+		--docdir=/removeme
+		$(use_enable cxx)
+	)
+
+	# more sigh
+	# https://bugs.gentoo.org/931599
+	local -x LDXXFLAGS="${LDFLAGS}" LD="${CC}" LDXX="${CXX}"
+	econf "${myconf[@]}"
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	default
+	rm -r "${D}/removeme" || die
+}

From 42a831feae641a014ffc652e7dde55e19d3e6901 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:02 +0000
Subject: [PATCH 032/136] dev-libs/mpfr: Sync with Gentoo

It's from Gentoo commit 72fe95c68003d52d63b3e55e79d976cb449a9ff8.
---
 .../third_party/portage-stable/dev-libs/mpfr/mpfr-4.2.2.ebuild  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/mpfr/mpfr-4.2.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/mpfr/mpfr-4.2.2.ebuild
index 3800b06f187..2bfa57814eb 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/mpfr/mpfr-4.2.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/mpfr/mpfr-4.2.2.ebuild
@@ -48,7 +48,7 @@ LICENSE="LGPL-3+"
 # preserve-libs.eclass usage to pkg_*inst! See e.g. the readline ebuild.
 SLOT="0/6" # libmpfr.so version
 if [[ ${PV} != *_rc* ]] ; then
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 IUSE="static-libs"
 

From eb27d1e5fec97a55318c5581e9b100dbf25d4616 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:07 +0000
Subject: [PATCH 033/136] dev-libs/xmlsec: Sync with Gentoo

It's from Gentoo commit b9f32506a908ed8533b851f18187582011a6c123.
---
 .../portage-stable/dev-libs/xmlsec/Manifest   |  1 -
 .../dev-libs/xmlsec/xmlsec-1.3.6.ebuild       | 96 -------------------
 ...ec-1.3.7.ebuild => xmlsec-1.3.7-r1.ebuild} |  2 +-
 3 files changed, 1 insertion(+), 98 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.6.ebuild
 rename sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/{xmlsec-1.3.7.ebuild => xmlsec-1.3.7-r1.ebuild} (98%)

diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/Manifest
index d38c6e1f4b2..4930e16a7e4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/Manifest
@@ -1,2 +1 @@
-DIST xmlsec1-1.3.6.tar.gz 2453984 BLAKE2B 217817ef0f7003247b7173a6581ba6428e623ff4e464b4ea08bd93d07c0aaba8ee379cbdd6309e3c2c6f07f5022fe55a51dc1afc001525bf219eff9f06ff5aad SHA512 f38ccc7af0026973a94b1b6f95accd70a2a2c4398985a0002c66d7b43bff6d6bcfb09ae62046cbdac82a0890622aead2df710cb0ab373c3bdf6159797613cdaa
 DIST xmlsec1-1.3.7.tar.gz 2468083 BLAKE2B 6e3b14d476cc6d37e5f9324383432dfacc1a3ac0340bcf709f70b2e8f99dadee23d48e12569b50768446dfa3601868c99190bb44fdeb5c6fc2a0bb48cfd7335e SHA512 0813ad0f7821f765947a7d81d276ba479bf54430279a7b9da31988d1ec76c60b81d3d57f1088a69a2cc0d8d27fa932ce1cb051457d1c0c5a6f071a2df4395cb8
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.6.ebuild
deleted file mode 100644
index 78ba551e9c1..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.6.ebuild
+++ /dev/null
@@ -1,96 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit autotools
-
-DESCRIPTION="Command line tool for signing, verifying, encrypting and decrypting XML"
-HOMEPAGE="https://www.aleksey.com/xmlsec"
-SRC_URI="
-	https://www.aleksey.com/xmlsec/download/${PN}1-${PV}.tar.gz
-	https://www.aleksey.com/xmlsec/download/older-releases/${PN}1-${PV}.tar.gz
-"
-S="${WORKDIR}/${PN}1-${PV}"
-
-LICENSE="MIT"
-# Upstream consider major version bumps to be changes in either X or Y in X.Y.Z
-SLOT="0/$(ver_cut 1-2)"
-KEYWORDS="amd64 arm arm64 ~loong ppc ppc64 ~riscv ~sparc x86"
-IUSE="doc gcrypt gnutls http nss +openssl static-libs test"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="
-	|| ( gnutls nss openssl )
-"
-
-RDEPEND="
-	>=dev-libs/libxml2-2.7.4
-	>=dev-libs/libxslt-1.0.20
-	dev-libs/libltdl
-	gcrypt? ( >=dev-libs/libgcrypt-1.4.0:= )
-	gnutls? ( >=net-libs/gnutls-3.6.13:= )
-	nss? (
-		>=dev-libs/nspr-4.4.1
-		>=dev-libs/nss-3.9
-	)
-	openssl? ( dev-libs/openssl:= )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	virtual/pkgconfig
-	test? (
-		nss? (
-			>=dev-libs/nss-3.9[utils]
-		)
-	)
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-1.3.0-optimisation.patch
-)
-
-src_prepare() {
-	default
-
-	eautoreconf
-}
-
-src_configure() {
-	local myeconfargs=(
-		$(use_enable doc docs)
-		$(use_enable static-libs static)
-		$(use_with gcrypt)
-		$(use_with gnutls)
-		$(use_with nss nspr)
-		$(use_with nss)
-		$(use_with openssl)
-
-		--disable-werror
-		--enable-mans
-		--enable-pkgconfig
-
-		--enable-concatkdf
-		--enable-pbkdf2
-		--enable-ec
-		--enable-dh
-		--enable-sha3
-
-		--enable-files
-		$(use_enable http)
-		--disable-ftp
-	)
-
-	# Bash because of bug #721128
-	CONFIG_SHELL="${BROOT}"/bin/bash econf "${myeconfargs[@]}"
-}
-
-src_test() {
-	# See https://github.com/lsh123/xmlsec/issues/280 for TZ=UTC
-	TZ=UTC SHELL="${BROOT}"/bin/bash emake TMPFOLDER="${T}" check
-}
-
-src_install() {
-	default
-
-	find "${ED}" -name '*.la' -delete || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.7-r1.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.7.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.7-r1.ebuild
index 518b63635de..5d1a9be8149 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.7-r1.ebuild
@@ -24,7 +24,7 @@ REQUIRED_USE="
 "
 
 RDEPEND="
-	>=dev-libs/libxml2-2.7.4
+	>=dev-libs/libxml2-2.7.4:=
 	>=dev-libs/libxslt-1.0.20
 	dev-libs/libltdl
 	gcrypt? ( >=dev-libs/libgcrypt-1.4.0:= )

From 855593a723e27028aea942bb741d24849a93073d Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:10 +0000
Subject: [PATCH 034/136] dev-python/certifi: Sync with Gentoo

It's from Gentoo commit acdc792acbe0e1135b55cb8f68dbd5d927359a67.
---
 .../portage-stable/dev-python/certifi/certifi-3024.7.22.ebuild  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/certifi/certifi-3024.7.22.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/certifi/certifi-3024.7.22.ebuild
index c90394650b5..945bec52583 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/certifi/certifi-3024.7.22.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/certifi/certifi-3024.7.22.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1
 

From 12ab79c2d47f879c05c55e7abb17d363ec136c74 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:11 +0000
Subject: [PATCH 035/136] dev-python/cffi: Sync with Gentoo

It's from Gentoo commit 2dc63d43143b6da20541971af8fe74ab150dcdc3.
---
 .../portage-stable/dev-python/cffi/cffi-1.17.1.ebuild         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cffi/cffi-1.17.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cffi/cffi-1.17.1.ebuild
index 2170e3c5193..b0724e385a4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cffi/cffi-1.17.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cffi/cffi-1.17.1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # please keep this ebuild at EAPI 8 -- sys-apps/portage dep
@@ -8,7 +8,7 @@ DISTUTILS_EXT=1
 DISTUTILS_USE_PEP517=setuptools
 # DO NOT ADD pypy to PYTHON_COMPAT
 # pypy bundles a modified version of cffi. Use python_gen_cond_dep instead.
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..14} )
 
 inherit distutils-r1 toolchain-funcs pypi
 

From 4c95e28c5456d4c7841d263db3538fc72ccb9990 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:11 +0000
Subject: [PATCH 036/136] dev-python/chardet: Sync with Gentoo

It's from Gentoo commit 47f543d4ece32a0deda61b38fdc05409a5d7891c.
---
 .../portage-stable/dev-python/chardet/chardet-5.2.0.ebuild      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/chardet/chardet-5.2.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/chardet/chardet-5.2.0.ebuild
index ded553993b5..510867cb076 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/chardet/chardet-5.2.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/chardet/chardet-5.2.0.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1
 

From 0d35c0565879beacd59496a787e6dd8d2eaa8d07 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:11 +0000
Subject: [PATCH 037/136] dev-python/charset-normalizer: Sync with Gentoo

It's from Gentoo commit 73ada1454c62a9cdab671b1e63b740d8dc19cfcd.
---
 .../charset-normalizer/charset-normalizer-3.4.2.ebuild          | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/charset-normalizer-3.4.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/charset-normalizer-3.4.2.ebuild
index baaaf1950c4..4feeb7bb861 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/charset-normalizer-3.4.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/charset-normalizer-3.4.2.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{11..13} pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1 pypi
 

From c8c310b0bdaf13d3ee815ec6d63617c56060195d Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:11 +0000
Subject: [PATCH 038/136] dev-python/colorama: Sync with Gentoo

It's from Gentoo commit 1a5e7a2d40f47bfe29fe99e237787f06a5357e55.
---
 .../portage-stable/dev-python/colorama/colorama-0.4.6.ebuild    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/colorama/colorama-0.4.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/colorama/colorama-0.4.6.ebuild
index a859bd28226..16b20fdac36 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/colorama/colorama-0.4.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/colorama/colorama-0.4.6.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=hatchling
-PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} )
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} )
 
 inherit distutils-r1
 

From 64363cd78adc67218dbf7991aa1bf9f253405701 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:14 +0000
Subject: [PATCH 039/136] dev-python/cython: Sync with Gentoo

It's from Gentoo commit cbed169e1aab9269353ab5f729beee1a2a48241d.
---
 .../portage-stable/dev-python/cython/Manifest |  2 +
 .../dev-python/cython/cython-3.0.12-r1.ebuild |  2 -
 .../dev-python/cython/cython-3.1.0.ebuild     | 82 +++++++++++++++++++
 .../cython/cython-3.1.0_rc1-r1.ebuild         |  2 -
 .../dev-python/cython/cython-3.1.0_rc1.ebuild |  2 -
 .../dev-python/cython/cython-3.1.0_rc2.ebuild | 82 +++++++++++++++++++
 6 files changed, 166 insertions(+), 6 deletions(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0_rc2.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest
index 780b68fddd6..b2ed93e391c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest
@@ -1,2 +1,4 @@
 DIST cython-3.0.12.tar.gz 2757617 BLAKE2B 064549e36e03424065eab081b60e2761d198490cfd4d7836ea236b833ada3962e6ed42ba1710b33418f8a31ac282cdc156ceb544ee21be80ee34b7a3d3f6c7fb SHA512 c4e85596eeea444fae983d32ce8731cc5d0d612d1f96b998db3aa7946e8be151a7ea62c6df163d875111e306c870656b82a8468dd873cacf84c7bd5671a39bc3
+DIST cython-3.1.0.tar.gz 3181017 BLAKE2B 8da25d43e4e24503dba8f0b22176eecf31d597c091734a7d3460d712137783c451f4589a99932ad3c0b028a825939980a92d9a653208eff2be71307680d353ff SHA512 94bbf2d020785a24828e9f5516515d11926bc3511074e5ea780db30d0b8dde332d52adb950dbdca4767ba86d5e7630549efc442e73269d2c4c91ac4844a69a14
 DIST cython-3.1.0rc1.tar.gz 3158411 BLAKE2B 44540e95b8b060956654a0d92fc4b8417088816a1e3f8fc17c8575a1cbd4b71a76cc69209d58c731281a310a9f6a7e2e711f88dc6855bc487d08056203cb04d8 SHA512 b0cefe1d4e248e6044af373088902475839ae06b5855b5b3bffdce5159a0f6e54802c24715a6f6e3242a250841c2ff1e56435b7ed3e304964af01a162f8a851a
+DIST cython-3.1.0rc2.tar.gz 3170920 BLAKE2B 08dbce1c6d52295dfc09d14349af03d2d58c84d165b92b8c95c24b6446695e4064960280acb177ab4114b381ee03c99d230f4b70a6f71b9a4b9a8ccd85e7a2e6 SHA512 89f75cd32187db8072fc9596528f72b374f47a0bcfeeea24d401bc4ab52b48ec16049e68e2b8c36ba6b9b6e28bf6e8d5f8f3dde2f19452ee3d8baf21bdf0e747
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.12-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.12-r1.ebuild
index 74e5de7e847..99a15f0d035 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.12-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.12-r1.ebuild
@@ -68,8 +68,6 @@ python_test() {
 	unset CYTHON_FORCE_REGEN
 
 	tc-export CC
-	# https://github.com/cython/cython/issues/1911
-	local -x CFLAGS="${CFLAGS} -fno-strict-overflow"
 	"${PYTHON}" runtests.py \
 		-vv \
 		-j "$(makeopts_jobs)" \
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0.ebuild
new file mode 100644
index 00000000000..3931c3e0fe2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0.ebuild
@@ -0,0 +1,82 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_TESTED=( python3_{11..12} )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" pypy3_11 python3_13{,t} python3_14{,t} )
+PYTHON_REQ_USE="threads(+)"
+
+inherit distutils-r1 multiprocessing pypi toolchain-funcs
+
+DESCRIPTION="A Python to C compiler"
+HOMEPAGE="
+	https://cython.org/
+	https://github.com/cython/cython/
+	https://pypi.org/project/Cython/
+"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	${RDEPEND}
+	test? (
+		$(python_gen_cond_dep '
+			<dev-python/numpy-2[${PYTHON_USEDEP}]
+		' "${PYTHON_TESTED[@]}")
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-0.29.22-spawn-multiprocessing.patch"
+	"${FILESDIR}/${PN}-0.29.23-pythran-parallel-install.patch"
+)
+
+distutils_enable_sphinx docs \
+	dev-python/jinja2 \
+	dev-python/sphinx-issues \
+	dev-python/sphinx-tabs
+
+python_prepare_all() {
+	# Needs dev-python/pip and doesn't like 'externally-managed' (bug #927995)
+	rm tests/run/coverage_cmd_src_pkg_layout.srctree || die
+
+	distutils-r1_python_prepare_all
+}
+
+python_compile() {
+	# Python gets confused when it is in sys.path before build.
+	local -x PYTHONPATH=
+
+	distutils-r1_python_compile
+}
+
+python_test() {
+	if ! has "${EPYTHON/./_}" "${PYTHON_TESTED[@]}"; then
+		einfo "Skipping tests on ${EPYTHON} (xfail)"
+		return
+	fi
+
+	# Needed to avoid confusing cache tests
+	unset CYTHON_FORCE_REGEN
+
+	tc-export CC
+	"${PYTHON}" runtests.py \
+		-vv \
+		-j "$(makeopts_jobs)" \
+		--work-dir "${BUILD_DIR}"/tests \
+		--no-examples \
+		--no-code-style \
+		|| die "Tests fail with ${EPYTHON}"
+}
+
+python_install_all() {
+	local DOCS=( CHANGES.rst README.rst ToDo.txt USAGE.txt )
+	distutils-r1_python_install_all
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0_rc1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0_rc1-r1.ebuild
index 561a1b8a077..29c67eac6a7 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0_rc1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0_rc1-r1.ebuild
@@ -69,8 +69,6 @@ python_test() {
 	unset CYTHON_FORCE_REGEN
 
 	tc-export CC
-	# https://github.com/cython/cython/issues/1911
-	local -x CFLAGS="${CFLAGS} -fno-strict-overflow"
 	"${PYTHON}" runtests.py \
 		-vv \
 		-j "$(makeopts_jobs)" \
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0_rc1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0_rc1.ebuild
index 58fa8c542bf..9aa834b62a0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0_rc1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0_rc1.ebuild
@@ -67,8 +67,6 @@ python_test() {
 	unset CYTHON_FORCE_REGEN
 
 	tc-export CC
-	# https://github.com/cython/cython/issues/1911
-	local -x CFLAGS="${CFLAGS} -fno-strict-overflow"
 	"${PYTHON}" runtests.py \
 		-vv \
 		-j "$(makeopts_jobs)" \
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0_rc2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0_rc2.ebuild
new file mode 100644
index 00000000000..b35805bef40
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0_rc2.ebuild
@@ -0,0 +1,82 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_TESTED=( python3_{11..12} )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" pypy3_11 python3_13{,t} )
+PYTHON_REQ_USE="threads(+)"
+
+inherit distutils-r1 multiprocessing pypi toolchain-funcs
+
+DESCRIPTION="A Python to C compiler"
+HOMEPAGE="
+	https://cython.org/
+	https://github.com/cython/cython/
+	https://pypi.org/project/Cython/
+"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	${RDEPEND}
+	test? (
+		$(python_gen_cond_dep '
+			<dev-python/numpy-2[${PYTHON_USEDEP}]
+		' "${PYTHON_TESTED[@]}")
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-0.29.22-spawn-multiprocessing.patch"
+	"${FILESDIR}/${PN}-0.29.23-pythran-parallel-install.patch"
+)
+
+distutils_enable_sphinx docs \
+	dev-python/jinja2 \
+	dev-python/sphinx-issues \
+	dev-python/sphinx-tabs
+
+python_prepare_all() {
+	# Needs dev-python/pip and doesn't like 'externally-managed' (bug #927995)
+	rm tests/run/coverage_cmd_src_pkg_layout.srctree || die
+
+	distutils-r1_python_prepare_all
+}
+
+python_compile() {
+	# Python gets confused when it is in sys.path before build.
+	local -x PYTHONPATH=
+
+	distutils-r1_python_compile
+}
+
+python_test() {
+	if ! has "${EPYTHON/./_}" "${PYTHON_TESTED[@]}"; then
+		einfo "Skipping tests on ${EPYTHON} (xfail)"
+		return
+	fi
+
+	# Needed to avoid confusing cache tests
+	unset CYTHON_FORCE_REGEN
+
+	tc-export CC
+	"${PYTHON}" runtests.py \
+		-vv \
+		-j "$(makeopts_jobs)" \
+		--work-dir "${BUILD_DIR}"/tests \
+		--no-examples \
+		--no-code-style \
+		|| die "Tests fail with ${EPYTHON}"
+}
+
+python_install_all() {
+	local DOCS=( CHANGES.rst README.rst ToDo.txt USAGE.txt )
+	distutils-r1_python_install_all
+}

From 66381a5b612f6f65436e53d988bc19f4b936d388 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:14 +0000
Subject: [PATCH 040/136] dev-python/distlib: Sync with Gentoo

It's from Gentoo commit 7c2d62f17c8ba8968e131fcce2c956c80118b580.
---
 .../portage-stable/dev-python/distlib/distlib-0.3.9.ebuild    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.3.9.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.3.9.ebuild
index 77dd9df8987..42235ab5015 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.3.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.3.9.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_1{3t,4t} pypy3_11 )
 
 inherit distutils-r1
 
@@ -52,7 +52,7 @@ python_test() {
 	# disable system-site-packages -- distlib has no deps, and is very
 	# fragile to packages actually installed on the system
 	sed -i -e '/system-site-packages/s:true:false:' \
-		"${BUILD_DIR}/install${EPREFIX}/usr/bin/pyvenv.cfg" || die
+		"${BUILD_DIR}/install${EPREFIX}/usr/pyvenv.cfg" || die
 
 	"${EPYTHON}" tests/test_all.py -v -x ||
 		die "Tests failed with ${EPYTHON}"

From 40804b9be6bcbbe81f9094cc97afa4b91389d5d4 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:14 +0000
Subject: [PATCH 041/136] dev-python/distro: Sync with Gentoo

It's from Gentoo commit 48f4968c23a9f7416f02b7c7e1a8a52353941d85.
---
 .../portage-stable/dev-python/distro/distro-1.9.0.ebuild        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/distro/distro-1.9.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/distro/distro-1.9.0.ebuild
index f710cf921c3..c3798009c61 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/distro/distro-1.9.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/distro/distro-1.9.0.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1 pypi
 

From db33f8887713932b592e6d2afe65d072616e60ce Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:14 +0000
Subject: [PATCH 042/136] dev-python/editables: Sync with Gentoo

It's from Gentoo commit aa5c3a23b605cf8c0c6623f19415884ebf4ca686.
---
 .../portage-stable/dev-python/editables/editables-0.5.ebuild    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/editables/editables-0.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/editables/editables-0.5.ebuild
index f82cdb0cb6d..653b48fa490 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/editables/editables-0.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/editables/editables-0.5.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} python3_13t )
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} python3_1{3t,4t} )
 
 inherit distutils-r1
 

From 939a3301420e038fd61ea2de8534d39ef7fb6529 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:15 +0000
Subject: [PATCH 043/136] dev-python/ensurepip-setuptools: Sync with Gentoo

It's from Gentoo commit d0094ff23b1cde956e3f804591133835d61a037d.
---
 .../dev-python/ensurepip-setuptools/Manifest  |  4 +---
 .../ensurepip-setuptools-75.8.2.ebuild        | 20 -------------------
 .../ensurepip-setuptools-78.1.0.ebuild        | 20 -------------------
 .../ensurepip-setuptools-79.0.1.ebuild        |  2 +-
 ...ild => ensurepip-setuptools-80.4.0.ebuild} |  0
 5 files changed, 2 insertions(+), 44 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-75.8.2.ebuild
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-78.1.0.ebuild
 rename sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/{ensurepip-setuptools-80.3.0.ebuild => ensurepip-setuptools-80.4.0.ebuild} (100%)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest
index ff4ed01cf98..3a7693be76d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest
@@ -1,6 +1,4 @@
-DIST setuptools-75.8.2-py3-none-any.whl 1229385 BLAKE2B e2890604e9acbf23aefc94ee99927bafdc189e45c84b0e4e0b48737d120ba60590438603195e180988b26e3e8fb378812507e2a0b513bf886c3b1eb673853da5 SHA512 083447a6bd375ca99e017ec4c5e3083ee4eee32b65d911b4d5ccadfa587ec213d43562d21d0f238753cc5c54354027b8425880d7248fbbd170b0c006613f4327
-DIST setuptools-78.1.0-py3-none-any.whl 1256108 BLAKE2B 3bc6328e3ca2f98df327054c308560c48849ea3374017e72111471f4d7394bb6200d181e9ce7bc5cc2732ca365ade8e7ac79a8b1bfae1a18d0364c5dea4aa151 SHA512 89b1ba752d6b1cf7820ad0ef37ad42a6614e9b88438c63264eee09f94439608e53a51bf5ff8ce9f898300d6d628a7ed582004e6a483d774f4ec285f95e23752e
 DIST setuptools-79.0.1-py3-none-any.whl 1256281 BLAKE2B 8ae51bdd1c0ccada116757c2bd765225fcf4bedc7ada18567ae12f09b6978cdbcddd4f635a39a5568b6d3ed4388e4f73af5c33a7060f2ac0d0907fc82d8fd74f SHA512 fef6cfc6f95a5bb7320f1680e1c665cb8d9a4e4227cde4d8aab8a50bed4bcf04320085b9d7d5343359f887008db5c5a861e57f3d08b7b0b2311a28adaeee6b4a
 DIST setuptools-80.2.0-py3-none-any.whl 1240763 BLAKE2B afb1a983aa8534ab20de1889fd8460bcddad7ffb956b95a830879f03982d38da5f76f71d8c45d8134d9c0223dd3771c639f95ad9e4447e4c201dfbabaca16a3d SHA512 d3b4f97ea45a7f98b9dd711ed3bef6e5faf562a2bd114aec458b196170f8ccf53e2ae12642aeed17af65a2647c258679148c1dfe136cb2b59fa7f4fdd3768ad1
-DIST setuptools-80.3.0-py3-none-any.whl 1200273 BLAKE2B 6f17d3e7ef602d31698f450714af9ee86dd3234450dfcca23d0d27d2e58c3242e77bc156d377192660cab0a3986e85615a74f611bd3b8f6951dd0cb5a3b074f4 SHA512 c6ab8430aae000d986d4edb5027f3a6f5062ff869a8ed85768ce488cb494289ab8ec85a0377928a080111b70a7959e05f9e17487eded93c84637db8a9dda6153
 DIST setuptools-80.3.1-py3-none-any.whl 1201172 BLAKE2B 4daf6a4a65a4e7c0547750addbf30f92e3a386fd7fcc2a98761ec1bee5caf6ccf506f1e201a9518c34bc278ae504f8b277d6199e23df0457a603b1c05a7bb50d SHA512 85b62d19a3762c9cb5d5b79a2f5319d4d387e334711963730e4b6a72dc73be3291bf5fb6eb40a6284a8486cbe615e8af44bc299210642f70f52d3fbfd41be26c
+DIST setuptools-80.4.0-py3-none-any.whl 1200812 BLAKE2B a3487a12084fa8582f1201b6df8cdd23de5b5fc763c5df607a4ae9a688fbd8defe064865e7f03a860819cdff1bf8c8fb98e3f94408e6511709f52eb9538feaef SHA512 2348c2e181394016f23d8ab55d9bf1104f16154729dfa891c3f57cd76d4f2fa0b96cc09b61d2a2ba73ac862c79ae03a6c57850c02c0a46ec279a78dddb06c39d
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-75.8.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-75.8.2.ebuild
deleted file mode 100644
index 473fddfd3cc..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-75.8.2.ebuild
+++ /dev/null
@@ -1,20 +0,0 @@
-# Copyright 2022-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit pypi
-
-DESCRIPTION="Shared setuptools wheel for ensurepip Python module"
-HOMEPAGE="https://pypi.org/project/setuptools/"
-SRC_URI="$(pypi_wheel_url "${PN#ensurepip-}")"
-S=${DISTDIR}
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-src_install() {
-	insinto /usr/lib/python/ensurepip
-	doins "${A}"
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-78.1.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-78.1.0.ebuild
deleted file mode 100644
index 473fddfd3cc..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-78.1.0.ebuild
+++ /dev/null
@@ -1,20 +0,0 @@
-# Copyright 2022-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit pypi
-
-DESCRIPTION="Shared setuptools wheel for ensurepip Python module"
-HOMEPAGE="https://pypi.org/project/setuptools/"
-SRC_URI="$(pypi_wheel_url "${PN#ensurepip-}")"
-S=${DISTDIR}
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-src_install() {
-	insinto /usr/lib/python/ensurepip
-	doins "${A}"
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-79.0.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-79.0.1.ebuild
index b76c3f6972d..473fddfd3cc 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-79.0.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-79.0.1.ebuild
@@ -12,7 +12,7 @@ S=${DISTDIR}
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 src_install() {
 	insinto /usr/lib/python/ensurepip
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.3.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.4.0.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.3.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.4.0.ebuild

From ac53ef6d3e9e4a99f4c2a73e91244c33e8ff4b87 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:19 +0000
Subject: [PATCH 044/136] dev-python/fastjsonschema: Sync with Gentoo

It's from Gentoo commit 22d4cc214caf01f1f32b8ec9dcdf08c9ff6ab123.
---
 .../dev-python/fastjsonschema/fastjsonschema-2.21.1.ebuild      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/fastjsonschema/fastjsonschema-2.21.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/fastjsonschema/fastjsonschema-2.21.1.ebuild
index cf71fc86453..69c8443a46b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/fastjsonschema/fastjsonschema-2.21.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/fastjsonschema/fastjsonschema-2.21.1.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} )
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} )
 
 inherit distutils-r1 pypi
 

From 8614b3ccb8dc6d4af954f1250f4d4872cf69955e Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:19 +0000
Subject: [PATCH 045/136] dev-python/flit-core: Sync with Gentoo

It's from Gentoo commit 182a8336b48192cb74773c5c4f634a678fbd19f6.
---
 .../portage-stable/dev-python/flit-core/flit-core-3.12.0.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/flit-core/flit-core-3.12.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/flit-core/flit-core-3.12.0.ebuild
index 063c798a097..b2d9618e0ae 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/flit-core/flit-core-3.12.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/flit-core/flit-core-3.12.0.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=standalone
-PYTHON_COMPAT=( python3_{11..13} python3_13t pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_1{3t,4t} pypy3_11 )
 
 inherit distutils-r1 pypi
 

From 80ff5c58df6227e982325c33485ee2a75cb1591b Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:21 +0000
Subject: [PATCH 046/136] dev-python/gpep517: Sync with Gentoo

It's from Gentoo commit 59b637048ca6b3a401033a329fb011bc2145b580.
---
 .../portage-stable/dev-python/gpep517/gpep517-19.ebuild         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-19.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-19.ebuild
index bc3123e8bcf..a09a4c8fa4f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-19.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-19.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=no
-PYTHON_COMPAT=( pypy3_11 python3_{11..13} python3_13t )
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} python3_1{3t,4t} )
 
 inherit distutils-r1
 

From d78f033a463bd0bed4c4b66c7148515bc657fdab Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:21 +0000
Subject: [PATCH 047/136] dev-python/hatchling: Sync with Gentoo

It's from Gentoo commit 41c140f08786e270a32603d35207a9202c5a3254.
---
 .../portage-stable/dev-python/hatchling/hatchling-1.27.0.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.27.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.27.0.ebuild
index c8fcc896280..fbb122bc2ca 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.27.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.27.0.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 DISTUTILS_USE_PEP517=standalone
 PYTHON_TESTED=( pypy3 pypy3_11 python3_{10..13} )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_13t )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_13t python3_14 python3_14t )
 
 inherit distutils-r1
 

From 544a11b54918085d0498185272d07a61bdd4088a Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:21 +0000
Subject: [PATCH 048/136] dev-python/hatch-vcs: Sync with Gentoo

It's from Gentoo commit b0ca3c52e7fd072982c21f7d3bc0a8203e6e962b.
---
 .../portage-stable/dev-python/hatch-vcs/hatch-vcs-0.4.0.ebuild  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/hatch-vcs-0.4.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/hatch-vcs-0.4.0.ebuild
index 7ff7445fbd3..a4c9a72ce31 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/hatch-vcs-0.4.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/hatch-vcs-0.4.0.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=hatchling
-PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} python3_13t )
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} python3_1{3t,4t} )
 
 inherit distutils-r1
 

From ba58c3c3451550e8e67e4b078ee29c574f39575c Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:21 +0000
Subject: [PATCH 049/136] dev-python/idna: Sync with Gentoo

It's from Gentoo commit 00958dec76e3054168982693e7d194bc8027e624.
---
 .../third_party/portage-stable/dev-python/idna/idna-3.10.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/idna/idna-3.10.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/idna/idna-3.10.ebuild
index 748fe083f83..6f05c20ab90 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/idna/idna-3.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/idna/idna-3.10.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 

From 9e3b4209af72cf9a1540a7db51fce605b32d9637 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:22 +0000
Subject: [PATCH 050/136] dev-python/installer: Sync with Gentoo

It's from Gentoo commit fb990028e805f50437af3ff356cad6834aaf7e1b.
---
 .../portage-stable/dev-python/installer/installer-0.7.0.ebuild  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/installer/installer-0.7.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/installer/installer-0.7.0.ebuild
index 52c9205cc81..85c42fc37d0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/installer/installer-0.7.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/installer/installer-0.7.0.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=no
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_1{3t,4t} pypy3_11 )
 
 inherit distutils-r1 pypi
 

From 2d9335d2d98a47f9aca94334a2870197a4c147b3 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:22 +0000
Subject: [PATCH 051/136] dev-python/jaraco-collections: Sync with Gentoo

It's from Gentoo commit 1fa7b1b4402bf87201584a3b5631898ede217076.
---
 .../jaraco-collections/jaraco-collections-5.1.0.ebuild          | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-collections/jaraco-collections-5.1.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-collections/jaraco-collections-5.1.0.ebuild
index e8ac4ce3b01..fd94bb33fc9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-collections/jaraco-collections-5.1.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-collections/jaraco-collections-5.1.0.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 DISTUTILS_USE_PEP517=flit
 PYPI_PN=${PN/-/.}
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_1{3t,4t} pypy3_11 )
 
 inherit distutils-r1 pypi
 

From 69120e7e58cd3add3fcf0d4da734567979c43e03 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:22 +0000
Subject: [PATCH 052/136] dev-python/jaraco-context: Sync with Gentoo

It's from Gentoo commit 3c1d52f229b70307482fb8844da53b9787784713.
---
 .../dev-python/jaraco-context/jaraco-context-6.0.1-r1.ebuild    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-6.0.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-6.0.1-r1.ebuild
index 1f03c21b8d7..eccc708af3a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-6.0.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-6.0.1-r1.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 
 DISTUTILS_USE_PEP517=flit
 PYPI_PN=${PN/-/.}
-PYTHON_COMPAT=( python3_{11..13} python3_13t pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_1{3t,4t} pypy3_11 )
 
 inherit distutils-r1 pypi
 

From def853fff42926167c9293e75b9aaf37a4c2b8aa Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:22 +0000
Subject: [PATCH 053/136] dev-python/jaraco-functools: Sync with Gentoo

It's from Gentoo commit ff1632b4c399daba8bfba29fda31071ec59c5114.
---
 .../dev-python/jaraco-functools/jaraco-functools-4.1.0.ebuild   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/jaraco-functools-4.1.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/jaraco-functools-4.1.0.ebuild
index 200ed01418d..1f260537e95 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/jaraco-functools-4.1.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/jaraco-functools-4.1.0.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 
 DISTUTILS_USE_PEP517=flit
 PYPI_PN=${PN/-/.}
-PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} python3_13t )
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} python3_1{3t,4t} )
 
 inherit distutils-r1 pypi
 

From 4759f46340d54dd46da50ef0c2b10fa5e257352b Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:22 +0000
Subject: [PATCH 054/136] dev-python/jaraco-text: Sync with Gentoo

It's from Gentoo commit 186253c33d8c66cb9143d8dc60557ef7fbe20ea8.
---
 .../dev-python/jaraco-text/jaraco-text-4.0.0.ebuild             | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-4.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-4.0.0.ebuild
index b851fd1a404..7f9aaee6a05 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-4.0.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-4.0.0.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 
 DISTUTILS_USE_PEP517=flit
 PYPI_PN=${PN/-/.}
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_1{3t,4t} pypy3_11 )
 
 inherit distutils-r1 pypi
 

From cd9628ddc0b25015698919ead09d443a404cb6d5 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:23 +0000
Subject: [PATCH 055/136] dev-python/jinja2: Sync with Gentoo

It's from Gentoo commit 5691a10aea8efbf0f3c34111dad647b12247ce80.
---
 .../portage-stable/dev-python/jinja2/jinja2-3.1.6.ebuild        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jinja2/jinja2-3.1.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/jinja2/jinja2-3.1.6.ebuild
index 3f72cd7b1c3..2dfd037022f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/jinja2/jinja2-3.1.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jinja2/jinja2-3.1.6.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 DISTUTILS_USE_PEP517=flit
 PYPI_PN=jinja2
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 PYTHON_REQ_USE="threads(+)"
 
 inherit distutils-r1 pypi

From 636109f7b973a74dc4b94a5f1e8e0209ac1272df Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:23 +0000
Subject: [PATCH 056/136] dev-python/lark: Sync with Gentoo

It's from Gentoo commit 47a4311d8ac7d963e5e27ba7f42b329c9adde88e.
---
 .../lark/files/lark-1.2.2-py314.patch         | 38 +++++++++++++++++++
 .../dev-python/lark/lark-1.2.2.ebuild         |  7 +++-
 2 files changed, 44 insertions(+), 1 deletion(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/lark/files/lark-1.2.2-py314.patch

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lark/files/lark-1.2.2-py314.patch b/sdk_container/src/third_party/portage-stable/dev-python/lark/files/lark-1.2.2-py314.patch
new file mode 100644
index 00000000000..aade3ae3022
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/lark/files/lark-1.2.2-py314.patch
@@ -0,0 +1,38 @@
+https://github.com/lark-parser/lark/issues/1480
+https://github.com/lark-parser/lark/pull/1483
+
+From 4809ce89ca005b71f6db930c4aabf6496a502795 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
+Date: Wed, 6 Nov 2024 16:47:11 +0100
+Subject: [PATCH] Wrap functools.partial in staticmethod() to add compatibility
+ with Python 3.14
+
+Fixes: #1480
+---
+ tests/test_trees.py | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tests/test_trees.py b/tests/test_trees.py
+index 1f69869e..07687ac0 100644
+--- a/tests/test_trees.py
++++ b/tests/test_trees.py
+@@ -254,7 +254,7 @@ def ab_method(self, a, b):
+             ab_partialmethod = partialmethod(ab_for_partialmethod, 1)
+             set_union = set(["a"]).union
+             static_add = staticmethod(add)
+-            partial_reduce_mul = partial(reduce, mul)
++            partial_reduce_mul = staticmethod(partial(reduce, mul))
+ 
+             custom_callable = CustomCallable()
+ 
+@@ -355,8 +355,8 @@ def test(prefix, s, postfix):
+ 
+         @v_args(inline=True)
+         class T(Transformer):
+-            a = functools.partial(test, "@", postfix="!")
+-            b = functools.partial(lambda s: s + "!")
++            a = staticmethod(functools.partial(test, "@", postfix="!"))
++            b = staticmethod(functools.partial(lambda s: s + "!"))
+ 
+         res = T().transform(tree)
+         assert res.children == ["@TEST1!", "test2!"]
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lark/lark-1.2.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/lark/lark-1.2.2.ebuild
index 4ce565bfc04..a8a5dd0e749 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/lark/lark-1.2.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/lark/lark-1.2.2.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1 pypi
 
@@ -28,6 +28,11 @@ BDEPEND="
 	)
 "
 
+PATCHES=(
+	# https://github.com/lark-parser/lark/pull/1483
+	"${FILESDIR}"/${P}-py314.patch
+)
+
 distutils_enable_tests pytest
 
 python_test() {

From f47bcdf05e7da0a818079e35ce46f3a6382ccef6 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:23 +0000
Subject: [PATCH 057/136] dev-python/linkify-it-py: Sync with Gentoo

It's from Gentoo commit 606da456627f22be0f9fb465b1bc445498bd9c3e.
---
 .../dev-python/linkify-it-py/linkify-it-py-2.0.3.ebuild         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/linkify-it-py/linkify-it-py-2.0.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/linkify-it-py/linkify-it-py-2.0.3.ebuild
index c6533726ecf..4b78371d072 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/linkify-it-py/linkify-it-py-2.0.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/linkify-it-py/linkify-it-py-2.0.3.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} )
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} )
 
 inherit distutils-r1
 

From 3447bc417d7e6ffcf92adf31f55d320fd45c8ef4 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:23 +0000
Subject: [PATCH 058/136] dev-python/lxml: Sync with Gentoo

It's from Gentoo commit d9b5156e5820fee9010efc9cd661ab1f75b66f01.
---
 .../portage-stable/dev-python/lxml/lxml-5.4.0-r2.ebuild         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.4.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.4.0-r2.ebuild
index 26d81a16ea3..8b9582e51c5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.4.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.4.0-r2.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 DISTUTILS_EXT=1
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1 optfeature toolchain-funcs
 

From f4cdfda79e7861d5f5dc168b8d73790da5f317de Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:23 +0000
Subject: [PATCH 059/136] dev-python/markdown-it-py: Sync with Gentoo

It's from Gentoo commit 48e446511d565d4e9a480302f735b541c6422f45.
---
 .../dev-python/markdown-it-py/markdown-it-py-3.0.0.ebuild       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/markdown-it-py/markdown-it-py-3.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/markdown-it-py/markdown-it-py-3.0.0.ebuild
index 8e4b43bdeb0..985a9c088e4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/markdown-it-py/markdown-it-py-3.0.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/markdown-it-py/markdown-it-py-3.0.0.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1
 

From 1d05ef1a4dad2cb5c4b5a65a3b40e4edc4d96c7d Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:24 +0000
Subject: [PATCH 060/136] dev-python/markupsafe: Sync with Gentoo

It's from Gentoo commit 0dd11719d14c2954e909007d39d9f7c48370187e.
---
 .../dev-python/markupsafe/markupsafe-3.0.2.ebuild               | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/markupsafe/markupsafe-3.0.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/markupsafe/markupsafe-3.0.2.ebuild
index 50f53fa58b8..6bfb18affd5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/markupsafe/markupsafe-3.0.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/markupsafe/markupsafe-3.0.2.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 DISTUTILS_EXT=1
 DISTUTILS_USE_PEP517=setuptools
 PYPI_PN="MarkupSafe"
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_13t pypy3_11 )
 
 inherit distutils-r1 pypi
 

From 9d2d5a7a03b9cf522099a3e7c5375045020c00bf Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:24 +0000
Subject: [PATCH 061/136] dev-python/mdurl: Sync with Gentoo

It's from Gentoo commit 1e5c8dcc223d45ba3c262f11f5262ddf306089f1.
---
 .../portage-stable/dev-python/mdurl/mdurl-0.1.2.ebuild          | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/mdurl/mdurl-0.1.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/mdurl/mdurl-0.1.2.ebuild
index 0d78b93cc02..b486364919f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/mdurl/mdurl-0.1.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/mdurl/mdurl-0.1.2.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1
 

From 09b78c5163169a13863c816d46b43a67301acc93 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:24 +0000
Subject: [PATCH 062/136] dev-python/more-itertools: Sync with Gentoo

It's from Gentoo commit fb074223acef1a97285216ec7fc0a6767f00ff57.
---
 .../dev-python/more-itertools/more-itertools-10.7.0.ebuild      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.7.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.7.0.ebuild
index 7acd5472ab8..d2743ecb932 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.7.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.7.0.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_1{3t,4t} pypy3_11 )
 
 inherit distutils-r1 pypi
 

From f4eaa61f348c64ed8d4ed22f97482c431ee4043e Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:25 +0000
Subject: [PATCH 063/136] dev-python/olefile: Sync with Gentoo

It's from Gentoo commit 1124415b9bdc67fb0c537ba8980351141b417ea5.
---
 .../portage-stable/dev-python/olefile/olefile-0.47.ebuild       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/olefile/olefile-0.47.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/olefile/olefile-0.47.ebuild
index 606eef403fe..9a09f78dee9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/olefile/olefile-0.47.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/olefile/olefile-0.47.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1
 

From df18494d895ea9133b228a5636188eed17a66671 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:25 +0000
Subject: [PATCH 064/136] dev-python/packaging: Sync with Gentoo

It's from Gentoo commit daac88938d45ec8f559f0326263ac5e9b82a2d82.
---
 .../portage-stable/dev-python/packaging/packaging-25.0.ebuild   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/packaging/packaging-25.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/packaging/packaging-25.0.ebuild
index 1aab3809831..08100063d9b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/packaging/packaging-25.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/packaging/packaging-25.0.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_1{3t,4t} pypy3_11 )
 
 inherit distutils-r1 pypi
 

From 81832b38e780bc2e31afffc2767a7c8dceb3d961 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:25 +0000
Subject: [PATCH 065/136] dev-python/pathspec: Sync with Gentoo

It's from Gentoo commit 4a67f8988bbf0ab5a3ff38d32a9406bf959f7b4c.
---
 .../portage-stable/dev-python/pathspec/pathspec-0.12.1.ebuild   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pathspec/pathspec-0.12.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pathspec/pathspec-0.12.1.ebuild
index db6d05b9415..8cca4c24e85 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pathspec/pathspec-0.12.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pathspec/pathspec-0.12.1.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_1{3t,4t} pypy3_11 )
 
 inherit distutils-r1 pypi
 

From e86f198572062f383f980c2b4f222321dc2ebab6 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:28 +0000
Subject: [PATCH 066/136] dev-python/pillow: Sync with Gentoo

It's from Gentoo commit b41af526ac1f2fb16d72915a9172d427a1f4b472.
---
 .../pillow/files/pillow-11.2.1-py314.patch    | 49 +++++++++++++++++++
 .../dev-python/pillow/pillow-11.2.1.ebuild    |  4 +-
 2 files changed, 52 insertions(+), 1 deletion(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/pillow/files/pillow-11.2.1-py314.patch

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pillow/files/pillow-11.2.1-py314.patch b/sdk_container/src/third_party/portage-stable/dev-python/pillow/files/pillow-11.2.1-py314.patch
new file mode 100644
index 00000000000..b9fe40d4704
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pillow/files/pillow-11.2.1-py314.patch
@@ -0,0 +1,49 @@
+https://github.com/python-pillow/Pillow/pull/8948
+https://github.com/python-pillow/Pillow/commit/3c71559804e661a5f727e2007a5be51f26d9af27
+
+From c7193f74fc5ce1a0fe1742a0845165024be45ef5 Mon Sep 17 00:00:00 2001
+From: Andrew Murray <radarhere@users.noreply.github.com>
+Date: Thu, 8 May 2025 20:10:34 +1000
+Subject: [PATCH 1/3] Updated error message
+
+---
+ Tests/test_image_resample.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Tests/test_image_resample.py b/Tests/test_image_resample.py
+index ce6209c0da4..73b25ed51b2 100644
+--- a/Tests/test_image_resample.py
++++ b/Tests/test_image_resample.py
+@@ -462,7 +462,7 @@ def test_wrong_arguments(self, resample: Image.Resampling) -> None:
+         im.resize((32, 32), resample, (20, 20, 20, 100))
+         im.resize((32, 32), resample, (20, 20, 100, 20))
+ 
+-        with pytest.raises(TypeError, match="must be sequence of length 4"):
++        with pytest.raises(TypeError, match="must be (sequence|tuple) of length 4"):
+             im.resize((32, 32), resample, (im.width, im.height))  # type: ignore[arg-type]
+ 
+         with pytest.raises(ValueError, match="can't be negative"):
+
+From 215069af5ddec6f4d3b92b8bc7554a10e2efb669 Mon Sep 17 00:00:00 2001
+From: Andrew Murray <radarhere@users.noreply.github.com>
+Date: Thu, 8 May 2025 22:13:13 +1000
+Subject: [PATCH 3/3] Added support for Python 3.14
+
+---
+ setup.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/setup.py b/setup.py
+index 5ecd6b8160a..5d41e27d981 100644
+--- a/setup.py
++++ b/setup.py
+@@ -46,7 +46,7 @@ def get_version() -> str:
+ ZLIB_ROOT = None
+ FUZZING_BUILD = "LIB_FUZZING_ENGINE" in os.environ
+ 
+-if sys.platform == "win32" and sys.version_info >= (3, 14):
++if sys.platform == "win32" and sys.version_info >= (3, 15):
+     import atexit
+ 
+     atexit.register(
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pillow/pillow-11.2.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pillow/pillow-11.2.1.ebuild
index fc131fa8d8e..5972d432576 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pillow/pillow-11.2.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pillow/pillow-11.2.1.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 DISTUTILS_EXT=1
 # setuptools wrapper
 DISTUTILS_USE_PEP517=standalone
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 PYTHON_REQ_USE='tk?,threads(+)'
 
 inherit distutils-r1 toolchain-funcs virtualx
@@ -81,6 +81,8 @@ src_prepare() {
 	local PATCHES=(
 		# https://github.com/python-pillow/pillow/pull/7634
 		"${FILESDIR}/${PN}-10.2.0-cross.patch"
+		# https://github.com/python-pillow/Pillow/pull/8948
+		"${FILESDIR}/${PN}-11.2.1-py314.patch"
 	)
 
 	distutils-r1_src_prepare

From 4e27af91335d106da1323576a2c90445861a8e9c Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:28 +0000
Subject: [PATCH 067/136] dev-python/platformdirs: Sync with Gentoo

It's from Gentoo commit e0fc7df5423f06809e0166615a4f59ce28c2f793.
---
 .../dev-python/platformdirs/Manifest          |  1 +
 .../platformdirs/platformdirs-4.3.8.ebuild    | 54 +++++++++++++++++++
 2 files changed, 55 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.8.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest
index 7bf70ea3cb9..844ceb74991 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest
@@ -1 +1,2 @@
 DIST platformdirs-4.3.7.tar.gz 21291 BLAKE2B 8abe5b99140d1968d0341c025a65cd373d798b4b3848686888e754aad95d5d7e526db9618b2f44300d5b84700655b1562fa40929362a78ed50502a6ef54a55fa SHA512 d2d131aabc448d80581e930b7bb6ced950ce7f2fe595243f0a57ab2e990f7c6669cc45fb4592971f7601f268455451881ceaf303618b5f963056e818c1580bcc
+DIST platformdirs-4.3.8.tar.gz 21362 BLAKE2B dbacac7a6692a2011b8d47abf45ec1141331743336615340d84376ca468b478b0b7d211c6d1256028ecfb81f26b8f31cb290bcb21af4714dc77f834d956c8abc SHA512 131fc9f673313d0c8ea6bc36f6efed09eedc106a37194cb35c73980841b1314fc6f5e4362180d420c071d9c173dbb11f322baab0d264d1a3d9f02f4aa1e43169
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.8.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.8.ebuild
new file mode 100644
index 00000000000..d0fc960712e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.8.ebuild
@@ -0,0 +1,54 @@
+# Copyright 2021-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( python3_{11..14} python3_1{3t,4t} pypy3_11 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="A small Python module for determining appropriate platform-specific dirs"
+HOMEPAGE="
+	https://pypi.org/project/platformdirs/
+	https://github.com/tox-dev/platformdirs/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+
+BDEPEND="
+	test? (
+		dev-python/appdirs[${PYTHON_USEDEP}]
+		dev-python/pytest-mock[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+src_configure() {
+	grep -q 'build-backend = "hatchling' pyproject.toml ||
+		die "Upstream changed build-backend, recheck"
+	# write a custom pyproject.toml to ease setuptools bootstrap
+	cat > pyproject.toml <<-EOF || die
+		[build-system]
+		requires = ["flit_core >=3.2,<4"]
+		build-backend = "flit_core.buildapi"
+
+		[project]
+		name = "${PN}"
+		version = "${PV}"
+		description = 'A small Python package for determining appropriate platform-specific dirs, e.g. a "user data dir".'
+	EOF
+	# sigh
+	cat > src/platformdirs/version.py <<-EOF || die
+		__version__ = version = '${PV}'
+		__version_tuple__ = version_tuple = (${PV//./, })
+	EOF
+}
+
+python_test() {
+	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+	epytest -p pytest_mock
+}

From 3e4ebe3e551f99a5b38e4c2264ded0510d542fc5 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:28 +0000
Subject: [PATCH 068/136] dev-python/pluggy: Sync with Gentoo

It's from Gentoo commit 453a2ae15ba0fd62cd6ee038c4fb2b37c3925a25.
---
 .../portage-stable/dev-python/pluggy/pluggy-1.5.0.ebuild        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pluggy/pluggy-1.5.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pluggy/pluggy-1.5.0.ebuild
index 4cd4eb563aa..0e9404a3cf8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pluggy/pluggy-1.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pluggy/pluggy-1.5.0.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_1{3t,4t} pypy3_11 )
 
 inherit distutils-r1 pypi
 

From 3532bbeccb660cfffdb412109f8b935c2e04c264 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:29 +0000
Subject: [PATCH 069/136] dev-python/ply: Sync with Gentoo

It's from Gentoo commit 32c678b7fdc4b36a0dfe1e2204b08eba7597308d.
---
 .../portage-stable/dev-python/ply/ply-3.11-r2.ebuild            | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ply/ply-3.11-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ply/ply-3.11-r2.ebuild
index fb6f8f3c428..a0b371d6e84 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ply/ply-3.11-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ply/ply-3.11-r2.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{11..13} pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1 pypi
 

From 46cbd3edb5923f5c577d54e982af41514eb04454 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:29 +0000
Subject: [PATCH 070/136] dev-python/poetry-core: Sync with Gentoo

It's from Gentoo commit 8e1cdb79167941a8cd3b0b55598b48caf3a1f682.
---
 .../dev-python/poetry-core/poetry-core-2.1.3.ebuild             | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/poetry-core/poetry-core-2.1.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/poetry-core/poetry-core-2.1.3.ebuild
index bb27669c074..ab51d8094cc 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/poetry-core/poetry-core-2.1.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/poetry-core/poetry-core-2.1.3.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=standalone
-PYTHON_TESTED=( pypy3 pypy3_11 python3_{10..13} )
+PYTHON_TESTED=( pypy3_11 python3_{11..14} )
 PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" )
 
 inherit distutils-r1 pypi

From 551edb8a08fa2b259e6f4a30e59235c01ab5fd05 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:29 +0000
Subject: [PATCH 071/136] dev-python/pycparser: Sync with Gentoo

It's from Gentoo commit ae3337c4b8c05ef700a9fdfe7064a200f2c881c9.
---
 .../portage-stable/dev-python/pycparser/pycparser-2.22.ebuild   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pycparser/pycparser-2.22.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pycparser/pycparser-2.22.ebuild
index dcc2cfd77c3..3ed190f94ed 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pycparser/pycparser-2.22.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pycparser/pycparser-2.22.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1 pypi
 

From abe54670a3b356f703c5b383ebabb0b7d8e13b64 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:31 +0000
Subject: [PATCH 072/136] dev-python/pygments: Sync with Gentoo

It's from Gentoo commit 92d1c6bc0b66c358d851126dbad19e887c92879f.
---
 .../dev-python/pygments/pygments-2.19.1.ebuild     | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.19.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.19.1.ebuild
index 7ace5ffe427..063bd7bb01b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.19.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.19.1.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 DISTUTILS_USE_PEP517=hatchling
 PYPI_PN=${PN^}
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1 bash-completion-r1 pypi
 
@@ -40,6 +40,18 @@ EPYTEST_DESELECT=(
 EPYTEST_XDIST=1
 distutils_enable_tests pytest
 
+python_test() {
+	if [[ ${EPYTHON} == python3.14* ]] ; then
+		EPYTEST_IGNORE+=(
+			# https://github.com/python/cpython/issues/133653
+			# https://github.com/python/cpython/pull/133813
+			tests/test_cmdline.py
+		)
+	fi
+
+	epytest
+}
+
 src_install() {
 	distutils-r1_src_install
 	newbashcomp external/pygments.bashcomp pygmentize

From 56225c586f266f842426e0319a5664c0b060889b Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:31 +0000
Subject: [PATCH 073/136] dev-python/pyproject-hooks: Sync with Gentoo

It's from Gentoo commit e23f2b01c5d89656375075fc8b81a3fef8852d3f.
---
 .../dev-python/pyproject-hooks/pyproject-hooks-1.2.0.ebuild     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pyproject-hooks/pyproject-hooks-1.2.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pyproject-hooks/pyproject-hooks-1.2.0.ebuild
index 88bad0a895c..e20db963976 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pyproject-hooks/pyproject-hooks-1.2.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pyproject-hooks/pyproject-hooks-1.2.0.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_1{3t,4t} pypy3_11 )
 
 inherit distutils-r1 pypi
 

From d9e93d6e0b05a57ec8109117e538d9bda1c45b8d Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:31 +0000
Subject: [PATCH 074/136] dev-python/pysocks: Sync with Gentoo

It's from Gentoo commit 062fd4fd873d92e7373f98f8d52d8b36e7bca703.
---
 .../portage-stable/dev-python/pysocks/pysocks-1.7.1-r2.ebuild   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pysocks/pysocks-1.7.1-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pysocks/pysocks-1.7.1-r2.ebuild
index 841211e8df8..54eab123176 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pysocks/pysocks-1.7.1-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pysocks/pysocks-1.7.1-r2.ebuild
@@ -7,7 +7,7 @@ EAPI=8
 DISTUTILS_USE_PEP517=setuptools
 PYPI_NO_NORMALIZE=1
 PYPI_PN=PySocks
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1 pypi
 

From 17448a5468396dc6702b657f81d451b9b4087472 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:33 +0000
Subject: [PATCH 075/136] dev-python/rich: Sync with Gentoo

It's from Gentoo commit 369bd4e9f81a0e32e8cc32c030098903c7fac2c8.
---
 .../rich/files/rich-14.0.0-py314.patch        | 84 +++++++++++++++++++
 .../dev-python/rich/rich-14.0.0.ebuild        | 15 +++-
 2 files changed, 95 insertions(+), 4 deletions(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/rich/files/rich-14.0.0-py314.patch

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/rich/files/rich-14.0.0-py314.patch b/sdk_container/src/third_party/portage-stable/dev-python/rich/files/rich-14.0.0-py314.patch
new file mode 100644
index 00000000000..4684f2b469e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/rich/files/rich-14.0.0-py314.patch
@@ -0,0 +1,84 @@
+https://github.com/Textualize/rich/pull/3622
+
+From 91bbeac3ec8b87790865be974260d44adc8def61 Mon Sep 17 00:00:00 2001
+From: Karolina Surma <ksurma@redhat.com>
+Date: Tue, 28 Jan 2025 10:03:26 +0100
+Subject: [PATCH] Skip tests which are expected to fail with Python 3.14
+
+---
+ tests/test_inspect.py | 9 +++++++++
+ tests/test_pretty.py  | 5 +++++
+ 2 files changed, 14 insertions(+)
+
+diff --git a/tests/test_inspect.py b/tests/test_inspect.py
+index 130e8df12..fd1d26e2c 100644
+--- a/tests/test_inspect.py
++++ b/tests/test_inspect.py
+@@ -43,6 +43,11 @@
+     reason="rendered differently on py3.13",
+ )
+ 
++skip_py314 = pytest.mark.skipif(
++    sys.version_info.minor == 14 and sys.version_info.major == 3,
++    reason="rendered differently on py3.14",
++)
++
+ skip_pypy3 = pytest.mark.skipif(
+     hasattr(sys, "pypy_version_info"),
+     reason="rendered differently on pypy3",
+@@ -139,6 +144,7 @@ def test_inspect_empty_dict():
+     assert render({}).startswith(expected)
+ 
+ 
++@skip_py314
+ @skip_py313
+ @skip_py312
+ @skip_py311
+@@ -219,6 +225,7 @@ def test_inspect_integer_with_value():
+ @skip_py311
+ @skip_py312
+ @skip_py313
++@skip_py314
+ def test_inspect_integer_with_methods_python38_and_python39():
+     expected = (
+         "╭──────────────── <class 'int'> ─────────────────╮\n"
+@@ -257,6 +264,7 @@ def test_inspect_integer_with_methods_python38_and_python39():
+ @skip_py311
+ @skip_py312
+ @skip_py313
++@skip_py314
+ def test_inspect_integer_with_methods_python310only():
+     expected = (
+         "╭──────────────── <class 'int'> ─────────────────╮\n"
+@@ -299,6 +307,7 @@ def test_inspect_integer_with_methods_python310only():
+ @skip_py310
+ @skip_py312
+ @skip_py313
++@skip_py314
+ def test_inspect_integer_with_methods_python311():
+     # to_bytes and from_bytes methods on int had minor signature change -
+     # they now, as of 3.11, have default values for all of their parameters
+diff --git a/tests/test_pretty.py b/tests/test_pretty.py
+index 90be42f87..29331d9d5 100644
+--- a/tests/test_pretty.py
++++ b/tests/test_pretty.py
+@@ -38,6 +38,10 @@
+     sys.version_info.minor == 13 and sys.version_info.major == 3,
+     reason="rendered differently on py3.13",
+ )
++skip_py314 = pytest.mark.skipif(
++    sys.version_info.minor == 14 and sys.version_info.major == 3,
++    reason="rendered differently on py3.14",
++)
+ 
+ 
+ def test_install() -> None:
+@@ -639,6 +643,7 @@ class Nada:
+ @skip_py311
+ @skip_py312
+ @skip_py313
++@skip_py314
+ def test_attrs_broken() -> None:
+     @attr.define
+     class Foo:
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.0.0.ebuild
index 3fb0c38348f..5cf4037f031 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.0.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.0.0.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=poetry
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1 optfeature
 
@@ -26,9 +26,6 @@ RDEPEND="
 	dev-python/colorama[${PYTHON_USEDEP}]
 	>=dev-python/markdown-it-py-2.2.0[${PYTHON_USEDEP}]
 	>=dev-python/pygments-2.13.0[${PYTHON_USEDEP}]
-	$(python_gen_cond_dep '
-		>=dev-python/typing-extensions-4.0.0[${PYTHON_USEDEP}]
-	' 3.10)
 "
 BDEPEND="
 	test? (
@@ -36,6 +33,11 @@ BDEPEND="
 	)
 "
 
+PATCHES=(
+	# https://github.com/Textualize/rich/pull/3622
+	"${FILESDIR}"/${PN}-14.0.0-py314.patch
+)
+
 distutils_enable_tests pytest
 
 python_test() {
@@ -62,6 +64,11 @@ python_test() {
 				tests/test_inspect.py::test_inspect_integer_with_methods_python311
 			)
 			;;
+		python3.14*)
+			EPYTEST_DESELECT+=(
+				# Span vs Style
+				tests/test_text.py::test_assemble_meta
+			)
 	esac
 
 	local -x COLUMNS=80

From 31833fb7168499b4bb4e7dda56fa6533082e1e86 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:34 +0000
Subject: [PATCH 076/136] dev-python/setuptools: Sync with Gentoo

It's from Gentoo commit f5d58c6ab571891275e9a2f7975723cf7fd1d088.
---
 .../dev-python/setuptools/Manifest            |   4 +-
 .../setuptools/setuptools-75.8.2.ebuild       | 132 -----------------
 .../setuptools/setuptools-78.1.0.ebuild       | 134 ------------------
 .../setuptools/setuptools-79.0.1.ebuild       |   2 +-
 .../setuptools/setuptools-80.3.1.ebuild       |   2 +-
 ...80.3.0.ebuild => setuptools-80.4.0.ebuild} |   8 +-
 6 files changed, 6 insertions(+), 276 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-75.8.2.ebuild
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-78.1.0.ebuild
 rename sdk_container/src/third_party/portage-stable/dev-python/setuptools/{setuptools-80.3.0.ebuild => setuptools-80.4.0.ebuild} (95%)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
index 8544804e3a3..36dbef5ff3e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
@@ -1,6 +1,4 @@
-DIST setuptools-75.8.2.tar.gz 1344083 BLAKE2B 7d4dff2c0948bb411ef5f70e5f5f91bc0e230b155a97419d263f88e54a94390fd7dcadad14105f4d886a25024bf4c95e776ae7b25e4b1d6f17e45e6060b99da2 SHA512 adf7f5d2eab7621b03c86e3f96857b176631108dc8a0eba2b16b87e394bff0b607998bc24cc074cd3f7b0ed6dbe0bd753cce5af2f108fce2473fb50b22f32913
-DIST setuptools-78.1.0.tar.gz 1367827 BLAKE2B d82320d11829e43e6841cd6b5a9bd4e16cfc9e7e2f97f64ac2ab1956ed68587ca6c74a07781f6afeefd3a949c23dee374460bdd327b7a5d908f33b2882f3d87d SHA512 e0b9562a8b3bb7a6b664da84ef37e4f4f71df5dd3129b636ece798878e62bf4be60ff6b6643a98b7047e540e14c931eeb54b4e08c583ac1a86ffb5dc5e921c68
 DIST setuptools-79.0.1.tar.gz 1367909 BLAKE2B d495a22753400b3b0ef71423e2c9b5adaad1a065d1f9638b5da8161b29c453495701c3efaa3abd2482777e186ba992bd7b57090dfc711d9cdfdaa8254616a8ff SHA512 5b68d7cc775f4318e178f7d7f69c60a01b1abc607411e88c88e3507a08bd85eed241b915d4be5f3ada90df4b68718056c2ba032943c1f53fe68d171c7d728179
 DIST setuptools-80.2.0.tar.gz 1354232 BLAKE2B 2eb5f9b51632c865533bb018e268da7e9b52f1cecdb9da0eb0da713ee4e44d0827c6340b5c1f663d3b8b4df08849c32972498980de287fab6101593d5aeb47ca SHA512 a684eb3ef4049c6d05aca9cd77a015e63047cdc84460af798ac1dc1d87a970370176ac7fd87e250be155e61dddd77e89ad84adb5557f04d1a1059cd449c08c53
-DIST setuptools-80.3.0.tar.gz 1314475 BLAKE2B 26fb2b0408221a51f4664a983927be79936b89e3daffb71f1d6ad76a2b752ee10f3958ac9be9fb7d8c78906b6cff33b19c16d248649600d6921083bdfc841d04 SHA512 f492360d8eec2a33a70328cf6e7e017290dea510ffa14fe12ef0161bd72a46d6078ff099a885f256ced0862c3551b6ef3af449a4638b309f6b55070dcd482c51
 DIST setuptools-80.3.1.tar.gz 1315082 BLAKE2B 65207edf080d80599b2fe82caed638221bbe1155f745fd8cd02bd9da5934b1880782eb285f5be44088e189684385e7fbbd2bd0750fcd27aaf556f0a44214573d SHA512 be5157aa1f1a7f1e3e11b971ffedac509303d4919d590c1f741dd1c4966c5dc83168b458d3aad66dd9874c7f8f4c8c5bbded6b4dbf6ed91f0d05b1c65229a789
+DIST setuptools-80.4.0.tar.gz 1315008 BLAKE2B e41541fdd6e6adad6ed2f39f2c344c944336e89c24b6d9de9984c8a0234c61dba05b15df805639d380e840b0a15b98a3998c251b764340b5251624827be0934a SHA512 d4d55d9f7bdecbf26e3de6e5a99245db4b69a203a37475539ce4a3b8c6e6b9f1c47f5dc29b4d6a4dc971cabc6714ae7bc0a55f99e214d9402b47bb3dd89b58a4
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-75.8.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-75.8.2.ebuild
deleted file mode 100644
index a4fd87dbb97..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-75.8.2.ebuild
+++ /dev/null
@@ -1,132 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
-EAPI=8
-
-# please bump dev-python/ensurepip-setuptools along with this package!
-
-DISTUTILS_USE_PEP517=standalone
-PYTHON_TESTED=( python3_{10..13} pypy3 pypy3_11 )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_13t )
-PYTHON_REQ_USE="xml(+)"
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Collection of extensions to Distutils"
-HOMEPAGE="
-	https://github.com/pypa/setuptools/
-	https://pypi.org/project/setuptools/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
-IUSE="test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	!<dev-python/setuptools-rust-1.8.0
-	dev-python/jaraco-collections[${PYTHON_USEDEP}]
-	>=dev-python/jaraco-functools-4[${PYTHON_USEDEP}]
-	>=dev-python/jaraco-text-3.7.0-r1[${PYTHON_USEDEP}]
-	>=dev-python/more-itertools-8.12.0-r1[${PYTHON_USEDEP}]
-	>=dev-python/packaging-24.2[${PYTHON_USEDEP}]
-	>=dev-python/platformdirs-4.2.2[${PYTHON_USEDEP}]
-	>=dev-python/wheel-0.44.0[${PYTHON_USEDEP}]
-	$(python_gen_cond_dep '
-		>=dev-python/tomli-2.0.1[${PYTHON_USEDEP}]
-	' 3.10)
-	!<=dev-libs/gobject-introspection-1.76.1-r0
-	!=dev-libs/gobject-introspection-1.78.1-r0
-	!=dev-libs/gobject-introspection-1.80.1-r1
-"
-BDEPEND="
-	${RDEPEND}
-	test? (
-		$(python_gen_cond_dep '
-			>=dev-python/build-1.0.3[${PYTHON_USEDEP}]
-			>=dev-python/ini2toml-0.14[${PYTHON_USEDEP}]
-			>=dev-python/filelock-3.4.0[${PYTHON_USEDEP}]
-			>=dev-python/jaraco-envs-2.2[${PYTHON_USEDEP}]
-			>=dev-python/jaraco-path-3.7.2[${PYTHON_USEDEP}]
-			>=dev-python/jaraco-test-5.5[${PYTHON_USEDEP}]
-			dev-python/pip[${PYTHON_USEDEP}]
-			dev-python/pyproject-hooks[${PYTHON_USEDEP}]
-			dev-python/pytest[${PYTHON_USEDEP}]
-			>=dev-python/pytest-home-0.5[${PYTHON_USEDEP}]
-			dev-python/pytest-subprocess[${PYTHON_USEDEP}]
-			dev-python/pytest-timeout[${PYTHON_USEDEP}]
-			dev-python/pytest-xdist[${PYTHON_USEDEP}]
-			>=dev-python/tomli-w-1.0.0[${PYTHON_USEDEP}]
-			>=dev-python/virtualenv-20[${PYTHON_USEDEP}]
-		' "${PYTHON_TESTED[@]}")
-	)
-"
-# setuptools-scm is here because installing plugins apparently breaks stuff at
-# runtime, so let's pull it early. See bug #663324.
-#
-# trove-classifiers are optionally used in validation, if they are
-# installed.  Since we really oughtn't block them, let's always enforce
-# the newest version for the time being to avoid errors.
-# https://github.com/pypa/setuptools/issues/4459
-PDEPEND="
-	dev-python/setuptools-scm[${PYTHON_USEDEP}]
-	>=dev-python/trove-classifiers-2024.10.16[${PYTHON_USEDEP}]
-"
-
-src_prepare() {
-	local PATCHES=(
-		# TODO: remove this when we're 100% PEP517 mode
-		"${FILESDIR}/setuptools-62.4.0-py-compile.patch"
-		# https://github.com/abravalheri/validate-pyproject/pull/221
-		"${FILESDIR}/setuptools-75.6.0-disable-trove-classifiers.patch"
-	)
-
-	distutils-r1_src_prepare
-
-	# breaks tests
-	sed -i -e '/--import-mode/d' pytest.ini || die
-
-	# remove bundled dependencies
-	rm -r */_vendor || die
-}
-
-python_test() {
-	if ! has "${EPYTHON}" "${PYTHON_TESTED[@]/_/.}"; then
-		return
-	fi
-
-	local EPYTEST_DESELECT=(
-		# network
-		setuptools/tests/test_build_meta.py::test_legacy_editable_install
-		setuptools/tests/test_distutils_adoption.py
-		setuptools/tests/test_editable_install.py
-		setuptools/tests/test_virtualenv.py::test_no_missing_dependencies
-		setuptools/tests/test_virtualenv.py::test_test_command_install_requirements
-		# TODO
-		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_basic
-		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_ignore_errors
-		# expects bundled deps in virtualenv
-		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_in_sdist
-		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_not_in_wheel
-		# fails if python-xlib is installed
-		setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_allow_hosts
-		# TODO, probably some random package
-		setuptools/tests/config/test_setupcfg.py::TestOptions::test_cmdclass
-		# broken by unbundling
-		setuptools/tests/test_setuptools.py::test_wheel_includes_vendored_metadata
-		# fails on normalized metadata, perhaps different dep version?
-		setuptools/tests/test_build_meta.py::TestBuildMetaBackend::test_build_with_pyproject_config
-		# TODO
-		setuptools/tests/test_sdist.py::test_sanity_check_setuptools_own_sdist
-		# relies on -Werror
-		setuptools/_static.py::setuptools._static.Dict
-		setuptools/_static.py::setuptools._static.List
-	)
-
-	local EPYTEST_XDIST=1
-	local -x PRE_BUILT_SETUPTOOLS_WHEEL=${DISTUTILS_WHEEL_PATH}
-	epytest -o tmp_path_retention_policy=all \
-		-m "not uses_network" setuptools
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-78.1.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-78.1.0.ebuild
deleted file mode 100644
index f85cc1d403c..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-78.1.0.ebuild
+++ /dev/null
@@ -1,134 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
-EAPI=8
-
-# please bump dev-python/ensurepip-setuptools along with this package!
-
-DISTUTILS_USE_PEP517=standalone
-PYTHON_TESTED=( python3_{10..13} pypy3 pypy3_11 )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_13t )
-PYTHON_REQ_USE="xml(+)"
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Collection of extensions to Distutils"
-HOMEPAGE="
-	https://github.com/pypa/setuptools/
-	https://pypi.org/project/setuptools/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
-IUSE="test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	!<dev-python/setuptools-rust-1.8.0
-	dev-python/jaraco-collections[${PYTHON_USEDEP}]
-	>=dev-python/jaraco-functools-4[${PYTHON_USEDEP}]
-	>=dev-python/jaraco-text-3.7.0-r1[${PYTHON_USEDEP}]
-	>=dev-python/more-itertools-8.12.0-r1[${PYTHON_USEDEP}]
-	>=dev-python/packaging-24.2[${PYTHON_USEDEP}]
-	>=dev-python/platformdirs-4.2.2[${PYTHON_USEDEP}]
-	>=dev-python/wheel-0.44.0[${PYTHON_USEDEP}]
-	$(python_gen_cond_dep '
-		>=dev-python/tomli-2.0.1[${PYTHON_USEDEP}]
-	' 3.10)
-	!<=dev-libs/gobject-introspection-1.76.1-r0
-	!=dev-libs/gobject-introspection-1.78.1-r0
-	!=dev-libs/gobject-introspection-1.80.1-r1
-"
-BDEPEND="
-	${RDEPEND}
-	test? (
-		$(python_gen_cond_dep '
-			>=dev-python/build-1.0.3[${PYTHON_USEDEP}]
-			>=dev-python/ini2toml-0.14[${PYTHON_USEDEP}]
-			>=dev-python/filelock-3.4.0[${PYTHON_USEDEP}]
-			>=dev-python/jaraco-envs-2.2[${PYTHON_USEDEP}]
-			>=dev-python/jaraco-path-3.7.2[${PYTHON_USEDEP}]
-			>=dev-python/jaraco-test-5.5[${PYTHON_USEDEP}]
-			dev-python/pip[${PYTHON_USEDEP}]
-			dev-python/pyproject-hooks[${PYTHON_USEDEP}]
-			dev-python/pytest[${PYTHON_USEDEP}]
-			>=dev-python/pytest-home-0.5[${PYTHON_USEDEP}]
-			dev-python/pytest-subprocess[${PYTHON_USEDEP}]
-			dev-python/pytest-timeout[${PYTHON_USEDEP}]
-			dev-python/pytest-xdist[${PYTHON_USEDEP}]
-			>=dev-python/tomli-w-1.0.0[${PYTHON_USEDEP}]
-			>=dev-python/virtualenv-20[${PYTHON_USEDEP}]
-		' "${PYTHON_TESTED[@]}")
-	)
-"
-# setuptools-scm is here because installing plugins apparently breaks stuff at
-# runtime, so let's pull it early. See bug #663324.
-#
-# trove-classifiers are optionally used in validation, if they are
-# installed.  Since we really oughtn't block them, let's always enforce
-# the newest version for the time being to avoid errors.
-# https://github.com/pypa/setuptools/issues/4459
-PDEPEND="
-	dev-python/setuptools-scm[${PYTHON_USEDEP}]
-	>=dev-python/trove-classifiers-2024.10.16[${PYTHON_USEDEP}]
-"
-
-src_prepare() {
-	local PATCHES=(
-		# TODO: remove this when we're 100% PEP517 mode
-		"${FILESDIR}/setuptools-62.4.0-py-compile.patch"
-		# https://github.com/abravalheri/validate-pyproject/pull/221
-		"${FILESDIR}/setuptools-75.6.0-disable-trove-classifiers.patch"
-	)
-
-	distutils-r1_src_prepare
-
-	# breaks tests
-	sed -i -e '/--import-mode/d' pytest.ini || die
-
-	# remove bundled dependencies
-	rm -r */_vendor || die
-}
-
-python_test() {
-	if ! has "${EPYTHON}" "${PYTHON_TESTED[@]/_/.}"; then
-		return
-	fi
-
-	local EPYTEST_DESELECT=(
-		# network
-		setuptools/tests/test_build_meta.py::test_legacy_editable_install
-		setuptools/tests/test_distutils_adoption.py
-		setuptools/tests/test_editable_install.py
-		setuptools/tests/test_virtualenv.py::test_no_missing_dependencies
-		setuptools/tests/test_virtualenv.py::test_test_command_install_requirements
-		# TODO
-		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_basic
-		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_ignore_errors
-		# expects bundled deps in virtualenv
-		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_in_sdist
-		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_not_in_wheel
-		# fails if python-xlib is installed
-		setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_allow_hosts
-		# TODO, probably some random package
-		setuptools/tests/config/test_setupcfg.py::TestOptions::test_cmdclass
-		# broken by unbundling
-		setuptools/tests/test_setuptools.py::test_wheel_includes_vendored_metadata
-		# fails on normalized metadata, perhaps different dep version?
-		setuptools/tests/test_build_meta.py::TestBuildMetaBackend::test_build_with_pyproject_config
-		# TODO
-		setuptools/tests/test_sdist.py::test_sanity_check_setuptools_own_sdist
-		# relies on -Werror
-		setuptools/_static.py::setuptools._static.Dict
-		setuptools/_static.py::setuptools._static.List
-		# TODO
-		setuptools/dist.py::setuptools.dist.Distribution._find_pattern
-	)
-
-	local EPYTEST_XDIST=1
-	local -x PRE_BUILT_SETUPTOOLS_WHEEL=${DISTUTILS_WHEEL_PATH}
-	epytest -o tmp_path_retention_policy=all \
-		-m "not uses_network" setuptools
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-79.0.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-79.0.1.ebuild
index f57414ffa01..f85cc1d403c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-79.0.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-79.0.1.ebuild
@@ -21,7 +21,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
 IUSE="test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.3.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.3.1.ebuild
index 558dbf01291..38ca01dede1 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.3.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.3.1.ebuild
@@ -8,7 +8,7 @@ EAPI=8
 
 DISTUTILS_USE_PEP517=standalone
 PYTHON_TESTED=( python3_{11..13} pypy3_11 )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_13t )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_13t python3_14 python3_14t )
 PYTHON_REQ_USE="xml(+)"
 
 inherit distutils-r1 pypi
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.3.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.4.0.ebuild
similarity index 95%
rename from sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.3.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.4.0.ebuild
index 56dbefde5b3..286049ec204 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.3.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.4.0.ebuild
@@ -8,7 +8,7 @@ EAPI=8
 
 DISTUTILS_USE_PEP517=standalone
 PYTHON_TESTED=( python3_{11..13} pypy3_11 )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_13t )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_13t python3_14 python3_14t )
 PYTHON_REQ_USE="xml(+)"
 
 inherit distutils-r1 pypi
@@ -26,7 +26,6 @@ IUSE="test"
 RESTRICT="!test? ( test )"
 
 RDEPEND="
-	!<dev-python/setuptools-rust-1.8.0
 	dev-python/jaraco-collections[${PYTHON_USEDEP}]
 	>=dev-python/jaraco-functools-4[${PYTHON_USEDEP}]
 	>=dev-python/jaraco-text-3.7.0-r1[${PYTHON_USEDEP}]
@@ -34,9 +33,6 @@ RDEPEND="
 	>=dev-python/packaging-24.2[${PYTHON_USEDEP}]
 	>=dev-python/platformdirs-4.2.2[${PYTHON_USEDEP}]
 	>=dev-python/wheel-0.44.0[${PYTHON_USEDEP}]
-	!<=dev-libs/gobject-introspection-1.76.1-r0
-	!=dev-libs/gobject-introspection-1.78.1-r0
-	!=dev-libs/gobject-introspection-1.80.1-r1
 "
 BDEPEND="
 	${RDEPEND}
@@ -96,6 +92,7 @@ python_test() {
 
 	local EPYTEST_DESELECT=(
 		# network
+		setuptools/tests/integration/test_pbr.py::test_pbr_integration
 		setuptools/tests/test_build_meta.py::test_legacy_editable_install
 		setuptools/tests/test_develop.py::TestNamespaces::test_namespace_package_importable
 		setuptools/tests/test_distutils_adoption.py
@@ -121,6 +118,7 @@ python_test() {
 		# relies on -Werror
 		setuptools/_static.py::setuptools._static.Dict
 		setuptools/_static.py::setuptools._static.List
+		setuptools/tests/test_bdist_egg.py::Test::test_bdist_egg
 		# TODO
 		setuptools/dist.py::setuptools.dist.Distribution._find_pattern
 	)

From ed7d3006a768b2d844301cb3ef2630d9d95ce9f4 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:34 +0000
Subject: [PATCH 077/136] dev-python/setuptools-scm: Sync with Gentoo

It's from Gentoo commit d437389267eb5c963e7a03c2bb63884041bd392e.
---
 .../dev-python/setuptools-scm/setuptools-scm-8.3.1.ebuild       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.3.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.3.1.ebuild
index b3466e7f8a3..21d8e7a25a6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.3.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.3.1.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=standalone
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_1{3t,4t} pypy3_11 )
 
 inherit distutils-r1 pypi
 

From 57b282cc6fe30a835d4ab317e2f94344c3f9bfd2 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:34 +0000
Subject: [PATCH 078/136] dev-python/six: Sync with Gentoo

It's from Gentoo commit 321fab5b60ab9ac7092f2be0a45ce8bee0d88616.
---
 .../third_party/portage-stable/dev-python/six/six-1.17.0.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/six/six-1.17.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/six/six-1.17.0.ebuild
index 767557b2983..2de0f401558 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/six/six-1.17.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/six/six-1.17.0.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_1{3t,4t} pypy3_11 )
 
 inherit distutils-r1 pypi
 

From 418589d15e0f8f3b17838fb4dc9abf2808ef44dc Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:35 +0000
Subject: [PATCH 079/136] dev-python/tomli: Sync with Gentoo

It's from Gentoo commit 13b18f9bc9db9a377aac80b871e5d347503ea48a.
---
 .../portage-stable/dev-python/tomli/tomli-2.2.1.ebuild          | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/tomli/tomli-2.2.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/tomli/tomli-2.2.1.ebuild
index e44ac2de4a9..8efe24fbb7e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/tomli/tomli-2.2.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/tomli/tomli-2.2.1.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=no
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1 pypi
 

From c4033e082870c21a4645579dd4565f4d41460f02 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:36 +0000
Subject: [PATCH 080/136] dev-python/trove-classifiers: Sync with Gentoo

It's from Gentoo commit ac6d2162a2fa0037e4d3f9aa9bd4c2df82b6fac6.
---
 .../dev-python/trove-classifiers/Manifest     |  4 +-
 .../trove-classifiers-2025.4.28.22.ebuild     | 45 -------------------
 .../trove-classifiers-2025.5.1.12.ebuild      | 45 -------------------
 ...d => trove-classifiers-2025.5.9.12.ebuild} |  5 ++-
 4 files changed, 5 insertions(+), 94 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.4.28.22.ebuild
 delete mode 100644 sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.5.1.12.ebuild
 rename sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/{trove-classifiers-2025.4.11.15.ebuild => trove-classifiers-2025.5.9.12.ebuild} (88%)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest
index a0ef531182f..0808d7839f2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest
@@ -1,3 +1 @@
-DIST trove_classifiers-2025.4.11.15.tar.gz 16321 BLAKE2B b011b524d267506aef4d91ac6d365e08e419fb57b424259b080de8cb7205cd8c4c6df52e29532b9dc19ca36f41b0793ac25a8824e9d2328735357efa369b2157 SHA512 5eb5d892a751105319c003e4a370d2f69b614a1f2bea8904865b7da9f4d2648ffe57fba1cebc1ec21dab74d02b3223eb72af478ddd69635e45b0424621cefa9a
-DIST trove_classifiers-2025.4.28.22.tar.gz 16883 BLAKE2B 9598b19874f7deaeb15333a7f97cb91a7d82fe34d26d6d4e526bf857ed777539cad89949628196f2bbff187511fc5bca2327aeaacec4052611c5f2d82c4bb8a8 SHA512 4863ff031d9c83177099b5c1e04e2a22396055209b88e60dd44e22a8357889f27572444e0a1fbef65b7b37919cb9d7f8cb548b7007fd878d8fe92c9cd39b864e
-DIST trove_classifiers-2025.5.1.12.tar.gz 16876 BLAKE2B 27ae91479d2a811978b3f1447568f5849341a7fda5c825ebf0dd0502d85f206d63f4687463708031637da4313d0182abc05b6b710a6f32fd714167ac766a587d SHA512 af3c0ee51e7ce3e7ec0eb1fd901ac3d0c02f6c0ba1c77d3ba66e0770bf5300144f636dcbf608f046a21789cfc780f651be222b7d23f359a672fde0210af966b5
+DIST trove_classifiers-2025.5.9.12.tar.gz 16940 BLAKE2B f6143f341d280eca611269c1a04b7f795d8f8733e97518d81d5872b8e1e13f745f7428737993a5c50285de24f56f899737d05fe073c683ddd69765b6081a6ebe SHA512 ee858f52c08b867fe4845ebb19f9b431308d216b5313e2bc030d63340860205d40125ef6cee218f734ccd49e5ae36011c8e3415f03d0ace182cb518ed5f2318d
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.4.28.22.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.4.28.22.ebuild
deleted file mode 100644
index 5f05a4286c3..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.4.28.22.ebuild
+++ /dev/null
@@ -1,45 +0,0 @@
-# Copyright 2022-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} python3_13t )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Canonical source for classifiers on PyPI (pypi.org)"
-HOMEPAGE="
-	https://github.com/pypa/trove-classifiers/
-	https://pypi.org/project/trove-classifiers/
-"
-
-LICENSE="Apache-2.0"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-distutils_enable_tests pytest
-
-src_configure() {
-	grep -q 'build-backend = "setuptools' pyproject.toml ||
-		die "Upstream changed build-backend, recheck"
-	# write a custom pyproject.toml to ease hatchling bootstrap
-	cat > pyproject.toml <<-EOF || die
-		[build-system]
-		requires = ["flit_core >=3.2,<4"]
-		build-backend = "flit_core.buildapi"
-
-		[project]
-		name = "trove-classifiers"
-		version = "${PV}"
-		description = "Canonical source for classifiers on PyPI (pypi.org)."
-
-		[project.scripts]
-		trove-classifiers = "trove_classifiers.__main__:cli"
-	EOF
-}
-
-python_test() {
-	epytest
-	"${EPYTHON}" -m tests.lib || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.5.1.12.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.5.1.12.ebuild
deleted file mode 100644
index 2e0e947a067..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.5.1.12.ebuild
+++ /dev/null
@@ -1,45 +0,0 @@
-# Copyright 2022-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( pypy3_11 python3_{11..13} python3_13t )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Canonical source for classifiers on PyPI (pypi.org)"
-HOMEPAGE="
-	https://github.com/pypa/trove-classifiers/
-	https://pypi.org/project/trove-classifiers/
-"
-
-LICENSE="Apache-2.0"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-distutils_enable_tests pytest
-
-src_configure() {
-	grep -q 'build-backend = "setuptools' pyproject.toml ||
-		die "Upstream changed build-backend, recheck"
-	# write a custom pyproject.toml to ease hatchling bootstrap
-	cat > pyproject.toml <<-EOF || die
-		[build-system]
-		requires = ["flit_core >=3.2,<4"]
-		build-backend = "flit_core.buildapi"
-
-		[project]
-		name = "trove-classifiers"
-		version = "${PV}"
-		description = "Canonical source for classifiers on PyPI (pypi.org)."
-
-		[project.scripts]
-		trove-classifiers = "trove_classifiers.__main__:cli"
-	EOF
-}
-
-python_test() {
-	epytest
-	"${EPYTHON}" -m tests.lib || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.4.11.15.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.5.9.12.ebuild
similarity index 88%
rename from sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.4.11.15.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.5.9.12.ebuild
index b09ba5eba8f..d013f3c1837 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.4.11.15.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.5.9.12.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} python3_13t )
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} python3_1{3t,4t} )
 
 inherit distutils-r1 pypi
 
@@ -33,6 +33,9 @@ src_configure() {
 		name = "trove-classifiers"
 		version = "${PV}"
 		description = "Canonical source for classifiers on PyPI (pypi.org)."
+
+		[project.scripts]
+		trove-classifiers = "trove_classifiers.__main__:cli"
 	EOF
 }
 

From 3f7543cea5d0e5fbe1b5177764541b6ac7750e24 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:37 +0000
Subject: [PATCH 081/136] dev-python/typing-extensions: Sync with Gentoo

It's from Gentoo commit df8891052482caad9a9b541c289cb9a3d5eed91b.
---
 .../typing-extensions-4.13.2-py314.patch      | 422 ++++++++++++++++++
 .../typing-extensions-4.13.2-r2.ebuild        |  41 ++
 2 files changed, 463 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/files/typing-extensions-4.13.2-py314.patch
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.2-r2.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/files/typing-extensions-4.13.2-py314.patch b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/files/typing-extensions-4.13.2-py314.patch
new file mode 100644
index 00000000000..d1086c2c359
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/files/typing-extensions-4.13.2-py314.patch
@@ -0,0 +1,422 @@
+From 2354c1a8d21cf8f6d6f6a9d54bb3a69b5908e035 Mon Sep 17 00:00:00 2001
+From: Jelle Zijlstra <jelle.zijlstra@gmail.com>
+Date: Fri, 2 May 2025 19:45:27 -0700
+Subject: [PATCH 1/2] Fix test failures on Python 3.14 (#566)
+
+---
+ src/test_typing_extensions.py | 40 ++++++++++++++++++++++++-----------
+ src/typing_extensions.py      |  9 ++++++--
+ 2 files changed, 35 insertions(+), 14 deletions(-)
+
+diff --git a/src/test_typing_extensions.py b/src/test_typing_extensions.py
+index 584b0fa..7b08f72 100644
+--- a/src/test_typing_extensions.py
++++ b/src/test_typing_extensions.py
+@@ -901,10 +901,12 @@ class Cls:
+ 
+ class DeprecatedCoroTests(BaseTestCase):
+     def test_asyncio_iscoroutinefunction(self):
+-        self.assertFalse(asyncio.coroutines.iscoroutinefunction(func))
+-        self.assertFalse(asyncio.coroutines.iscoroutinefunction(Cls.func))
+-        self.assertTrue(asyncio.coroutines.iscoroutinefunction(coro))
+-        self.assertTrue(asyncio.coroutines.iscoroutinefunction(Cls.coro))
++        with warnings.catch_warnings():
++            warnings.simplefilter("ignore", DeprecationWarning)
++            self.assertFalse(asyncio.coroutines.iscoroutinefunction(func))
++            self.assertFalse(asyncio.coroutines.iscoroutinefunction(Cls.func))
++            self.assertTrue(asyncio.coroutines.iscoroutinefunction(coro))
++            self.assertTrue(asyncio.coroutines.iscoroutinefunction(Cls.coro))
+ 
+     @skipUnless(TYPING_3_12_ONLY or TYPING_3_13_0_RC, "inspect.iscoroutinefunction works differently on Python < 3.12")
+     def test_inspect_iscoroutinefunction(self):
+@@ -7228,7 +7230,7 @@ class TypeVarTests(BaseTestCase):
+ 
+     def test_bound_errors(self):
+         with self.assertRaises(TypeError):
+-            TypeVar('X', bound=Union)
++            TypeVar('X', bound=Optional)
+         with self.assertRaises(TypeError):
+             TypeVar('X', str, float, bound=Employee)
+         with self.assertRaisesRegex(TypeError,
+@@ -8213,19 +8215,26 @@ class TestGetAnnotations(BaseTestCase):
+             get_annotations(f2, format=Format.FORWARDREF),
+             {"a": "undefined"},
+         )
+-        self.assertEqual(get_annotations(f2, format=2), {"a": "undefined"})
++        # Test that the raw int also works
++        self.assertEqual(
++            get_annotations(f2, format=Format.FORWARDREF.value),
++            {"a": "undefined"},
++        )
+ 
+         self.assertEqual(
+             get_annotations(f1, format=Format.STRING),
+             {"a": "int"},
+         )
+-        self.assertEqual(get_annotations(f1, format=3), {"a": "int"})
++        self.assertEqual(
++            get_annotations(f1, format=Format.STRING.value),
++            {"a": "int"},
++        )
+ 
+         with self.assertRaises(ValueError):
+             get_annotations(f1, format=0)
+ 
+         with self.assertRaises(ValueError):
+-            get_annotations(f1, format=4)
++            get_annotations(f1, format=42)
+ 
+     def test_custom_object_with_annotations(self):
+         class C:
+@@ -8264,10 +8273,17 @@ class TestGetAnnotations(BaseTestCase):
+         foo.__annotations__ = {"a": "foo", "b": "str"}
+         for format in Format:
+             with self.subTest(format=format):
+-                self.assertEqual(
+-                    get_annotations(foo, format=format),
+-                    {"a": "foo", "b": "str"},
+-                )
++                if format is Format.VALUE_WITH_FAKE_GLOBALS:
++                    with self.assertRaisesRegex(
++                        ValueError,
++                        "The VALUE_WITH_FAKE_GLOBALS format is for internal use only"
++                    ):
++                        get_annotations(foo, format=format)
++                else:
++                    self.assertEqual(
++                        get_annotations(foo, format=format),
++                        {"a": "foo", "b": "str"},
++                    )
+ 
+         self.assertEqual(
+             get_annotations(foo, eval_str=True, locals=locals()),
+diff --git a/src/typing_extensions.py b/src/typing_extensions.py
+index fa89c83..d089d5e 100644
+--- a/src/typing_extensions.py
++++ b/src/typing_extensions.py
+@@ -4153,8 +4153,9 @@ _PEP_649_OR_749_IMPLEMENTED = (
+ 
+ class Format(enum.IntEnum):
+     VALUE = 1
+-    FORWARDREF = 2
+-    STRING = 3
++    VALUE_WITH_FAKE_GLOBALS = 2
++    FORWARDREF = 3
++    STRING = 4
+ 
+ 
+ if _PEP_649_OR_749_IMPLEMENTED:
+@@ -4198,6 +4199,10 @@ else:
+ 
+         """
+         format = Format(format)
++        if format is Format.VALUE_WITH_FAKE_GLOBALS:
++            raise ValueError(
++                "The VALUE_WITH_FAKE_GLOBALS format is for internal use only"
++            )
+ 
+         if eval_str and format is not Format.VALUE:
+             raise ValueError("eval_str=True is only supported with format=Format.VALUE")
+From 62740a52eca38414efc9ce01b361ab45eae7c38e Mon Sep 17 00:00:00 2001
+From: Jelle Zijlstra <jelle.zijlstra@gmail.com>
+Date: Mon, 5 May 2025 09:50:14 -0700
+Subject: [PATCH 2/2] Fix tests on Python 3.14 (#592)
+
+---
+ src/test_typing_extensions.py | 117 ++++++++++++++++++++++++++++++----
+ src/typing_extensions.py      |  67 +++++++++++++++----
+ 2 files changed, 161 insertions(+), 23 deletions(-)
+
+diff --git a/src/test_typing_extensions.py b/src/test_typing_extensions.py
+index 7b08f72..9742b98 100644
+--- a/src/test_typing_extensions.py
++++ b/src/test_typing_extensions.py
+@@ -440,6 +440,48 @@ class BaseTestCase(TestCase):
+             raise self.failureException(message)
+ 
+ 
++class EqualToForwardRef:
++    """Helper to ease use of annotationlib.ForwardRef in tests.
++
++    This checks only attributes that can be set using the constructor.
++
++    """
++
++    def __init__(
++        self,
++        arg,
++        *,
++        module=None,
++        owner=None,
++        is_class=False,
++    ):
++        self.__forward_arg__ = arg
++        self.__forward_is_class__ = is_class
++        self.__forward_module__ = module
++        self.__owner__ = owner
++
++    def __eq__(self, other):
++        if not isinstance(other, (EqualToForwardRef, typing.ForwardRef)):
++            return NotImplemented
++        if sys.version_info >= (3, 14) and self.__owner__ != other.__owner__:
++            return False
++        return (
++            self.__forward_arg__ == other.__forward_arg__
++            and self.__forward_module__ == other.__forward_module__
++            and self.__forward_is_class__ == other.__forward_is_class__
++        )
++
++    def __repr__(self):
++        extra = []
++        if self.__forward_module__ is not None:
++            extra.append(f", module={self.__forward_module__!r}")
++        if self.__forward_is_class__:
++            extra.append(", is_class=True")
++        if sys.version_info >= (3, 14) and self.__owner__ is not None:
++            extra.append(f", owner={self.__owner__!r}")
++        return f"EqualToForwardRef({self.__forward_arg__!r}{''.join(extra)})"
++
++
+ class Employee:
+     pass
+ 
+@@ -5075,6 +5117,64 @@ class TypedDictTests(BaseTestCase):
+                 x: str
+ 
+ 
++    def test_annotations(self):
++        # _type_check is applied
++        with self.assertRaisesRegex(TypeError, "Plain typing.Optional is not valid as type argument"):
++            class X(TypedDict):
++                a: Optional
++
++        # _type_convert is applied
++        class Y(TypedDict):
++            a: None
++            b: "int"
++        if sys.version_info >= (3, 14):
++            import annotationlib
++
++            fwdref = EqualToForwardRef('int', module=__name__)
++            self.assertEqual(Y.__annotations__, {'a': type(None), 'b': fwdref})
++            self.assertEqual(Y.__annotate__(annotationlib.Format.FORWARDREF), {'a': type(None), 'b': fwdref})
++        else:
++            self.assertEqual(Y.__annotations__, {'a': type(None), 'b': typing.ForwardRef('int', module=__name__)})
++
++    @skipUnless(TYPING_3_14_0, "Only supported on 3.14")
++    def test_delayed_type_check(self):
++        # _type_check is also applied later
++        class Z(TypedDict):
++            a: undefined  # noqa: F821
++
++        with self.assertRaises(NameError):
++            Z.__annotations__
++
++        undefined = Final
++        with self.assertRaisesRegex(TypeError, "Plain typing.Final is not valid as type argument"):
++            Z.__annotations__
++
++        undefined = None  # noqa: F841
++        self.assertEqual(Z.__annotations__, {'a': type(None)})
++
++    @skipUnless(TYPING_3_14_0, "Only supported on 3.14")
++    def test_deferred_evaluation(self):
++        class A(TypedDict):
++            x: NotRequired[undefined]  # noqa: F821
++            y: ReadOnly[undefined]  # noqa: F821
++            z: Required[undefined]  # noqa: F821
++
++        self.assertEqual(A.__required_keys__, frozenset({'y', 'z'}))
++        self.assertEqual(A.__optional_keys__, frozenset({'x'}))
++        self.assertEqual(A.__readonly_keys__, frozenset({'y'}))
++        self.assertEqual(A.__mutable_keys__, frozenset({'x', 'z'}))
++
++        with self.assertRaises(NameError):
++            A.__annotations__
++
++        import annotationlib
++        self.assertEqual(
++            A.__annotate__(annotationlib.Format.STRING),
++            {'x': 'NotRequired[undefined]', 'y': 'ReadOnly[undefined]',
++             'z': 'Required[undefined]'},
++        )
++
++
+ class AnnotatedTests(BaseTestCase):
+ 
+     def test_repr(self):
+@@ -5887,7 +5987,7 @@ class ConcatenateTests(BaseTestCase):
+         U2 = Unpack[Ts]
+         self.assertEqual(C2[U1], (str, int, str))
+         self.assertEqual(C2[U2], (str, Unpack[Ts]))
+-        self.assertEqual(C2["U2"], (str, typing.ForwardRef("U2")))
++        self.assertEqual(C2["U2"], (str, EqualToForwardRef("U2")))
+ 
+         if (3, 12, 0) <= sys.version_info < (3, 12, 4):
+             with self.assertRaises(AssertionError):
+@@ -7196,8 +7296,8 @@ class TypeVarTests(BaseTestCase):
+             self.assertEqual(X | "x", Union[X, "x"])
+             self.assertEqual("x" | X, Union["x", X])
+             # make sure the order is correct
+-            self.assertEqual(get_args(X | "x"), (X, typing.ForwardRef("x")))
+-            self.assertEqual(get_args("x" | X), (typing.ForwardRef("x"), X))
++            self.assertEqual(get_args(X | "x"), (X, EqualToForwardRef("x")))
++            self.assertEqual(get_args("x" | X), (EqualToForwardRef("x"), X))
+ 
+     def test_union_constrained(self):
+         A = TypeVar('A', str, bytes)
+@@ -8770,7 +8870,7 @@ class TestEvaluateForwardRefs(BaseTestCase):
+             type_params=None,
+             format=Format.FORWARDREF,
+         )
+-        self.assertEqual(evaluated_ref, typing.ForwardRef("doesnotexist2"))
++        self.assertEqual(evaluated_ref, EqualToForwardRef("doesnotexist2"))
+ 
+     def test_evaluate_with_type_params(self):
+         # Use a T name that is not in globals
+@@ -8857,13 +8957,6 @@ class TestEvaluateForwardRefs(BaseTestCase):
+         obj = object()
+         self.assertIs(evaluate_forward_ref(typing.ForwardRef("int"), globals={"int": obj}), obj)
+ 
+-    def test_fwdref_value_is_cached(self):
+-        fr = typing.ForwardRef("hello")
+-        with self.assertRaises(NameError):
+-            evaluate_forward_ref(fr)
+-        self.assertIs(evaluate_forward_ref(fr, globals={"hello": str}), str)
+-        self.assertIs(evaluate_forward_ref(fr), str)
+-
+     @skipUnless(TYPING_3_9_0, "Needs PEP 585 support")
+     def test_fwdref_with_owner(self):
+         self.assertEqual(
+@@ -8908,7 +9001,7 @@ class TestEvaluateForwardRefs(BaseTestCase):
+         self.assertEqual(get_args(evaluated_ref1b), (Y[Tx],))
+ 
+         with self.subTest("nested string of TypeVar"):
+-            evaluated_ref2 = evaluate_forward_ref(typing.ForwardRef("""Y["Y['Tx']"]"""), locals={"Y": Y})
++            evaluated_ref2 = evaluate_forward_ref(typing.ForwardRef("""Y["Y['Tx']"]"""), locals={"Y": Y, "Tx": Tx})
+             self.assertEqual(get_origin(evaluated_ref2), Y)
+             if not TYPING_3_9_0:
+                 self.skipTest("Nested string 'Tx' stays ForwardRef in 3.8")
+diff --git a/src/typing_extensions.py b/src/typing_extensions.py
+index d089d5e..baa6c4f 100644
+--- a/src/typing_extensions.py
++++ b/src/typing_extensions.py
+@@ -13,6 +13,9 @@ import types as _types
+ import typing
+ import warnings
+ 
++if sys.version_info >= (3, 14):
++    import annotationlib
++
+ __all__ = [
+     # Super-special typing primitives.
+     'Any',
+@@ -1014,21 +1017,31 @@ else:
+                 tp_dict.__orig_bases__ = bases
+ 
+             annotations = {}
++            own_annotate = None
+             if "__annotations__" in ns:
+                 own_annotations = ns["__annotations__"]
+-            elif "__annotate__" in ns:
+-                # TODO: Use inspect.VALUE here, and make the annotations lazily evaluated
+-                own_annotations = ns["__annotate__"](1)
++            elif sys.version_info >= (3, 14):
++                if hasattr(annotationlib, "get_annotate_from_class_namespace"):
++                    own_annotate = annotationlib.get_annotate_from_class_namespace(ns)
++                else:
++                    # 3.14.0a7 and earlier
++                    own_annotate = ns.get("__annotate__")
++                if own_annotate is not None:
++                    own_annotations = annotationlib.call_annotate_function(
++                        own_annotate, Format.FORWARDREF, owner=tp_dict
++                    )
++                else:
++                    own_annotations = {}
+             else:
+                 own_annotations = {}
+             msg = "TypedDict('Name', {f0: t0, f1: t1, ...}); each t must be a type"
+             if _TAKES_MODULE:
+-                own_annotations = {
++                own_checked_annotations = {
+                     n: typing._type_check(tp, msg, module=tp_dict.__module__)
+                     for n, tp in own_annotations.items()
+                 }
+             else:
+-                own_annotations = {
++                own_checked_annotations = {
+                     n: typing._type_check(tp, msg)
+                     for n, tp in own_annotations.items()
+                 }
+@@ -1041,7 +1054,8 @@ else:
+             for base in bases:
+                 base_dict = base.__dict__
+ 
+-                annotations.update(base_dict.get('__annotations__', {}))
++                if sys.version_info <= (3, 14):
++                    annotations.update(base_dict.get('__annotations__', {}))
+                 required_keys.update(base_dict.get('__required_keys__', ()))
+                 optional_keys.update(base_dict.get('__optional_keys__', ()))
+                 readonly_keys.update(base_dict.get('__readonly_keys__', ()))
+@@ -1051,8 +1065,8 @@ else:
+             # is retained for backwards compatibility, but only for Python
+             # 3.13 and lower.
+             if (closed and sys.version_info < (3, 14)
+-                       and "__extra_items__" in own_annotations):
+-                annotation_type = own_annotations.pop("__extra_items__")
++                       and "__extra_items__" in own_checked_annotations):
++                annotation_type = own_checked_annotations.pop("__extra_items__")
+                 qualifiers = set(_get_typeddict_qualifiers(annotation_type))
+                 if Required in qualifiers:
+                     raise TypeError(
+@@ -1066,8 +1080,8 @@ else:
+                     )
+                 extra_items_type = annotation_type
+ 
+-            annotations.update(own_annotations)
+-            for annotation_key, annotation_type in own_annotations.items():
++            annotations.update(own_checked_annotations)
++            for annotation_key, annotation_type in own_checked_annotations.items():
+                 qualifiers = set(_get_typeddict_qualifiers(annotation_type))
+ 
+                 if Required in qualifiers:
+@@ -1085,7 +1099,38 @@ else:
+                     mutable_keys.add(annotation_key)
+                     readonly_keys.discard(annotation_key)
+ 
+-            tp_dict.__annotations__ = annotations
++            if sys.version_info >= (3, 14):
++                def __annotate__(format):
++                    annos = {}
++                    for base in bases:
++                        if base is Generic:
++                            continue
++                        base_annotate = base.__annotate__
++                        if base_annotate is None:
++                            continue
++                        base_annos = annotationlib.call_annotate_function(
++                            base.__annotate__, format, owner=base)
++                        annos.update(base_annos)
++                    if own_annotate is not None:
++                        own = annotationlib.call_annotate_function(
++                            own_annotate, format, owner=tp_dict)
++                        if format != Format.STRING:
++                            own = {
++                                n: typing._type_check(tp, msg, module=tp_dict.__module__)
++                                for n, tp in own.items()
++                            }
++                    elif format == Format.STRING:
++                        own = annotationlib.annotations_to_string(own_annotations)
++                    elif format in (Format.FORWARDREF, Format.VALUE):
++                        own = own_checked_annotations
++                    else:
++                        raise NotImplementedError(format)
++                    annos.update(own)
++                    return annos
++
++                tp_dict.__annotate__ = __annotate__
++            else:
++                tp_dict.__annotations__ = annotations
+             tp_dict.__required_keys__ = frozenset(required_keys)
+             tp_dict.__optional_keys__ = frozenset(optional_keys)
+             tp_dict.__readonly_keys__ = frozenset(readonly_keys)
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.2-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.2-r2.ebuild
new file mode 100644
index 00000000000..a9e359e3e58
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.2-r2.ebuild
@@ -0,0 +1,41 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( python3_{11..14} python3_1{3t,4t} pypy3_11 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Backported and Experimental Type Hints for Python 3.7+"
+HOMEPAGE="
+	https://pypi.org/project/typing-extensions/
+	https://github.com/python/typing_extensions/
+"
+
+LICENSE="PSF-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	>=dev-python/flit-core-3.11[${PYTHON_USEDEP}]
+	test? (
+		dev-python/test[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests unittest
+
+PATCHES=(
+	# https://github.com/python/typing_extensions/pull/566
+	# https://github.com/python/typing_extensions/pull/592
+	"${FILESDIR}/${P}-py314.patch"
+)
+
+python_test() {
+	cd src || die
+	eunittest
+}

From 4fa2295a631589ed6e50986e45b2c6299cf59d45 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:37 +0000
Subject: [PATCH 082/136] dev-python/uc-micro-py: Sync with Gentoo

It's from Gentoo commit 24afd6a91c8f289818a7b4f2941d098af4e1be5d.
---
 .../dev-python/uc-micro-py/uc-micro-py-1.0.3.ebuild             | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/uc-micro-py/uc-micro-py-1.0.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/uc-micro-py/uc-micro-py-1.0.3.ebuild
index e4cea1adb89..484a801a568 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/uc-micro-py/uc-micro-py-1.0.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/uc-micro-py/uc-micro-py-1.0.3.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
 PYPI_NO_NORMALIZE=1
-PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} )
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} )
 
 inherit distutils-r1 pypi
 

From b690aa9c311defd274d8ed6598a560acd82404c7 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:37 +0000
Subject: [PATCH 083/136] dev-python/urllib3: Sync with Gentoo

It's from Gentoo commit cd1fc509c2645e795d9cf4e09d882c4b3010f396.
---
 .../portage-stable/dev-python/urllib3/urllib3-2.4.0.ebuild    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/urllib3/urllib3-2.4.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/urllib3/urllib3-2.4.0.ebuild
index 64e4b470b6b..47193d4a246 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/urllib3/urllib3-2.4.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/urllib3/urllib3-2.4.0.ebuild
@@ -5,8 +5,8 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=hatchling
-PYTHON_TESTED=( python3_{10..13} pypy3 pypy3_11 )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" )
+PYTHON_TESTED=( python3_{11..13} pypy3_11 )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_14 )
 PYTHON_REQ_USE="ssl(+)"
 
 inherit distutils-r1 pypi

From cd08f10092a8296f85dde5b2af3186bd2076b9c4 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:37 +0000
Subject: [PATCH 084/136] dev-python/wheel: Sync with Gentoo

It's from Gentoo commit d3720439a6b838127245273f2ee9130d08f110f6.
---
 .../wheel/files/wheel-0.45.1-test.patch       | 125 ++++++++++++++++++
 .../dev-python/wheel/wheel-0.45.1.ebuild      |  23 +++-
 2 files changed, 142 insertions(+), 6 deletions(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/wheel/files/wheel-0.45.1-test.patch

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/wheel/files/wheel-0.45.1-test.patch b/sdk_container/src/third_party/portage-stable/dev-python/wheel/files/wheel-0.45.1-test.patch
new file mode 100644
index 00000000000..49dba4e2e57
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/wheel/files/wheel-0.45.1-test.patch
@@ -0,0 +1,125 @@
+From 36877e99122e8df90d4aa41d414999857d6d852d Mon Sep 17 00:00:00 2001
+From: shenxianpeng <xianpeng.shen@gmail.com>
+Date: Sun, 16 Mar 2025 01:35:32 +0800
+Subject: [PATCH] Fixed test failures (#651)
+
+---
+ tests/test_bdist_wheel.py            |  4 ++--
+ tests/test_tagopt.py                 | 18 +++++++++---------
+ tests/testdata/unicode.dist/setup.py |  2 +-
+ 3 files changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/tests/test_bdist_wheel.py b/tests/test_bdist_wheel.py
+index fcb2dfc..21eddd0 100644
+--- a/tests/test_bdist_wheel.py
++++ b/tests/test_bdist_wheel.py
+@@ -79,9 +79,9 @@ def test_no_scripts(wheel_paths):
+ 
+ 
+ def test_unicode_record(wheel_paths):
+-    path = next(path for path in wheel_paths if "unicode.dist" in path)
++    path = next(path for path in wheel_paths if "unicode_dist" in path)
+     with ZipFile(path) as zf:
+-        record = zf.read("unicode.dist-0.1.dist-info/RECORD")
++        record = zf.read("unicode_dist-0.1.dist-info/RECORD")
+ 
+     assert "åäö_日本語.py".encode() in record
+ 
+diff --git a/tests/test_tagopt.py b/tests/test_tagopt.py
+index 5335af4..5733e1a 100644
+--- a/tests/test_tagopt.py
++++ b/tests/test_tagopt.py
+@@ -14,7 +14,7 @@ SETUP_PY = """\
+ from setuptools import setup, Extension
+ 
+ setup(
+-    name="Test",
++    name="test",
+     version="1.0",
+     author_email="author@example.com",
+     py_modules=["test"],
+@@ -63,7 +63,7 @@ def test_default_tag(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name == f"Test-1.0-py{sys.version_info[0]}-none-any.whl"
++    assert wheels[0].name == f"test-1.0-py{sys.version_info[0]}-none-any.whl"
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+@@ -76,7 +76,7 @@ def test_build_number(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name == f"Test-1.0-1-py{sys.version_info[0]}-none-any.whl"
++    assert wheels[0].name == f"test-1.0-1-py{sys.version_info[0]}-none-any.whl"
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+@@ -89,7 +89,7 @@ def test_explicit_tag(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name.startswith("Test-1.0-py32-")
++    assert wheels[0].name.startswith("test-1.0-py32-")
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+@@ -101,7 +101,7 @@ def test_universal_tag(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name.startswith("Test-1.0-py2.py3-")
++    assert wheels[0].name.startswith("test-1.0-py2.py3-")
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+@@ -114,7 +114,7 @@ def test_universal_beats_explicit_tag(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name.startswith("Test-1.0-py2.py3-")
++    assert wheels[0].name.startswith("test-1.0-py2.py3-")
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+@@ -129,7 +129,7 @@ def test_universal_in_setup_cfg(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name.startswith("Test-1.0-py2.py3-")
++    assert wheels[0].name.startswith("test-1.0-py2.py3-")
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+@@ -144,7 +144,7 @@ def test_pythontag_in_setup_cfg(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name.startswith("Test-1.0-py32-")
++    assert wheels[0].name.startswith("test-1.0-py32-")
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+@@ -157,7 +157,7 @@ def test_legacy_wheel_section_in_setup_cfg(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name.startswith("Test-1.0-py2.py3-")
++    assert wheels[0].name.startswith("test-1.0-py2.py3-")
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+diff --git a/tests/testdata/unicode.dist/setup.py b/tests/testdata/unicode.dist/setup.py
+index ec66d1e..46ef0a1 100644
+--- a/tests/testdata/unicode.dist/setup.py
++++ b/tests/testdata/unicode.dist/setup.py
+@@ -3,7 +3,7 @@ from __future__ import annotations
+ from setuptools import setup
+ 
+ setup(
+-    name="unicode.dist",
++    name="unicode_dist",
+     version="0.1",
+     description="A testing distribution \N{SNOWMAN}",
+     packages=["unicodedist"],
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/wheel/wheel-0.45.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/wheel/wheel-0.45.1.ebuild
index ebf512c733d..3e1c51275f2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/wheel/wheel-0.45.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/wheel/wheel-0.45.1.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_1{3t,4t} pypy3_11 )
 
 inherit distutils-r1 pypi
 
@@ -28,14 +28,14 @@ BDEPEND="
 	)
 "
 
-EPYTEST_DESELECT=(
-	# fails if any setuptools plugin imported the module first
-	tests/test_bdist_wheel.py::test_deprecated_import
-)
-
 distutils_enable_tests pytest
 
 src_prepare() {
+	local PATCHES=(
+		# https://github.com/pypa/wheel/pull/651
+		"${FILESDIR}/${P}-test.patch"
+	)
+
 	distutils-r1_src_prepare
 
 	# unbundle packaging
@@ -46,6 +46,17 @@ src_prepare() {
 }
 
 python_test() {
+	local EPYTEST_DESELECT=(
+		# fails if any setuptools plugin imported the module first
+		tests/test_bdist_wheel.py::test_deprecated_import
+
+		# broken by setuptools license changes
+		# upstream removed the tests already
+		tests/test_bdist_wheel.py::test_licenses_default
+		tests/test_bdist_wheel.py::test_licenses_deprecated
+		tests/test_bdist_wheel.py::test_licenses_override
+	)
+
 	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
 	epytest
 }

From 0ee25a2c0d8c2b18ce5338745ff8b649a4a84272 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:41 +0000
Subject: [PATCH 085/136] dev-util/gperf: Sync with Gentoo

It's from Gentoo commit 6ffeac27db6aaf2a9557276a2b264e59ebf7e977.
---
 .../third_party/portage-stable/dev-util/gperf/gperf-3.3.ebuild  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-util/gperf/gperf-3.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/gperf/gperf-3.3.ebuild
index ea3a44b9af9..9b0bed1ea89 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/gperf/gperf-3.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/gperf/gperf-3.3.ebuild
@@ -9,7 +9,7 @@ SRC_URI="mirror://gnu/gperf/${P}.tar.gz"
 
 LICENSE="GPL-3+"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 src_prepare() {
 	default

From 58fdfd383fa388859313c423485cd3dee79a4520 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:41 +0000
Subject: [PATCH 086/136] dev-util/maturin: Sync with Gentoo

It's from Gentoo commit c8afa073a6718ec98917ba8b230ee12b6588d3fa.
---
 .../portage-stable/dev-util/maturin/Manifest  |   2 +
 .../dev-util/maturin/maturin-1.8.5.ebuild     | 156 ++++++++++++++++++
 2 files changed, 158 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.8.5.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-util/maturin/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/maturin/Manifest
index c1af23451b1..dc07efd6441 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/maturin/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/maturin/Manifest
@@ -1,2 +1,4 @@
 DIST maturin-1.8.3-vendor.tar.xz 15014308 BLAKE2B 5dec263a5297108e5ac36ca6a05f7013f0bcc1704e8b5038418ac7c17d979dc449e1a06ec3a5b6439498b3473e68765fd2ae69ed671b9d4d9aef8e20f325a1a9 SHA512 106e7d0a013f715e1eb8008d31518317bb7e66c3d429c2972ddcfb457afc89de4359d4d85f19fce50861eff219063e666106e284916290e6cca08e7dd6c54889
 DIST maturin-1.8.3.gh.tar.gz 544455 BLAKE2B 0e0115331a8e23d03b8c96348b505d9573988c1f6fdbf9c179d6c94a0d3aa3d448727babb9d7f6e85ae2bc3f2a8201c7b32dbba894228f0035055662449b1556 SHA512 b4f79df7b099777d6068d2705fd6ca6a79c0a96c77530dcca26fef5d09b39a57feabab9d3871fc5b4760df234955329222dc29a86df5404d880140f1a3736431
+DIST maturin-1.8.5-vendor.tar.xz 15029800 BLAKE2B f81a5700cbc492b333e162b4cd60b53a58500a12686362ea4275b701568ed3aecf64d90167d02f5296c297bb71cb3511dc04f327e95bfafcf5023d8b49f67074 SHA512 ddd891c1e0311939fcd0601e9ec5cc16ea41ba55eef5944f2f3fd29dad8ab8f3c3cdb48a76e672761c11afa1d1979690400a3978440ce669aa62fe8a3a42b7c2
+DIST maturin-1.8.5.gh.tar.gz 551557 BLAKE2B bdc5467c618ef253cbf05c3710c8ffdf37b8d424daa70b918f9afeb1cd5d5c0fb8c4393b4c2ec0589223822b61eda7613582f671be733ff995a55013eb7073ca SHA512 fca9aff8bc6fc6b31c0346d29af3de9b60b59f6c063d4672702114be3631aaf330462e2a46824fd54a741ca693691035d53bac9c5d3d4c176a7b8a5e46f1f460
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.8.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.8.5.ebuild
new file mode 100644
index 00000000000..784a99e21c3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.8.5.ebuild
@@ -0,0 +1,156 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+DISTUTILS_UPSTREAM_PEP517=standalone
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} )
+RUST_MIN_VER=1.75.0
+inherit cargo distutils-r1 flag-o-matic shell-completion toolchain-funcs
+
+DESCRIPTION="Build and publish crates with pyo3, rust-cpython and cffi bindings"
+HOMEPAGE="https://www.maturin.rs/"
+SRC_URI="
+	https://github.com/PyO3/maturin/archive/refs/tags/v${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+	https://dev.gentoo.org/~ionen/distfiles/${P}-vendor.tar.xz
+"
+# ^ tarball also includes test-crates' Cargo.lock(s) crates for tests
+
+# rustls+ring is unused, so openssl license can be skipped
+LICENSE="|| ( Apache-2.0 MIT ) doc? ( CC-BY-4.0 OFL-1.1 )"
+LICENSE+="
+	0BSD Apache-2.0 Apache-2.0-with-LLVM-exceptions BSD Boost-1.0 MIT
+	MPL-2.0 Unicode-3.0 Unicode-DFS-2016
+" # crates
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="doc +ssl test"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	app-arch/xz-utils
+	ssl? ( dev-libs/openssl:= )
+"
+RDEPEND="${DEPEND}"
+BDEPEND="
+	virtual/pkgconfig
+	doc? ( app-text/mdbook )
+	test? (
+		$(python_gen_cond_dep 'dev-python/cffi[${PYTHON_USEDEP}]' 'python*')
+		dev-python/boltons[${PYTHON_USEDEP}]
+		dev-python/virtualenv[${PYTHON_USEDEP}]
+		dev-vcs/git
+		elibc_musl? ( dev-util/patchelf )
+	)
+"
+
+QA_FLAGS_IGNORED="usr/bin/${PN}"
+
+src_prepare() {
+	distutils-r1_src_prepare
+
+	# we build the Rust executable (just once) via cargo_src_compile
+	sed -i -e '/setuptools_rust/d' -e '/rust_extensions/d' setup.py || die
+
+	if use test; then
+		# used to prevent use of network during tests, and silence pip
+		# if it finds unrelated issues with system packages (bug #913613)
+		cat > "${T}"/pip.conf <<-EOF || die
+			[global]
+			quiet = 2
+
+			[install]
+			no-index = yes
+			no-dependencies = yes
+		EOF
+
+		# uv does not work easily w/ network-sandbox, force virtualenv
+		sed -i 's/"uv"/"uv-not-found"/' tests/common/mod.rs || die
+
+		# increase timeouts for tests (bug #950332)
+		sed -i '/^#\[timeout/s/secs(60)/secs(300)/' tests/run.rs || die
+
+		# used by *git_sdist_generator tests
+		git init -q || die
+		git config --global user.email "larry@gentoo.org" || die
+		git config --global user.name "Larry the Cow" || die
+		git add . || die
+		git commit -qm init || die
+	fi
+}
+
+src_configure() {
+	export OPENSSL_NO_VENDOR=1
+
+	# https://github.com/rust-lang/stacker/issues/79
+	use s390 && ! is-flagq '-march=*' &&
+		append-cflags $(test-flags-CC -march=z10)
+
+	local myfeatures=(
+		# like release.yml + native-tls for better platform support than rustls
+		full
+		password-storage
+		$(usev ssl native-tls)
+	)
+
+	cargo_src_configure --no-default-features
+}
+
+python_compile_all() {
+	cargo_src_compile
+
+	use !doc || mdbook build -d html guide || die
+
+	if ! tc-is-cross-compiler; then
+		local maturin=$(cargo_target_dir)/maturin
+		"${maturin}" completions bash > "${T}"/${PN} || die
+		"${maturin}" completions fish > "${T}"/${PN}.fish || die
+		"${maturin}" completions zsh > "${T}"/_${PN} || die
+	else
+		ewarn "shell completion files were skipped due to cross-compilation"
+	fi
+}
+
+python_test() {
+	local -x MATURIN_TEST_PYTHON=${EPYTHON}
+	local -x PIP_CONFIG_FILE=${T}/pip.conf
+	local -x VIRTUALENV_SYSTEM_SITE_PACKAGES=1
+
+	# need this for (new) python versions not yet recognized by pyo3
+	local -x PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1
+
+	local skip=(
+		# picky cli output test that easily benignly fail (bug #937992)
+		--skip cli_tests
+		# avoid need for wasm over a single hello world test
+		--skip integration_wasm_hello_world
+		# fragile depending on rust version, also wants libpypy*-c.so for pypy
+		--skip pyo3_no_extension_module
+		# unimportant tests that require uv, and not obvious to get it
+		# to work with network-sandbox (not worth the trouble)
+		--skip develop_hello_world::case_2
+		--skip develop_pyo3_ffi_pure::case_2
+		# compliance test using zig requires an old libc to pass (bug #946967)
+		--skip integration_pyo3_mixed_py_subdir
+		# fails on sparc since rust-1.74 (bug #934573), skip for now given
+		# should not affect the pep517 backend which is all we need on sparc
+		$(usev sparc '--skip build_context::test::test_macosx_deployment_target')
+	)
+
+	cargo_src_test -- "${skip[@]}"
+}
+
+python_install_all() {
+	cargo_src_install
+
+	dodoc Changelog.md README.md
+	use doc && dodoc -r guide/html
+
+	if ! tc-is-cross-compiler; then
+		dobashcomp "${T}"/${PN}
+		dofishcomp "${T}"/${PN}.fish
+		dozshcomp "${T}"/_${PN}
+	fi
+}

From 77a2ee46e6ffb497572f0acf2c25dcd15047e636 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:07:45 +0000
Subject: [PATCH 087/136] dev-util/pkgconf: Sync with Gentoo

It's from Gentoo commit dd4919f33ba78c8fd5d79c7e627846c7e693dc71.
---
 .../portage-stable/dev-util/pkgconf/pkgconf-2.4.3.ebuild        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.4.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.4.3.ebuild
index c3a622f7dc0..323d414e1db 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.4.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.4.3.ebuild
@@ -10,7 +10,7 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://gitea.treehouse.systems/ariadne/pkgconf.git"
 else
 	SRC_URI="https://distfiles.ariadne.space/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 DESCRIPTION="pkg-config compatible replacement with no dependencies other than C99"

From c80bb8af652f300c0345f50d7f025f014c29afec Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:08:08 +0000
Subject: [PATCH 088/136] eclass/distutils-r1: Sync with Gentoo

It's from Gentoo commit e45c2d0d0a9f22439eb2fcd1c99235ba6d1070a2.
---
 .../portage-stable/eclass/distutils-r1.eclass | 47 +++++++++++++++----
 1 file changed, 38 insertions(+), 9 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
index 880e33cd741..62e092b6231 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
@@ -134,13 +134,20 @@
 #
 # - sip - sipbuild backend
 #
-# - standalone - standalone build systems without external deps
-#   (used for bootstrapping).
+# - standalone - standalone/local build systems
 #
 # - uv-build - uv-build backend (using dev-python/uv)
 #
-# The variable needs to be set before the inherit line.  The eclass
-# adds appropriate build-time dependencies and verifies the value.
+# The variable needs to be set before the inherit line.  If another
+# value than "standalone" and "no" is used, The eclass adds appropriate
+# build-time dependencies, verifies the value and calls the appropriate
+# modern entry point for the backend.  With DISTUTILS_UPSTREAM_PEP517,
+# this variable can be used to override the upstream build backend.
+#
+# The value of "standalone" indicates that upstream is using a custom,
+# local build backend.  In this mode, the eclass does not add any
+# dependencies, disables build backend verification and uses the exact
+# entry point listed in pyproject.toml.
 #
 # The special value "no" indicates that the package has no build system.
 # This is not equivalent to unset DISTUTILS_USE_PEP517 (legacy mode).
@@ -162,6 +169,12 @@
 # overriden to workaround the eclass check, when it is desirable
 # to build the wheel using other backend than the one used upstream.
 #
+# When using it, ideally it should list the build backend actually used
+# upstream, so the eclass will throw an error if that backend changes
+# (and therefore overrides may need to change as well).  As a special
+# case, setting it to "standalone" disables the check entirely (while
+# still forcing the backend, unlike DISTUTILS_USE_PEP517=standalone).
+#
 # Please note that even in packages using PEP621 metadata, there can
 # be subtle differences between the behavior of different PEP517 build
 # backends, for example regarding finding package files.  When using
@@ -215,7 +228,7 @@
 # This is an optimization that can avoid the overhead of calling into
 # the build system in pure Python packages and packages using the stable
 # Python ABI.
-: ${DISTUTILS_ALLOW_WHEEL_REUSE=1}
+: "${DISTUTILS_ALLOW_WHEEL_REUSE=1}"
 
 # @ECLASS_VARIABLE: BUILD_DIR
 # @OUTPUT_VARIABLE
@@ -1150,11 +1163,23 @@ _distutils-r1_get_backend() {
 		fi
 	fi
 
+	# if DISTUTILS_USE_PEP517 is "standalone", we respect the exact
+	# backend used in pyproject.toml; otherwise we force the backend
+	# based on DISTUTILS_USE_PEP517
 	if [[ ${DISTUTILS_USE_PEP517} == standalone ]]; then
 		echo "${build_backend}"
 		return
 	fi
 
+	# we can output it early, even if we die below
+	echo "$(_distutils-r1_key_to_backend "${DISTUTILS_USE_PEP517}")"
+
+	# skip backend verification if DISTUTILS_UPSTREAM_PEP517
+	# is "standalone"
+	if [[ ${DISTUTILS_UPSTREAM_PEP517} == standalone ]]; then
+		return
+	fi
+
 	# verify that the ebuild correctly specifies the build backend
 	local expected_backend=$(
 		_distutils-r1_key_to_backend \
@@ -1189,8 +1214,6 @@ _distutils-r1_get_backend() {
 			> "${T}"/.distutils_deprecated_backend_warned || die
 		fi
 	fi
-
-	echo "$(_distutils-r1_key_to_backend "${DISTUTILS_USE_PEP517}")"
 }
 
 # @FUNCTION: distutils_wheel_install
@@ -1662,7 +1685,8 @@ distutils-r1_python_install() {
 		# let's explicitly verify these assumptions
 
 		# remove files that we've created explicitly
-		rm "${reg_scriptdir}"/{"${EPYTHON}",python3,python,pyvenv.cfg} || die
+		rm "${reg_scriptdir}"/{"${EPYTHON}",python3,python} || die
+		rm "${reg_scriptdir}"/../pyvenv.cfg || die
 
 		# Automagically do the QA check to avoid issues when bootstrapping
 		# prefix.
@@ -2030,7 +2054,12 @@ _distutils-r1_post_python_compile() {
 		ln -s "${PYTHON}" "${bindir}/${EPYTHON}" || die
 		ln -s "${EPYTHON}" "${bindir}/python3" || die
 		ln -s "${EPYTHON}" "${bindir}/python" || die
-		cat > "${bindir}"/pyvenv.cfg <<-EOF || die
+		# python3.14 changed venv logic so that:
+		# 1) pyvenv.cfg location explicitly determines prefix
+		#    (i.e. we no longer can be put in bin/)
+		# 2) "home =" key must be present
+		cat > "${bindir}"/../pyvenv.cfg <<-EOF || die
+			home = ${EPREFIX}/usr/bin
 			include-system-site-packages = true
 		EOF
 

From 60ae1a1f25be94fba5e4a86c9f5ca95fd08bb350 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:08:25 +0000
Subject: [PATCH 089/136] eclass/flag-o-matic: Sync with Gentoo

It's from Gentoo commit a13d692939efda7afb29c1d8a2cb1d5717972b89.
---
 .../src/third_party/portage-stable/eclass/flag-o-matic.eclass   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/eclass/flag-o-matic.eclass b/sdk_container/src/third_party/portage-stable/eclass/flag-o-matic.eclass
index 85274c91121..f22854c646c 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/flag-o-matic.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/flag-o-matic.eclass
@@ -46,7 +46,7 @@ setup-allowed-flags() {
 _setup-allowed-flags() {
 	ALLOWED_FLAGS=(
 		-pipe -O '-O[123szg]' '-mcpu=*' '-march=*' '-mtune=*' '-mfpmath=*'
-		-flto '-flto=*' -fno-lto
+		-flto '-flto=*' -fno-lto -ffat-lto-objects
 
 		# Hardening flags
 		'-fstack-protector*'

From 6589373adb5f08891180eaffc901159929bfc0d3 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:09:40 +0000
Subject: [PATCH 090/136] eclass/python-utils-r1: Sync with Gentoo

It's from Gentoo commit 4225e61a4368f275d1f7bbbb7f71f06cc082be4d.
---
 .../eclass/python-utils-r1.eclass             | 38 +++++--------------
 1 file changed, 9 insertions(+), 29 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
index ef05a58e1b1..a1ca388ab73 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
@@ -40,8 +40,8 @@ inherit multiprocessing toolchain-funcs
 # All supported Python implementations, most preferred last.
 _PYTHON_ALL_IMPLS=(
 	pypy3_11
-	python3_13t
-	python3_{11..13}
+	python3_{13..14}t
+	python3_{11..14}
 )
 readonly _PYTHON_ALL_IMPLS
 
@@ -81,7 +81,7 @@ _python_verify_patterns() {
 	local impl pattern
 	for pattern; do
 		case ${pattern} in
-			-[23]|3.[89]|3.1[0-3])
+			-[23]|3.[89]|3.1[0-4])
 				continue
 				;;
 		esac
@@ -137,7 +137,7 @@ _python_set_impls() {
 			# please keep them in sync with _PYTHON_ALL_IMPLS
 			# and _PYTHON_HISTORICAL_IMPLS
 			case ${i} in
-				pypy3_11|python3_9|python3_1[1-3]|python3_13t)
+				pypy3_11|python3_9|python3_1[1-4]|python3_1[3-4]t)
 					;;
 				jython2_7|pypy|pypy1_[89]|pypy2_0|pypy3|python2_[5-7]|python3_[1-9]|python3_10)
 					obsolete+=( "${i}" )
@@ -230,9 +230,7 @@ _python_impl_matches() {
 				fi
 				return 0
 				;;
-			3.10)
-				;;
-			3.8|3.9|3.1[1-3])
+			3.[89]|3.1[0-4])
 				[[ ${impl%t} == python${pattern/./_} || ${impl} == pypy${pattern/./_} ]] &&
 					return 0
 				;;
@@ -626,29 +624,11 @@ python_optimize() {
 	local jobs=$(makeopts_jobs)
 	local d
 	for d; do
-		# make sure to get a nice path without //
-		local instpath=${d#${D}}
-		instpath=/${instpath##/}
-
 		einfo "Optimize Python modules for ${instpath}"
-		case "${EPYTHON}" in
-			python3.8)
-				# both levels of optimization are separate since 3.5
-				"${PYTHON}" -m compileall -j "${jobs}" -q -f -d "${instpath}" "${d}"
-				"${PYTHON}" -O -m compileall -j "${jobs}" -q -f -d "${instpath}" "${d}"
-				"${PYTHON}" -OO -m compileall -j "${jobs}" -q -f -d "${instpath}" "${d}"
-				;;
-			python*|pypy3*)
-				# Python 3.9+
-				"${PYTHON}" -m compileall -j "${jobs}" -o 0 -o 1 -o 2 --hardlink-dupes -q -f -d "${instpath}" "${d}"
-				;;
-			pypy|jython2.7)
-				"${PYTHON}" -m compileall -q -f -d "${instpath}" "${d}"
-				;;
-			*)
-				die "${FUNCNAME}: unexpected EPYTHON=${EPYTHON}"
-				;;
-		esac
+		# NB: '-s' makes the path relative, so we need '-p /' to make it
+		# absolute again; https://github.com/python/cpython/issues/133503
+		"${PYTHON}" -m compileall -j "${jobs}" -o 0 -o 1 -o 2 \
+			--hardlink-dupes -q -f -s "${D}" -p / "${d}"
 	done
 }
 

From 58227d1fba1a8d3339204997b2563685e5576ad5 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:10:10 +0000
Subject: [PATCH 091/136] eclass/toolchain: Sync with Gentoo

It's from Gentoo commit abbb1a0e6aabd91d6d4c71216b6b9e20d25322d1.
---
 .../portage-stable/eclass/toolchain.eclass            | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass b/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
index 93d4792af4d..2d903f992b1 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
@@ -1139,6 +1139,15 @@ toolchain_setup_ada() {
 	! tc-is-cross-compiler && _toolchain_make_gnat_wrappers
 
 	export CC="$(tc-getCC) -specs=${T}/ada.spec"
+
+	if ver_test ${PV} -lt 13 && [[ ${CTARGET} == hppa* ]] ; then
+		# For HPPA, the ada-bootstrap binaries seem to default
+		# to -fstack-protector still (maybe because of cross-building)
+		# so we need to override it for <13 (which ignores -fstack-protector)
+		# as SSP doesn't exist there. The GNAT configure test gets confused
+		# by GCC warning about this otherwise.
+		CC+=" -fno-stack-protector"
+	fi
 }
 
 # @FUNCTION: toolchain_setup_d
@@ -2780,6 +2789,8 @@ toolchain_src_install() {
 	# Don't scan .gox files for executable stacks - false positives
 	export QA_EXECSTACK="usr/lib*/go/*/*.gox"
 	export QA_WX_LOAD="usr/lib*/go/*/*.gox"
+	# Workaround bug #793770
+	export QA_PRESTRIPPED="usr/lib*/go/*/*/*.gox"
 
 	# Disable RANDMMAP so PCH works, bug #301299
 	pax-mark -r "${ED}/libexec/gcc/${CTARGET}/${GCC_CONFIG_VER}/cc1"

From 4ad9ebed9d6e48b53c4b582fb9d1d6573939da79 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:10:34 +0000
Subject: [PATCH 092/136] licenses: Sync with Gentoo

It's from Gentoo commit 26090988703aac86fe2a4b4f991e7764787c3c88.
---
 .../portage-stable/licenses/Base64            |   5 +
 .../third_party/portage-stable/licenses/FFT2D |   5 +
 .../third_party/portage-stable/licenses/Ms-PL | 146 ++++++++----------
 .../portage-stable/licenses/SunSoft           |   6 +
 .../portage-stable/licenses/Unicode-DFS-2015  |  57 +++++++
 .../portage-stable/licenses/X11-Lucent        |  10 ++
 6 files changed, 148 insertions(+), 81 deletions(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/licenses/Base64
 create mode 100644 sdk_container/src/third_party/portage-stable/licenses/FFT2D
 create mode 100644 sdk_container/src/third_party/portage-stable/licenses/SunSoft
 create mode 100644 sdk_container/src/third_party/portage-stable/licenses/Unicode-DFS-2015
 create mode 100644 sdk_container/src/third_party/portage-stable/licenses/X11-Lucent

diff --git a/sdk_container/src/third_party/portage-stable/licenses/Base64 b/sdk_container/src/third_party/portage-stable/licenses/Base64
new file mode 100644
index 00000000000..7ae49b808e5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/licenses/Base64
@@ -0,0 +1,5 @@
+    Copyright (c) 1999, Bob Withers - bwit@pobox.com
+
+This code may be freely used for any purpose, either personal
+or commercial, provided the authors copyright notice remains
+intact.
diff --git a/sdk_container/src/third_party/portage-stable/licenses/FFT2D b/sdk_container/src/third_party/portage-stable/licenses/FFT2D
new file mode 100644
index 00000000000..83738a418ef
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/licenses/FFT2D
@@ -0,0 +1,5 @@
+Copyright Takuya OOURA, 1996-2001
+
+You may use, copy, modify and distribute this code for any purpose
+(include commercial use) and without fee. Please refer to this package
+when you modify this code.
diff --git a/sdk_container/src/third_party/portage-stable/licenses/Ms-PL b/sdk_container/src/third_party/portage-stable/licenses/Ms-PL
index 20919c80537..a5dd3ca5cae 100644
--- a/sdk_container/src/third_party/portage-stable/licenses/Ms-PL
+++ b/sdk_container/src/third_party/portage-stable/licenses/Ms-PL
@@ -1,81 +1,65 @@
-                      Microsoft Permissive License (Ms-PL)
-
-    
-
-   This license governs use of the accompanying software. If you use the
-   software, you accept this license. If you do not accept the license, do
-   not use the software.
-
-    
-
-1. Definitions
-
-   The terms "reproduce," "reproduction," "derivative works," and
-   "distribution" have the same meaning here as under U.S. copyright law.
-
-   A "contribution" is the original software, or any additions or changes to
-   the software.
-
-   A "contributor" is any person that distributes its contribution under this
-   license.
-
-    "Licensed patents" are a contributor's patent claims that read directly
-   on its contribution.
-
- 
-
-2. Grant of Rights
-
-   (A) Copyright Grant- Subject to the terms of this license, including the
-   license conditions and limitations in section 3, each contributor grants
-   you a non-exclusive, worldwide, royalty-free copyright license to
-   reproduce its contribution, prepare derivative works of its contribution,
-   and distribute its contribution or any derivative works that you create.
-
-   (B) Patent Grant- Subject to the terms of this license, including the
-   license conditions and limitations in section 3, each contributor grants
-   you a non-exclusive, worldwide, royalty-free license under its licensed
-   patents to make, have made, use, sell, offer for sale, import, and/or
-   otherwise dispose of its contribution in the software or derivative works
-   of the contribution in the software.
-
- 
-
-3. Conditions and Limitations
-
-    (A) No Trademark License- This license does not grant you rights to use
-   any contributors' name, logo, or trademarks.
-
-   (B) If you bring a patent claim against any contributor over patents that
-   you claim are infringed by the software, your patent license from such
-   contributor to the software ends automatically.
-
-   (C) If you distribute any portion of the software, you must retain all
-   copyright, patent, trademark, and attribution notices that are present in
-   the software.
-
-   (D) If you distribute any portion of the software in source code form, you
-   may do so only under this license by including a complete copy of this
-   license with your distribution. If you distribute any portion of the
-   software in compiled or object code form, you may only do so under a
-   license that complies with this license.
-
-   (E) The software is licensed "as-is." You bear the risk of using it. The
-   contributors give no express warranties, guarantees or conditions. You may
-   have additional consumer rights under your local laws which this license
-   cannot change. To the extent permitted under your local laws, the
-   contributors exclude the implied warranties of merchantability, fitness
-   for a particular purpose and non-infringement.
-
-   (F) If you distribute the software or derivative works with programs you
-   develop, you agree to indemnify, defend, and hold harmless all
-   contributors from any claims, including attorneys' fees, related to the
-   distribution or use of your programs.  For clarity, you have no such
-   obligations to a contributor for any claims based solely on the unmodified
-   contributions of that contributor.
-
-    (G) If you make any additions or changes to the original software, you
-   may only distribute them under a new namespace.  In addition, you will
-   clearly identify your changes or additions as your own.
-
-    
+Microsoft Public License (Ms-PL)
+
+This license governs use of the accompanying software. If you use the
+software, you accept this license. If you do not accept the license,
+do not use the software.
+
+ 1. Definitions
+
+    The terms "reproduce," "reproduction," "derivative works," and
+    "distribution" have the same meaning here as under U.S. copyright
+    law.
+
+    A "contribution" is the original software, or any additions or
+    changes to the software.
+
+    A "contributor" is any person that distributes its contribution
+    under this license.
+
+    "Licensed patents" are a contributor's patent claims that read
+    directly on its contribution.
+
+ 2. Grant of Rights
+
+    (A) Copyright Grant- Subject to the terms of this license,
+    including the license conditions and limitations in section 3,
+    each contributor grants you a non-exclusive, worldwide,
+    royalty-free copyright license to reproduce its contribution,
+    prepare derivative works of its contribution, and distribute its
+    contribution or any derivative works that you create.
+
+    (B) Patent Grant- Subject to the terms of this license, including
+    the license conditions and limitations in section 3, each
+    contributor grants you a non-exclusive, worldwide, royalty-free
+    license under its licensed patents to make, have made, use, sell,
+    offer for sale, import, and/or otherwise dispose of its
+    contribution in the software or derivative works of the
+    contribution in the software.
+
+ 3. Conditions and Limitations
+
+    (A) No Trademark License- This license does not grant you rights
+    to use any contributors' name, logo, or trademarks.
+
+    (B) If you bring a patent claim against any contributor over
+    patents that you claim are infringed by the software, your patent
+    license from such contributor to the software ends automatically.
+
+    (C) If you distribute any portion of the software, you must retain
+    all copyright, patent, trademark, and attribution notices that are
+    present in the software.
+
+    (D) If you distribute any portion of the software in source code
+    form, you may do so only under this license by including a
+    complete copy of this license with your distribution. If you
+    distribute any portion of the software in compiled or object code
+    form, you may only do so under a license that complies with this
+    license.
+
+    (E) The software is licensed "as-is." You bear the risk of using
+    it. The contributors give no express warranties, guarantees, or
+    conditions. You may have additional consumer rights under your
+    local laws which this license cannot change. To the extent
+    permitted under your local laws, the contributors exclude the
+    implied warranties of merchantability, fitness for a particular
+    purpose and non-infringement.
diff --git a/sdk_container/src/third_party/portage-stable/licenses/SunSoft b/sdk_container/src/third_party/portage-stable/licenses/SunSoft
new file mode 100644
index 00000000000..b54cb52278e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/licenses/SunSoft
@@ -0,0 +1,6 @@
+Copyright (C) 1993-2004 by Sun Microsystems, Inc. All rights reserved.
+
+Developed at SunSoft, a Sun Microsystems, Inc. business.
+Permission to use, copy, modify, and distribute this
+software is freely granted, provided that this notice
+is preserved.
diff --git a/sdk_container/src/third_party/portage-stable/licenses/Unicode-DFS-2015 b/sdk_container/src/third_party/portage-stable/licenses/Unicode-DFS-2015
new file mode 100644
index 00000000000..cd535409d60
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/licenses/Unicode-DFS-2015
@@ -0,0 +1,57 @@
+UNICODE, INC. LICENSE AGREEMENT - DATA FILES AND SOFTWARE
+
+Unicode Data Files include all data files under the directories
+http://www.unicode.org/Public/, http://www.unicode.org/reports/,
+and http://www.unicode.org/cldr/data/.
+Unicode Data Files do not include PDF online code charts under the
+directory http://www.unicode.org/Public/.
+Software includes any source code published in the Unicode Standard
+or under the directories
+http://www.unicode.org/Public/, http://www.unicode.org/reports/,
+and http://www.unicode.org/cldr/data/.
+
+NOTICE TO USER: Carefully read the following legal agreement.
+BY DOWNLOADING, INSTALLING, COPYING OR OTHERWISE USING UNICODE INC.'S
+DATA FILES ("DATA FILES"), AND/OR SOFTWARE ("SOFTWARE"),
+YOU UNEQUIVOCALLY ACCEPT, AND AGREE TO BE BOUND BY, ALL OF THE
+TERMS AND CONDITIONS OF THIS AGREEMENT.
+IF YOU DO NOT AGREE, DO NOT DOWNLOAD, INSTALL, COPY, DISTRIBUTE OR USE
+THE DATA FILES OR SOFTWARE.
+
+COPYRIGHT AND PERMISSION NOTICE
+
+Copyright © 1991-2015 Unicode, Inc. All rights reserved.
+Distributed under the Terms of Use in
+http://www.unicode.org/copyright.html.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Unicode data files and any associated documentation
+(the "Data Files") or Unicode software and any associated documentation
+(the "Software") to deal in the Data Files or Software
+without restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, and/or sell copies of
+the Data Files or Software, and to permit persons to whom the Data Files
+or Software are furnished to do so, provided that
+(a) this copyright and permission notice appear with all copies
+of the Data Files or Software,
+(b) this copyright and permission notice appear in associated
+documentation, and
+(c) there is clear notice in each modified Data File or in the Software
+as well as in the documentation associated with the Data File(s) or
+Software that the data or software has been modified.
+
+THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS INCLUDED IN THIS
+NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL
+DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
+DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THE DATA FILES OR SOFTWARE.
+
+Except as contained in this notice, the name of a copyright holder
+shall not be used in advertising or otherwise to promote the sale,
+use or other dealings in these Data Files or Software without prior
+written authorization of the copyright holder.
diff --git a/sdk_container/src/third_party/portage-stable/licenses/X11-Lucent b/sdk_container/src/third_party/portage-stable/licenses/X11-Lucent
new file mode 100644
index 00000000000..6a787310780
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/licenses/X11-Lucent
@@ -0,0 +1,10 @@
+Permission to use, copy, modify, and distribute this software for any
+purpose without fee is hereby granted, provided that this entire notice
+is included in all copies of any software which is or includes a copy
+or modification of this software and in all copies of the supporting
+documentation for such software.
+
+THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED
+WARRANTY.  IN PARTICULAR, NEITHER THE AUTHORS NOR LUCENT TECHNOLOGIES MAKE ANY
+REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY
+OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE.

From 063f929bd4984ebd9878fc421039686e4a17620c Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:10:39 +0000
Subject: [PATCH 093/136] net-dns/bind: Sync with Gentoo

It's from Gentoo commit d1984f7f59ab26150f073c9c13e0742d15cc856c.
---
 .../bind/{bind-9.18.29-r2.ebuild => bind-9.18.29-r3.ebuild}     | 2 +-
 .../bind/{bind-9.18.31-r1.ebuild => bind-9.18.31-r2.ebuild}     | 2 +-
 .../net-dns/bind/{bind-9.20.7.ebuild => bind-9.20.7-r1.ebuild}  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)
 rename sdk_container/src/third_party/portage-stable/net-dns/bind/{bind-9.18.29-r2.ebuild => bind-9.18.29-r3.ebuild} (99%)
 rename sdk_container/src/third_party/portage-stable/net-dns/bind/{bind-9.18.31-r1.ebuild => bind-9.18.31-r2.ebuild} (99%)
 rename sdk_container/src/third_party/portage-stable/net-dns/bind/{bind-9.20.7.ebuild => bind-9.20.7-r1.ebuild} (99%)

diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.29-r2.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.29-r3.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.29-r2.ebuild
rename to sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.29-r3.ebuild
index ba1fbcbae74..445b15be4e1 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.29-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.29-r3.ebuild
@@ -37,7 +37,7 @@ DEPEND="
 	idn? ( net-dns/libidn2 )
 	jemalloc? ( dev-libs/jemalloc:= )
 	lmdb? ( dev-db/lmdb )
-	xml? ( dev-libs/libxml2 )
+	xml? ( dev-libs/libxml2:= )
 "
 RDEPEND="
 	${DEPEND}
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.31-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.31-r2.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.31-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.31-r2.ebuild
index d4b6c103bbc..65e278b7e4c 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.31-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.31-r2.ebuild
@@ -37,7 +37,7 @@ DEPEND="
 	idn? ( net-dns/libidn2 )
 	jemalloc? ( dev-libs/jemalloc:= )
 	lmdb? ( dev-db/lmdb )
-	xml? ( dev-libs/libxml2 )
+	xml? ( dev-libs/libxml2:= )
 "
 RDEPEND="
 	${DEPEND}
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.20.7.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.20.7-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.20.7.ebuild
rename to sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.20.7-r1.ebuild
index a19f5a14882..5e2ec26cf32 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.20.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.20.7-r1.ebuild
@@ -38,7 +38,7 @@ DEPEND="
 	idn? ( net-dns/libidn2 )
 	jemalloc? ( dev-libs/jemalloc:= )
 	lmdb? ( dev-db/lmdb )
-	xml? ( dev-libs/libxml2 )
+	xml? ( dev-libs/libxml2:= )
 "
 RDEPEND="
 	${DEPEND}

From 15632d07684f1d42bd6f24cff97e69055585c597 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:10:39 +0000
Subject: [PATCH 094/136] net-dns/bind-tools: Sync with Gentoo

It's from Gentoo commit da28395496029c42cf535c0725745d68efbc523b.
---
 ...bind-tools-9.16.48.ebuild => bind-tools-9.16.48-r1.ebuild} | 4 ++--
 ...bind-tools-9.16.50.ebuild => bind-tools-9.16.50-r1.ebuild} | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)
 rename sdk_container/src/third_party/portage-stable/net-dns/bind-tools/{bind-tools-9.16.48.ebuild => bind-tools-9.16.48-r1.ebuild} (98%)
 rename sdk_container/src/third_party/portage-stable/net-dns/bind-tools/{bind-tools-9.16.50.ebuild => bind-tools-9.16.50-r1.ebuild} (99%)

diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.48.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.48-r1.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.48.ebuild
rename to sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.48-r1.ebuild
index 211061187c9..fd2df383c0e 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.48.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.48-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -33,7 +33,7 @@ RDEPEND="
 	>=dev-libs/libuv-1.42.0:=
 	dev-libs/openssl:=
 	caps? ( sys-libs/libcap )
-	xml? ( dev-libs/libxml2 )
+	xml? ( dev-libs/libxml2:= )
 	idn? ( net-dns/libidn2:= )
 	gssapi? ( virtual/krb5 )
 	libedit? ( dev-libs/libedit )
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.50.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.50-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.50.ebuild
rename to sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.50-r1.ebuild
index 9d1fac1aba0..5b553e924df 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.50.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.50-r1.ebuild
@@ -33,7 +33,7 @@ RDEPEND="
 	>=dev-libs/libuv-1.42.0:=
 	dev-libs/openssl:=
 	caps? ( sys-libs/libcap )
-	xml? ( dev-libs/libxml2 )
+	xml? ( dev-libs/libxml2:= )
 	idn? ( net-dns/libidn2:= )
 	gssapi? ( virtual/krb5 )
 	libedit? ( dev-libs/libedit )

From 443d48a1ded293264754956936bf1e712d416db6 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:10:47 +0000
Subject: [PATCH 095/136] net-firewall/nftables: Sync with Gentoo

It's from Gentoo commit 2c3dceb3ba39869c0eea3e7e3f36b39427dda1dd.
---
 .../net-firewall/nftables/nftables-1.1.1-r1.ebuild              | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/nftables/nftables-1.1.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-firewall/nftables/nftables-1.1.1-r1.ebuild
index 339c354ab8f..f570106f986 100644
--- a/sdk_container/src/third_party/portage-stable/net-firewall/nftables/nftables-1.1.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-firewall/nftables/nftables-1.1.1-r1.ebuild
@@ -21,7 +21,7 @@ else
 		https://netfilter.org/projects/nftables/files/${P}.tar.xz
 		verify-sig? ( https://netfilter.org/projects/nftables/files/${P}.tar.xz.sig )
 	"
-	KEYWORDS="amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~sparc x86"
+	KEYWORDS="amd64 arm arm64 hppa ~loong ~mips ppc ppc64 ~riscv ~sparc x86"
 	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-netfilter )"
 fi
 

From 87af18dbe97f935fcd2e63461c182ce477924943 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:10:47 +0000
Subject: [PATCH 096/136] net-fs/cifs-utils: Sync with Gentoo

It's from Gentoo commit fcde99ccaa5d4dc30a1e21f0438fb57d8f886759.
---
 .../cifs-utils/cifs-utils-7.0-r1.ebuild       |  3 +-
 .../net-fs/cifs-utils/cifs-utils-7.3.ebuild   |  1 +
 .../files/cifs-utils-7.0-musl.patch           | 39 +++++++++++++++++++
 3 files changed, 42 insertions(+), 1 deletion(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/files/cifs-utils-7.0-musl.patch

diff --git a/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.0-r1.ebuild
index 6c722804a3b..427fc00cfa1 100644
--- a/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.0-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -46,6 +46,7 @@ PATCHES=(
 	"${FILESDIR}/${PN}-6.12-ln_in_destdir.patch" #766594
 	"${FILESDIR}/${PN}-6.15-musl.patch"
 	"${FILESDIR}/${PN}-7.0-no-clobber-fortify-source.patch"
+	"${FILESDIR}/${PN}-7.0-musl.patch"
 )
 
 pkg_setup() {
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.3.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.3.ebuild
index 53562db9382..c46b5251d34 100644
--- a/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.3.ebuild
@@ -44,6 +44,7 @@ DOCS="doc/linux-cifs-client-guide.odt"
 
 PATCHES=(
 	"${FILESDIR}/${PN}-7.3-no-clobber-fortify-source.patch"
+	"${FILESDIR}/${PN}-7.0-musl.patch"
 )
 
 pkg_setup() {
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/files/cifs-utils-7.0-musl.patch b/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/files/cifs-utils-7.0-musl.patch
new file mode 100644
index 00000000000..e7c707ab14f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/files/cifs-utils-7.0-musl.patch
@@ -0,0 +1,39 @@
+https://lore.kernel.org/linux-cifs/CALMA0xaVdk3qwkb-92QqF2+6z+=oxbBWDR1hYEoE2WUc7jVGkw@mail.gmail.com/T/#u
+
+From abd3d9a2d4f8a5dc4d90daddc7cf0c62d954f03a Mon Sep 17 00:00:00 2001
+From: "Z. Liu" <zhixu.liu@gmail.com>
+Date: Fri, 2 May 2025 23:08:41 +0800
+Subject: [PATCH] getcifsacl, setcifsacl: use <libgen.h> for basename
+
+basename() is defined in <libgen.h> only in musl, while glibc defines it
+in <string.h> too, which is not standard behavior.
+
+Signed-off-by: Z. Liu <zhixu.liu@gmail.com>
+
+diff --git a/getcifsacl.c b/getcifsacl.c
+index 97471e9..6c6356f 100644
+--- a/getcifsacl.c
++++ b/getcifsacl.c
+@@ -33,6 +33,7 @@
+ #include <stdlib.h>
+ #include <stddef.h>
+ #include <errno.h>
++#include <libgen.h>
+ #include <limits.h>
+ #include <ctype.h>
+ #include <linux/limits.h>
+diff --git a/setcifsacl.c b/setcifsacl.c
+index b199118..3cb603c 100644
+--- a/setcifsacl.c
++++ b/setcifsacl.c
+@@ -47,6 +47,7 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <errno.h>
++#include <libgen.h>
+ #include <limits.h>
+ #include <ctype.h>
+ #include <linux/limits.h>
+-- 
+2.45.2
+

From 2b3d88c741439b3b6ef0b46b8ab46a2f5db2df4e Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:10:49 +0000
Subject: [PATCH 097/136] net-fs/samba: Sync with Gentoo

It's from Gentoo commit f64ae2112cb75de0ae814df39962a6eb2b901c40.
---
 .../third_party/portage-stable/net-fs/samba/samba-4.20.7.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.20.7.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.20.7.ebuild
index 6e10e7221e5..78cf82bd10b 100644
--- a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.20.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.20.7.ebuild
@@ -16,7 +16,7 @@ if [[ ${PV} == *_rc* ]]; then
 	SRC_URI="https://download.samba.org/pub/samba/rc/${MY_P}.tar.gz"
 else
 	SRC_URI="https://download.samba.org/pub/samba/stable/${MY_P}.tar.gz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~sparc x86"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv sparc x86"
 fi
 S="${WORKDIR}/${MY_P}"
 

From 57757c3560b4967e09c3c0ace545127f384b189c Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:11:12 +0000
Subject: [PATCH 098/136] net-libs/nghttp2: Sync with Gentoo

It's from Gentoo commit 5586171412b4bbab980f853cfc792b5d2e8c66f0.
---
 ...5.0-r1.ebuild => nghttp2-1.65.0-r2.ebuild} |  2 +-
 .../net-libs/nghttp2/nghttp2-1.65.0.ebuild    | 61 -------------------
 .../net-libs/nghttp2/nghttp2-9999.ebuild      |  2 +-
 3 files changed, 2 insertions(+), 63 deletions(-)
 rename sdk_container/src/third_party/portage-stable/net-libs/nghttp2/{nghttp2-1.65.0-r1.ebuild => nghttp2-1.65.0-r2.ebuild} (97%)
 delete mode 100644 sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-1.65.0.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-1.65.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-1.65.0-r2.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-1.65.0-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-1.65.0-r2.ebuild
index bd68d3e0955..c8f2aa55d58 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-1.65.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-1.65.0-r2.ebuild
@@ -35,7 +35,7 @@ RDEPEND="
 		>=sys-libs/zlib-1.2.3[${MULTILIB_USEDEP}]
 	)
 	systemd? ( >=sys-apps/systemd-209 )
-	xml? ( >=dev-libs/libxml2-2.7.7:2[${MULTILIB_USEDEP}] )
+	xml? ( >=dev-libs/libxml2-2.7.7:2=[${MULTILIB_USEDEP}] )
 "
 DEPEND="${RDEPEND}"
 BDEPEND="virtual/pkgconfig"
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-1.65.0.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-1.65.0.ebuild
deleted file mode 100644
index 4aaf85ea7b6..00000000000
--- a/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-1.65.0.ebuild
+++ /dev/null
@@ -1,61 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit cmake-multilib
-
-DESCRIPTION="HTTP/2 C Library"
-HOMEPAGE="https://nghttp2.org/"
-SRC_URI="https://github.com/nghttp2/nghttp2/releases/download/v${PV}/${P}.tar.xz"
-
-LICENSE="MIT"
-SLOT="0/1.14" # 1.<SONAME>
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="debug hpack-tools jemalloc static-libs systemd test utils xml"
-
-REQUIRED_USE="test? ( static-libs )"
-RESTRICT="!test? ( test )"
-
-SSL_DEPEND="
-	>=dev-libs/openssl-1.0.2:0=[-bindist(-),${MULTILIB_USEDEP}]
-"
-RDEPEND="
-	hpack-tools? ( >=dev-libs/jansson-2.5:= )
-	jemalloc? ( dev-libs/jemalloc:=[${MULTILIB_USEDEP}] )
-	utils? (
-		${SSL_DEPEND}
-		>=dev-libs/libev-4.15[${MULTILIB_USEDEP}]
-		>=sys-libs/zlib-1.2.3[${MULTILIB_USEDEP}]
-		net-dns/c-ares:=[${MULTILIB_USEDEP}]
-	)
-	systemd? ( >=sys-apps/systemd-209 )
-	xml? ( >=dev-libs/libxml2-2.7.7:2[${MULTILIB_USEDEP}] )"
-DEPEND="${RDEPEND}"
-BDEPEND="virtual/pkgconfig"
-
-multilib_src_configure() {
-	#TODO: enable HTTP3
-	#requires quictls/openssl, libngtcp2, libngtcp2_crypto_quictls, libnghttp3
-	local mycmakeargs=(
-		-DENABLE_EXAMPLES=OFF
-		-DENABLE_FAILMALLOC=OFF
-		-DENABLE_HTTP3=OFF
-		-DENABLE_WERROR=OFF
-		-DENABLE_THREADS=ON
-		-DENABLE_DEBUG=$(usex debug)
-		-DENABLE_HPACK_TOOLS=$(multilib_native_usex hpack-tools)
-		$(cmake_use_find_package hpack-tools Jansson)
-		-DWITH_JEMALLOC=$(multilib_native_usex jemalloc)
-		-DBUILD_STATIC_LIBS=$(usex static-libs)
-		-DBUILD_TESTING=$(usex test)
-		$(cmake_use_find_package systemd Systemd)
-		-DENABLE_APP=$(multilib_native_usex utils)
-		-DWITH_LIBXML2=$(multilib_native_usex xml)
-	)
-	cmake_src_configure
-}
-
-multilib_src_test() {
-	eninja check
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-9999.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-9999.ebuild
index 9f6a317734d..60883face4f 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-9999.ebuild
@@ -35,7 +35,7 @@ RDEPEND="
 		>=sys-libs/zlib-1.2.3[${MULTILIB_USEDEP}]
 	)
 	systemd? ( >=sys-apps/systemd-209 )
-	xml? ( >=dev-libs/libxml2-2.7.7:2[${MULTILIB_USEDEP}] )
+	xml? ( >=dev-libs/libxml2-2.7.7:2=[${MULTILIB_USEDEP}] )
 "
 DEPEND="${RDEPEND}"
 BDEPEND="virtual/pkgconfig"

From 674be9e0223c5bd9b8596c35eafd03e2417f6447 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:11:18 +0000
Subject: [PATCH 099/136] net-misc/iperf: Sync with Gentoo

It's from Gentoo commit 9cd3626bc9ddd78f7aad1c99d8f232040871b44a.
---
 .../third_party/portage-stable/net-misc/iperf/iperf-3.18.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.18.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.18.ebuild
index 302b37c9ef7..626c724ce7f 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.18.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.18.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/esnet/iperf/releases/download/${PV}/${P}.tar.gz"
 
 LICENSE="BSD"
 SLOT="3"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~mips ppc ppc64 ~riscv ~sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
 IUSE="sctp"
 
 DEPEND="

From da7fe6d8270ef54069fa0fb193bb68593e6f2988 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:11:22 +0000
Subject: [PATCH 100/136] net-misc/rsync: Sync with Gentoo

It's from Gentoo commit 822cab3f761fd49ef52c119e498907199d3ffb07.
---
 .../portage-stable/net-misc/rsync/rsync-3.4.1.ebuild            | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/net-misc/rsync/rsync-3.4.1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/rsync/rsync-3.4.1.ebuild
index ea4f6fc4ee2..1ccce7545e6 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/rsync/rsync-3.4.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/rsync/rsync-3.4.1.ebuild
@@ -27,7 +27,7 @@ else
 		SRC_DIR="src-previews"
 	else
 		SRC_DIR="src"
-		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 
 	SRC_URI="https://rsync.samba.org/ftp/rsync/${SRC_DIR}/${P/_/}.tar.gz

From 37cea9e8a75bfd03729e8f7613afb44348be9b1d Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:11:25 +0000
Subject: [PATCH 101/136] net-nds/openldap: Sync with Gentoo

It's from Gentoo commit 193c640de65c4ab8b98bdc44d5fe939042d720ff.
---
 .../portage-stable/net-nds/openldap/openldap-2.5.19.ebuild       | 1 +
 .../portage-stable/net-nds/openldap/openldap-2.6.8-r1.ebuild     | 1 +
 .../portage-stable/net-nds/openldap/openldap-2.6.9.ebuild        | 1 +
 3 files changed, 3 insertions(+)

diff --git a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.5.19.ebuild b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.5.19.ebuild
index 8a6b89fc30b..cbd50fb185d 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.5.19.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.5.19.ebuild
@@ -775,6 +775,7 @@ multilib_src_install() {
 			einfo "Install the smbk5pwd module"
 			cd "${S}/contrib/slapd-modules/smbk5pwd" || die
 			emake DESTDIR="${D}" \
+				prefix="${EPREFIX}/usr" \
 				LDAP_BUILD="${BUILD_DIR}" \
 				libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap" install
 			newdoc README smbk5pwd-README
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.8-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.8-r1.ebuild
index a001cc4d9e3..512535934e2 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.8-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.8-r1.ebuild
@@ -779,6 +779,7 @@ multilib_src_install() {
 			einfo "Install the smbk5pwd module"
 			cd "${S}/contrib/slapd-modules/smbk5pwd" || die
 			emake DESTDIR="${D}" \
+				prefix="${EPREFIX}/usr" \
 				LDAP_BUILD="${BUILD_DIR}" \
 				libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap" install
 			newdoc README smbk5pwd-README
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.9.ebuild b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.9.ebuild
index b6bac7149c3..b76192650eb 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.9.ebuild
@@ -787,6 +787,7 @@ multilib_src_install() {
 			einfo "Install the smbk5pwd module"
 			cd "${S}/contrib/slapd-modules/smbk5pwd" || die
 			emake DESTDIR="${D}" \
+				prefix="${EPREFIX}/usr" \
 				LDAP_BUILD="${BUILD_DIR}" \
 				libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap" install
 			newdoc README smbk5pwd-README

From de61f6c7b2d36547a1041b38b4d7a66c80026bf0 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:11:28 +0000
Subject: [PATCH 102/136] profiles: Sync with Gentoo

It's from Gentoo commit 638399ec07dc0f2fa71abfa5ea14779fb579d6b5.
---
 .../profiles/arch/alpha/package.use.mask      |  4 ++
 .../profiles/arch/amd64/package.use.mask      |  5 ++
 .../profiles/arch/amd64/use.mask              |  9 +++
 .../profiles/arch/arm/package.use.mask        | 12 ++++
 .../portage-stable/profiles/arch/arm/use.mask |  5 ++
 .../profiles/arch/arm64/package.use.mask      |  8 +++
 .../profiles/arch/arm64/use.mask              |  4 ++
 .../profiles/arch/base/package.use.mask       |  5 ++
 .../profiles/arch/base/use.mask               | 54 +++++++----------
 .../profiles/arch/powerpc/package.use.mask    |  4 ++
 .../arch/powerpc/ppc32/package.use.mask       |  1 +
 .../arch/powerpc/ppc64/package.use.mask       |  6 ++
 .../profiles/arch/ppc/package.use.mask        |  4 ++
 .../profiles/arch/riscv/package.use.mask      |  6 ++
 .../arch/riscv/rv32imac/ilp32/make.defaults   |  2 +
 .../arch/riscv/rv32imac/ilp32d/make.defaults  |  2 +
 .../profiles/arch/riscv/use.mask              |  3 +
 .../profiles/arch/s390/package.use.mask       |  4 ++
 .../arch/sparc/32ul/package.use.force         |  6 ++
 .../profiles/arch/sparc/package.use.mask      |  8 +++
 .../profiles/arch/x86/package.use.mask        |  4 ++
 .../profiles/base/package.use.force           |  2 +
 .../profiles/base/package.use.mask            | 11 ++--
 .../profiles/base/package.use.stable.mask     |  4 ++
 .../profiles/base/use.stable.mask             |  4 ++
 .../default/linux/arm64/23.0/make.defaults    |  1 +
 .../default/linux/loong/23.0/make.defaults    |  1 +
 .../profiles/desc/apache2_modules.desc        |  3 +-
 .../profiles/desc/python_single_target.desc   |  2 +
 .../profiles/desc/python_targets.desc         |  2 +
 .../profiles/desc/video_cards.desc            |  1 +
 .../profiles/features/big-endian/package.mask |  1 +
 .../features/big-endian/package.use.mask      |  1 +
 .../profiles/features/big-endian/use.mask     |  4 ++
 .../profiles/features/musl/package.mask       |  1 +
 .../profiles/features/wd40/package.mask       | 11 ++++
 .../portage-stable/profiles/license_groups    |  6 +-
 .../portage-stable/profiles/package.mask      | 60 +++++++++++--------
 .../portage-stable/profiles/thirdpartymirrors |  2 +-
 39 files changed, 204 insertions(+), 69 deletions(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/arch/sparc/32ul/package.use.force
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/make.defaults
 create mode 100644 sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/make.defaults

diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
index d05c1282691..00c591d9308 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Eray Aslan <eras@gentoo.org> (2025-05-08)
+# dev-db/tinycdb is not keyworded here
+net-mail/dovecot cdb
+
 # Andreas Sturmlechner <asturm@gentoo.org> (2025-05-03)
 # dev-qt/qtbase:6 is not keyworded here
 media-libs/openal gui
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
index a9695303324..c2fd7da55bf 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
@@ -17,6 +17,11 @@
 
 #--- END OF EXAMPLES ---
 
+# Michał Górny <mgorny@gentoo.org> (2025-05-08)
+# dev-python/sigstore is keyworded here.
+>=dev-lang/python-3.14 -verify-sig
+>=dev-python/python-tests-3.14 -verify-sig
+
 # Jimi Huotari <chiitoo@gentoo.org> (2025-04-24)
 # Unmask on amd64.
 lxqt-base/lxqt-meta -wayland
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask
index 6fa65aba43d..4f6141bd7fb 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask
@@ -4,6 +4,15 @@
 # Unmask the flag which corresponds to ARCH.
 -amd64
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-01)
+# media-libs/libspng only keyworded on amd64, arm64
+-spng
+
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-01)
+# only keyworded on amd64, arm
+-openni
+-openni2
+
 # Thomas Bettler <thomas.bettler@gmail.com> (2024-11-04)
 # media-libs/tiff only keyworded on amd64
 -lerc
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
index 8b647557cc1..ae0801470b1 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
@@ -1,6 +1,18 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Eray Aslan <eras@gentoo.org> (2025-05-08)
+# dev-db/tinycdb is not keyworded here
+net-mail/dovecot cdb
+
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-06)
+# dev-python/nanobind is not keyworded here
+media-gfx/openvdb python
+
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-06)
+# oidn is not available on 32 bits arch
+media-gfx/blender oidn
+
 # Alfredo Tupone <tupone@gentoo.org> (2025-04-21)
 # ocamlopt is not available on 32 bits arch
 >=dev-lang/ocaml-5 ocamlopt
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/use.mask
index a7f97c88407..3392eaf5797 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/use.mask
@@ -4,6 +4,11 @@
 # Unmask the flag which corresponds to ARCH.
 -arm
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-01)
+# only keyworded on amd64, arm
+-openni
+-openni2
+
 # Sam James <sam@gentoo.org> (2024-06-13)
 # Needs as-yet-unkeyworded KF6 (bug #934215)
 kde
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
index 04df7369136..a46f3d2beaa 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
@@ -1,6 +1,14 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-06)
+# dev-python/nanobind is not keyworded here
+media-gfx/openvdb python
+
+# Alfredo Tupone <tupone@gentoo.org> (2025-05-03)
+# test add dependency on torchvision, not read for arm64
+sci-ml/datasets test
+
 # Alfredo Tupone <tupone@gentoo.org> (2025-05-03)
 # dependencies not arm64 ready
 sci-ml/caffe2 distributed gloo fbgemm nnpack onednn qnnpack rocm xnnpack
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/use.mask
index eb3669e0a16..79bb11cae00 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/use.mask
@@ -4,6 +4,10 @@
 # Unmask the flag which corresponds to ARCH.
 -arm64
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-01)
+# media-libs/libspng only keyworded on amd64, arm64
+-spng
+
 # Sam James <sam@gentoo.org> (2025-02-19)
 # x11-drivers/xf86-input-wacom is available here
 -input_devices_wacom
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
index ddacbeecd89..13d686d67e0 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
@@ -1,6 +1,11 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Michał Górny <mgorny@gentoo.org> (2025-05-08)
+# dev-python/sigstore is not keyworded everywhere.
+>=dev-lang/python-3.14 verify-sig
+>=dev-python/python-tests-3.14 verify-sig
+
 # Jimi Huotari <chiitoo@gentoo.org> (2025-04-24)
 # lxqt-base/lxqt-wayland-session is only keyworded for amd64 at this time.
 lxqt-base/lxqt-meta wayland
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
index 4dd8214f5b7..60cd7027580 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
@@ -1,6 +1,15 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-01)
+# media-libs/libspng only keyworded on amd64, arm64
+spng
+
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-01)
+# only keyworded on amd64, arm
+openni
+openni2
+
 # Thomas Bettler <thomas.bettler@gmail.com> (2024-11-04)
 # media-libs/tiff only keyworded on amd64
 lerc
@@ -170,51 +179,34 @@ nvidia
 oci8-instant-client
 oracle
 
-# not keyworded on non-x86 systems
-video_cards_geode
-
-# not needed on non-x86, non-amd64 systems
+input_devices_synaptics
 input_devices_vmmouse
+input_devices_wacom
+video_cards_asahi
 video_cards_ast
 video_cards_d3d12
+video_cards_exynos
+video_cards_freedreno
+video_cards_geode
 video_cards_i915
 video_cards_i965
+video_cards_imagination
 video_cards_intel
+video_cards_lima
 video_cards_nvidia
 video_cards_nvk
-video_cards_vesa
-video_cards_via
-video_cards_vmware
-video_cards_virtualbox
-
-# not needed on non-x86, non-amd64, non-mips systems
-video_cards_siliconmotion
-
-# not needed on non-arm systems
-video_cards_exynos
-video_cards_freedreno
-video_cards_lima
 video_cards_omap
 video_cards_panfrost
+video_cards_qxl
+video_cards_siliconmotion
 video_cards_tegra
 video_cards_v3d
 video_cards_vc4
-
-# James Le Cuirot <chewi@gentoo.org>
-# Vivante is only available for arm and mips.
+video_cards_vesa
+video_cards_via
+video_cards_virtualbox
 video_cards_vivante
-
-# linux-only drivers
-video_cards_qxl
-
-# drivers with virtgpu DRM native-context support
-# these could be unmasked on all architectures with qemu system target but
-# unmasking only tested and actually used ones is a sane default.
-video_cards_asahi
-
-# not needed on non-x86, non-amd64, non-ppc systems
-input_devices_synaptics
-input_devices_wacom
+video_cards_vmware
 
 # Robert Buchholz <rbu@gentoo.org> (2007-06-03)
 # Only works on x86 or amd64
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
index 09c69375f80..72532dea953 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Eray Aslan <eras@gentoo.org> (2025-05-08)
+# dev-db/tinycdb is not keyworded here
+net-mail/dovecot cdb
+
 # PPN-SD <nicolas.parlant@parhuet.fr> (2025-04-08)
 # media-libs/libsidplayfp is not keyworded
 media-sound/mpd sid
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
index 11ab2ec13a7..ba7bc858e1c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
@@ -97,6 +97,7 @@ sci-mathematics/maxima vtk
 # Broken bundled Eigen, fails to compile. See bug #865191.
 sci-geosciences/grass pdal
 sci-libs/vtk pdal
+media-gfx/openvdb pdal
 
 # Sam James <sam@gentoo.org> (2023-04-14)
 # Needs dev-python/sympy which is not keyworded
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
index 479b422cd4f..11fb2a964e1 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
@@ -1,6 +1,12 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-06)
+# Broken bundled Eigen, fails to compile. See bug #865191.
+sci-geosciences/grass pdal
+sci-libs/vtk pdal
+media-gfx/openvdb pdal
+
 # Alfredo Tupone <tupone@gentoo.org> (2025-05-03)
 # dependencies not yet keyworded
 sci-ml/caffe2 distributed gloo fbgemm nnpack onednn qnnpack rocm xnnpack
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/ppc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/ppc/package.use.mask
index 7261f063576..b7482738170 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/ppc/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/ppc/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 2023-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Viorel Munteanu (2025-05-06)
+# Needs dev-lang/go which is not keyworded here
+net-dialup/picocom man
+
 # NRK <nrk@disroot.org> (2025-04-07)
 # media-libs/libyuv is not keyworded
 media-libs/imlib2 y4m
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
index cbc0ac23631..fc81ac2612b 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
@@ -1,6 +1,12 @@
 # Copyright 2019-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-02)
+# Broken bundled Eigen, fails to compile. See bug #865191.
+sci-geosciences/grass pdal
+sci-libs/vtk pdal
+media-gfx/openvdb pdal
+
 # PPN-SD <nicolas.parlant@parhuet.fr> (2025-04-26)
 # dev-python/sphinx-panels is not keyworded
 net-dns/knot doc
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/rv32imac/ilp32/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/rv32imac/ilp32/make.defaults
index 4e7eed0bff7..35a8afe6179 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/rv32imac/ilp32/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/rv32imac/ilp32/make.defaults
@@ -16,6 +16,8 @@ CXXFLAGS="${CFLAGS}"
 FFLAGS="${CFLAGS}"
 FCFLAGS="${CFLAGS}"
 
+LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,-z,pack-relative-relocs -Wl,--no-keep-memory"
+
 ## Mike Gilbert <floppym@gentoo.org> (2021-12-17)
 ## Prevent automagic use of 64-bit time_t.
 ## https://bugs.gentoo.org/828001
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/rv32imac/ilp32d/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/rv32imac/ilp32d/make.defaults
index 2464269fd8e..54469cc4090 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/rv32imac/ilp32d/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/rv32imac/ilp32d/make.defaults
@@ -16,6 +16,8 @@ CXXFLAGS="${CFLAGS}"
 FFLAGS="${CFLAGS}"
 FCFLAGS="${CFLAGS}"
 
+LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,-z,pack-relative-relocs -Wl,--no-keep-memory"
+
 ## Mike Gilbert <floppym@gentoo.org> (2021-12-17)
 ## Prevent automagic use of 64-bit time_t.
 ## https://bugs.gentoo.org/828001
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/use.mask
index 2743d42cd44..0fb28d38e6a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/use.mask
@@ -49,6 +49,9 @@ mono
 # No proper support for this arch yet
 java
 
+
+-video_cards_imagination
+
 # not supported / tested cards
 
 video_cards_ast
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
index d90c82d39c4..29defb854e2 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Eray Aslan <eras@gentoo.org> (2025-05-08)
+# dev-db/tinycdb is not keyworded here
+net-mail/dovecot cdb
+
 # NRK <nrk@disroot.org> (2025-04-07)
 # media-libs/libyuv is not keyworded
 media-libs/imlib2 y4m
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/32ul/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/32ul/package.use.force
new file mode 100644
index 00000000000..ed34cbf37b9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/32ul/package.use.force
@@ -0,0 +1,6 @@
+# Copyright 2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# Andreas K. Hüttel <dilfridge@gentoo.org> (2025-05-10)
+# Fails to build without, bug #955704
+dev-libs/libgcrypt asm
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
index c15c38aff38..1eaa79ef5eb 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
@@ -1,6 +1,14 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Eray Aslan <eras@gentoo.org> (2025-05-08)
+# dev-db/tinycdb is not keyworded here
+net-mail/dovecot cdb
+
+# Viorel Munteanu (2025-05-06)
+# Needs dev-lang/go which is not keyworded here
+net-dialup/picocom man
+
 # Andreas Sturmlechner <asturm@gentoo.org> (2025-05-03)
 # dev-qt/qtbase:6 is not keyworded here
 media-libs/openal gui
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
index 71d140aac62..e8c794f0990 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-02)
+# dev-python/nanobind is not keyworded here
+media-gfx/openvdb python
+
 # Alfredo Tupone <tupone@gentoo.org> (2025-04-21)
 # ocamlopt is not available on 32 bits arch
 >=dev-lang/ocaml-5 ocamlopt
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
index 8748fa6a267..55b5f2f874f 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
@@ -330,6 +330,8 @@ dev-lang/python-exec python_targets_python3_11
 dev-lang/python-exec python_targets_python3_12
 dev-lang/python-exec python_targets_python3_13
 dev-lang/python-exec python_targets_python3_13t
+dev-lang/python-exec python_targets_python3_14
+dev-lang/python-exec python_targets_python3_14t
 dev-lang/python-exec python_targets_pypy3_11
 
 # Zac Medico <zmedico@gentoo.org> (2010-10-20)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
index 47637157358..fab7bd8bffe 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
@@ -6,6 +6,10 @@
 
 # New entries go on top.
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-01)
+# Requires llvm-15
+media-gfx/openvdb ax
+
 # Ionen Wolkens <ionen@gentoo.org> (2025-04-30)
 # Valve has modified Wine's ffmpeg code with a new pcm_byte_order_reverse_bsf.c
 # that seems riddled with issues (missing identifiers, incompatible pointer
@@ -278,7 +282,6 @@ net-analyzer/nagios-plugin-check_raid hpa
 # Michał Górny <mgorny@gentoo.org> (2023-12-22)
 # Requires LLVM 14 that is being removed.
 <dev-lang/ghc-9.4 llvm
-<media-gfx/openvdb-11 ax
 sys-devel/sparse llvm
 
 # Takuya Wakazono <pastalian46@gmail.com> (2023-11-21)
@@ -565,12 +568,6 @@ sys-devel/gcc custom-cflags
 # situation is resolved.
 dev-util/rizin test
 
-# Sam James <sam@gentoo.org> (2021-12-27)
-# Doc building is broken and no new releases in a long time.
-# bug #830013
-# fixed in sci-libs/flann-1.9.2-20221027
-<=sci-libs/flann-1.9.2 doc
-
 # Joonas Niilola <juippis@gentoo.org> (2021-12-20)
 # Broken, upstream issue/PR open since 2021-05 without reply.
 # Gentoo bug #821253
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask
index 16f1277362b..a04c5a5a146 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask
@@ -4,6 +4,10 @@
 # New entries go on top.
 # Please use the same syntax as in package.use.mask.
 
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-06)
+# USE=experimental is not stable by definition
+media-libs/zxing-cpp experimental
+
 # Michał Górny <mgorny@gentoo.org> (2024-04-12)
 # dev-python/mpi4py has no stable keywords.
 media-gfx/netgen mpi
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/base/use.stable.mask
index 7fdb45177a2..aa52f352586 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/use.stable.mask
@@ -20,6 +20,10 @@ ruby_targets_ruby33
 
 # Michał Górny <mgorny@gentoo.org> (2024-05-08)
 # Python implementations without stable keywords.
+python_targets_python3_14t
+python_single_target_python3_14t
+python_targets_python3_14
+python_single_target_python3_14
 python_targets_python3_13t
 python_single_target_python3_13t
 python_targets_pypy3_11
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/make.defaults
new file mode 100644
index 00000000000..8fe4a1e300f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/make.defaults
@@ -0,0 +1 @@
+LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,-z,pack-relative-relocs"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/make.defaults
new file mode 100644
index 00000000000..8fe4a1e300f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/make.defaults
@@ -0,0 +1 @@
+LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,-z,pack-relative-relocs"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/desc/apache2_modules.desc b/sdk_container/src/third_party/portage-stable/profiles/desc/apache2_modules.desc
index f557f4279de..2370787710d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/desc/apache2_modules.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/desc/apache2_modules.desc
@@ -1,4 +1,4 @@
-# Copyright 2007-2023 Gentoo Authors
+# Copyright 2007-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # This file contains descriptions of APACHE2_MODULES USE_EXPAND flags.
@@ -81,6 +81,7 @@ proxy_wstunnel - Provides support for the tunnelling of web socket connections t
 ratelimit - Bandwidth Rate Limiting for Clients
 remoteip - Replaces the original client IP address for the connection with the useragent IP address list presented by a proxies or a load balancer via the request headers
 reqtimeout - Set timeout and minimum data rate for receiving requests
+request - Filters to handle and make available HTTP request bodies
 rewrite - Provides a rule-based rewriting engine to rewrite requested URLs on the fly
 session - Provides support for a server wide per user session interface
 session_crypto - Provides support for the encryption of user sessions before being written to a local database, or written to a remote browser via an HTTP cookie
diff --git a/sdk_container/src/third_party/portage-stable/profiles/desc/python_single_target.desc b/sdk_container/src/third_party/portage-stable/profiles/desc/python_single_target.desc
index 8e38ae89b7a..2b074a3ceaa 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/desc/python_single_target.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/desc/python_single_target.desc
@@ -7,4 +7,6 @@ python3_11 - Build for Python 3.11 only
 python3_12 - Build for Python 3.12 only
 python3_13 - Build for Python 3.13 only
 python3_13t - Build for Python 3.13 freethreading only
+python3_14 - Build for Python 3.14 only
+python3_14t - Build for Python 3.14 freethreading only
 pypy3_11 - Build for PyPy3.11 only
diff --git a/sdk_container/src/third_party/portage-stable/profiles/desc/python_targets.desc b/sdk_container/src/third_party/portage-stable/profiles/desc/python_targets.desc
index 7b3fedd5245..ea191dccdac 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/desc/python_targets.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/desc/python_targets.desc
@@ -7,4 +7,6 @@ python3_11 - Build with Python 3.11
 python3_12 - Build with Python 3.12
 python3_13 - Build with Python 3.13
 python3_13t - Build with Python 3.13 freethreading
+python3_14 - Build with Python 3.14
+python3_14t - Build with Python 3.14 freethreading
 pypy3_11 - Build with PyPy3.11
diff --git a/sdk_container/src/third_party/portage-stable/profiles/desc/video_cards.desc b/sdk_container/src/third_party/portage-stable/profiles/desc/video_cards.desc
index da5843660cd..ff6013e04ac 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/desc/video_cards.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/desc/video_cards.desc
@@ -16,6 +16,7 @@ fbdev - VIDEO_CARDS setting to build driver for fbdev video cards
 geode - VIDEO_CARDS setting to build driver for AMD Geode GX and LX video cards
 i915 - VIDEO_CARDS setting to build driver for Intel i915 video cards
 i965 - VIDEO_CARDS setting to build driver for Intel i965 video cards
+imagination - VIDEO_CARDS setting to build driver for Imagination video cards
 intel - VIDEO_CARDS setting to build driver for Intel video cards
 lavapipe - VIDEO_CARDS setting to build Vulkan software rasterizer using LLVMpipe
 lima - VIDEO_CARDS setting to build driver for Mali 200/400 video cards
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.mask
index e73e7f48e57..259b2680917 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.mask
@@ -25,6 +25,7 @@ net-libs/quiche
 
 # matoro <matoro_gentoo@matoro.tk> (2023-11-17)
 # media-libs/libvpx casualties (#700902)
+media-gfx/blender
 media-plugins/gst-plugins-vpx
 dev-qt/qtwebengine
 www-client/falkon
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.use.mask
index cdb1f2f138e..3b2be0d3fea 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.use.mask
@@ -16,6 +16,7 @@ media-libs/gexiv2 test
 
 # matoro <matoro_gentoo@matoro.tk> (2023-11-16)
 # media-libs/libvpx casualties (#700902)
+media-libs/opencv test
 media-video/ffmpeg vpx
 media-video/ffmpeg-compat vpx
 www-client/firefox system-libvpx
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/use.mask
index 792562b3f91..5056e649fe3 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/use.mask
@@ -1,6 +1,10 @@
 # Copyright 2023-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-02)
+# media-gfx/alembic is masked (#884295)
+alembic
+
 # matoro <matoro_gentoo@matoro.tk> (2023-06-30)
 # media-libs/libjxl casualties
 # https://github.com/libjxl/libjxl/issues/2433
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
index f7e7e704309..543598b0d56 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
@@ -448,6 +448,7 @@ dev-libs/optix
 media-libs/nvidia-vaapi-driver
 x11-drivers/nvidia-drivers
 x11-misc/primus
+dev-libs/cusparselt
 
 # Ulrich Müller (2020-03-31)
 # Not ported to musl, bug #715642.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
index 0a3b4219a52..2dcab9199d6 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
@@ -1,6 +1,16 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Michał Górny <mgorny@gentoo.org> (2024-05-08)
+# The sigstore bundle.
+dev-python/betterproto
+dev-python/securesystemslib
+dev-python/sigstore
+dev-python/sigstore-protobuf-specs
+dev-python/sigstore-rekor-types
+dev-python/rfc3161-client
+dev-python/tuf
+
 # Michał Górny <mgorny@gentoo.org> (2024-04-20)
 # The mitmproxy bundle.
 dev-python/mitmproxy-wireguard
@@ -223,6 +233,7 @@ app-crypt/certbot-nginx
 app-crypt/rpm-sequoia
 app-emulation/virtiofsd
 app-eselect/eselect-rust
+app-misc/gramps
 app-misc/khal
 app-text/mdbook
 dev-embedded/esptool
diff --git a/sdk_container/src/third_party/portage-stable/profiles/license_groups b/sdk_container/src/third_party/portage-stable/profiles/license_groups
index 0f36cdbdf27..e18adffcb8a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/license_groups
+++ b/sdk_container/src/third_party/portage-stable/profiles/license_groups
@@ -15,7 +15,7 @@
 # https://www.gnu.org/licenses/license-list.html
 # GPL or LGPL with various exceptions are also included here, because
 # they are more permissive than the licenses they are based on.
-GPL-COMPATIBLE AGPL-3 AGPL-3+ Apache-2.0 Apache-2.0-with-LLVM-exceptions Artistic-2 Boost-1.0 BSD BSD-2 CC0-1.0 CeCILL-2 Clarified-Artistic Clear-BSD ECL-2.0 FSFAP FTL gcc-runtime-library-exception-3.1 GPL-1 GPL-1+ GPL-2 GPL-2+ GPL-2+-with-openssl-exception GPL-2+-with-eCos-exception-2 GPL-2-with-classpath-exception GPL-2-with-font-exception GPL-2-with-linking-exception GPL-2-with-MySQL-FLOSS-exception GPL-2+-with-Pyinstaller-Bootloader-exception GPL-3 GPL-3+ GPL-3+-with-autoconf-exception GPL-3+-with-font-exception GPL-3+-with-openssl-exception GPL-3-with-font-exception GPL-3-with-openssl-exception HPND IJG ISC LGPL-2 LGPL-2+ LGPL-2-with-linking-exception LGPL-2.1 LGPL-2.1+ LGPL-2.1-with-linking-exception LGPL-3 LGPL-3+ LGPL-3-with-linking-exception libgcc libstdc++ metapackage MIT MPL-2.0 Nokia-Qt-LGPL-Exception-1.1 OPENLDAP PSF-2 PSF-2.4 public-domain PYTHON qwt Ruby Ruby-BSD SGI-B-2.0 Sleepycat tanuki-community Transmission-OpenSSL-exception Unicode-DFS-2016 Unlicense UoI-NCSA UPL-1.0 UPX-exception vim W3C WTFPL-2 wxWinLL-3.1 ZLIB ZPL
+GPL-COMPATIBLE AGPL-3 AGPL-3+ Apache-2.0 Apache-2.0-with-LLVM-exceptions Artistic-2 Boost-1.0 BSD BSD-2 CC0-1.0 CeCILL-2 Clarified-Artistic Clear-BSD ECL-2.0 FSFAP FTL gcc-runtime-library-exception-3.1 GPL-1 GPL-1+ GPL-2 GPL-2+ GPL-2+-with-openssl-exception GPL-2+-with-eCos-exception-2 GPL-2-with-classpath-exception GPL-2-with-font-exception GPL-2-with-linking-exception GPL-2-with-MySQL-FLOSS-exception GPL-2+-with-Pyinstaller-Bootloader-exception GPL-3 GPL-3+ GPL-3+-with-autoconf-exception GPL-3+-with-font-exception GPL-3+-with-openssl-exception GPL-3-with-font-exception GPL-3-with-openssl-exception HPND IJG ISC LGPL-2 LGPL-2+ LGPL-2-with-linking-exception LGPL-2.1 LGPL-2.1+ LGPL-2.1-with-linking-exception LGPL-3 LGPL-3+ LGPL-3-with-linking-exception libgcc libstdc++ metapackage MIT MPL-2.0 Nokia-Qt-LGPL-Exception-1.1 OPENLDAP PSF-2 PSF-2.4 public-domain PYTHON qwt Ruby Ruby-BSD SGI-B-2.0 Sleepycat tanuki-community Transmission-OpenSSL-exception Unicode-DFS-2015 Unicode-DFS-2016 Unlicense UoI-NCSA UPL-1.0 UPX-exception vim W3C WTFPL-2 wxWinLL-3.1 ZLIB ZPL
 
 # Free software licenses approved by the FSF
 FSF-APPROVED @GPL-COMPATIBLE AFL-2.1 AFL-3.0 Apache-1.0 Apache-1.1 APSL-2 BSD-4 CDDL CeCILL-B CeCILL-C CNRI CPAL-1.0 CPL-1.0 EPL-1.0 EPL-2.0 EUPL-1.1 EUPL-1.2 FraunhoferFDK gnuplot IBM LPL-1.02 LPPL-1.2 LPPL-1.3a MPL-1.0 MPL-1.1 Ms-PL Ms-RL NPL-1.1 openssl OSL-1.1 OSL-2.0 OSL-2.1 PHP-3.01 QPL-1.0 Zend-2.0
@@ -25,7 +25,7 @@ FSF-APPROVED @GPL-COMPATIBLE AFL-2.1 AFL-3.0 Apache-1.0 Apache-1.1 APSL-2 BSD-4
 # Note that the FSF lists these as nonfree: Artistic NOSA Watcom-1.0
 # We exclude NOSA and Watcom-1.0, but we keep Artistic because Debian
 # considers it DFSG-free.
-OSI-APPROVED-FREE 0BSD AFL-3.0 AGPL-3 AGPL-3+ Apache-1.1 Apache-2.0 APL-1.0 APSL-2 Artistic Artistic-2 BlueOak-1.0.0 Boost-1.0 BSD BSD-2 CDDL CNRI CPAL-1.0 CPL-1.0 ECL-2.0 EPL-1.0 EPL-2.0 EUPL-1.1 EUPL-1.2 GPL-1 GPL-1+ GPL-2 GPL-2+ GPL-3 GPL-3+ HPND IBM IPAfont ISC LBNLBSD LGPL-2 LGPL-2+ LGPL-2.1 LGPL-2.1+ LGPL-3 LGPL-3+ LPL-1.02 LPPL-1.3c MirOS MIT MIT-0 MPL-1.0 MPL-1.1 MPL-2.0 Ms-PL Ms-RL nethack OFL-1.1 OSL-2.1 PHP-3 PHP-3.01 POSTGRESQL PSF-2 QPL-1.0 Sleepycat Unicode-3.0 Unicode-DFS-2016 Unlicense UPL-1.0 UoI-NCSA W3C wxWinLL-3 ZLIB ZPL
+OSI-APPROVED-FREE 0BSD AFL-3.0 AGPL-3 AGPL-3+ Apache-1.1 Apache-2.0 APL-1.0 APSL-2 Artistic Artistic-2 BlueOak-1.0.0 Boost-1.0 BSD BSD-2 CDDL CNRI CPAL-1.0 CPL-1.0 ECL-2.0 EPL-1.0 EPL-2.0 EUPL-1.1 EUPL-1.2 GPL-1 GPL-1+ GPL-2 GPL-2+ GPL-3 GPL-3+ HPND IBM IPAfont ISC LBNLBSD LGPL-2 LGPL-2+ LGPL-2.1 LGPL-2.1+ LGPL-3 LGPL-3+ LPL-1.02 LPPL-1.3c MirOS MIT MIT-0 MPL-1.0 MPL-1.1 MPL-2.0 Ms-PL Ms-RL nethack OFL-1.1 OSL-2.1 PHP-3 PHP-3.01 POSTGRESQL PSF-2 QPL-1.0 Sleepycat Unicode-3.0 Unicode-DFS-2015 Unicode-DFS-2016 Unlicense UPL-1.0 UoI-NCSA W3C wxWinLL-3 ZLIB ZPL
 
 # Misc licenses that are probably free software, i.e. follow the
 # Free Software Definition at https://www.gnu.org/philosophy/free-sw.html
@@ -34,7 +34,7 @@ OSI-APPROVED-FREE 0BSD AFL-3.0 AGPL-3 AGPL-3+ Apache-1.1 Apache-2.0 APL-1.0 APSL
 # Licenses in this list should NOT appear directly or indirectly in
 # @FSF-APPROVED or @OSI-APPROVED.
 # Note: Licenses for fonts should be included in @MISC-FREE-DOCS.
-MISC-FREE AIFFWriter.m Allegro alternate AMPAS BEER-WARE boehm-gc BSD-1 BSD-2-with-patent BSD-with-attribution BSD-with-disclosure buddy bufexplorer.vim BZIP2 CAOSL CDDL-1.1 CDDL-Schily coldspringharbor CPL-0.5 Crypt-IDEA curl DES docbook dom4j DUMB-0.9.3 ElementTree Emacs ErlPL-1.1 FastCGI feh File-MMagic Flashpix FLEX flexmock FLTK freetts FVWM gd gsm HTML-Tidy iASL icu IDPL imagemagick Info-ZIP inner-net ipadic Ispell JasPer2.0 JDOM JOVE Khronos-CLHPP LambdaMOO LIBGLOSS libmng libpng libpng2 libtiff LLGPL-2.1 LPPL-1.0 LPPL-1.3 lsof matplotlib Mini-XML minpack MIT-with-advertising mm mpich2 NCSA-AMD NCSA-HDF netcat NEWLIB ngrep NPSL-0.95 Old-MIT openafs-krb5-a Openwall otter par PCRE perforce photopc PHP-2.02 pngcrush pngnq Princeton psutils rc rdisc regexp-UofT repoze RSA RtMidi rwpng sash scanlogd sdlsasteroids Sendmail Sendmail-Open-Source SMAIL Snd Spencer-99 SSLeay symlinks Sympow-BSD tablelist tcltk tcp_wrappers_license TeX TeX-other-free TextMate-bundle the-Click-license Time-Format Time-modules tm-align torque-2.5 Toyoda trio UCAR-Unidata unicode URT VTK w3m wm2 xbatt xboing XC Xdebug xtrs ZSH
+MISC-FREE AIFFWriter.m Allegro alternate AMPAS Base64 BEER-WARE boehm-gc BSD-1 BSD-2-with-patent BSD-with-attribution BSD-with-disclosure buddy bufexplorer.vim BZIP2 CAOSL CDDL-1.1 CDDL-Schily coldspringharbor CPL-0.5 Crypt-IDEA curl DES docbook dom4j DUMB-0.9.3 ElementTree Emacs ErlPL-1.1 FastCGI feh FFT2D File-MMagic Flashpix FLEX flexmock FLTK freetts FVWM gd gsm HTML-Tidy iASL icu IDPL imagemagick Info-ZIP inner-net ipadic Ispell JasPer2.0 JDOM JOVE Khronos-CLHPP LambdaMOO LIBGLOSS libmng libpng libpng2 libtiff LLGPL-2.1 LPPL-1.0 LPPL-1.3 lsof matplotlib Mini-XML minpack MIT-with-advertising mm mpich2 NCSA-AMD NCSA-HDF netcat NEWLIB ngrep NPSL-0.95 Old-MIT openafs-krb5-a Openwall otter par PCRE perforce photopc PHP-2.02 pngcrush pngnq Princeton psutils rc rdisc regexp-UofT repoze RSA RtMidi rwpng sash scanlogd sdlsasteroids Sendmail Sendmail-Open-Source SMAIL Snd Spencer-99 SSLeay SunSoft symlinks Sympow-BSD tablelist tcltk tcp_wrappers_license TeX TeX-other-free TextMate-bundle the-Click-license Time-Format Time-modules tm-align torque-2.5 Toyoda trio UCAR-Unidata unicode URT VTK w3m wm2 X11-Lucent xbatt xboing XC Xdebug xtrs ZSH
 
 # Metaset for all free software
 FREE-SOFTWARE @FSF-APPROVED @OSI-APPROVED-FREE @MISC-FREE
diff --git a/sdk_container/src/third_party/portage-stable/profiles/package.mask b/sdk_container/src/third_party/portage-stable/profiles/package.mask
index 826d8063863..984b74df435 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/package.mask
@@ -36,6 +36,32 @@
 
 #--- END OF EXAMPLES ---
 
+# Petr Vaněk <arkamar@gentoo.org> (2025-05-10)
+# Unmaintained upstream, incompatible with py3.12+, no revdeps, see
+# https://github.com/torproject/stem/issues/154 and
+# https://github.com/torproject/nyx/issues/68
+# Removal on 2025-06-09.
+net-libs/stem
+net-misc/nyx
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-08)
+# No more revdeps. Removal on 2025-05-31.
+kde-frameworks/kinit
+
+# Eray Aslan <eras@gentoo.org> (2025-05-08)
+# Needs testing
+=net-mail/dovecot-2.4*
+
+# Michał Górny <mgorny@gentoo.org> (2025-05-08)
+# Vulnerable, EOL branch of dev-python/django.  Bug #955606.
+# Pleas upgrade to 5.1, 5.2 LTS, or downgrade to 4.2 LTS.
+=dev-python/django-5.0*
+
+# Alfred Wingate <parona@protonmail.com> (2025-05-05)
+# Masked for testing
+>=dev-libs/libxml2-2.14
+dev-libs/libxml2-compat
+
 # Andreas Sturmlechner <asturm@gentoo.org> (2025-05-04)
 # Several open bugs, pending bump since 2020, fails to fetch since 2022.
 # If anyone is here to fix these things, then please make upstream port
@@ -68,7 +94,6 @@ sci-electronics/osqoop
 
 # Matt Turner <mattst88@gentoo.org> (2024-05-02)
 # Masked for testing
-=dev-util/mesa_clc-25.1*
 =media-libs/mesa-25.1*
 
 # Marc Schiffbauer <mschiff@gentoo.org> (2025-05-02)
@@ -212,25 +237,6 @@ dev-python/ipaddr
 # slot instead. Masked for removal on 2025-05-14.
 dev-ruby/childprocess:2
 
-# Michał Górny <mgorny@gentoo.org> (2025-04-09)
-# Still uses legacy distutils-r1 mode, and lacks Python 3.13 target.
-# No reply from the maintainer for a year now.
-# Removal on 2025-05-09.  Bug #909900.
-app-text/nfoview
-
-# Matt Turner <mattst88@gentoo.org> (2025-04-04)
-# Package is dead (last release in 1999).
-# Not relevant today: purpose is to not overload a very slow system with
-# multiple X11 clients starting at the same time. SRC_URI is long dead.
-# Removal on 2025-05-04.  Bug #953120.
-x11-misc/xtoolwait
-
-# Matt Turner <mattst88@gentoo.org> (2025-04-04)
-# Package is dead and has a pile of patches to make it compile.
-# SRC_URI is long gone. Many alternative image viewers.
-# Removal on 2025-05-04.  Bug #953119.
-media-gfx/xloadimage
-
 # Ionen Wolkens <ionen@gentoo.org> (2025-04-02)
 # Masked for testing the new .0 version and leave time for packages
 # to catch up on support if needed. May or may keep masked until 6.9.1
@@ -466,9 +472,11 @@ app-emulation/virtualbox-kvm
 ~sys-boot/plymouth-24.004.60
 
 # Sam James <sam@gentoo.org> (2024-09-30)
-# GCC 10 and older no longer receive upstream support or fixes for
+# GCC 11 and older no longer receive upstream support or fixes for
 # bugs. Please switch to a newer GCC version using gcc-config.
-# The lowest supported version of GCC is GCC 11.
+#
+# The earliest supported version of GCC is GCC 12, but 11 remains unmasked
+# for now to ease sys-devel/gcc[d] bootstrapping.
 <sys-devel/gcc-11
 <sys-devel/kgcc64-11
 
@@ -662,10 +670,10 @@ media-plugins/kodi-game-libretro-dosbox
 # If you still use one of these old toolchain packages, please upgrade (and
 # switch the compiler / the binutils) ASAP. If you need them for a specific
 # (isolated) use case, feel free to unmask them on your system.
-<sys-libs/glibc-2.38-r10
-<sys-libs/binutils-libs-2.42
-<sys-devel/binutils-2.42
-<sys-devel/binutils-hppa64-2.42
+<sys-libs/glibc-2.40-r8
+<sys-libs/binutils-libs-2.43-r3
+<sys-devel/binutils-2.43-r2
+<sys-devel/binutils-hppa64-2.43-r2
 
 # Michael Orlitzky <mjo@gentoo.org> (2017-01-07)
 # This package has some dangerous quality and security issues, but
diff --git a/sdk_container/src/third_party/portage-stable/profiles/thirdpartymirrors b/sdk_container/src/third_party/portage-stable/profiles/thirdpartymirrors
index bb539889697..8a255a61f38 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/thirdpartymirrors
+++ b/sdk_container/src/third_party/portage-stable/profiles/thirdpartymirrors
@@ -10,7 +10,7 @@ gnupg		https://www.mirrorservice.org/sites/ftp.gnupg.org/gcrypt/ https://mirrors
 goproxy https://proxy.golang.org/ https://goproxy.io/
 idsoftware	ftp://ftp.fu-berlin.de/pc/games/idgames/idstuff ftp://ftp.gamers.org/pub/idgames/idstuff
 imagemagick	https://imagemagick.org/archive/releases/ https://mirror.checkdomain.de/imagemagick/releases/ https://ftp.acc.umu.se/mirror/imagemagick.org/ftp/releases/ ftp://ftp.fifi.org/pub/ImageMagick/releases/
-kde		https://download.kde.org https://mirror.csclub.uwaterloo.ca/kde ftp://mirrors.dotsrc.org/kde http://kde.mirror.anlx.net
+kde		https://download.kde.org https://mirror.csclub.uwaterloo.ca/kde ftp://mirrors.dotsrc.org/kde https://ftp.gwdg.de/pub/linux/kde https://ftp.mirrorservice.org/sites/ftp.kde.org/pub/kde
 lokigames	http://updates.lokigames.com
 mariadb		https://archive.mariadb.org/ http://ftp.bme.hu/pub/mirrors/mariadb/ https://ftp.nluug.nl/db/mariadb/ https://mirrors.up.pt/pub/mariadb/ https://rsync.osuosl.org/pub/mariadb/ https://mirror.netcologne.de/mariadb/
 mplayer		https://www1.mplayerhq.hu/MPlayer http://www2.mplayerhq.hu/MPlayer http://www7.mplayerhq.hu/MPlayer http://www8.mplayerhq.hu/MPlayer ftp://ftp1.mplayerhq.hu/MPlayer/ ftp://ftp6.mplayerhq.hu/MPlayer/ ftp://ftp7.mplayerhq.hu/MPlayer/ ftp://ftp8.mplayerhq.hu/MPlayer/

From b595675d887748bf1b575337b8cbda94d6188a47 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:11:38 +0000
Subject: [PATCH 103/136] sys-apps/attr: Sync with Gentoo

It's from Gentoo commit 35eb56280d7143bc6945b3cbaa209702109c85f1.
---
 .../portage-stable/sys-apps/attr/attr-2.5.2-r1.ebuild      | 7 +++++--
 .../portage-stable/sys-apps/attr/attr-9999.ebuild          | 7 +++++--
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/attr/attr-2.5.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/attr/attr-2.5.2-r1.ebuild
index a055cb13a55..dfe43b9e635 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/attr/attr-2.5.2-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/attr/attr-2.5.2-r1.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-inherit multilib-minimal
+inherit dot-a multilib-minimal
 
 if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://git.savannah.gnu.org/git/${PN}.git"
@@ -42,6 +42,8 @@ src_prepare() {
 }
 
 multilib_src_configure() {
+	use static-libs && lto-guarantee-fat
+
 	local myeconfargs=(
 		--bindir="${EPREFIX}"/bin
 		--libexecdir="${EPREFIX}"/usr/$(get_libdir)
@@ -68,5 +70,6 @@ multilib_src_install_all() {
 		find "${ED}" -name '*.la' -delete || die
 	fi
 
+	strip-lto-bytecode
 	einstalldocs
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/attr/attr-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/attr/attr-9999.ebuild
index 35f3c75e822..6973625cc4e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/attr/attr-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/attr/attr-9999.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-inherit multilib-minimal
+inherit dot-a multilib-minimal
 
 if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://git.savannah.gnu.org/git/${PN}.git"
@@ -42,6 +42,8 @@ src_prepare() {
 }
 
 multilib_src_configure() {
+	use static-libs && lto-guarantee-fat
+
 	local myeconfargs=(
 		--bindir="${EPREFIX}"/bin
 		--libexecdir="${EPREFIX}"/usr/$(get_libdir)
@@ -68,5 +70,6 @@ multilib_src_install_all() {
 		find "${ED}" -name '*.la' -delete || die
 	fi
 
+	strip-lto-bytecode
 	einstalldocs
 }

From f16ab2ca6449333ecd3a294aa54ec17d3b411908 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:11:39 +0000
Subject: [PATCH 104/136] sys-apps/checkpolicy: Sync with Gentoo

It's from Gentoo commit fab3f74a44e500b058baea1c5f4143111a691eca.
---
 .../sys-apps/checkpolicy/checkpolicy-3.8.1.ebuild               | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.8.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.8.1.ebuild
index b5524796510..22a24ddad25 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.8.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.8.1.ebuild
@@ -17,7 +17,7 @@ if [[ ${PV} == 9999 ]] ; then
 	S="${WORKDIR}/${P}/${PN}"
 else
 	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
-	KEYWORDS="~amd64 ~arm ~arm64 ~mips ~riscv ~x86"
+	KEYWORDS="amd64 arm arm64 ~mips ~riscv x86"
 	S="${WORKDIR}/${MY_P}"
 fi
 

From ed90ce16f6fc6fdf279a46f6bdf7a0e7607be2db Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:11:43 +0000
Subject: [PATCH 105/136] sys-apps/diffutils: Sync with Gentoo

It's from Gentoo commit 513fa5a25f49664bddad3ab0970410d4cc2f52f8.
---
 .../portage-stable/sys-apps/diffutils/diffutils-3.12.ebuild     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/diffutils-3.12.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/diffutils-3.12.ebuild
index 54d4be116e3..675a517e46d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/diffutils-3.12.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/diffutils-3.12.ebuild
@@ -20,7 +20,7 @@ if [[ ${PV} == *_p* ]] ; then
 else
 	SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
 	SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="GPL-2"

From a094b03bca4e18a271ab1b7e083a4189075239a2 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:11:43 +0000
Subject: [PATCH 106/136] sys-apps/dtc: Sync with Gentoo

It's from Gentoo commit 300e466631a529b6a095675253a6406763b9753c.
---
 .../{dtc-1.7.2-r1.ebuild => dtc-1.7.2-r2.ebuild}    | 13 ++++++++-----
 .../portage-stable/sys-apps/dtc/dtc-9999.ebuild     | 10 +++++-----
 2 files changed, 13 insertions(+), 10 deletions(-)
 rename sdk_container/src/third_party/portage-stable/sys-apps/dtc/{dtc-1.7.2-r1.ebuild => dtc-1.7.2-r2.ebuild} (87%)

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-1.7.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-1.7.2-r2.ebuild
similarity index 87%
rename from sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-1.7.2-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-1.7.2-r2.ebuild
index 964f035d268..7b50b6fbaec 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-1.7.2-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-1.7.2-r2.ebuild
@@ -3,8 +3,8 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} )
-inherit meson python-single-r1
+PYTHON_COMPAT=( python3_{11..13} )
+inherit dot-a meson python-single-r1
 
 if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://git.kernel.org/pub/scm/utils/dtc/dtc.git"
@@ -61,6 +61,7 @@ pkg_setup() {
 }
 
 src_configure() {
+	use static-libs && lto-guarantee-fat
 	local emesonargs=(
 		-Dtools=true
 		-Dvalgrind=disabled # only used for some tests
@@ -69,14 +70,16 @@ src_configure() {
 		$(meson_feature yaml)
 	)
 
-	# bug #909366
-	use static-libs && emesonargs+=( -Dstatic-build=true )
-
 	meson_src_configure
 }
 
 src_install() {
 	meson_src_install
+	if use !static-libs; then
+		# bug #907940
+		rm "${ED}/usr/$(get_libdir)"/*.a || die
+	fi
+	strip-lto-bytecode
 
 	use python && python_optimize "${ED}"
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-9999.ebuild
index 3f84b5746fa..3095155f0e3 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-9999.ebuild
@@ -3,8 +3,8 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} )
-inherit meson python-single-r1
+PYTHON_COMPAT=( python3_{11..13} )
+inherit dot-a meson python-single-r1
 
 if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://git.kernel.org/pub/scm/utils/dtc/dtc.git"
@@ -56,7 +56,9 @@ pkg_setup() {
 }
 
 src_configure() {
+	use static-libs && lto-guarantee-fat
 	local emesonargs=(
+		-Ddefault_library=$(usex static-libs both shared)
 		-Dtools=true
 		-Dvalgrind=disabled # only used for some tests
 		$(meson_feature python)
@@ -64,14 +66,12 @@ src_configure() {
 		$(meson_feature yaml)
 	)
 
-	# bug #909366
-	use static-libs && emesonargs+=( -Dstatic-build=true )
-
 	meson_src_configure
 }
 
 src_install() {
 	meson_src_install
+	strip-lto-bytecode
 
 	use python && python_optimize "${ED}"
 }

From 0617be4340bc9a65353aa367eec5bc59cb3c4496 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:11:44 +0000
Subject: [PATCH 107/136] sys-apps/file: Sync with Gentoo

It's from Gentoo commit 478efacd8670e7836bd30f9359fbe467e68afce5.
---
 .../portage-stable/sys-apps/file/file-5.46-r2.ebuild            | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.46-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.46-r2.ebuild
index bf8ef8f09f9..6c791e40209 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.46-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.46-r2.ebuild
@@ -18,7 +18,7 @@ else
 	SRC_URI="https://astron.com/pub/file/${P}.tar.gz"
 	SRC_URI+=" verify-sig? ( https://astron.com/pub/file/${P}.tar.gz.asc )"
 
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-file )"
 fi

From 9e78e413c5d48a65505b62950af54f7f5e879307 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:11:45 +0000
Subject: [PATCH 108/136] sys-apps/gawk: Sync with Gentoo

It's from Gentoo commit 390ee512158d6a8c7a72c9659d8fbe278ed0aa04.
---
 .../third_party/portage-stable/sys-apps/gawk/gawk-5.3.2.ebuild  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.2.ebuild
index 9972bde7f7d..9925c2a4518 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.2.ebuild
@@ -29,7 +29,7 @@ else
 	SRC_URI="mirror://gnu/gawk/${P}.tar.xz"
 	SRC_URI+=" verify-sig? ( mirror://gnu/gawk/${P}.tar.xz.sig )"
 
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="GPL-3+"

From aeff3616182ad32e70e595bf155c83ffa9ae1c34 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:11:53 +0000
Subject: [PATCH 109/136] sys-apps/iproute2: Sync with Gentoo

It's from Gentoo commit a07f997c521cf2a5ca2ebc755f53d0e1f5d358fe.
---
 .../portage-stable/sys-apps/iproute2/iproute2-6.14.0.ebuild   | 4 +++-
 .../portage-stable/sys-apps/iproute2/iproute2-9999.ebuild     | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.14.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.14.0.ebuild
index dc463bb807c..1a434fec50e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.14.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.14.0.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit edo toolchain-funcs flag-o-matic
+inherit dot-a edo toolchain-funcs flag-o-matic
 
 if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
@@ -86,6 +86,7 @@ src_prepare() {
 
 src_configure() {
 	tc-export AR CC PKG_CONFIG
+	lto-guarantee-fat
 
 	# This sure is ugly. Should probably move into toolchain-funcs at some point.
 	local setns
@@ -210,4 +211,5 @@ src_install() {
 	elif [[ -d "${ED}"/var/lib/arpd ]]; then
 		rmdir --ignore-fail-on-non-empty -p "${ED}"/var/lib/arpd || die
 	fi
+	strip-lto-bytecode
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild
index dcaf60620fa..dfc30230bd4 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit edo toolchain-funcs flag-o-matic
+inherit dot-a edo toolchain-funcs flag-o-matic
 
 if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
@@ -86,6 +86,7 @@ src_prepare() {
 
 src_configure() {
 	tc-export AR CC PKG_CONFIG
+	lto-guarantee-fat
 
 	# This sure is ugly. Should probably move into toolchain-funcs at some point.
 	local setns
@@ -210,4 +211,5 @@ src_install() {
 	elif [[ -d "${ED}"/var/lib/arpd ]]; then
 		rmdir --ignore-fail-on-non-empty -p "${ED}"/var/lib/arpd || die
 	fi
+	strip-lto-bytecode
 }

From ee1fc06d2312561f417cf795f1efde6408f9c8c8 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:12:19 +0000
Subject: [PATCH 110/136] sys-apps/semodule-utils: Sync with Gentoo

It's from Gentoo commit 4720877f3f3563ee4353bd30e9ca01d6931a1f5a.
---
 .../sys-apps/semodule-utils/semodule-utils-3.8.1.ebuild         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/semodule-utils/semodule-utils-3.8.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/semodule-utils/semodule-utils-3.8.1.ebuild
index 184020a21d9..090a025102f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/semodule-utils/semodule-utils-3.8.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/semodule-utils/semodule-utils-3.8.1.ebuild
@@ -17,7 +17,7 @@ if [[ ${PV} == *9999 ]] ; then
 	S="${WORKDIR}/${P}/${PN}"
 else
 	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
-	KEYWORDS="~amd64 ~arm ~arm64 ~mips ~x86"
+	KEYWORDS="amd64 arm arm64 ~mips x86"
 	S="${WORKDIR}/${MY_P}"
 fi
 

From 129dbbd916ee651312b3b54f61856405e4a5ff34 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:12:20 +0000
Subject: [PATCH 111/136] sys-apps/texinfo: Sync with Gentoo

It's from Gentoo commit 771d5c3056b5983c107ee983de8664deecc4227c.
---
 .../portage-stable/sys-apps/texinfo/texinfo-7.2.ebuild          | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/texinfo/texinfo-7.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/texinfo/texinfo-7.2.ebuild
index 51327c186fc..fab8ace23ef 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/texinfo/texinfo-7.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/texinfo/texinfo-7.2.ebuild
@@ -27,7 +27,7 @@ elif [[ $(ver_cut 3) -ge 90 || $(ver_cut 4) -ge 90 ]] ; then
 	REGEN_BDEPEND=""
 else
 	SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	REGEN_BDEPEND=""
 fi
 

From 6f07e712bbb5effebb528cefa96cacc7c4030ed2 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:12:20 +0000
Subject: [PATCH 112/136] sys-apps/usbutils: Sync with Gentoo

It's from Gentoo commit 294c2dac181ff7c8e4195521c7be1600e5dadeb5.
---
 .../portage-stable/sys-apps/usbutils/usbutils-018-r1.ebuild     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/usbutils/usbutils-018-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/usbutils/usbutils-018-r1.ebuild
index 2f00ea1e981..82616c1f0d7 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/usbutils/usbutils-018-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/usbutils/usbutils-018-r1.ebuild
@@ -15,7 +15,7 @@ SRC_URI="https://www.kernel.org/pub/linux/utils/usb/${PN}/${P}.tar.xz"
 
 LICENSE="GPL-2+"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
 IUSE="python usbreset"
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 

From 5f0a681750763890bb589d6fe1d22b9ad9747a12 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:12:20 +0000
Subject: [PATCH 113/136] sys-apps/util-linux: Sync with Gentoo

It's from Gentoo commit 100d63807a362d686529059b4ff1e85d546b578e.
---
 .../portage-stable/sys-apps/util-linux/util-linux-2.40.4.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.4.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.4.ebuild
index e8d02fbc6a1..cd398debbd3 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.4.ebuild
@@ -23,7 +23,7 @@ else
 	inherit verify-sig
 
 	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha amd64 arm ~arm64 hppa ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos"
 	fi
 
 	SRC_URI="https://www.kernel.org/pub/linux/utils/util-linux/v${PV:0:4}/${MY_P}.tar.xz"

From a895514a5ab58a5c033dd0dcd64f68a10157d74d Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:12:28 +0000
Subject: [PATCH 114/136] sys-devel/binutils: Sync with Gentoo

It's from Gentoo commit 23400b8bf2bd5a488dca6df4ed31c10e91b1c2f1.
---
 .../portage-stable/sys-devel/binutils/binutils-2.44.9999.ebuild | 2 +-
 .../portage-stable/sys-devel/binutils/binutils-9999.ebuild      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44.9999.ebuild
index 3c840be5f3e..74723e50739 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44.9999.ebuild
@@ -1,7 +1,7 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 inherit libtool flag-o-matic gnuconfig strip-linguas toolchain-funcs
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
index 65d9f15ce0f..c5b34f9990f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
@@ -1,7 +1,7 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 inherit libtool flag-o-matic gnuconfig strip-linguas toolchain-funcs
 

From 57e2c97744e94b0077f1c72422f27a6e99c67828 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:12:30 +0000
Subject: [PATCH 115/136] sys-devel/crossdev: Sync with Gentoo

It's from Gentoo commit 731552f368b6d87f0c7cc8800ea3b92a12769385.
---
 .../portage-stable/sys-devel/crossdev/crossdev-20250106.ebuild  | 2 +-
 .../portage-stable/sys-devel/crossdev/crossdev-20250410.ebuild  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250106.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250106.ebuild
index 82b2f724c5f..b0bc483b655 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250106.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250106.ebuild
@@ -11,7 +11,7 @@ if [[ ${PV} == "99999999" ]] ; then
 	"
 else
 	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
 fi
 
 DESCRIPTION="Gentoo Cross-toolchain generator"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250410.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250410.ebuild
index 6ba1801e842..084660d0c36 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250410.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250410.ebuild
@@ -11,7 +11,7 @@ if [[ ${PV} == "99999999" ]] ; then
 	"
 else
 	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
 fi
 
 DESCRIPTION="Gentoo Cross-toolchain generator"

From a604f2c4dda4411651956b2ea59e44158345f95f Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:12:30 +0000
Subject: [PATCH 116/136] sys-devel/flex: Sync with Gentoo

It's from Gentoo commit dd25aa948453fae21f85d607bde480904da451d6.
---
 .../portage-stable/sys-devel/flex/flex-2.6.4-r6.ebuild     | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/flex/flex-2.6.4-r6.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/flex/flex-2.6.4-r6.ebuild
index 41845f105a3..c024ea00fe9 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/flex/flex-2.6.4-r6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/flex/flex-2.6.4-r6.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-inherit flag-o-matic libtool multilib-minimal toolchain-funcs
+inherit dot-a flag-o-matic libtool multilib-minimal toolchain-funcs
 
 DESCRIPTION="The Fast Lexical Analyzer"
 HOMEPAGE="https://github.com/westes/flex"
@@ -53,7 +53,7 @@ src_prepare() {
 
 src_configure() {
 	use static && append-ldflags -static
-
+	lto-guarantee-fat
 	multilib-minimal_src_configure
 }
 
@@ -86,6 +86,7 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	strip-lto-bytecode
 	einstalldocs
 	dodoc ONEWS
 	find "${ED}" -name '*.la' -type f -delete || die

From 0f887407ef0e59318ece83c29247768c649e672b Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:12:30 +0000
Subject: [PATCH 117/136] sys-devel/gcc: Sync with Gentoo

It's from Gentoo commit 8a42f5dffc10d37e6932c552360b9f72c21403ad.
---
 .../portage-stable/sys-devel/gcc/Manifest     | 12 +++-
 .../sys-devel/gcc/gcc-10.5.0.ebuild           |  2 +-
 .../sys-devel/gcc/gcc-11.5.0.ebuild           |  2 +-
 .../sys-devel/gcc/gcc-12.4.0.ebuild           |  2 +-
 .../sys-devel/gcc/gcc-12.4.1_p20241219.ebuild |  2 +-
 .../sys-devel/gcc/gcc-12.4.1_p20250227.ebuild |  2 +-
 .../sys-devel/gcc/gcc-12.4.1_p20250417.ebuild |  2 +-
 .../sys-devel/gcc/gcc-12.4.1_p20250430.ebuild |  2 +-
 .../sys-devel/gcc/gcc-12.4.1_p20250507.ebuild | 68 ++++++++++++++++++
 .../sys-devel/gcc/gcc-12.5.9999.ebuild        |  2 +-
 .../sys-devel/gcc/gcc-13.2.0.ebuild           |  2 +-
 .../sys-devel/gcc/gcc-13.3.1_p20241220.ebuild |  2 +-
 .../sys-devel/gcc/gcc-13.3.1_p20250301.ebuild |  2 +-
 .../sys-devel/gcc/gcc-13.3.1_p20250418.ebuild |  2 +-
 .../sys-devel/gcc/gcc-13.3.1_p20250424.ebuild |  2 +-
 .../sys-devel/gcc/gcc-13.3.1_p20250501.ebuild |  2 +-
 .../sys-devel/gcc/gcc-13.3.1_p20250508.ebuild | 69 +++++++++++++++++++
 .../sys-devel/gcc/gcc-13.4.9999.ebuild        |  2 +-
 .../sys-devel/gcc/gcc-14.2.1_p20241221.ebuild |  2 +-
 .../sys-devel/gcc/gcc-14.2.1_p20250301.ebuild |  2 +-
 .../sys-devel/gcc/gcc-14.2.1_p20250419.ebuild |  2 +-
 .../sys-devel/gcc/gcc-14.2.1_p20250425.ebuild |  2 +-
 .../sys-devel/gcc/gcc-14.2.1_p20250502.ebuild |  2 +-
 .../sys-devel/gcc/gcc-14.2.1_p20250509.ebuild | 57 +++++++++++++++
 .../sys-devel/gcc/gcc-14.3.9999.ebuild        |  2 +-
 .../sys-devel/gcc/gcc-15.1.0.ebuild           | 10 +--
 .../sys-devel/gcc/gcc-15.1.1_p20250426.ebuild | 10 +--
 .../sys-devel/gcc/gcc-15.1.1_p20250503.ebuild | 10 +--
 .../sys-devel/gcc/gcc-15.1.1_p20250510.ebuild | 56 +++++++++++++++
 .../sys-devel/gcc/gcc-15.1.9999.ebuild        |  6 +-
 .../sys-devel/gcc/gcc-16.0.0_p20250427.ebuild |  2 +-
 .../gcc/gcc-16.0.0_p20250504-r1.ebuild        | 56 +++++++++++++++
 .../sys-devel/gcc/gcc-16.0.0_p20250504.ebuild |  2 +-
 .../sys-devel/gcc/gcc-16.0.0_p20250511.ebuild | 56 +++++++++++++++
 .../sys-devel/gcc/gcc-16.0.9999.ebuild        |  2 +-
 .../sys-devel/gcc/gcc-8.5.0-r2.ebuild         |  2 +-
 .../sys-devel/gcc/gcc-9.5.0.ebuild            |  2 +-
 37 files changed, 416 insertions(+), 46 deletions(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250507.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250508.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250509.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250510.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250504-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250511.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
index e7b10290412..0cb69fa90c0 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
@@ -8,6 +8,7 @@ DIST gcc-12-20241219.tar.xz 79920016 BLAKE2B 71044352515f33eaf0bcc64cc6eacdecb8b
 DIST gcc-12-20250227.tar.xz 79915940 BLAKE2B 0adb19847cb3f317316549f657434654b9923806366a4b95e496effea9c07995b7d3de65c40cc2f62ba1e87cfb0f8cd8a1a833284042fdc5e6fce2bd7e7e9543 SHA512 d01cad1771762f5b56c783d6a3b39415be1c7619229b5ff056fe40ef0bf821c67a2d1a2272c2227a44f92825582579625352d19e2342d11f76a079556dae0ae8
 DIST gcc-12-20250417.tar.xz 79924416 BLAKE2B 4f6542d016693e2392a433c1931a33112fc959e194cdfbe01f76c9f4103d0ba3b899bd4d1993031340d90d5512a2075f8aaf0a73013eaad0afe9708fcefd47dc SHA512 82ee092685d988eb184926f4bd306540d43c7da94a0f76a5b1aaaf134235ee882b07f34e4c9a55cddba11988aafafa8ff0be1fe12330a61c2ee927d63597e7a6
 DIST gcc-12-20250430.tar.xz 79927628 BLAKE2B c57d83bfa68765807c7fb0f6b8834232a3296f8c3cb944c5338c6334d69017b0132e82fe579ac8ac3efc5deaa039c6ae180c9d1515659b13d70a2109a48a7949 SHA512 61f35a337ff034c5872103fed5645c954bb833f4155e0ce78d3478c62448f0648b947217b4ed6e801367a649749f332eeb09ba44a4dc2c941e1e1c921cca4242
+DIST gcc-12-20250507.tar.xz 79936088 BLAKE2B d80e3bf0e00a8849de4e55f130f0a86ac9f3711c1c033987719a809293d6e332d3e999bc62f5a9e0d568712ae7ee20a7d17c5f9b92621187d8dc3799ae888e1d SHA512 54fbf9b74785d77861f2def014e14908f6de22b76c9b2d974bc750beb83d13743d0163ffad0c4ae0b068a4163fd2c0407194d4cbd760be258657ba4073201b66
 DIST gcc-12.4.0-musl-patches-1.tar.xz 3068 BLAKE2B e5e39c24934072ea89e4467d0dc5196f3dadfb5ffba0c856d051648a2fbf57d434a57e95227cdf2b8cea45f0f5555aec2bc372d2f6cb0b69efd87831d248d364 SHA512 b9db204845a25be043d76cae826d42eebeeb4f9be7c3049af6fe7601a552bedfd24731156a6a36b4b5e2e2af656a589a5c556d2b0b3ded33ba290a773ee87c62
 DIST gcc-12.4.0-patches-1.tar.xz 15576 BLAKE2B 98c29888de7701b365be7ac9062f0cee3340d58c85485e26f0d02f1483ec64cc9c10651488a4fd937551afe30f4e19777e6766871a724ae3ba6c290c16f4fdf1 SHA512 3f7c5d36e56e07ea9dd143a5d13342a6c1ccbf0643abd1c0bcbfb46bb7c7b1308aef6e3e882031c9c191610f01af906b19be5aa2b139cf617614f46e97463aec
 DIST gcc-12.4.0-patches-2.tar.xz 14876 BLAKE2B 6bf5abbb2abba4b9fe9fa153ac4112fe5f563e97cd4e1b885ccd0d88abf1124fa91f20d6be972e2242410447be73bca60014785f8551b8087ed0d4cc3e868225 SHA512 dfd5f02d4c1076fad4ee998b2f620171dd3eb65a1160312def9dae89b18327a06db853f569e0e3c049e5ab06c61488bb6faecec52bafe737fddeb43628c54a1f
@@ -18,6 +19,7 @@ DIST gcc-13-20250301.tar.xz 84525780 BLAKE2B c366f4de63b7956abb1bf2d1039acdf90c7
 DIST gcc-13-20250418.tar.xz 84528940 BLAKE2B 566cc9570d9a2e41e67416cd3bb3609fad38a37cc648422988182652010ba2f2eb459c29fce32f8f97ea33c23eac3b43098af6fb333ce250a7e9eac4ca0abeb7 SHA512 185179a591d6ecc3a6477379fd877241a18b25bec0eacd0819e6e0ee38abbbebe7fee9027d36a60087f487c65a8afd17228e8dc0b803f4cf5ae6b8ce9cdadcbc
 DIST gcc-13-20250424.tar.xz 84551016 BLAKE2B 0c70b70bb741567e8b9689a484852d7b689193b0752b062f7d6639f59c6d404a3a91e91a674b64aa3d189bd8f28cc8f678d89027e659d0213b1e9e735af45e14 SHA512 7558b829c1e51ccb203ce182620528f5dd599f86f039074e575fcd50cf7ec38c23f4dee0bff0fa9dea77af416d934a1b2fabdd82e47a053ac93d486bc7af9823
 DIST gcc-13-20250501.tar.xz 84577616 BLAKE2B bb389c8bed1055febed51dd85a332ab903db758aca5403a5cee1bd3c5af0a821ffbc82ad97b020734e5dbe5693bdfb0789b1749ab7d75a2e79d4dad74e371ed1 SHA512 4ddc9306b86b72982847ea6915c92ba6e4956b835cdc0b55426e7120018b2bb85c7c2a69d727c79e48a1114e8321277ca16a6f441131c67e3d9f50ebd1409c48
+DIST gcc-13-20250508.tar.xz 84567972 BLAKE2B f15a144b17bb5f0d2ef8c24904b916578cef493ba23ab7cc54ac8bb68170b8d455c131e4f90675c5ab6a95b8c07b40ab75a5ce7d85df7f2425f74cd4810cb341 SHA512 e4a3eb7787260c5b628a3328b6fcc10dfe8f79fd5e32f8aa4800d1ebf8722a607595c54770d8b8d8fc200049b30c72212e66e90fec8f81a30ef32bf5d2581b50
 DIST gcc-13.2.0-musl-patches-2.tar.xz 5292 BLAKE2B c057d6574d03c05854edaa9f3fd40e9149662b04f3ac7a7db3eb078d73a7b535726d1bf52e5b12736dedb2f9898ad731f2e48a6421fcfbf7b90f929dee072fcb SHA512 a691da0c87c443a5e9d23731f4005f27871c5b12bc9102873ffa24d374aa7b9fbd187c4f5635d23fa9ffb17e351e76173c2d3fdf40646e355c4cb314b538de69
 DIST gcc-13.2.0-patches-3.tar.xz 30956 BLAKE2B 29ce043b46645640ca1e983397af3e158588ad87575f0bc59451ea4a7dd5e3bb5b190ed031de6a22cd790d423ba111e95d222187dd09985dceb12db9f0a2d907 SHA512 4ffecae7be320124ad0c4e71e39e142b7aa8db0e70b5f486f491d7a33ea31efc6464c6abeea77df02a8bd5cf81f08225d625c8af5c27f9afa32c0d7d989f7a3c
 DIST gcc-13.2.0.tar.xz 87858592 BLAKE2B 0034b29d3d6cc05821f0c4253ce077805943aff7b370729dd203bda57d89c107edd657eeddc2fb1e69ea15c7b0323b961f46516c7f4af89a3ccf7fea84701be2 SHA512 d99e4826a70db04504467e349e9fbaedaa5870766cda7c5cab50cdebedc4be755ebca5b789e1232a34a20be1a0b60097de9280efe47bdb71c73251e30b0862a2
@@ -29,16 +31,22 @@ DIST gcc-14-20250301.tar.xz 88230928 BLAKE2B 2b65e7cccbf431a74df73adac53995873e7
 DIST gcc-14-20250419.tar.xz 88251960 BLAKE2B b9d8312ac8dd9dd82128ff872e379f3426b4464e940ebd7748e53d6cd41e5a0f936f01ffdd3beb308a693ce98d3c323206ec67006de0735a430534b21899ae6d SHA512 44cd816dc61d4cf9925be47b75c5ddfc791dbfb43cc56a82e3a46673e8a2753d69f8b9230d68399c4b232c2daab85622168998f2dab767bb78c2292613dd6643
 DIST gcc-14-20250425.tar.xz 88293272 BLAKE2B 13e27faa2db627a97dcd34b866a036ecf4593468c88b061a24e5c7fc09c0d525019f714842cbb2a6081ac16cccd823ea104915f41d0840c6e3eef7db51650414 SHA512 6afdb41289f37c00bec0629a068c2907af87bf6e78d44b6f41c5de23dae31294c6d06e30ed6c48460f1efe0b314df3afd1be2022d66f3b7826b5c8491554be69
 DIST gcc-14-20250502.tar.xz 88287888 BLAKE2B c7d8daa57bdd68fada6f51d4db66c69b094e72feef12e866163f96e2b2d8a4bc699cfe6885aed31e507c08e660167fdd2edc18b92d0b7f53560d4107e2f04989 SHA512 7fe989f8bb0b0b0bbc48f6ec237e8802b2d1a7f184e4179917d93fe40c2774927d4579943571c6f70bbc8f1c8475c633dcc77f847bee6bb8810909cb3afc9ee6
+DIST gcc-14-20250509.tar.xz 88289160 BLAKE2B 59188064dad7f3e7fd8483896738a78857b2bf9015405ea31dc20e9a0f21b7c88701ae29c8a358ee238b0541535764a1aebbee7c26036c72d108eb16e0478f5f SHA512 e055c35d4fbe6eaeee4aa64dd8634979001206a65c8e17d8ee5ce8c1240bd4cbaf6c77572fec919064549eda36f954b046776b993eabd290971fe9a1fdede869
 DIST gcc-14.1.0-musl-patches-1.tar.xz 3600 BLAKE2B 4cd920b7ca1f122cae806707564d8e45bfd48e78c88788a12a301f6068b5a5f335d8885e67479ac536c66aeaa81f2ecb7240ae56e9fc821a7246ab66b453711f SHA512 61c48d90a55dfc2129d96aee69d939d6a89f6407f69f7bd12c1a619f28989f471fd219d731958f8e62b0fd650c32300f0ad8dc06d5df23d9fc8c1a77fe210c25
 DIST gcc-14.2.0-patches-7.tar.xz 14244 BLAKE2B 11236e91e1fe83fec8ffaa40ec0cdd4b52a00a951e9aa9a7a0a932b234b8f1a9603333a7ccf55859f4ef53dd4d8ad1fd5c1d2514b6e45fce5b86bb58622a0ecc SHA512 5a4d86d943e31fa068b5a784c0132bd83c23243dcb3cf972557a42e004469a415e1b3185f31b1bb36f916594d475f266a2fda031a414e4a15e0bbfe471269eee
 DIST gcc-14.2.0-patches-8.tar.xz 14540 BLAKE2B 09f66035343d4cab694b8ab382170f8e2d546ddffedf3477f26edbd6a798ddf94294f569c2661729d40088d590bc17a4eb651710d8d9f66f33703734a1a82b67 SHA512 7a9a2724ef8db3c57b033d90751192969c16e5eaa8f4777b7f16470222ff3a18771b461bd89feaad701e7f0d573b883b487981588129933c732fb76117728b86
 DIST gcc-15-20250426.tar.xz 92081764 BLAKE2B 1aded22dbac3458140744c85409da569c3fb8db0b0798a1a7bdea2d9d77b0375f68a240721bda5c8e97e363c3e06e63489ced6987dd6a517b7c4f185e0468f86 SHA512 2278176ed9b7a19e81dc7a174d587523ae01d5a2e49710ac36381b30463c84ed3184c1f1e9c96116e9387b9ff58bc7d389b8dfda7b755c4a0d8470c14f1872c5
 DIST gcc-15-20250503.tar.xz 92076804 BLAKE2B 9c32f2c354df41ae0d340d15aacfe0724f1e75666b3c31a98b2bfc68e0446cb4b38f38b08580fd6dd3ac109544710649d735846c742ebc950c6843e1805907c2 SHA512 30d10cde478800d44fae444ed1cd45b566f449143bc50df95a1a8c8cd80bab0d0cb09255e50fd134bb128c4b49f60a37a21c34924cd1b1143f8f7a4a4709bf31
-DIST gcc-15.0.0-musl-patches-2.tar.xz 3076 BLAKE2B 0073248fe4f7dd827980559017b5aa1fb5c4c46acc9ad5c410dc152fd1e44966d3066bf7152338573cb45b1c36027de5f0c519abd414d97a37bccef07f6a5281 SHA512 295f1a669020bbe2874e9b03afd46b5d083073b276fca3543f3767a2d74f35df81cf0a67abad50c200cf7a3af36ec98ff9977cb7d5c19f334af7d3bb1926a3de
-DIST gcc-15.0.0-patches-55.tar.xz 19028 BLAKE2B f01935ebcf814b34c0319e6b92cb3fc83a562990743d906fe171583ae583e4e6a8c31abba893b0a9b2e1665c3af62271e5ffdad0626a8585dd92e085c886c82e SHA512 1c46d0fb96dadf51a3aa48db97210eb4d9b92f6b9f4ac08af41009a385ef9ed064432a92b5e3163d9ca8bd9065cd5934b2792359ec8c09203e950e21d29119b4
+DIST gcc-15-20250510.tar.xz 92092512 BLAKE2B c264dd81bb7560d02a0779ae6a6a303f55fc0bc041b021d9ce87628bd99681a3084d457b9134cb1e744189696f8bd9da5efc9b7c64e80ef38cc5caeee227c38a SHA512 7d1e8cc5d60904ddffcaea94086d916d641ad1b94dc452879b120023a0be0a58df96394f460006daffdaf2ecb48748fa7ea21239973e78281885b29961e01d6b
+DIST gcc-15.1.0-musl-patches-1.tar.xz 3036 BLAKE2B f7e8b794feb3c30252dd3e35b990c8a134d337e285a2778ad5575b04667cf01040bf4187252151cd57097cd6d440851843156c9631736f4f065ca8b7ce2f0678 SHA512 4d3f1660d89484f63ad6c238884415673cdfdabb8833cce2fe114193b52f11b3518b034881024527f6553de93936d15ed707d4d2b1e8221908a08ec67810464b
+DIST gcc-15.1.0-patches-1.tar.xz 18628 BLAKE2B ee5fc9d6a06374ccc8d85cd1e269514fde8fed9b1810867a199ac747c09fc166e11e54ba531d42ee2ffbab3ca80277f9ad3c873fbaa3530ff60e5f2bc25c41ba SHA512 72992f0698f632c98abd6d8c7a7a38a109b2f064775a0c5029e44dc29cd88ae061cddd603d47eabced5af5f8571e0b73c9778080873c69dd4dc4766c60339b28
 DIST gcc-15.1.0.tar.xz 98268344 BLAKE2B a902ce99db4e93615879e435bcd0b96d5a16ea0af42598ca0e6d12913b2ce3651a98574c3264b2717b848e6b5a823b403ccca0adde463938d5b41aa3f1da0d34 SHA512 ddd35ca6c653dffa88f7c7ef9ee4cd806e156e0f3b30f4d63e75a8363361285cd566ee73127734cde6a934611de815bee3e32e24bfd2e0ab9f7ff35c929821c1
 DIST gcc-16-20250427.tar.xz 92158556 BLAKE2B a993e398989cd1548e4bcd399faccf381a82e5648e4638b1a8144637794d4f188232fecc658b3f2a5be58e085931c3abbb9033984c3cab54adac144abb9817f6 SHA512 a64224705eae17147cd2944cf2b24c6542ef77ab6c3d4dfe598b6abcee5c178a3e2cfdbde729b23c22ed4803ddab49d636652f452f382d8cfee0d2be43a227b1
 DIST gcc-16-20250504.tar.xz 92144212 BLAKE2B 6b9390e5cbc44332926f79fdcbb46678b46cded8502a493ba950ced72b74ba47f5ad40de30c2e86e06d3e41b6e51b15ed16802b05b3ad4ed9a93e6987848a299 SHA512 b47468969129288408b09cf5dee79cac0243e6a83321b2622d6681f1cd67e93b9211d6033f307404cf7ecf72b8f2c2e67537ceab9fbc9a13e34d800a42ba677c
+DIST gcc-16-20250511.tar.xz 92224236 BLAKE2B 6026ddf597a5611707284bd5f6f221de52eb8d39bc58f12ab4ffd5a0a5c988f69bf4bc15f4390d0f682d2e19323abb1aceb0def6fae96ef1d6a3b92b3d780c75 SHA512 d61a11bd72d818cafcda8535113db140a892ce6e82d27879d4d1416a53406fa5da5aadd9400af645452c7a8eff99df5119ea0e307d15ef605eadce76e951dbe8
+DIST gcc-16.0.0-musl-patches-1.tar.xz 3040 BLAKE2B 18b16357699780eb470cf44a10710281955140103198e0bd55b75e1efe3dbec233689edb11e1b9a62f782f3d97293af4906c18c2c41613b422eda085ee819467 SHA512 5ba580c7c7bb9e62935a5162d44d357cc31185a113acff7498ed7b1ac43fd0a35de7c3de0c87f02fe0be46b5e55b49bb35d1f5cd470058d21a9ea4096a37e13d
+DIST gcc-16.0.0-patches-1.tar.xz 21916 BLAKE2B 3f067ec7598931a4c277572be2a2783a888da4659150cdb0ca892f4936c16d3c9e0868a249e1820b2cad160bee47ec7b29876e00712b075d8579baae336b91b4 SHA512 8beeeefd8a9b78aaee6470e7b6ae2d3b033fa980d44d441f11361ef14cc602d7c05481f390ae035c5d4c848f301f0526949344327ab169a5f37601ab83d1a675
+DIST gcc-16.0.0-patches-2.tar.xz 17524 BLAKE2B 6e5f07e01ec4981cccb6286151e7948b9ceaadb61afb11307174fcd855440db84d233857c07e311b099130913a26d13201a3b62e2f52ceb959055e190e776efb SHA512 3e6c7fd3e819dff461e54d2a0d568d2d68e01bda845ab44e026231f187c43a9ffa266e7dab981f3b36a55b9654cefb197f5fff7158538526512ce05be0948992
 DIST gcc-8.5.0-patches-4.tar.xz 18616 BLAKE2B 7594cbaea5daecf1a0b3d526c06aeba0a84c6da66aee2e105a51fda6be8d30a37ccc3814281b284a4582d892a1d556bca063551584edfc2525bed8ea5b6888e7 SHA512 1aa5742c361186637e7855f06feb1a4547e7d4d5de6e51f3d049e0ef3c19e2eff179465f52781739f59422035b7f8e4c0efa3844849f920f3c96acfdc37ca6a6
 DIST gcc-8.5.0.tar.xz 63841008 BLAKE2B aa81a1a730fd7371360f6abed6ba78b5843fd18c58d5de5687acc320741b9e430e85df3535a1ef7a26051409be8d2f0945f503e5968480d919103123a99d4b12 SHA512 92f599680e6b7fbce88bcdda810f468777d541e5fddfbb287f7977d51093de2a5178bd0e6a08dfe37090ea10a0508a43ccd00220041abbbec33f1179bfc174d8
 DIST gcc-9.5.0-patches-2.tar.xz 14324 BLAKE2B 1d3bf3e673108ad2fcdcb86daefb4603d1c9f6aa815e34d1591054d466b76d6f50cce124ab4760528c4951ea16eb00888a3e6485417f81ebf250548732df4a8e SHA512 a6d6f650aaf0bd193a17ac279649f0544a282cea295824384c59341c3000eac4b574b60e00dd427585d928f9768166abf85168b47772132790ad98854acacbbf
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild
index 886019dca3e..35a344c26f9 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="10.5.0"
 PATCH_VER="6"
 MUSL_VER="2"
 MUSL_GCC_VER="10.5.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild
index 477eb3fd96a..1e35f778baf 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="11.5.0"
 PATCH_VER="1"
 MUSL_VER="2"
 MUSL_GCC_VER="11.4.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.0.ebuild
index 8198fc49dbb..cbd9d60b416 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.0.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="12.4.0"
 PATCH_VER="1"
 MUSL_VER="1"
 MUSL_GCC_VER="12.4.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20241219.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20241219.ebuild
index bc4c233455e..6adf0ff80bf 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20241219.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20241219.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="12.4.0"
 PATCH_VER="2"
 MUSL_VER="1"
 MUSL_GCC_VER="12.4.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250227.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250227.ebuild
index abbfb04944b..830a3c31071 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250227.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250227.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="12.4.0"
 PATCH_VER="2"
 MUSL_VER="1"
 MUSL_GCC_VER="12.4.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250417.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250417.ebuild
index a300c328e74..f4974702aeb 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250417.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250417.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="12.4.0"
 PATCH_VER="3"
 MUSL_VER="1"
 MUSL_GCC_VER="12.4.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250430.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250430.ebuild
index fb618179942..37640af01a4 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250430.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250430.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="12.4.0"
 PATCH_VER="3"
 MUSL_VER="1"
 MUSL_GCC_VER="12.4.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250507.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250507.ebuild
new file mode 100644
index 00000000000..37640af01a4
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250507.ebuild
@@ -0,0 +1,68 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
+TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="12.4.0"
+PATCH_VER="3"
+MUSL_VER="1"
+MUSL_GCC_VER="12.4.0"
+PYTHON_COMPAT=( python3_{10..14} )
+
+if [[ ${PV} == *.9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	MY_PV_3=1
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+		MY_PV_3=0
+	else
+	        MY_PV_2=$((${MY_PV_2} - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.9999.ebuild
index 8e7542f313a..476367feff6 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.9999.ebuild
@@ -10,7 +10,7 @@ TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="12.4.0"
 MUSL_GCC_VER="12.4.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.0.ebuild
index 51f50a6419e..44ee9ff5c0b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.0.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 # Maintenance notes and explanations of GCC handling are on the wiki:
 # https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="13.2.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20241220.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20241220.ebuild
index 716039677f5..0231b6eb4cc 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20241220.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20241220.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="13.3.0"
 MUSL_GCC_VER="13.2.0"
 PATCH_VER="2"
 MUSL_VER="2"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250301.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250301.ebuild
index 7969b89177c..fb8b4333a3f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250301.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250301.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="13.3.0"
 MUSL_GCC_VER="13.2.0"
 PATCH_VER="2"
 MUSL_VER="2"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250418.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250418.ebuild
index 209e0b1fcad..b8d2cb59046 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250418.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250418.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="13.3.0"
 MUSL_GCC_VER="13.2.0"
 PATCH_VER="3"
 MUSL_VER="2"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250424.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250424.ebuild
index a439cd30a1b..00e9c5b46a1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250424.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250424.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="13.3.0"
 MUSL_GCC_VER="13.2.0"
 PATCH_VER="4"
 MUSL_VER="2"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250501.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250501.ebuild
index a439cd30a1b..00e9c5b46a1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250501.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250501.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="13.3.0"
 MUSL_GCC_VER="13.2.0"
 PATCH_VER="4"
 MUSL_VER="2"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250508.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250508.ebuild
new file mode 100644
index 00000000000..00e9c5b46a1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250508.ebuild
@@ -0,0 +1,69 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
+TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="13.3.0"
+MUSL_GCC_VER="13.2.0"
+PATCH_VER="4"
+MUSL_VER="2"
+PYTHON_COMPAT=( python3_{10..14} )
+
+if [[ ${PV} == *.9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	MY_PV_3=1
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+		MY_PV_3=0
+	else
+		MY_PV_2=$((${MY_PV_2} - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+
+	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.9999.ebuild
index 1de90381b63..962be9a61a6 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.9999.ebuild
@@ -10,7 +10,7 @@ TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="13.3.0"
 MUSL_GCC_VER="13.3.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20241221.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20241221.ebuild
index 4e0e4421fa0..9e1ce5ddf6d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20241221.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20241221.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="14.2.0"
 PATCH_VER="7"
 MUSL_VER="1"
 MUSL_GCC_VER="14.1.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250301.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250301.ebuild
index a2ede76ffc5..f7475a6a2bf 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250301.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250301.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="14.2.0"
 PATCH_VER="8"
 MUSL_VER="1"
 MUSL_GCC_VER="14.1.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250419.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250419.ebuild
index a2ede76ffc5..f7475a6a2bf 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250419.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250419.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="14.2.0"
 PATCH_VER="8"
 MUSL_VER="1"
 MUSL_GCC_VER="14.1.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250425.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250425.ebuild
index d405a1386bd..999d16e0cd7 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250425.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250425.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="14.2.0"
 PATCH_VER="8"
 MUSL_VER="1"
 MUSL_GCC_VER="14.1.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250502.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250502.ebuild
index d405a1386bd..999d16e0cd7 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250502.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250502.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="14.2.0"
 PATCH_VER="8"
 MUSL_VER="1"
 MUSL_GCC_VER="14.1.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250509.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250509.ebuild
new file mode 100644
index 00000000000..999d16e0cd7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250509.ebuild
@@ -0,0 +1,57 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
+TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="14.2.0"
+PATCH_VER="8"
+MUSL_VER="1"
+MUSL_GCC_VER="14.1.0"
+PYTHON_COMPAT=( python3_{10..14} )
+
+if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# m68k doesnt build (ICE, bug 932733)
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+
+	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.9999.ebuild
index 0465a3f8e64..892196f71e8 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.9999.ebuild
@@ -10,7 +10,7 @@ TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="14.2.0"
 MUSL_GCC_VER="14.2.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.0.ebuild
index 780f510704b..d5439334d32 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.0.ebuild
@@ -8,11 +8,11 @@ EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
-PATCH_GCC_VER="15.0.0"
-PATCH_VER="55"
-MUSL_VER="2"
-MUSL_GCC_VER="15.0.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PATCH_GCC_VER="15.1.0"
+PATCH_VER="1"
+MUSL_VER="1"
+MUSL_GCC_VER="15.1.0"
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250426.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250426.ebuild
index 3c858925143..4ec15f7d43e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250426.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250426.ebuild
@@ -8,11 +8,11 @@ EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
-PATCH_GCC_VER="15.0.0"
-PATCH_VER="55"
-MUSL_VER="2"
-MUSL_GCC_VER="15.0.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PATCH_GCC_VER="15.1.0"
+PATCH_VER="1"
+MUSL_VER="1"
+MUSL_GCC_VER="15.1.0"
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250503.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250503.ebuild
index 3c858925143..4ec15f7d43e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250503.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250503.ebuild
@@ -8,11 +8,11 @@ EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
-PATCH_GCC_VER="15.0.0"
-PATCH_VER="55"
-MUSL_VER="2"
-MUSL_GCC_VER="15.0.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PATCH_GCC_VER="15.1.0"
+PATCH_VER="1"
+MUSL_VER="1"
+MUSL_GCC_VER="15.1.0"
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250510.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250510.ebuild
new file mode 100644
index 00000000000..4ec15f7d43e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250510.ebuild
@@ -0,0 +1,56 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
+TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="15.1.0"
+PATCH_VER="1"
+MUSL_VER="1"
+MUSL_GCC_VER="15.1.0"
+PYTHON_COMPAT=( python3_{10..14} )
+
+if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=master
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.9999.ebuild
index 65883e2a1dd..122fc9f98e0 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.9999.ebuild
@@ -8,9 +8,9 @@ EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
-PATCH_GCC_VER="15.0.0"
-MUSL_GCC_VER="15.0.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PATCH_GCC_VER="15.1.0"
+MUSL_GCC_VER="15.1.0"
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250427.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250427.ebuild
index 2338e2a3938..42e1def5b40 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250427.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250427.ebuild
@@ -10,7 +10,7 @@ TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="16.0.0"
 MUSL_GCC_VER="16.0.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250504-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250504-r1.ebuild
new file mode 100644
index 00000000000..aafb14911b0
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250504-r1.ebuild
@@ -0,0 +1,56 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
+TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="16.0.0"
+PATCH_VER="1"
+MUSL_VER="1"
+MUSL_GCC_VER="16.0.0"
+PYTHON_COMPAT=( python3_{10..14} )
+
+if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=master
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250504.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250504.ebuild
index 2338e2a3938..42e1def5b40 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250504.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250504.ebuild
@@ -10,7 +10,7 @@ TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="16.0.0"
 MUSL_GCC_VER="16.0.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250511.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250511.ebuild
new file mode 100644
index 00000000000..031efdb451b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250511.ebuild
@@ -0,0 +1,56 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
+TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="16.0.0"
+PATCH_VER="2"
+MUSL_VER="1"
+MUSL_GCC_VER="16.0.0"
+PYTHON_COMPAT=( python3_{10..14} )
+
+if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=master
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.9999.ebuild
index 2338e2a3938..42e1def5b40 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.9999.ebuild
@@ -10,7 +10,7 @@ TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="16.0.0"
 MUSL_GCC_VER="16.0.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r2.ebuild
index 650d49559b8..125c8cf1e39 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r2.ebuild
@@ -10,7 +10,7 @@ TOOLCHAIN_PATCH_SUFFIX="xz"
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_VER="4"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 inherit toolchain
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild
index a38688e620b..fa67a8543c4 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild
@@ -10,7 +10,7 @@ TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="9.5.0"
 PATCH_VER="2"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)

From a467bb324be5ed76668485b43134b98606d47ad3 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:12:32 +0000
Subject: [PATCH 118/136] sys-devel/m4: Sync with Gentoo

It's from Gentoo commit b472b85e16c80431682fd301a005ccead32c2abb.
---
 .../portage-stable/sys-devel/m4/Manifest      |  6 +-
 .../sys-devel/m4/m4-1.4.19_p20250413.ebuild   | 92 -------------------
 ...4.19_p20250419.ebuild => m4-1.4.20.ebuild} |  0
 3 files changed, 2 insertions(+), 96 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/sys-devel/m4/m4-1.4.19_p20250413.ebuild
 rename sdk_container/src/third_party/portage-stable/sys-devel/m4/{m4-1.4.19_p20250419.ebuild => m4-1.4.20.ebuild} (100%)

diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/m4/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/m4/Manifest
index 97747795b01..ea6b0f02f75 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/m4/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/m4/Manifest
@@ -1,7 +1,5 @@
 DIST m4-1.4.19-test-198-sysval-r1.patch.gz 6292 BLAKE2B 62f52c8bb75e7b8f11e487906f1ce47069ea6d3095fd6532aa6b47bcd8109b7cd733fde26915d449a1cfc326f27f5ed83ba29a5a80687b8b9bdb73c8d87e96b8 SHA512 c3e7d4c1631e401c6b5477c22fd5de837188acf9d72551b116c665a927d1799b1fb249e90c9fb4f6f2f328ee84b2e4dd0bf54f684139997c19ee5b69a3e9284d
-DIST m4-1.4.19.60-6ebfc.tar.xz 2031984 BLAKE2B d6001b14a4f4bb5bb163463331b9e24469b6b48f690c88796b4d2ca57dc3c31046eb7ece0c2593941aa1b5a0e90e2aa0d85b000e135742286bf90cc7f5d09b57 SHA512 bcb801404ff8f4146e59e8baadae02f5dfac1ce3f860118122430e4facae098628e915d8ee9386abb3c133a0cc2b7c98170a57687c9d85aaa6f130b061b7810f
-DIST m4-1.4.19.60-6ebfc.tar.xz.sig 488 BLAKE2B 71f9c4aec3e981816eda83032474b4d9acccc628c79a5dd9a5e2a077e4f3f30fa6f59fb29ed7e0c1ae7148a4605584b65653eacaee7d06ba006fa2dcb7e425c1 SHA512 5e89d23c7879eb4970f05a6e8fb37eb1b17ece4204bb86cc16bcbb4f4705263725ac70b286c2454249a8a33728784a2434e498deccbbd367424ceef91a36b164
-DIST m4-1.4.19.65-bdd9.tar.xz 2038192 BLAKE2B 47a719ce90486ffa819b05173225ce3d7e6669be238bd8df5bb37f81dc30e95fc7a3c717940b97543f87b547b3db58607d9fe35c967609c04174f5204da93994 SHA512 f74ea0305e3ccde89633a7f6e4acd05ec4f68defc3d4aedea635f93f99555ceea1fed2bf3cca6386bcf7994e879e67f6f4c9a64b59636047b26e282e42e735c3
-DIST m4-1.4.19.65-bdd9.tar.xz.sig 488 BLAKE2B 281e3300b02fc92dd03bd38faa082f5394536dcebf7c87ec33b0b2bb5a94ebff1a2233c8aaeb23b17f436e2b40c90ee1d68e5a59d208306242688710f797c6d5 SHA512 c33bd351b73616fc3e7cd7292403af9f0001fedbd005a7cd115180005f3fffd0a58b37422b70c638302cf5c3a65bb723c3b916bc237be0f687b2a190b4162fe7
 DIST m4-1.4.19.tar.xz 1654908 BLAKE2B 08694485a49c542761fa9a7db4d7609f4dfb08a5c6b785b57f2e14cf1f696c2a1c788bb5eb934e8159a632b63ff071dfe42511d0109d7b1828f46d33c8bf416a SHA512 47f595845c89709727bda0b3fc78e3188ef78ec818965b395532e7041cabe9e49677ee4aca3d042930095a7f8df81de3da1026b23b6897be471f6cf13ddd512b
 DIST m4-1.4.19.tar.xz.sig 488 BLAKE2B 99e89b1ed0bf158d29a652392fb122e23227e895c75a8c63057ebe33f11b433ab205ae99a991578a89df8c3e723fc00669d8cdb290fbc86eaa6c704b112e4370 SHA512 d6ac9c6a54c57e9b53fb3e34a60d49df2f46a6e494da0a0c9ae8246b984e68a853b5d8c42677c1a0485c3f36b0bce10a481d3775c0edc1dbdfb27b43545bc31e
+DIST m4-1.4.20.tar.xz 2044756 BLAKE2B d8e6716dd4f35e17b866917f0697f980d7b6fbfa9aa92feb1234fdb49fb62107dc48405036a8ca97db73889d7638b90b69ea005352992b7bf45e8605127b318f SHA512 dc7b4f61452e564b095010029bf6ce4246e5a03959989cd76b09eb8012db7424c52819143020fab21a3471ff57ab026d3eccbd00dd3969819208980565a9fec0
+DIST m4-1.4.20.tar.xz.sig 488 BLAKE2B a202c6d8f7d65bf8f4936ec5d18bce768fe80ab485905cce051339fffdecbdd191f73b25675770648536ee24c2b161416e924b6acd30c1d8d00a425174f0a439 SHA512 bc75a64e47a87fe4073f26850a8344e82d15f156ac5b52cde1af701a0ba4e0d18f414323f86c868f114c4867b00c31ce205a9505343e588ad97825b05136c5eb
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/m4/m4-1.4.19_p20250413.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/m4/m4-1.4.19_p20250413.ebuild
deleted file mode 100644
index 6fb2e2de7ee..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/m4/m4-1.4.19_p20250413.ebuild
+++ /dev/null
@@ -1,92 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/m4.asc
-inherit verify-sig
-
-DESCRIPTION="GNU macro processor"
-HOMEPAGE="https://www.gnu.org/software/m4/m4.html"
-if [[ ${PV} == *_p* ]] ; then
-	# Note: could put this in devspace, but if it's gone, we don't want
-	# it in tree anyway. It's just for testing.
-	MY_SNAPSHOT="$(ver_cut 1-3).60-6ebfc"
-	SRC_URI="
-		https://alpha.gnu.org/gnu/${PN}/${PN}-${MY_SNAPSHOT}.tar.xz
-		https://people.redhat.com/eblake/${PN}/${PN}-${MY_SNAPSHOT}.tar.xz
-		verify-sig? (
-			https://alpha.gnu.org/gnu/${PN}/${PN}-${MY_SNAPSHOT}.tar.xz.sig
-			https://people.redhat.com/eblake/${PN}/${PN}-${MY_SNAPSHOT}.tar.xz.sig
-		)
-	"
-	S="${WORKDIR}"/${PN}-${MY_SNAPSHOT}
-else
-	SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
-	SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-LICENSE="GPL-3+"
-SLOT="0"
-IUSE="examples nls"
-
-RDEPEND="
-	virtual/libiconv
-	nls? (
-		sys-devel/gettext
-		virtual/libintl
-	)
-"
-DEPEND="${RDEPEND}"
-# Remember: cannot dep on autoconf since it needs us
-BDEPEND="
-	app-arch/xz-utils
-	nls? ( sys-devel/gettext )
-	verify-sig? ( sec-keys/openpgp-keys-m4 )
-"
-
-src_prepare() {
-	default
-
-	# touch generated files after patching m4, to avoid activating maintainer
-	# mode
-	# remove when loong-fix-build.patch is no longer necessary
-	#touch ./aclocal.m4 ./lib/config.hin ./configure ./doc/stamp-vti || die
-	#find . -name Makefile.in -exec touch {} + || die
-}
-
-src_configure() {
-	local -a myeconfargs=(
-		--enable-changeword
-
-		--with-packager="Gentoo Linux"
-		--with-packager-version="${PVR}"
-		--with-packager-bug-reports="https://bugs.gentoo.org/"
-
-		$(usex nls '' '--disable-nls')
-
-		# Disable automagic dependency over libsigsegv; see bug #278026
-		ac_cv_libsigsegv=no
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_test() {
-	[[ -d /none ]] && die "m4 tests will fail with /none/" # bug #244396
-	emake check
-}
-
-src_install() {
-	default
-
-	# autoconf-2.60 for instance, first checks gm4, then m4.  If we don't have
-	# gm4, it might find gm4 from outside the prefix on for instance Darwin
-	use prefix && dosym m4 /usr/bin/gm4
-
-	if use examples ; then
-		dodoc -r examples
-		rm -f "${ED}"/usr/share/doc/${PF}/examples/Makefile*
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/m4/m4-1.4.19_p20250419.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/m4/m4-1.4.20.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-devel/m4/m4-1.4.19_p20250419.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/m4/m4-1.4.20.ebuild

From 7a3ef9f260be9f75e9a6cdec88cd8aed51198f45 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:12:33 +0000
Subject: [PATCH 119/136] sys-devel/patch: Sync with Gentoo

It's from Gentoo commit 7cd05c4a9e5243d85f4766b8b32ef76609b44706.
---
 .../third_party/portage-stable/sys-devel/patch/patch-2.8.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.8.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.8.ebuild
index 8f8d1b87aa0..2eceb5f4735 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.8.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.8.ebuild
@@ -22,7 +22,7 @@ else
 	SRC_URI="mirror://gnu/patch/${P}.tar.xz"
 	SRC_URI+=" verify-sig? ( mirror://gnu/patch/${P}.tar.xz.sig )"
 
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="GPL-3+"

From fc1f0171675a557e592598db4d36b5d3d0cbe6eb Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:12:41 +0000
Subject: [PATCH 120/136] sys-fs/e2fsprogs: Sync with Gentoo

It's from Gentoo commit e8b33bf1a025af10b7e6c812076bb9a300e20bf9.
---
 .../portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.47.2-r10.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.47.2-r10.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.47.2-r10.ebuild
index f7ae4d73b02..626430641f7 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.47.2-r10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.47.2-r10.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://www.kernel.org/pub/linux/kernel/people/tytso/e2fsprogs/v${PV}/$
 
 LICENSE="GPL-2 BSD"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
 IUSE="archive cron fuse nls static-libs test +tools"
 RESTRICT="!test? ( test )"
 

From 6303ab4a4487cd3d477db5691611e64f22c30a9a Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:12:51 +0000
Subject: [PATCH 121/136] sys-fs/squashfs-tools-ng: Sync with Gentoo

It's from Gentoo commit f5f3c877489b719a571e4fc21fa1a99349520710.
---
 .../sys-fs/squashfs-tools-ng/Manifest         |  1 -
 .../squashfs-tools-ng-1.3.1.ebuild            | 57 -------------------
 2 files changed, 58 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/squashfs-tools-ng-1.3.1.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/Manifest b/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/Manifest
index d8111034d34..0bca2786677 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/Manifest
@@ -1,2 +1 @@
-DIST squashfs-tools-ng-1.3.1.tar.xz 585916 BLAKE2B 697131ddb9959bed388534f90c93e2e7495ef5aec9facf97e7d17475cff64d7a4badb709a16ae5e6da3ee89b1a1e3a49833bd15b9a0b4b364e15a565bd18e480 SHA512 0a433f7c3633cd5d8646d990744e31ed59c7012d5f8bb4fdb7892b892631f22a8fd0969f7d81de68f53e44670e71cb8e29729cd925a93b98ab3b6942bbc30662
 DIST squashfs-tools-ng-1.3.2.tar.xz 585380 BLAKE2B 43e8e7c189a9e3a23964a9ae17666eba7ff362d7ed011ee09e342d9ef777de2ce8e326cd38fa0932ace33929cf75bab81786ca56411053c08041300459262076 SHA512 6f14d90875ef3f3d36d3cd38932ade6b0da7284922c914bd655e3f0a4abb17ba75d4bc052a1d4244c1b4ff96b3798d83d5a7b3263b8e1b96c112f4cdf967400f
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/squashfs-tools-ng-1.3.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/squashfs-tools-ng-1.3.1.ebuild
deleted file mode 100644
index 9342b6bd684..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/squashfs-tools-ng-1.3.1.ebuild
+++ /dev/null
@@ -1,57 +0,0 @@
-# Copyright 2019-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DESCRIPTION="A new set of tools for working with SquashFS images"
-HOMEPAGE="https://github.com/AgentD/squashfs-tools-ng"
-if [[ ${PV} = 9999* ]]; then
-	inherit autotools git-r3
-	EGIT_REPO_URI="https://github.com/AgentD/${PN}.git"
-else
-	inherit libtool
-	KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	SRC_URI="https://infraroot.at/pub/squashfs/${P}.tar.xz"
-fi
-
-LICENSE="LGPL-3+ BSD-2 MIT tools? ( GPL-3+ )"
-SLOT="0"
-IUSE="lz4 +lzma lzo selinux +tools zstd"
-
-DEPEND="
-	app-arch/bzip2:=
-	sys-libs/zlib:=
-	lz4?     ( app-arch/lz4:= )
-	lzma?    ( app-arch/xz-utils )
-	lzo?     ( dev-libs/lzo:2 )
-	selinux? ( sys-libs/libselinux:= )
-	zstd?    ( app-arch/zstd:= )
-"
-RDEPEND="${DEPEND}"
-
-src_prepare() {
-	default
-	if [[ ${PV} = "9999" ]]; then
-		eautoreconf
-	else
-		elibtoolize
-	fi
-}
-
-src_configure() {
-	local myconf=(
-		--disable-static
-		$(use_with lz4)
-		$(use_with lzo)
-		$(use_with selinux)
-		$(use_with tools)
-		$(use_with lzma xz)
-		$(use_with zstd)
-	)
-	econf "${myconf[@]}"
-}
-
-src_install() {
-	default
-	find "${D}" -name "*.la" -delete || die
-}

From ab191d3b7fb42a7931bcd76aa023dd5f21e6bf35 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:12:51 +0000
Subject: [PATCH 122/136] sys-fs/zfs: Sync with Gentoo

It's from Gentoo commit c35ebdde62dd2078bfe1f3b0341b5118764cffa6.
---
 .../portage-stable/sys-fs/zfs/Manifest        |   2 -
 .../sys-fs/zfs/zfs-2.3.0.ebuild               | 308 ------------------
 .../sys-fs/zfs/zfs-2.3.2.ebuild               |   7 +-
 .../portage-stable/sys-fs/zfs/zfs-9999.ebuild |   5 +
 4 files changed, 11 insertions(+), 311 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.3.0.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/Manifest b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/Manifest
index 98d07222123..7dd806e761c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/Manifest
@@ -2,8 +2,6 @@ DIST zfs-2.1.16.tar.gz 35187215 BLAKE2B 8bb90903f3747589fff94a810584de54d7f598b0
 DIST zfs-2.1.16.tar.gz.asc 836 BLAKE2B b46614399ca63d9c88216c55bb2177cc0c28f4da2cb6be3ee361efca994309abff46fdf6ad6b0bad448c44e9e84ee40e2183d1b482e04844317f14744bab5c1f SHA512 d2d94a4e3ffe182e86fa3319cb9661688125f378ffa1e5768ee89033f796a1f52f877c382588fb1f434686e30bc4e65e3f08ceac0dd3dd7f8f751ba6182c3317
 DIST zfs-2.2.7.tar.gz 33852602 BLAKE2B 31a066d5d543e3328d1afd065a8da4f9b4c52433d585cdbb41936900fd1453431585c6bc4b6e6d9a497a03e79969bae883e17cf4677099686feb3e32577d2777 SHA512 6493faa8e31d9c042c4e8f748d32cb9243212fdf4e0341c19568b47bcf302e60beb89940b80374610b71e1dca1ca5813f3efaddbf1a2453ceabb38381165b271
 DIST zfs-2.2.7.tar.gz.asc 836 BLAKE2B e8fc5e04f5b37a22c741bda46b4573e0cebe85da051c73cf3c5fc267de3c313399b235fc346ca06f4c22d37d2500044a26adb3ea241a65fbcf8760d0ef880039 SHA512 8d22a64c920c2a983429688a340f4ae281decdd30e465591e6b40af9f3016b8f168f4e8ea460600c832a2f46b383ff307986649a645585fb25c34fdfda75ad6e
-DIST zfs-2.3.0.tar.gz 34029599 BLAKE2B b9fb7913f95dd0c8aec703961ecc0413aa51df889f15b1541ff8fcd7146ba485947fab83deb062bdffcdeab17a2465b7551c7eba3ec55c62c21aba58846c0da5 SHA512 f0bb1c6e28b325765be809dbc5d38ba294daa38b54eafd7d129cf6081fb209b200580437019faeed3614bbb0687d6583698a9282f3275905a1f5a8314a66cf0b
-DIST zfs-2.3.0.tar.gz.asc 836 BLAKE2B 9d1bd03dc6e5699236bca4c2b20a0a8b46e88d90ea58f7171d087c555da85d6af88acc5990f828ba455f9fbe24c90800c1edf74cd3f865b528730ffef8a931b8 SHA512 ba9a8e8b248de7383c8d33b84b0d70de026b8f3e6a1c82557b74ac274b28e559435541fbdfe816f6b80ce5098b3cac34af69cd53877f1f50fa6a846fa92a5dd0
 DIST zfs-2.3.1.tar.gz 34048716 BLAKE2B 7f22826c3359a015a87aafd119d882d8196dca59dadd85674a48c42ed502937f2880e98a387e9986be2c14fc48f46a288aed5fd8635f13db2585e3fc95e57726 SHA512 235023dbe97b3f7c5273e2a6fa34957cc37967256845d4ed9faa2e2a6da29ea6fdcba4167658cf03129afbb0aa11311a760d3d0b5ea5aecc64a4c7ee22ad2d31
 DIST zfs-2.3.1.tar.gz.asc 836 BLAKE2B 5d1f84f5803f1b0553ad75b12020a57537f6a6e3c3781ab8a21f0d7de9ad6be0be7618bb42e51bbddd5fc48cabb05f6d79ea2f5eebc63d67383b29c44d69f7f6 SHA512 619aac22d80b8100f28ca3e4a984b2e0387b272131d2a8c104a278955a811e2280ecf3bfa3b7d54ed73572ed7cd45121cd724b52afd3503c30c1e41400d27674
 DIST zfs-2.3.2.tar.gz 34344259 BLAKE2B 8a89c62cbbeaf410db4011821cdd9959abef1782be7427b81ac47565407384fa3a381bef041dae73e97c2b2cefca62933180851901b3b1b86974ed33ad178a61 SHA512 94311f2eca1488be83aa0cb802b4a4541bbbd061a3e8e5cbda62cabbb0c8f9a705372ad192cb77703b3d7642c43be7f604f3c363b243cf03a6aceae2d7e5db81
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.3.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.3.0.ebuild
deleted file mode 100644
index 1f1fcfb8f87..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.3.0.ebuild
+++ /dev/null
@@ -1,308 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_OPTIONAL=1
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} )
-
-inherit autotools bash-completion-r1 dist-kernel-utils distutils-r1 flag-o-matic linux-info pam systemd udev usr-ldscript
-
-DESCRIPTION="Userland utilities for ZFS Linux kernel module"
-HOMEPAGE="https://github.com/openzfs/zfs"
-
-if [[ ${PV} == "9999" ]]; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/openzfs/zfs.git"
-else
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openzfs.asc
-	inherit verify-sig
-
-	MY_P="${P/_rc/-rc}"
-	SRC_URI="https://github.com/openzfs/${PN}/releases/download/${MY_P}/${MY_P}.tar.gz"
-	SRC_URI+=" verify-sig? ( https://github.com/openzfs/${PN}/releases/download/${MY_P}/${MY_P}.tar.gz.asc )"
-	S="${WORKDIR}/${MY_P}"
-
-	if [[ ${PV} != *_rc* ]]; then
-		KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv ~sparc"
-	fi
-fi
-
-LICENSE="BSD-2 CDDL MIT"
-# just libzfs soname major for now.
-# possible candidates: libuutil, libzpool, libnvpair. Those do not provide stable abi, but are considered.
-# see libsoversion_check() below as well
-SLOT="0/6"
-IUSE="custom-cflags debug dist-kernel kernel-builtin minimal nls pam python +rootfs selinux test-suite unwind"
-
-DEPEND="
-	dev-libs/openssl:=
-	net-libs/libtirpc:=
-	sys-apps/util-linux
-	sys-libs/zlib
-	virtual/libudev:=
-	!minimal? ( ${PYTHON_DEPS} )
-	pam? ( sys-libs/pam )
-	python? (
-		$(python_gen_cond_dep 'dev-python/cffi[${PYTHON_USEDEP}]' 'python*')
-	)
-	unwind? ( sys-libs/libunwind:= )
-"
-
-BDEPEND="
-	app-alternatives/awk
-	virtual/pkgconfig
-	nls? ( sys-devel/gettext )
-	python? (
-		${DISTUTILS_DEPS}
-		|| (
-			dev-python/packaging[${PYTHON_USEDEP}]
-			dev-python/distlib[${PYTHON_USEDEP}]
-		)
-	)
-"
-
-if [[ ${PV} != "9999" ]] ; then
-	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-openzfs )"
-fi
-
-# awk is used for some scripts, completions, and the Dracut module
-RDEPEND="
-	${DEPEND}
-	!kernel-builtin? ( ~sys-fs/zfs-kmod-${PV}:= )
-	!prefix? ( virtual/udev )
-	app-alternatives/awk
-	sys-fs/udev-init-scripts
-	dist-kernel? ( virtual/dist-kernel:= )
-	rootfs? (
-		app-alternatives/cpio
-		app-misc/pax-utils
-	)
-	selinux? ( sec-policy/selinux-zfs )
-	test-suite? (
-		app-shells/ksh
-		sys-apps/kmod[tools]
-		sys-apps/util-linux
-		app-alternatives/bc
-		sys-block/parted
-		sys-fs/lsscsi
-		sys-fs/mdadm
-		sys-process/procps
-	)
-"
-
-# PDEPEND in this form is needed to trick portage suggest
-# enabling dist-kernel if only 1 package have it set, without suggesting to disable
-PDEPEND="dist-kernel? ( ~sys-fs/zfs-kmod-${PV}[dist-kernel] )"
-
-REQUIRED_USE="
-	!minimal? ( ${PYTHON_REQUIRED_USE} )
-	python? ( !minimal )
-	test-suite? ( !minimal )
-"
-
-RESTRICT="test"
-
-PATCHES=(
-	"${FILESDIR}"/2.1.5-dracut-zfs-missing.patch
-)
-
-pkg_pretend() {
-	use rootfs || return 0
-
-	if has_version virtual/dist-kernel && ! use dist-kernel; then
-		ewarn "You have virtual/dist-kernel installed, but"
-		ewarn "USE=\"dist-kernel\" is not enabled for ${CATEGORY}/${PN}"
-		ewarn "It's recommended to globally enable dist-kernel USE flag"
-		ewarn "to auto-trigger initrd rebuilds with kernel updates"
-	fi
-}
-
-pkg_setup() {
-	if use kernel_linux; then
-		linux-info_pkg_setup
-
-		if ! linux_config_exists; then
-			ewarn "Cannot check the linux kernel configuration."
-		else
-			if use test-suite; then
-				if linux_chkconfig_present BLK_DEV_LOOP; then
-					eerror "The ZFS test suite requires loop device support enabled."
-					eerror "Please enable it:"
-					eerror "    CONFIG_BLK_DEV_LOOP=y"
-					eerror "in /usr/src/linux/.config or"
-					eerror "    Device Drivers --->"
-					eerror "        Block devices --->"
-					eerror "            [X] Loopback device support"
-				fi
-			fi
-		fi
-	fi
-}
-
-libsoversion_check() {
-	local bugurl libzfs_sover
-	bugurl="https://bugs.gentoo.org/enter_bug.cgi?form_name=enter_bug&product=Gentoo+Linux&component=Current+packages"
-
-	libzfs_sover="$(grep 'libzfs_la_LDFLAGS += -version-info' lib/libzfs/Makefile.am \
-		| grep -Eo '[0-9]+:[0-9]+:[0-9]+')"
-	libzfs_sover="${libzfs_sover%%:*}"
-
-	if [[ ${libzfs_sover} -ne $(ver_cut 2 ${SLOT}) ]]; then
-		echo
-		eerror "BUG BUG BUG BUG BUG BUG BUG BUG"
-		eerror "ebuild subslot does not match libzfs soversion!"
-		eerror "libzfs soversion: ${libzfs_sover}"
-		eerror "ebuild value: $(ver_cut 2 ${SLOT})"
-		eerror "This is a bug in the ebuild, please use the following URL to report it"
-		eerror "${bugurl}&short_desc=${CATEGORY}%2F${P}+update+subslot"
-		echo
-		# we want to abort for releases, but just print a warning for live ebuild
-		# to keep package installable
-		[[  ${PV} == "9999" ]] || die
-	fi
-}
-
-src_prepare() {
-	default
-	libsoversion_check
-
-	# Run unconditionally (bug #792627)
-	eautoreconf
-
-	if [[ ${PV} != "9999" ]]; then
-		# Set revision number
-		sed -i "s/\(Release:\)\(.*\)1/\1\2${PR}-gentoo/" META || die "Could not set Gentoo release"
-	fi
-
-	if use python; then
-		pushd contrib/pyzfs >/dev/null || die
-		distutils-r1_src_prepare
-		popd >/dev/null || die
-	fi
-
-	# Tries to use /etc/conf.d which we reserve for OpenRC
-	sed -i -e '/EnvironmentFile/d' etc/systemd/system/zfs*.in || die
-
-	# prevent errors showing up on zfs-mount stop, #647688
-	# openrc will unmount all filesystems anyway.
-	sed -i "/^ZFS_UNMOUNT=/ s/yes/no/" "etc/default/zfs.in" || die
-}
-
-src_configure() {
-	use custom-cflags || strip-flags
-	use minimal || python_setup
-
-	local myconf=(
-		--bindir="${EPREFIX}/bin"
-		--enable-shared
-		--enable-sysvinit
-		--localstatedir="${EPREFIX}/var"
-		--sbindir="${EPREFIX}/sbin"
-		--with-config=user
-		--with-dracutdir="${EPREFIX}/usr/lib/dracut"
-		--with-linux="${KV_DIR}"
-		--with-linux-obj="${KV_OUT_DIR}"
-		--with-udevdir="$(get_udevdir)"
-		--with-pamconfigsdir="${EPREFIX}/unwanted_files"
-		--with-pammoduledir="$(getpam_mod_dir)"
-		--with-systemdunitdir="$(systemd_get_systemunitdir)"
-		--with-systemdpresetdir="$(systemd_get_systempresetdir)"
-		--with-vendor=gentoo
-		# Building zfs-mount-generator.c on musl breaks as strndupa
-		# isn't available. But systemd doesn't support musl anyway, so
-		# just disable building it.
-		# UPDATE: it has been fixed since,
-		# https://github.com/openzfs/zfs/commit/1f19826c9ac85835cbde61a7439d9d1fefe43a4a
-		# but we still leave it as this for now.
-		$(use_enable !elibc_musl systemd)
-		$(use_enable debug)
-		$(use_enable nls)
-		$(use_enable pam)
-		$(use_enable python pyzfs)
-		$(use_with unwind libunwind)
-		--disable-static
-		$(usex minimal --without-python --with-python="${EPYTHON}")
-	)
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	default
-	if use python; then
-		pushd contrib/pyzfs >/dev/null || die
-		distutils-r1_src_compile
-		popd >/dev/null || die
-	fi
-}
-
-src_install() {
-	default
-
-	gen_usr_ldscript -a nvpair uutil zfsbootenv zfs zfs_core zpool
-
-	use pam && { rm -rv "${ED}/unwanted_files" || die ; }
-
-	use test-suite || { rm -r "${ED}"/usr/share/zfs/{test-runner,zfs-tests,runfiles,*sh} || die ; }
-
-	find "${ED}" -name '*.la' -delete || die
-
-	dobashcomp contrib/bash_completion.d/zfs
-	bashcomp_alias zfs zpool
-
-	# strip executable bit from conf.d file
-	fperms 0644 /etc/conf.d/zfs
-
-	if use python; then
-		pushd contrib/pyzfs >/dev/null || die
-		distutils-r1_src_install
-		popd >/dev/null || die
-	fi
-
-	# enforce best available python implementation
-	use minimal || python_fix_shebang "${ED}/bin"
-}
-
-pkg_postinst() {
-	udev_reload
-
-	# we always need userspace utils in sync with zfs-kmod
-	# so force initrd update for userspace as well, to avoid
-	# situation when zfs-kmod trigger initrd rebuild before
-	# userspace component is rebuilt
-	# KV_* variables are provided by linux-info.eclass
-	if [[ -z ${ROOT} ]] && use dist-kernel; then
-		dist-kernel_reinstall_initramfs "${KV_DIR}" "${KV_FULL}"
-	fi
-
-	if use rootfs; then
-		if ! has_version sys-kernel/genkernel && ! has_version sys-kernel/dracut; then
-			elog "Root on zfs requires an initramfs to boot"
-			elog "The following packages provide one and are tested on a regular basis:"
-			elog "  sys-kernel/dracut ( preferred, module maintained by zfs developers )"
-			elog "  sys-kernel/genkernel"
-		fi
-	fi
-
-	if systemd_is_booted || has_version sys-apps/systemd; then
-		einfo "Please refer to ${EROOT}/$(systemd_get_systempresetdir)/50-zfs.preset"
-		einfo "for default zfs systemd service configuration"
-	else
-		[[ -e "${EROOT}/etc/runlevels/boot/zfs-import" ]] || \
-			einfo "You should add zfs-import to the boot runlevel."
-		[[ -e "${EROOT}/etc/runlevels/boot/zfs-load-key" ]] || \
-			einfo "You should add zfs-load-key to the boot runlevel."
-		[[ -e "${EROOT}/etc/runlevels/boot/zfs-mount" ]]|| \
-			einfo "You should add zfs-mount to the boot runlevel."
-		[[ -e "${EROOT}/etc/runlevels/default/zfs-share" ]] || \
-			einfo "You should add zfs-share to the default runlevel."
-		[[ -e "${EROOT}/etc/runlevels/default/zfs-zed" ]] || \
-			einfo "You should add zfs-zed to the default runlevel."
-	fi
-}
-
-pkg_postrm() {
-	udev_reload
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.3.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.3.2.ebuild
index ed54eda9d89..707e354a195 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.3.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.3.2.ebuild
@@ -3,6 +3,11 @@
 
 EAPI=8
 
+# Maintainers should consider lurking in the ZFS IRC channels (there's several)
+# and regularly checking ZFS GitHub issues and PRs. Look out for the 'zfs-*'
+# stable backport PRs when they're opened and subscribe to them for any important
+# cherry-picks that may be needed in advance.
+
 DISTUTILS_OPTIONAL=1
 DISTUTILS_USE_PEP517=setuptools
 PYTHON_COMPAT=( python3_{10..13} )
@@ -25,7 +30,7 @@ else
 	S="${WORKDIR}/${MY_P}"
 
 	if [[ ${PV} != *_rc* ]]; then
-		KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv ~sparc"
+		KEYWORDS="amd64 arm64 ~loong ppc64 ~riscv ~sparc"
 	fi
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-9999.ebuild
index ed54eda9d89..0f03de4f371 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-9999.ebuild
@@ -3,6 +3,11 @@
 
 EAPI=8
 
+# Maintainers should consider lurking in the ZFS IRC channels (there's several)
+# and regularly checking ZFS GitHub issues and PRs. Look out for the 'zfs-*'
+# stable backport PRs when they're opened and subscribe to them for any important
+# cherry-picks that may be needed in advance.
+
 DISTUTILS_OPTIONAL=1
 DISTUTILS_USE_PEP517=setuptools
 PYTHON_COMPAT=( python3_{10..13} )

From 9f7248d2ff90d5ba3cea6503d1dfba68d978ee55 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:12:51 +0000
Subject: [PATCH 123/136] sys-fs/zfs-kmod: Sync with Gentoo

It's from Gentoo commit 0937861843de5e4740d43cf77d514ddea7f27d05.
---
 .../portage-stable/sys-fs/zfs-kmod/Manifest   |   2 -
 .../sys-fs/zfs-kmod/zfs-kmod-2.3.0.ebuild     | 207 ------------------
 .../sys-fs/zfs-kmod/zfs-kmod-2.3.2.ebuild     |   2 +-
 3 files changed, 1 insertion(+), 210 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.3.0.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/Manifest b/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/Manifest
index 98d07222123..7dd806e761c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/Manifest
@@ -2,8 +2,6 @@ DIST zfs-2.1.16.tar.gz 35187215 BLAKE2B 8bb90903f3747589fff94a810584de54d7f598b0
 DIST zfs-2.1.16.tar.gz.asc 836 BLAKE2B b46614399ca63d9c88216c55bb2177cc0c28f4da2cb6be3ee361efca994309abff46fdf6ad6b0bad448c44e9e84ee40e2183d1b482e04844317f14744bab5c1f SHA512 d2d94a4e3ffe182e86fa3319cb9661688125f378ffa1e5768ee89033f796a1f52f877c382588fb1f434686e30bc4e65e3f08ceac0dd3dd7f8f751ba6182c3317
 DIST zfs-2.2.7.tar.gz 33852602 BLAKE2B 31a066d5d543e3328d1afd065a8da4f9b4c52433d585cdbb41936900fd1453431585c6bc4b6e6d9a497a03e79969bae883e17cf4677099686feb3e32577d2777 SHA512 6493faa8e31d9c042c4e8f748d32cb9243212fdf4e0341c19568b47bcf302e60beb89940b80374610b71e1dca1ca5813f3efaddbf1a2453ceabb38381165b271
 DIST zfs-2.2.7.tar.gz.asc 836 BLAKE2B e8fc5e04f5b37a22c741bda46b4573e0cebe85da051c73cf3c5fc267de3c313399b235fc346ca06f4c22d37d2500044a26adb3ea241a65fbcf8760d0ef880039 SHA512 8d22a64c920c2a983429688a340f4ae281decdd30e465591e6b40af9f3016b8f168f4e8ea460600c832a2f46b383ff307986649a645585fb25c34fdfda75ad6e
-DIST zfs-2.3.0.tar.gz 34029599 BLAKE2B b9fb7913f95dd0c8aec703961ecc0413aa51df889f15b1541ff8fcd7146ba485947fab83deb062bdffcdeab17a2465b7551c7eba3ec55c62c21aba58846c0da5 SHA512 f0bb1c6e28b325765be809dbc5d38ba294daa38b54eafd7d129cf6081fb209b200580437019faeed3614bbb0687d6583698a9282f3275905a1f5a8314a66cf0b
-DIST zfs-2.3.0.tar.gz.asc 836 BLAKE2B 9d1bd03dc6e5699236bca4c2b20a0a8b46e88d90ea58f7171d087c555da85d6af88acc5990f828ba455f9fbe24c90800c1edf74cd3f865b528730ffef8a931b8 SHA512 ba9a8e8b248de7383c8d33b84b0d70de026b8f3e6a1c82557b74ac274b28e559435541fbdfe816f6b80ce5098b3cac34af69cd53877f1f50fa6a846fa92a5dd0
 DIST zfs-2.3.1.tar.gz 34048716 BLAKE2B 7f22826c3359a015a87aafd119d882d8196dca59dadd85674a48c42ed502937f2880e98a387e9986be2c14fc48f46a288aed5fd8635f13db2585e3fc95e57726 SHA512 235023dbe97b3f7c5273e2a6fa34957cc37967256845d4ed9faa2e2a6da29ea6fdcba4167658cf03129afbb0aa11311a760d3d0b5ea5aecc64a4c7ee22ad2d31
 DIST zfs-2.3.1.tar.gz.asc 836 BLAKE2B 5d1f84f5803f1b0553ad75b12020a57537f6a6e3c3781ab8a21f0d7de9ad6be0be7618bb42e51bbddd5fc48cabb05f6d79ea2f5eebc63d67383b29c44d69f7f6 SHA512 619aac22d80b8100f28ca3e4a984b2e0387b272131d2a8c104a278955a811e2280ecf3bfa3b7d54ed73572ed7cd45121cd724b52afd3503c30c1e41400d27674
 DIST zfs-2.3.2.tar.gz 34344259 BLAKE2B 8a89c62cbbeaf410db4011821cdd9959abef1782be7427b81ac47565407384fa3a381bef041dae73e97c2b2cefca62933180851901b3b1b86974ed33ad178a61 SHA512 94311f2eca1488be83aa0cb802b4a4541bbbd061a3e8e5cbda62cabbb0c8f9a705372ad192cb77703b3d7642c43be7f604f3c363b243cf03a6aceae2d7e5db81
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.3.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.3.0.ebuild
deleted file mode 100644
index 435d8a40d27..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.3.0.ebuild
+++ /dev/null
@@ -1,207 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-MODULES_INITRAMFS_IUSE=+initramfs
-inherit autotools flag-o-matic linux-mod-r1 multiprocessing
-
-DESCRIPTION="Linux ZFS kernel module for sys-fs/zfs"
-HOMEPAGE="https://github.com/openzfs/zfs"
-
-MODULES_KERNEL_MAX=6.12
-MODULES_KERNEL_MIN=4.18
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://github.com/openzfs/zfs.git"
-	inherit git-r3
-	unset MODULES_KERNEL_MAX
-else
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openzfs.asc
-	inherit verify-sig
-
-	MY_PV=${PV/_rc/-rc}
-	SRC_URI="https://github.com/openzfs/zfs/releases/download/zfs-${MY_PV}/zfs-${MY_PV}.tar.gz"
-	SRC_URI+=" verify-sig? ( https://github.com/openzfs/zfs/releases/download/zfs-${MY_PV}/zfs-${MY_PV}.tar.gz.asc )"
-	S="${WORKDIR}/zfs-${MY_PV}"
-
-	ZFS_KERNEL_COMPAT="${MODULES_KERNEL_MAX}"
-	# Increments minor eg 5.14 -> 5.15, and still supports override.
-	ZFS_KERNEL_DEP="${ZFS_KERNEL_COMPAT_OVERRIDE:-${ZFS_KERNEL_COMPAT}}"
-	ZFS_KERNEL_DEP="${ZFS_KERNEL_DEP%%.*}.$(( ${ZFS_KERNEL_DEP##*.} + 1))"
-
-	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv ~sparc"
-	fi
-fi
-
-LICENSE="CDDL MIT debug? ( GPL-2+ )"
-SLOT="0/${PVR}"
-IUSE="custom-cflags debug +rootfs"
-RESTRICT="test"
-
-BDEPEND="
-	app-alternatives/awk
-	dev-lang/perl
-"
-
-if [[ ${PV} != 9999 ]] ; then
-	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-openzfs )"
-
-	IUSE+=" +dist-kernel-cap"
-	RDEPEND="
-		dist-kernel-cap? ( dist-kernel? (
-			<virtual/dist-kernel-${ZFS_KERNEL_DEP}
-		) )
-	"
-fi
-
-# Used to suggest matching USE, but without suggesting to disable
-PDEPEND="dist-kernel? ( ~sys-fs/zfs-${PV}[dist-kernel] )"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-2.1.11-gentoo.patch
-)
-
-pkg_pretend() {
-	use rootfs || return 0
-}
-
-pkg_setup() {
-	local CONFIG_CHECK="
-		EFI_PARTITION
-		ZLIB_DEFLATE
-		ZLIB_INFLATE
-		!DEBUG_LOCK_ALLOC
-		!PAX_KERNEXEC_PLUGIN_METHOD_OR
-	"
-	use debug && CONFIG_CHECK+="
-		DEBUG_INFO
-		FRAME_POINTER
-		!DEBUG_INFO_REDUCED
-	"
-	use rootfs && CONFIG_CHECK+="
-		BLK_DEV_INITRD
-		DEVTMPFS
-	"
-
-	kernel_is -lt 5 && CONFIG_CHECK+=" IOSCHED_NOOP"
-
-	if [[ ${PV} != 9999 ]] ; then
-		local kv_major_max kv_minor_max zcompat
-		zcompat="${ZFS_KERNEL_COMPAT_OVERRIDE:-${ZFS_KERNEL_COMPAT}}"
-		kv_major_max="${zcompat%%.*}"
-		zcompat="${zcompat#*.}"
-		kv_minor_max="${zcompat%%.*}"
-		kernel_is -le "${kv_major_max}" "${kv_minor_max}" || die \
-			"Linux ${kv_major_max}.${kv_minor_max} is the latest supported version"
-	fi
-
-	linux-mod-r1_pkg_setup
-}
-
-src_prepare() {
-	default
-
-	# Run unconditionally (bug #792627)
-	eautoreconf
-
-	if [[ ${PV} != 9999 ]] ; then
-		# Set module revision number
-		sed -Ei "s/(Release:.*)1/\1${PR}-gentoo/" META || die
-	fi
-}
-
-src_configure() {
-	use custom-cflags || strip-flags
-	filter-ldflags -Wl,*
-
-	local myconf=(
-		--bindir="${EPREFIX}"/bin
-		--sbindir="${EPREFIX}"/sbin
-		--with-config=kernel
-		--with-linux="${KV_DIR}"
-		--with-linux-obj="${KV_OUT_DIR}"
-		$(use_enable debug)
-
-		# See gentoo.patch
-		GENTOO_MAKEARGS_EVAL="${MODULES_MAKEARGS[*]@Q}"
-		TEST_JOBS="$(makeopts_jobs)"
-	)
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	emake "${MODULES_MAKEARGS[@]}"
-}
-
-src_install() {
-	emake "${MODULES_MAKEARGS[@]}" DESTDIR="${ED}" install
-	modules_post_process
-
-	dodoc AUTHORS COPYRIGHT META README.md
-}
-
-_old_layout_cleanup() {
-	# new files are just extra/{spl,zfs}.ko with no subdirs.
-	local olddir=(
-		avl/zavl
-		icp/icp
-		lua/zlua
-		nvpair/znvpair
-		spl/spl
-		unicode/zunicode
-		zcommon/zcommon
-		zfs/zfs
-		zstd/zzstd
-	)
-
-	# kernel/module/Kconfig contains possible compressed extentions.
-	local kext kextfiles
-		for kext in .ko{,.{gz,xz,zst}}; do
-		kextfiles+=( "${olddir[@]/%/${kext}}" )
-	done
-
-	local oldfile oldpath
-	for oldfile in "${kextfiles[@]}"; do
-		oldpath="${EROOT}/lib/modules/${KV_FULL}/extra/${oldfile}"
-		if [[ -f "${oldpath}" ]]; then
-			ewarn "Found obsolete zfs module ${oldfile} for current kernel ${KV_FULL}, removing."
-			rm -rv "${oldpath}" || die
-			# we do not remove non-empty directories just for safety in case there's something else.
-			# also it may fail if there are both compressed and uncompressed modules installed.
-			rmdir -v --ignore-fail-on-non-empty "${oldpath%/*.*}" || die
-		fi
-	done
-}
-
-pkg_postinst() {
-	# Check for old module layout before doing anything else.
-	# only attempt layout cleanup if new .ko location is used.
-	local newko=( "${EROOT}/lib/modules/${KV_FULL}/extra"/{zfs,spl}.ko* )
-	# We check first array member, if glob above did not exand, it will be "zfs.ko*" and -f will return false.
-	# if glob expanded -f will do correct file precense check.
-	[[ -f ${newko[0]} ]] && _old_layout_cleanup
-
-	linux-mod-r1_pkg_postinst
-
-	if use x86 || use arm ; then
-		ewarn "32-bit kernels will likely require increasing vmalloc to"
-		ewarn "at least 256M and decreasing zfs_arc_max to some value less than that."
-	fi
-
-	if has_version sys-boot/grub ; then
-		ewarn "This version of OpenZFS includes support for new feature flags"
-		ewarn "that are incompatible with previous versions. GRUB2 support for"
-		ewarn "/boot with the new feature flags is not yet available."
-		ewarn "Do *NOT* upgrade root pools to use the new feature flags."
-		ewarn "Any new pools will be created with the new feature flags by default"
-		ewarn "and will not be compatible with older versions of OpenZFS. To"
-		ewarn "create a new pool that is backward compatible wih GRUB2, use "
-		ewarn
-		ewarn "zpool create -o compatibility=grub2 ..."
-		ewarn
-		ewarn "Refer to /usr/share/zfs/compatibility.d/grub2 for list of features."
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.3.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.3.2.ebuild
index 2b1d047a34c..e8da986b29c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.3.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.3.2.ebuild
@@ -31,7 +31,7 @@ else
 	ZFS_KERNEL_DEP="${ZFS_KERNEL_DEP%%.*}.$(( ${ZFS_KERNEL_DEP##*.} + 1))"
 
 	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv ~sparc"
+		KEYWORDS="amd64 arm64 ~loong ppc64 ~riscv ~sparc"
 	fi
 fi
 

From 7bf456e11f01119912710a4b2f55fd354abbe71e Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:12:52 +0000
Subject: [PATCH 124/136] sys-libs/binutils-libs: Sync with Gentoo

It's from Gentoo commit b2d68e3a4bae7c7b144fabe58efdccf68c862628.
---
 .../binutils-libs-2.44-r1.ebuild              | 233 ++++++++++++++++++
 .../binutils-libs/binutils-libs-9999.ebuild   |  23 +-
 2 files changed, 249 insertions(+), 7 deletions(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44-r1.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44-r1.ebuild
new file mode 100644
index 00000000000..990df14b583
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44-r1.ebuild
@@ -0,0 +1,233 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit dot-a flag-o-matic libtool toolchain-funcs multilib-minimal
+
+DESCRIPTION="Core binutils libraries (libbfd, libopcodes, libiberty) for external packages"
+HOMEPAGE="https://sourceware.org/binutils/"
+
+LICENSE="|| ( GPL-3 LGPL-3 )"
+IUSE="64-bit-bfd cet multitarget nls static-libs test"
+
+# Variables that can be set here  (ignored for live ebuilds)
+# PATCH_VER          - the patchset version
+#                      Default: empty, no patching
+# PATCH_BINUTILS_VER - the binutils version in the patchset name
+#                    - Default: PV
+# PATCH_DEV          - Use download URI https://dev.gentoo.org/~{PATCH_DEV}/distfiles/...
+#                      for the patchsets
+
+PATCH_VER=1
+PATCH_DEV=dilfridge
+
+MY_PN=binutils
+MY_P=${MY_PN}-${PV}
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	SLOT="0/${PV}"
+elif [[ ${PV} == *9999 ]]; then
+	inherit git-r3
+	SLOT="0/$(ver_cut 1-2)"
+else
+	PATCH_BINUTILS_VER=${PATCH_BINUTILS_VER:-${PV}}
+	PATCH_DEV=${PATCH_DEV:-dilfridge}
+	SRC_URI="mirror://gnu/binutils/${MY_P}.tar.xz
+	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${MY_P}.tar.xz
+	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${MY_PN}-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
+	SLOT="0/${PV}"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+fi
+
+BDEPEND="
+	nls? ( sys-devel/gettext )
+	test? ( dev-util/dejagnu )
+"
+DEPEND="sys-libs/zlib[${MULTILIB_USEDEP}]"
+# Need a newer binutils-config that'll reset include/lib symlinks for us.
+RDEPEND="${DEPEND}
+	>=sys-devel/binutils-config-5
+"
+
+RESTRICT="!test? ( test )"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/bfd.h
+)
+
+src_unpack() {
+	if [[ ${PV} == *9999 ]] ; then
+		EGIT_REPO_URI="
+			https://anongit.gentoo.org/git/proj/toolchain/binutils-patches.git
+			https://github.com/gentoo/binutils-patches
+		"
+		EGIT_CHECKOUT_DIR=${WORKDIR}/patches-git
+		git-r3_src_unpack
+		mv patches-git/9999 patch || die
+
+		if [[ ${PV} != 9999 ]] ; then
+			EGIT_BRANCH=binutils-$(ver_cut 1)_$(ver_cut 2)-branch
+		fi
+		EGIT_REPO_URI="
+			https://sourceware.org/git/binutils-gdb.git
+			https://git.sr.ht/~sourceware/binutils-gdb
+			https://gitlab.com/x86-binutils/binutils-gdb.git
+		"
+		S=${WORKDIR}/binutils
+		EGIT_CHECKOUT_DIR=${S}
+		git-r3_src_unpack
+	else
+		unpack ${MY_P}.tar.xz
+
+		cd "${WORKDIR}" || die
+		unpack binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz
+
+		# _p patch versions are Gentoo specific tarballs ...
+		local dir=${MY_P}
+		dir=${dir/-hppa64/}
+
+		S=${WORKDIR}/${dir}
+	fi
+
+	cd "${WORKDIR}" || die
+}
+
+src_prepare() {
+	if [[ -n ${PATCH_VER} ]] ; then
+		einfo "Applying binutils-${PATCH_BINUTILS_VER} patchset ${PATCH_VER}"
+		eapply "${WORKDIR}/patch"/*.patch
+	fi
+
+	# Fix cross-compile relinking issue, bug #626402
+	elibtoolize
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# somehow libtool/configure is messed up and (custom patch at
+		# upstream?) and misdetects (basically assumes) nm can be called
+		# with -B arg -- can't run eautoreconf (fails), so patch up
+		# manually, this would break any target that needs -B to nm
+		sed -i -e 's/lt_cv_path_NM="$tmp_nm -B"/lt_cv_path_NM="$tmp_nm"/' \
+			libctf/configure || die
+	fi
+
+	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
+	# Avoid really confusing logs from subconfigure spam, makes logs far
+	# more legible.
+	export MAKEOPTS="--output-sync=line ${MAKEOPTS}"
+
+	default
+}
+
+pkgversion() {
+	printf "Gentoo ${PVR}"
+	[[ -n ${PATCHVER} ]] && printf " p${PATCHVER}"
+}
+
+src_configure() {
+	lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	filter-lto
+
+	local myconf=(
+		# portage's econf() does not detect presence of --d-d-t
+		# because it greps only top-level ./configure. But not
+		# libiberty's or bfd's configure.
+		--disable-dependency-tracking
+		--disable-silent-rules
+		--enable-obsolete
+		--enable-shared
+		--enable-threads
+		# Newer versions (>=2.24) make this an explicit option. #497268
+		--enable-install-libiberty
+		--disable-werror
+		--with-bugurl="https://bugs.gentoo.org/"
+		--with-pkgversion="$(pkgversion)"
+		$(use_enable static-libs static)
+		# The binutils eclass enables this flag for all bi-arch builds,
+		# but other tools often don't care about that support.  Put it
+		# beyond a flag if people really want it, but otherwise leave
+		# it disabled as it can slow things down on 32bit arches. #438522
+		$(use_enable 64-bit-bfd)
+		# This only disables building in the zlib subdir.
+		# For binutils itself, it'll use the system version. #591516
+		--without-zlib
+		--with-system-zlib
+		# We only care about the libs, so disable programs. #528088
+		--disable-{binutils,etc,ld,gas,gprof,gprofng}
+		# Disable modules that are in a combined binutils/gdb tree. #490566
+		--disable-{gdb,gdbserver,libbacktrace,libdecnumber,readline,sim}
+		# Strip out broken static link flags.
+		# https://gcc.gnu.org/PR56750
+		--without-stage1-ldflags
+		# We pull in all USE-flags that change ABI in an incompatible
+		# way. #666100
+		# USE=multitarget change size of global arrays
+		# USE=64-bit-bfd changes data structures of exported API
+		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)-$(usex 64-bit-bfd 64 def)
+
+		# Avoid automagic dependency on (currently prefix) systems
+		# with debuginfod library, bug #754753
+		--without-debuginfod
+
+		# Revisit if it's useful, we do have binutils[zstd] though
+		--without-zstd
+
+		# Allow user to opt into CET for host libraries.
+		# Ideally we would like automagic-or-disabled here.
+		# But the check does not quite work on i686: bug #760926.
+		$(use_enable cet)
+	)
+
+	# mips can't do hash-style=gnu ...
+	if [[ $(tc-arch) != mips ]] ; then
+		myconf+=( --enable-default-hash-style=gnu )
+	fi
+
+	use multitarget && myconf+=( --enable-targets=all --enable-64-bit-bfd )
+
+	use nls \
+		&& myconf+=( --without-included-gettext ) \
+		|| myconf+=( --disable-nls )
+
+	if [[ ${CHOST} == *-darwin* ]] && use nls ; then
+		# fix underlinking in opcodes
+		sed -i -e 's/@SHARED_LDFLAGS@/@SHARED_LDFLAGS@ -lintl/' \
+			"${S}"/opcodes/Makefile.in || die
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+
+	# Prevent makeinfo from running as we don't build docs here.
+	# bug #622652
+	sed -i \
+		-e '/^MAKEINFO/s:=.*:= true:' \
+		Makefile || die
+}
+
+multilib_src_test() {
+	# Without this, the default `src_test` check for the 'check' target
+	# with `-n` may fail with parallel make and silently skip tests (bug #955595)
+	emake check
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+
+	# Provided by dev-debug/gdb instead
+	if [[ ${PV} != 9999 ]] ; then
+		rm "${ED}"/usr/share/info/sframe-spec.info || die
+	fi
+
+	# Provide libiberty.h directly.
+	dosym libiberty/libiberty.h /usr/include/libiberty.h
+}
+
+multilib_src_install_all() {
+	use static-libs || find "${ED}"/usr -name '*.la' -delete
+	strip-lto-bytecode
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-9999.ebuild
index 6b4dbbfd697..9b8bfbc90fc 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-9999.ebuild
@@ -1,9 +1,9 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
-inherit flag-o-matic libtool toolchain-funcs multilib-minimal
+inherit dot-a flag-o-matic libtool toolchain-funcs multilib-minimal
 
 DESCRIPTION="Core binutils libraries (libbfd, libopcodes, libiberty) for external packages"
 HOMEPAGE="https://sourceware.org/binutils/"
@@ -53,8 +53,6 @@ RDEPEND="${DEPEND}
 
 RESTRICT="!test? ( test )"
 
-MY_BUILDDIR=${WORKDIR}/build
-
 MULTILIB_WRAPPED_HEADERS=(
 	/usr/include/bfd.h
 )
@@ -94,7 +92,6 @@ src_unpack() {
 	fi
 
 	cd "${WORKDIR}" || die
-	mkdir -p "${MY_BUILDDIR}" || die
 }
 
 src_prepare() {
@@ -128,6 +125,11 @@ pkgversion() {
 	[[ -n ${PATCHVER} ]] && printf " p${PATCHVER}"
 }
 
+src_configure() {
+	lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	filter-lto
 
@@ -168,8 +170,8 @@ multilib_src_configure() {
 		# USE=64-bit-bfd changes data structures of exported API
 		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)-$(usex 64-bit-bfd 64 def)
 
-		# avoid automagic dependency on (currently prefix) systems
-		# systems with debuginfod library, bug #754753
+		# Avoid automagic dependency on (currently prefix) systems
+		# with debuginfod library, bug #754753
 		--without-debuginfod
 
 		# Revisit if it's useful, we do have binutils[zstd] though
@@ -207,6 +209,12 @@ multilib_src_configure() {
 		Makefile || die
 }
 
+multilib_src_test() {
+	# Without this, the default `src_test` check for the 'check' target
+	# with `-n` may fail with parallel make and silently skip tests (bug #955595)
+	emake check
+}
+
 multilib_src_install() {
 	emake DESTDIR="${D}" install
 
@@ -221,4 +229,5 @@ multilib_src_install() {
 
 multilib_src_install_all() {
 	use static-libs || find "${ED}"/usr -name '*.la' -delete
+	strip-lto-bytecode
 }

From 4f9c6387c141eb1829c5634f8f07127e65b807cd Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:12:54 +0000
Subject: [PATCH 125/136] sys-libs/gdbm: Sync with Gentoo

It's from Gentoo commit c0d8f8bb00a3b79b5af0dc1f1710c574ad637cc6.
---
 .../third_party/portage-stable/sys-libs/gdbm/gdbm-1.25.ebuild   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.25.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.25.ebuild
index 2c4d0280032..a991431ac21 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.25.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.25.ebuild
@@ -15,7 +15,7 @@ SRC_URI="
 
 LICENSE="GPL-3"
 SLOT="0/6" # libgdbm.so version
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="+berkdb nls +readline static-libs test"
 RESTRICT="!test? ( test )"
 

From 2a16253dc52af54e9edc6185063416c8cd9086b9 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:12:54 +0000
Subject: [PATCH 126/136] sys-libs/glibc: Sync with Gentoo

It's from Gentoo commit 3775999aabeca27608c38d4a6d135a281345ce0a.
---
 .../portage-stable/sys-libs/glibc/Manifest    |    1 +
 .../sys-libs/glibc/glibc-2.41-r2.ebuild       | 1759 +++++++++++++++++
 2 files changed, 1760 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.41-r2.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/Manifest
index 89f9e828911..2466e38ddde 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/Manifest
@@ -28,6 +28,7 @@ DIST glibc-2.40-patches-9.tar.xz 187952 BLAKE2B 48aecbdcc9ddc0b1139de1934c26952d
 DIST glibc-2.40.tar.xz 18752204 BLAKE2B 8593cab5b2549b77159b6866fbb40b917e491fd5bc0814f7f85b6529166d78d4583436450c479b86cdfe468304fc4d2a9ba8294230a55dbc4c15e89c3ab6c000 SHA512 33caf91dbfddde6480b7cdf7a68b36aff8c522bfee56160af26af297f1b768668edb08bc4e1a7ff61c64721e3c1d49c347a5dd01c5edd3b914ee6479c8b27885
 DIST glibc-2.41-patches-1.tar.xz 17560 BLAKE2B dc4e39cb5605867b44c2308a8d6d6c0a662656b80a0aa2734f488e2cc22e26c948177eeb80ff6c79d82925b4dbd146a4d78646879c6e32fd60f817fb0d9ae092 SHA512 94da2092e49ee827d7558bcbfa8ebcbb9f81ed68848221d139039ea788cef57375ccfa61498bc73c6e83050681990d3968791a5f90514de12e45c10baef31d1e
 DIST glibc-2.41-patches-2.tar.xz 54320 BLAKE2B cd0779c452159c90adf165da18e61699dc5e53dcfecb44f8e7ddc5bcbb00050705a423a298a57054ddce5daaee728ac03d1e25c71ad5070edf5907ac6eac0783 SHA512 4c74a657faa1cffedc083d061258508f483d25e5f3989d98e61608e245a6e75e5c389fefd0c31e5ccde6926c5173364852957b8d8b83a474842c635d1f7fc1c3
+DIST glibc-2.41-patches-3.tar.xz 71180 BLAKE2B 4e871573c6f223ab8eb48a6f4589d511ea2e7b13b45c2317ba6309c3453b3bcaa9c1d07ebcb6c3ac81a7f2650330b5c4c575a0ea6a1526724cacf6a6aaef9d62 SHA512 89ccc4f382eedb83e0b69d39b7e40f32737eb6ea07351ac599849effb7591d43e266ef43f12afb430a15e3c4df98e512e4b3b5c4c3db2fc34be97f5b309edede
 DIST glibc-2.41.tar.xz 19344868 BLAKE2B 4da62f489ba7a95bb069c2cfea8cf78e4d37e3a5f7e1736239670ba1dca12b69aa77bd00ced078c27d91b1e622c58cbd70258161a9d18c5b3bcc95863b8d744d SHA512 894a3e5a796bc13df30c26a5bfbe4d60b5dbdaac54e7763432235124b547070c7dda88c50584536870cab79183d8cad73a3ac6ed09bfe54fa8482aad07253169
 DIST glibc-systemd-20210729.tar.gz 1480 BLAKE2B 37722c7579df782d890e44dbab99c3de52ab466eb9de80d82405e9bb5620bf39ffc8c5f466a435bdb86ef6d36dd7019c0736573916bda6c67d02a2581e0ec979 SHA512 efd75af58b50522c28cdac7abd1fc56555bc1bb042512c90d8340c1ec09c5791b3872a305bf83723252bbde5855b75d958c041083457765c4cfd170732d09238
 DIST glibc-systemd-20210814.tar.gz 1469 BLAKE2B 10fa7bcb46d4fdce9c0ab353cbd30871e9b09a347a13a9c9a3b5777f931aa3c826c158d2e49532c604d4a834f2fab4089b67495fb88d0398945dc50d45ad9ef1 SHA512 5346a9ea459a1e6ccf665389f2a294de1e16f1e3e05cdf07e3dd99ed0e4f6f8b52cc333d4bff3c75ac90ab6ce70cd4ab2b3e126f920ce7979abd6dda56315efc
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.41-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.41-r2.ebuild
new file mode 100644
index 00000000000..de7c10771d7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.41-r2.ebuild
@@ -0,0 +1,1759 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Bumping notes: https://wiki.gentoo.org/wiki/Project:Toolchain/sys-libs/glibc
+# Please read & adapt the page as necessary if obsolete.
+
+PYTHON_COMPAT=( python3_{10..13} )
+TMPFILES_OPTIONAL=1
+
+EMULTILIB_PKG="true"
+
+# Gentoo patchset (ignored for live ebuilds)
+PATCH_VER=3
+PATCH_DEV=dilfridge
+
+# gcc mulitilib bootstrap files version
+GCC_BOOTSTRAP_VER=20201208
+
+# systemd integration version
+GLIBC_SYSTEMD_VER=20210729
+
+# Minimum kernel version that glibc requires
+MIN_KERN_VER="3.2.0"
+
+# Minimum pax-utils version needed (which contains any new syscall changes for
+# its seccomp filter!). Please double check this!
+MIN_PAX_UTILS_VER="1.3.3"
+
+# Minimum systemd version needed (which contains any new syscall changes for
+# its seccomp filter!). Please double check this!
+MIN_SYSTEMD_VER="254.9-r1"
+
+inherit python-any-r1 prefix preserve-libs toolchain-funcs flag-o-matic gnuconfig \
+	multilib systemd multiprocessing tmpfiles eapi9-ver
+
+DESCRIPTION="GNU libc C library"
+HOMEPAGE="https://www.gnu.org/software/libc/"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+else
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	SRC_URI="mirror://gnu/glibc/${P}.tar.xz"
+	SRC_URI+=" https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${P}-patches-${PATCH_VER}.tar.xz"
+fi
+
+SRC_URI+=" multilib-bootstrap? ( https://dev.gentoo.org/~dilfridge/distfiles/gcc-multilib-bootstrap-${GCC_BOOTSTRAP_VER}.tar.xz )"
+SRC_URI+=" systemd? ( https://gitweb.gentoo.org/proj/toolchain/glibc-systemd.git/snapshot/glibc-systemd-${GLIBC_SYSTEMD_VER}.tar.gz )"
+
+LICENSE="LGPL-2.1+ BSD HPND ISC inner-net rc PCRE"
+SLOT="2.2"
+IUSE="audit caps cet compile-locales custom-cflags doc gd hash-sysv-compat headers-only +multiarch multilib multilib-bootstrap nscd perl profile selinux +ssp stack-realign +static-libs suid systemd systemtap test vanilla"
+
+# Here's how the cross-compile logic breaks down ...
+#  CTARGET - machine that will target the binaries
+#  CHOST   - machine that will host the binaries
+#  CBUILD  - machine that will build the binaries
+# If CTARGET != CHOST, it means you want a libc for cross-compiling.
+# If CHOST != CBUILD, it means you want to cross-compile the libc.
+#  CBUILD = CHOST = CTARGET    - native build/install
+#  CBUILD != (CHOST = CTARGET) - cross-compile a native build
+#  (CBUILD = CHOST) != CTARGET - libc for cross-compiler
+#  CBUILD != CHOST != CTARGET  - cross-compile a libc for a cross-compiler
+# For install paths:
+#  CHOST = CTARGET  - install into /
+#  CHOST != CTARGET - install into /usr/CTARGET/
+#
+export CBUILD=${CBUILD:-${CHOST}}
+export CTARGET=${CTARGET:-${CHOST}}
+if [[ ${CTARGET} == ${CHOST} ]] ; then
+	if [[ ${CATEGORY} == cross-* ]] ; then
+		export CTARGET=${CATEGORY#cross-}
+	fi
+fi
+
+# Note [Disable automatic stripping]
+# Disabling automatic stripping for a few reasons:
+# - portage's attempt to strip breaks non-native binaries at least on
+#   arm: bug #697428
+# - portage's attempt to strip libpthread.so.0 breaks gdb thread
+#   enumeration: bug #697910. This is quite subtle:
+#   * gdb uses glibc's libthread_db-1.0.so to enumerate threads.
+#   * libthread_db-1.0.so needs access to libpthread.so.0 local symbols
+#     via 'ps_pglobal_lookup' symbol defined in gdb.
+#   * 'ps_pglobal_lookup' uses '.symtab' section table to resolve all
+#     known symbols in 'libpthread.so.0'. Specifically 'nptl_version'
+#     (unexported) is used to sanity check compatibility before enabling
+#     debugging.
+#     Also see https://sourceware.org/gdb/wiki/FAQ#GDB_does_not_see_any_threads_besides_the_one_in_which_crash_occurred.3B_or_SIGTRAP_kills_my_program_when_I_set_a_breakpoint
+#   * normal 'strip' command trims '.symtab'
+#   Thus our main goal here is to prevent 'libpthread.so.0' from
+#   losing it's '.symtab' entries.
+# - similarly, valgrind requires knowledge about symbols in ld.so:
+#	bug #920753
+# As Gentoo's strip does not allow us to pass less aggressive stripping
+# options and does not check the machine target we strip selectively.
+
+# We need a new-enough binutils/gcc to match upstream baseline.
+# Also we need to make sure our binutils/gcc supports TLS,
+# and that gcc already contains the hardened patches.
+# Lastly, let's avoid some openssh nastiness, bug 708224, as
+# convenience to our users.
+
+IDEPEND="
+	!compile-locales? ( sys-apps/locale-gen )
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	>=app-misc/pax-utils-${MIN_PAX_UTILS_VER}
+	sys-devel/bison
+	compile-locales? ( sys-apps/locale-gen )
+	doc? (
+		dev-lang/perl
+		sys-apps/texinfo
+	)
+	test? (
+		dev-lang/perl
+		>=net-dns/libidn2-2.3.0
+		sys-apps/gawk[mpfr]
+	)
+"
+COMMON_DEPEND="
+	gd? ( media-libs/gd:2= )
+	nscd? ( selinux? (
+		audit? ( sys-process/audit )
+		caps? ( sys-libs/libcap )
+	) )
+	suid? ( caps? ( sys-libs/libcap ) )
+	selinux? ( sys-libs/libselinux )
+	systemtap? ( dev-debug/systemtap )
+"
+DEPEND="${COMMON_DEPEND}
+"
+RDEPEND="${COMMON_DEPEND}
+	!<app-misc/pax-utils-${MIN_PAX_UTILS_VER}
+	!<sys-apps/systemd-${MIN_SYSTEMD_VER}
+	perl? ( dev-lang/perl )
+"
+
+RESTRICT="!test? ( test )"
+
+if [[ ${CATEGORY} == cross-* ]] ; then
+	BDEPEND+=" !headers-only? (
+		>=${CATEGORY}/binutils-2.27
+		>=${CATEGORY}/gcc-6.2
+	)"
+	[[ ${CATEGORY} == *-linux* ]] && DEPEND+=" ${CATEGORY}/linux-headers"
+else
+	BDEPEND+="
+		>=sys-devel/binutils-2.27
+		>=sys-devel/gcc-6.2
+	"
+	DEPEND+=" virtual/os-headers "
+	RDEPEND+="
+		>=net-dns/libidn2-2.3.0
+		vanilla? ( !sys-libs/timezone-data )
+	"
+	PDEPEND+=" !vanilla? ( sys-libs/timezone-data )"
+fi
+
+# Ignore tests whitelisted below
+GENTOO_GLIBC_XFAIL_TESTS="${GENTOO_GLIBC_XFAIL_TESTS:-yes}"
+
+# The following tests fail due to the Gentoo build system and are thus
+# executed but ignored:
+XFAIL_TEST_LIST=(
+	# buggy test, assumes /dev/ and /dev/null on a single filesystem
+	# 'mount --bind /dev/null /chroot/dev/null' breaks it.
+	# https://sourceware.org/PR25909
+	tst-support_descriptors
+
+	# The following tests fail only inside portage
+	# https://bugs.gentoo.org/831267
+	tst-system
+	tst-strerror
+	tst-strsignal
+
+	# Fails with certain PORTAGE_NICENESS/PORTAGE_SCHEDULING_POLICY
+	tst-sched1
+	tst-sched_setattr
+
+	# Fails regularly, unreliable
+	tst-valgrind-smoke
+
+	# https://sourceware.org/bugzilla/show_bug.cgi?id=31877 (bug #927973)
+	tst-shstk-legacy-1g
+)
+
+XFAIL_NSPAWN_TEST_LIST=(
+	# These tests need to be adapted to handle EPERM/ENOSYS(?) properly
+	# upstream, as systemd-nspawn's default seccomp whitelist is too strict.
+	# https://sourceware.org/PR30603
+	test-errno-linux
+	tst-aarch64-pkey
+	tst-bz21269
+	tst-mlock2
+	tst-ntp_gettime
+	tst-ntp_gettime-time64
+	tst-ntp_gettimex
+	tst-ntp_gettimex-time64
+	tst-pkey
+	tst-process_mrelease
+	tst-adjtime
+	tst-adjtime-time64
+	tst-clock2
+	tst-clock2-time64
+
+	# These fail if --suppress-sync and/or low priority is set
+	tst-sync_file_range
+	test-errno
+)
+
+#
+# Small helper functions
+#
+
+dump_build_environment() {
+	einfo ==== glibc build environment ========================================================
+	local v
+	for v in ABI CBUILD CHOST CTARGET CBUILD_OPT CTARGET_OPT CC CXX CPP LD \
+		{AS,C,CPP,CXX,LD}FLAGS MAKEINFO NM AR AS STRIP RANLIB OBJCOPY \
+		STRINGS OBJDUMP READELF; do
+		einfo " $(printf '%15s' ${v}:)   ${!v}"
+	done
+	einfo =====================================================================================
+}
+
+is_crosscompile() {
+	[[ ${CHOST} != ${CTARGET} ]]
+}
+
+just_headers() {
+	is_crosscompile && use headers-only
+}
+
+alt_prefix() {
+	is_crosscompile && echo /usr/${CTARGET}
+}
+
+# This prefix is applicable to CHOST when building against this
+# glibc. It is baked into the library at configure time.
+host_eprefix() {
+	is_crosscompile || echo "${EPREFIX}"
+}
+
+# This prefix is applicable to CBUILD when building against this
+# glibc. It determines the destination path at install time.
+build_eprefix() {
+	is_crosscompile && echo "${EPREFIX}"
+}
+
+alt_headers() {
+	echo $(alt_prefix)/usr/include
+}
+alt_libdir() {
+	echo $(alt_prefix)/$(get_libdir)
+}
+alt_usrlibdir() {
+	echo $(alt_prefix)/usr/$(get_libdir)
+}
+
+builddir() {
+	echo "${WORKDIR}/build-${ABI}-${CTARGET}-$1"
+}
+
+do_compile_test() {
+	local ret save_cflags=${CFLAGS}
+	CFLAGS+=" $1"
+	shift
+
+	pushd "${T}" >/dev/null
+
+	rm -f glibc-test*
+	printf '%b' "$*" > glibc-test.c
+
+	# We assume CC is already set up.
+	nonfatal emake glibc-test
+	ret=$?
+
+	popd >/dev/null
+
+	CFLAGS=${save_cflags}
+	return ${ret}
+}
+
+do_run_test() {
+	local ret
+
+	if [[ ${MERGE_TYPE} == "binary" ]] ; then
+		# ignore build failures when installing a binary package #324685
+		do_compile_test "" "$@" 2>/dev/null || return 0
+	else
+		ebegin "Performing simple compile test for ABI=${ABI}"
+		if ! do_compile_test "" "$@" ; then
+			ewarn "Simple build failed ... assuming this is desired #324685"
+			eend 1
+			return 0
+		else
+			eend 0
+		fi
+	fi
+
+	pushd "${T}" >/dev/null
+
+	./glibc-test
+	ret=$?
+	rm -f glibc-test*
+
+	popd >/dev/null
+
+	return ${ret}
+}
+
+setup_target_flags() {
+	# This largely mucks with compiler flags.  None of which should matter
+	# when building up just the headers.
+	just_headers && return 0
+
+	case $(tc-arch) in
+		x86)
+			# -march needed for #185404 #199334
+			# TODO: When creating the first glibc cross-compile, this test will
+			# always fail as it does a full link which in turn requires glibc.
+			# Probably also applies when changing multilib profile settings (e.g.
+			# enabling x86 when the profile was amd64-only previously).
+			# We could change main to _start and pass -nostdlib here so that we
+			# only test the gcc code compilation.  Or we could do a compile and
+			# then look for the symbol via scanelf.
+			if ! do_compile_test "" 'void f(int i, void *p) {if (__sync_fetch_and_add(&i, 1)) f(i, p);}\nint main(){return 0;}\n'; then
+				local t=${CTARGET_OPT:-${CTARGET}}
+				t=${t%%-*}
+				filter-flags '-march=*'
+				export CFLAGS="-march=${t} ${CFLAGS}"
+				einfo "Auto adding -march=${t} to CFLAGS #185404"
+			fi
+			# For compatibility with older binaries at slight performance cost.
+			use stack-realign && export CFLAGS+=" -mstackrealign"
+		;;
+		amd64)
+			# -march needed for #185404 #199334
+			# TODO: See cross-compile issues listed above for x86.
+			if [[ ${ABI} == x86 ]]; then
+				if ! do_compile_test "${CFLAGS_x86}" 'void f(int i, void *p) {if (__sync_fetch_and_add(&i, 1)) f(i, p);}\nint main(){return 0;}\n'; then
+					local t=${CTARGET_OPT:-${CTARGET}}
+					t=${t%%-*}
+					# Normally the target is x86_64-xxx, so turn that into the -march that
+					# gcc actually accepts. #528708
+					[[ ${t} == "x86_64" ]] && t="x86-64"
+					filter-flags '-march=*'
+					# ugly, ugly, ugly.  ugly.
+					CFLAGS_x86=$(CFLAGS=${CFLAGS_x86} filter-flags '-march=*'; echo "${CFLAGS}")
+					export CFLAGS_x86="${CFLAGS_x86} -march=${t}"
+					einfo "Auto adding -march=${t} to CFLAGS_x86 #185404 (ABI=${ABI})"
+				fi
+				# For compatibility with older binaries at slight performance cost.
+				use stack-realign && export CFLAGS_x86+=" -mstackrealign"
+			fi
+		;;
+		mips)
+			# The mips abi cannot support the GNU style hashes. #233233
+			filter-ldflags -Wl,--hash-style=gnu -Wl,--hash-style=both
+		;;
+		ppc|ppc64)
+			# Many arch-specific implementations do not work on ppc with
+			# cache-block not equal to 128 bytes. This breaks memset:
+			#   https://sourceware.org/PR26522
+			#   https://bugs.gentoo.org/737996
+			# Use default -mcpu=. For ppc it means non-multiarch setup.
+			filter-flags '-mcpu=*'
+		;;
+		sparc)
+			# Both sparc and sparc64 can use -fcall-used-g6.  -g7 is bad, though.
+			filter-flags "-fcall-used-g7"
+			append-flags "-fcall-used-g6"
+
+			local cpu
+			case ${CTARGET} in
+			sparc64-*)
+				cpu="sparc64"
+				case $(get-flag mcpu) in
+				v9)
+					# We need to force at least v9a because the base build doesn't
+					# work with just v9.
+					# https://sourceware.org/bugzilla/show_bug.cgi?id=19477
+					append-flags "-Wa,-xarch=v9a"
+					;;
+				esac
+				;;
+			sparc-*)
+				case $(get-flag mcpu) in
+				v8|supersparc|hypersparc|leon|leon3)
+					cpu="sparcv8"
+					;;
+				*)
+					cpu="sparcv9"
+					;;
+				esac
+			;;
+			esac
+			[[ -n ${cpu} ]] && CTARGET_OPT="${cpu}-${CTARGET#*-}"
+		;;
+	esac
+}
+
+setup_flags() {
+	# Make sure host make.conf doesn't pollute us
+	if is_crosscompile || tc-is-cross-compiler ; then
+		CHOST=${CTARGET} strip-unsupported-flags
+	fi
+
+	# Store our CFLAGS because it's changed depending on which CTARGET
+	# we are building when pulling glibc on a multilib profile
+	CFLAGS_BASE=${CFLAGS_BASE-${CFLAGS}}
+	CFLAGS=${CFLAGS_BASE}
+	CXXFLAGS_BASE=${CXXFLAGS_BASE-${CXXFLAGS}}
+	CXXFLAGS=${CXXFLAGS_BASE}
+	ASFLAGS_BASE=${ASFLAGS_BASE-${ASFLAGS}}
+	ASFLAGS=${ASFLAGS_BASE}
+
+	# Allow users to explicitly avoid flag sanitization via
+	# USE=custom-cflags.
+	if ! use custom-cflags; then
+		# Over-zealous CFLAGS can often cause problems.  What may work for one
+		# person may not work for another.  To avoid a large influx of bugs
+		# relating to failed builds, we strip most CFLAGS out to ensure as few
+		# problems as possible.
+		strip-flags
+
+		# Allow -O2 and -O3, but nothing else for now.
+		# TODO: Test -Os, -Oz.
+		if ! is-flagq '-O@(2|3)' ; then
+			# Lock glibc at -O2. We want to be conservative here.
+			filter-flags '-O?'
+			append-flags -O2
+		fi
+	fi
+
+	strip-unsupported-flags
+	filter-lto
+	filter-flags -m32 -m64 '-mabi=*'
+
+	# glibc aborts if rpath is set by LDFLAGS
+	filter-ldflags '-Wl,-rpath=*'
+
+	# ld can't use -r & --relax at the same time, bug #788901
+	# https://sourceware.org/PR27837
+	filter-ldflags '-Wl,--relax'
+
+	# Flag added for cross-prefix, but causes ldconfig to segfault. Not needed
+	# anyway because glibc already handles this by itself.
+	filter-ldflags '-Wl,--dynamic-linker=*'
+
+	# Fails to link (bug #940709) in some cases but even if it manages to,
+	# subtle runtime breakage will occur because the linker scripts need
+	# adaptation. Mentioned in PR21557#c0.
+	filter-ldflags '-Wl,--gc-sections'
+
+	# some weird software relies on sysv hashes in glibc, bug 863863, bug 864100
+	# we have to do that here already so mips can filter it out again :P
+	if use hash-sysv-compat ; then
+		append-ldflags '-Wl,--hash-style=both'
+	fi
+
+	# #492892
+	filter-flags -frecord-gcc-switches
+
+	# #898098
+	filter-flags -fno-builtin
+
+	# #798774
+	filter-flags -fno-semantic-interposition
+
+	# #829583
+	filter-lfs-flags
+
+	unset CBUILD_OPT CTARGET_OPT
+	if use multilib ; then
+		CTARGET_OPT=$(get_abi_CTARGET)
+		[[ -z ${CTARGET_OPT} ]] && CTARGET_OPT=$(get_abi_CHOST)
+	fi
+
+	setup_target_flags
+
+	if [[ -n ${CTARGET_OPT} && ${CBUILD} == ${CHOST} ]] && ! is_crosscompile; then
+		CBUILD_OPT=${CTARGET_OPT}
+	fi
+
+	# glibc's headers disallow -O0 and fail at build time:
+	#  include/libc-symbols.h:75:3: #error "glibc cannot be compiled without optimization"
+	# https://sourceware.org/glibc/wiki/FAQ#Why_do_I_get:.60.23error_.22glibc_cannot_be_compiled_without_optimization.22.27.2C_when_trying_to_compile_GNU_libc_with_GNU_CC.3F
+	replace-flags -O0 -O1
+
+	# Similar issues as with SSP. Can't inject yourself that early.
+	filter-flags '-fsanitize=*'
+
+	# See end of bug #830454; we handle this via USE=cet
+	filter-flags '-fcf-protection=*'
+
+	# When bootstrapping, we may have a situation where
+	# CET-enabled gcc from seed is used to build CET-disabled
+	# glibc. As such, gcc implicitly enables CET if no
+	# -fcf-protection flag is passed. For a typical package it
+	# should not be a problem, but for glibc it matters as it is
+	# dealing with CET in ld.so. So if CET is supposed to be
+	# disabled for glibc, be explicit about it.
+	if ! use cet; then
+		case ${ABI}-${CTARGET} in
+			amd64-x86_64-*|x32-x86_64-*-*-gnux32)
+				append-flags '-fcf-protection=none'
+				;;
+			arm64-aarch64*)
+				append-flags '-mbranch-protection=none'
+				;;
+		esac
+	fi
+}
+
+use_multiarch() {
+	# Allow user to disable runtime arch detection in multilib.
+	use multiarch || return 1
+	# Make sure binutils is new enough to support indirect functions,
+	# #336792. This funky sed supports gold and bfd linkers.
+	local bver nver
+	bver=$($(tc-getLD ${CTARGET}) -v | sed -n -r '1{s:[^0-9]*::;s:^([0-9.]*).*:\1:;p}')
+	case $(tc-arch ${CTARGET}) in
+	amd64|x86) nver="2.20" ;;
+	arm)       nver="2.22" ;;
+	hppa)      nver="2.23" ;;
+	ppc|ppc64) nver="2.20" ;;
+	# ifunc support was added in 2.23, but glibc also needs
+	# machinemode which is in 2.24.
+	s390)      nver="2.24" ;;
+	sparc)     nver="2.21" ;;
+	*)         return 1 ;;
+	esac
+	ver_test ${bver} -ge ${nver}
+}
+
+# Setup toolchain variables that had historically been defined in the
+# profiles for these archs.
+setup_env() {
+	# silly users
+	unset LD_RUN_PATH
+	unset LD_ASSUME_KERNEL
+
+	if is_crosscompile || tc-is-cross-compiler ; then
+		multilib_env ${CTARGET_OPT:-${CTARGET}}
+
+		if ! use multilib ; then
+			MULTILIB_ABIS=${DEFAULT_ABI}
+		else
+			MULTILIB_ABIS=${MULTILIB_ABIS:-${DEFAULT_ABI}}
+		fi
+
+		# If the user has CFLAGS_<CTARGET> in their make.conf, use that,
+		# and fall back on CFLAGS.
+		local VAR=CFLAGS_${CTARGET//[-.]/_}
+		CFLAGS=${!VAR-${CFLAGS}}
+		einfo " $(printf '%15s' 'Manual CFLAGS:')   ${CFLAGS}"
+	fi
+
+	setup_flags
+
+	export ABI=${ABI:-${DEFAULT_ABI:-default}}
+
+	if just_headers ; then
+		# Avoid mixing host's CC and target's CFLAGS_${ABI}:
+		# At this bootstrap stage we have only binutils for
+		# target but not compiler yet.
+		einfo "Skip CC ABI injection. We can't use (cross-)compiler yet."
+		return 0
+	fi
+
+	# glibc does not work with non-bfd (for various reasons):
+	# * gold (bug #269274)
+	# * mold (bug #860900)
+	tc-ld-force-bfd
+
+	if use doc ; then
+		export MAKEINFO=makeinfo
+	else
+		export MAKEINFO=/dev/null
+	fi
+
+	# Reset CC and CXX to the value at start of emerge
+	export CC=${glibc__ORIG_CC:-${CC:-$(tc-getCC ${CTARGET})}}
+	export CXX=${glibc__ORIG_CXX:-${CXX:-$(tc-getCXX ${CTARGET})}}
+	export CPP=${glibc__ORIG_CPP:-${CPP:-$(tc-getCPP ${CTARGET})}}
+
+	# and make sure glibc__ORIG_CC and glibc__ORIG_CXX is defined now.
+	export glibc__ORIG_CC=${CC}
+	export glibc__ORIG_CXX=${CXX}
+	export glibc__ORIG_CPP=${CPP}
+
+	if tc-is-clang && ! use custom-cflags && ! is_crosscompile ; then
+		export glibc__force_gcc=yes
+		# once this is toggled on, it needs to stay on, since with CPP manipulated
+		# tc-is-clang does not work correctly anymore...
+	fi
+
+	if [[ ${glibc__force_gcc} == "yes" ]] ; then
+		# If we are running in an otherwise clang/llvm environment, we need to
+		# recover the proper gcc and binutils settings here, at least until glibc
+		# is finally building with clang. So let's override everything that is
+		# set in the clang profiles.
+		# Want to shoot yourself into the foot? Set USE=custom-cflags, that's always
+		# a good start into that direction.
+		# Also, if you're crosscompiling, let's assume you know what you are doing.
+		# Hopefully.
+		# Last, we need the settings of the *build* environment, not of the
+		# target environment...
+
+		local current_binutils_path=$(env CHOST="${CBUILD}" ROOT="${BROOT}" binutils-config -B "${CTARGET}")
+		local current_gcc_path=$(env ROOT="${BROOT}" gcc-config -B)
+		einfo "Overriding clang configuration, since it won't work here"
+
+		export CC="${current_gcc_path}/${CTARGET}-gcc"
+		export CPP="${current_gcc_path}/${CTARGET}-cpp"
+		export CXX="${current_gcc_path}/${CTARGET}-g++"
+		export LD="${current_binutils_path}/ld.bfd"
+		export AR="${current_binutils_path}/ar"
+		export AS="${current_binutils_path}/as"
+		export NM="${current_binutils_path}/nm"
+		export STRIP="${current_binutils_path}/strip"
+		export RANLIB="${current_binutils_path}/ranlib"
+		export OBJCOPY="${current_binutils_path}/objcopy"
+		export STRINGS="${current_binutils_path}/strings"
+		export OBJDUMP="${current_binutils_path}/objdump"
+		export READELF="${current_binutils_path}/readelf"
+		export ADDR2LINE="${current_binutils_path}/addr2line"
+
+		# do we need to also do flags munging here? yes! at least...
+		filter-flags '-fuse-ld=*'
+		filter-flags '-D_FORTIFY_SOURCE=*'
+
+	else
+
+		# this is the "normal" case
+
+		export CC="$(tc-getCC ${CTARGET})"
+		export CXX="$(tc-getCXX ${CTARGET})"
+		export CPP="$(tc-getCPP ${CTARGET})"
+
+		# Always use tuple-prefixed toolchain. For non-native ABI glibc's configure
+		# can't detect them automatically due to ${CHOST} mismatch and fallbacks
+		# to unprefixed tools. Similar to multilib.eclass:multilib_toolchain_setup().
+		export NM="$(tc-getNM ${CTARGET})"
+		export READELF="$(tc-getREADELF ${CTARGET})"
+
+	fi
+
+	# We need to export CFLAGS with abi information in them because glibc's
+	# configure script checks CFLAGS for some targets (like mips).  Keep
+	# around the original clean value to avoid appending multiple ABIs on
+	# top of each other. (Why does the comment talk about CFLAGS if the code
+	# acts on CC?)
+	export glibc__GLIBC_CC=${CC}
+	export glibc__GLIBC_CXX=${CXX}
+	export glibc__GLIBC_CPP=${CPP}
+
+	export glibc__abi_CFLAGS="$(get_abi_CFLAGS)"
+
+	# CFLAGS can contain ABI-specific flags like -mfpu=neon, see bug #657760
+	# To build .S (assembly) files with the same ABI-specific flags
+	# upstream currently recommends adding CFLAGS to CC/CXX:
+	#    https://sourceware.org/PR23273
+	# Note: Passing CFLAGS via CPPFLAGS overrides glibc's arch-specific CFLAGS
+	# and breaks multiarch support. See 659030#c3 for an example.
+	# The glibc configure script doesn't properly use LDFLAGS all the time.
+	export CC="${glibc__GLIBC_CC} ${glibc__abi_CFLAGS} ${CFLAGS} ${LDFLAGS}"
+
+	# Some of the tests are written in C++, so we need to force our multlib abis in, bug 623548
+	export CXX="${glibc__GLIBC_CXX} ${glibc__abi_CFLAGS} ${CFLAGS}"
+
+	export CPP="${glibc__GLIBC_CPP} ${glibc__abi_CFLAGS} ${CFLAGS}"
+
+	if is_crosscompile; then
+		# Assume worst-case bootstrap: glibc is built for the first time
+		# with ${CTARGET}-g++ not available yet. We avoid
+		# building auxiliary programs that require C++: bug #683074
+		# It should not affect final result.
+		export libc_cv_cxx_link_ok=no
+		# The line above has the same effect. We set CXX explicitly
+		# to make build logs less confusing.
+		export CXX=
+	fi
+}
+
+foreach_abi() {
+	setup_env
+
+	local ret=0
+	local abilist=""
+	if use multilib ; then
+		abilist=$(get_install_abis)
+	else
+		abilist=${DEFAULT_ABI}
+	fi
+	local -x ABI
+	for ABI in ${abilist:-default} ; do
+		setup_env
+		einfo "Running $1 for ABI ${ABI}"
+		$1
+		: $(( ret |= $? ))
+	done
+	return ${ret}
+}
+
+glibc_banner() {
+	local b="Gentoo ${PVR}"
+	[[ -n ${PATCH_VER} ]] && ! use vanilla && b+=" (patchset ${PATCH_VER})"
+	echo "${b}"
+}
+
+# The following Kernel version handling functions are mostly copied from portage
+# source. It's better not to use linux-info.eclass here since a) it adds too
+# much magic, see bug 326693 for some of the arguments, and b) some of the
+# functions are just not provided.
+
+g_get_running_KV() {
+	uname -r
+	return $?
+}
+
+g_KV_major() {
+	[[ -z $1 ]] && return 1
+	local KV=$@
+	echo "${KV%%.*}"
+}
+
+g_KV_minor() {
+	[[ -z $1 ]] && return 1
+	local KV=$@
+	KV=${KV#*.}
+	echo "${KV%%.*}"
+}
+
+g_KV_micro() {
+	[[ -z $1 ]] && return 1
+	local KV=$@
+	KV=${KV#*.*.}
+	echo "${KV%%[^[:digit:]]*}"
+}
+
+g_KV_to_int() {
+	[[ -z $1 ]] && return 1
+	local KV_MAJOR=$(g_KV_major "$1")
+	local KV_MINOR=$(g_KV_minor "$1")
+	local KV_MICRO=$(g_KV_micro "$1")
+	local KV_int=$(( KV_MAJOR * 65536 + KV_MINOR * 256 + KV_MICRO ))
+
+	# We make version 2.2.0 the minimum version we will handle as
+	# a sanity check ... if its less, we fail ...
+	if [[ ${KV_int} -ge 131584 ]] ; then
+		echo "${KV_int}"
+		return 0
+	fi
+	return 1
+}
+
+g_int_to_KV() {
+	local version=$1 major minor micro
+	major=$((version / 65536))
+	minor=$(((version % 65536) / 256))
+	micro=$((version % 256))
+	echo ${major}.${minor}.${micro}
+}
+
+eend_KV() {
+	[[ $(g_KV_to_int $1) -ge $(g_KV_to_int $2) ]]
+	eend $?
+}
+
+get_kheader_version() {
+	printf '#include <linux/version.h>\nLINUX_VERSION_CODE\n' | \
+	$(tc-getCPP ${CTARGET}) -I "${ESYSROOT}$(alt_headers)" - | \
+	tail -n 1
+}
+
+# We collect all sanity checks here. Consistency is not guranteed between
+# pkg_ and src_ phases, so we call this function both in pkg_pretend and in
+# src_unpack.
+sanity_prechecks() {
+	# Prevent native builds from downgrading
+	if [[ ${MERGE_TYPE} != "buildonly" ]] && \
+	   [[ -z ${ROOT} ]] && \
+	   [[ ${CBUILD} == ${CHOST} ]] && \
+	   [[ ${CHOST} == ${CTARGET} ]] ; then
+
+		# The high rev # is to allow people to downgrade between -r#
+		# versions. We want to block 2.20->2.19, but 2.20-r3->2.20-r2
+		# should be fine. Hopefully we never actually use a r# this
+		# high.
+		if has_version ">${CATEGORY}/${P}-r10000" ; then
+			eerror "Sanity check to keep you from breaking your system:"
+			eerror " Downgrading glibc is not supported and a sure way to destruction."
+			[[ ${I_ALLOW_TO_BREAK_MY_SYSTEM} = yes ]] || die "Aborting to save your system."
+		fi
+
+		if ! do_run_test '#include <unistd.h>\n#include <sys/syscall.h>\nint main(){return syscall(1000)!=-1;}\n' ; then
+			eerror "Your old kernel is broken. You need to update it to a newer"
+			eerror "version as syscall(<bignum>) will break. See bug 279260."
+			die "Old and broken kernel."
+		fi
+	fi
+
+	if [[ ${CTARGET} == i386-* ]] ; then
+		eerror "i386 CHOSTs are no longer supported."
+		eerror "Chances are you don't actually want/need i386."
+		eerror "Please read https://www.gentoo.org/doc/en/change-chost.xml"
+		die "Please fix your CHOST"
+	fi
+
+	if [[ -e /proc/xen ]] && [[ $(tc-arch) == "x86" ]] && ! is-flag -mno-tls-direct-seg-refs ; then
+		ewarn "You are using Xen but don't have -mno-tls-direct-seg-refs in your CFLAGS."
+		ewarn "This will result in a 50% performance penalty when running with a 32bit"
+		ewarn "hypervisor, which is probably not what you want."
+	fi
+
+	# ABI-specific checks follow here. Hey, we have a lot more specific conditions that
+	# we test for...
+	if ! is_crosscompile ; then
+		if use amd64 && use multilib && [[ ${MERGE_TYPE} != "binary" ]] ; then
+			ebegin "Checking if the system can execute 32-bit binaries"
+			echo 'int main(){return 0;}' > "${T}/check-ia32-emulation.c"
+			local STAT
+			if ${CC-${CHOST}-gcc} ${CFLAGS_x86} "${T}/check-ia32-emulation.c" -o "${T}/check-ia32-emulation.elf32"; then
+				"${T}/check-ia32-emulation.elf32"
+				STAT=$?
+			else
+				# Don't fail here to allow single->multi ABI switch
+				# or recover from breakage like bug #646424
+				ewarn "Failed to compile the ABI test. Broken host glibc?"
+				STAT=0
+			fi
+			rm -f "${T}/check-ia32-emulation.elf32"
+			eend $STAT
+			if [[ $STAT -ne 0 ]]; then
+				eerror "Ensure that CONFIG_IA32_EMULATION is enabled in the kernel."
+				eerror "Seek support otherwise."
+				die "Unable to execute 32-bit binaries"
+			fi
+		fi
+
+	fi
+
+	# When we actually have to compile something...
+	if ! just_headers && [[ ${MERGE_TYPE} != "binary" ]] ; then
+		if [[ -d "${ESYSROOT}"/usr/lib/include ]] ; then
+			# bug #833620, bug #643302
+			eerror "Found ${ESYSROOT}/usr/lib/include directory!"
+			eerror "This is known to break glibc's build."
+			eerror "Please backup its contents then remove the directory."
+			die "Found directory (${ESYSROOT}/usr/lib/include) which will break build (bug #833620)!"
+		fi
+
+		if [[ ${CTARGET} == *-linux* ]] ; then
+			local run_kv build_kv want_kv
+
+			run_kv=$(g_get_running_KV)
+			build_kv=$(g_int_to_KV $(get_kheader_version))
+			want_kv=${MIN_KERN_VER}
+
+			if ! is_crosscompile && ! tc-is-cross-compiler ; then
+				# Building fails on an non-supporting kernel
+				ebegin "Checking running kernel version (${run_kv} >= ${want_kv})"
+				if ! eend_KV ${run_kv} ${want_kv} ; then
+					echo
+					eerror "You need a kernel of at least ${want_kv}!"
+					die "Kernel version too low!"
+				fi
+			fi
+
+			# Do not run this check for pkg_pretend, just pkg_setup and friends (if we ever get used there).
+			# It's plausible (seen it in the wild) that Portage will (correctly) schedule a linux-headers
+			# upgrade before glibc, but because pkg_pretend gets run before any packages are merged at all (not
+			# just glibc), the whole emerge gets aborted without a good reason. We probably don't
+			# need to run this check at all given we have a dependency on the right headers,
+			# but let's leave it as-is for now.
+			if [[ ${EBUILD_PHASE_FUNC} != pkg_pretend ]] ; then
+				ebegin "Checking linux-headers version (${build_kv} >= ${want_kv})"
+				if ! eend_KV ${build_kv} ${want_kv} ; then
+					echo
+					eerror "You need linux-headers of at least ${want_kv}!"
+					die "linux-headers version too low!"
+				fi
+			fi
+		fi
+	fi
+}
+
+upgrade_warning() {
+	is_crosscompile && return
+
+	if [[ ${MERGE_TYPE} != buildonly && -n ${REPLACING_VERSIONS} && -z ${ROOT} ]]; then
+		if ver_replacing -lt $(ver_cut 1-2 ${PV}); then
+			ewarn "After upgrading glibc, please restart all running processes."
+			ewarn "Be sure to include init (telinit u) or systemd (systemctl daemon-reexec)."
+			ewarn "Alternatively, reboot your system."
+			ewarn "(See bug #660556, bug #741116, bug #823756, etc)"
+		fi
+	fi
+}
+
+#
+# the phases
+#
+
+# pkg_pretend
+
+pkg_pretend() {
+	upgrade_warning
+}
+
+# pkg_setup
+
+pkg_setup() {
+	# see bug 682570
+	[[ -z ${BOOTSTRAP_RAP} ]] && python-any-r1_pkg_setup
+}
+
+# src_unpack
+
+src_unpack() {
+	setup_env
+
+	einfo "Checking general environment sanity."
+	sanity_prechecks
+
+	use multilib-bootstrap && unpack gcc-multilib-bootstrap-${GCC_BOOTSTRAP_VER}.tar.xz
+
+	if [[ ${PV} == 9999* ]] ; then
+		EGIT_REPO_URI="
+			https://anongit.gentoo.org/git/proj/toolchain/glibc-patches.git
+			https://github.com/gentoo/glibc-patches.git
+		"
+		EGIT_CHECKOUT_DIR=${WORKDIR}/patches-git
+		git-r3_src_unpack
+		mv patches-git/9999 patches || die
+		EGIT_REPO_URI="
+			https://sourceware.org/git/glibc.git
+			https://git.sr.ht/~sourceware/glibc
+			https://gitlab.com/x86-glibc/glibc.git
+		"
+		EGIT_CHECKOUT_DIR=${S}
+		git-r3_src_unpack
+	else
+		unpack ${P}.tar.xz
+
+		cd "${WORKDIR}" || die
+		unpack glibc-${PV}-patches-${PATCH_VER}.tar.xz
+	fi
+
+	cd "${WORKDIR}" || die
+	use systemd && unpack glibc-systemd-${GLIBC_SYSTEMD_VER}.tar.gz
+}
+
+# src_prepare
+
+src_prepare() {
+	local patchsetname
+	if ! use vanilla ; then
+		if [[ ${PV} == 9999* ]] ; then
+			patchsetname="from git master"
+		else
+			patchsetname="${PV}-${PATCH_VER}"
+		fi
+		einfo "Applying Gentoo Glibc patchset ${patchsetname}"
+		eapply "${WORKDIR}"/patches
+		einfo "Done."
+	fi
+
+	default
+
+	gnuconfig_update
+
+	cd "${WORKDIR}" || die
+	find . -name configure -exec touch {} +
+
+	# Fix permissions on some of the scripts.
+	chmod u+x "${S}"/scripts/*.sh
+
+	cd "${S}" || die
+}
+
+# src_configure
+
+glibc_do_configure() {
+	dump_build_environment
+
+	local myconf=()
+
+	# Use '=strong' instead of '=all' to protect only functions
+	# worth protecting from stack smashes.
+	myconf+=( --enable-stack-protector=$(usex ssp strong no) )
+
+	# Keep a whitelist of targets supporting IFUNC. glibc's ./configure
+	# is not robust enough to detect proper support:
+	#    https://bugs.gentoo.org/641216
+	#    https://sourceware.org/PR22634#c0
+	case $(tc-arch ${CTARGET}) in
+		# Keep whitelist of targets where autodetection mostly works.
+		amd64|x86|sparc|ppc|ppc64|arm|arm64|s390|riscv|loong) ;;
+		# Blacklist everywhere else
+		*) myconf+=( libc_cv_ld_gnu_indirect_function=no ) ;;
+	esac
+
+	case ${ABI}-${CTARGET} in
+		amd64-x86_64-*|x32-x86_64-*-*-gnux32) myconf+=( $(use_enable cet) ) ;;
+		*) ;;
+	esac
+
+	[[ $(tc-is-softfloat) == "yes" ]] && myconf+=( --without-fp )
+
+	myconf+=( --enable-kernel=${MIN_KERN_VER} )
+
+	# Since SELinux support is only required for nscd, only enable it if:
+	# 1. USE selinux
+	# 2. only for the primary ABI on multilib systems
+	# 3. Not a crosscompile
+	if ! is_crosscompile && use selinux ; then
+		if use multilib ; then
+			if is_final_abi ; then
+				myconf+=( --with-selinux )
+			else
+				myconf+=( --without-selinux )
+			fi
+		else
+			myconf+=( --with-selinux )
+		fi
+	else
+		myconf+=( --without-selinux )
+	fi
+
+	# Force a few tests where we always know the answer but
+	# configure is incapable of finding it.
+	if is_crosscompile ; then
+		export \
+			libc_cv_c_cleanup=yes \
+			libc_cv_forced_unwind=yes
+	fi
+
+	myconf+=(
+		--disable-werror
+		--enable-bind-now
+		--enable-fortify-source
+		--build=${CBUILD_OPT:-${CBUILD}}
+		--host=${CTARGET_OPT:-${CTARGET}}
+		$(use_enable profile)
+		$(use_with gd)
+		--with-headers="${ESYSROOT}$(alt_headers)"
+		--prefix="$(host_eprefix)/usr"
+		--sysconfdir="$(host_eprefix)/etc"
+		--localstatedir="$(host_eprefix)/var"
+		--libdir='$(prefix)'/$(get_libdir)
+		--mandir='$(prefix)'/share/man
+		--infodir='$(prefix)'/share/info
+		--libexecdir='$(libdir)'/misc/glibc
+		--with-bugurl=https://bugs.gentoo.org/
+		--with-pkgversion="$(glibc_banner)"
+		$(use_multiarch || echo --disable-multi-arch)
+		$(use_enable systemtap)
+		$(use_enable nscd)
+
+		# /usr/bin/mtrace has a Perl shebang. Gentoo Prefix QA checks fail if
+		# Perl hasn't been installed inside the prefix yet and configure picks
+		# up a Perl from outside the prefix instead. configure will fail to
+		# execute Perl during configure if we're cross-compiling a prefix, but
+		# it will just disable mtrace in that case.
+		# Note: mtrace is needed by the test suite.
+		ac_cv_path_PERL="$(usex perl "${EPREFIX}"/usr/bin/perl $(usex test "${EPREFIX}"/usr/bin/perl $(usex doc "${EPREFIX}"/usr/bin/perl no)))"
+
+		# locale data is arch-independent
+		# https://bugs.gentoo.org/753740
+		libc_cv_complocaledir='${exec_prefix}/lib/locale'
+
+		# On aarch64 there is no way to override -mcpu=native, and if
+		# the current cpu does not support SVE configure fails.
+		# Let's boldly assume our toolchain can always build SVE instructions.
+		libc_cv_aarch64_sve_asm=yes
+
+		${EXTRA_ECONF}
+	)
+
+	# We rely on sys-libs/timezone-data for timezone tools normally.
+	myconf+=( $(use_enable vanilla timezone-tools) )
+
+	# These libs don't have configure flags.
+	ac_cv_lib_audit_audit_log_user_avc_message=$(usex audit || echo no)
+	ac_cv_lib_cap_cap_init=$(usex caps || echo no)
+
+	# There is no configure option for this and we need to export it
+	# since the glibc build will re-run configure on itself
+	export libc_cv_rootsbindir="$(host_eprefix)/sbin"
+	export libc_cv_slibdir="$(host_eprefix)/$(get_libdir)"
+
+	local builddir=$(builddir nptl)
+	mkdir -p "${builddir}"
+	cd "${builddir}"
+	set -- "${S}"/configure "${myconf[@]}"
+	echo "$@"
+	"$@" || die "failed to configure glibc"
+
+	# If we're trying to migrate between ABI sets, we need
+	# to lie and use a local copy of gcc.  Like if the system
+	# is built with MULTILIB_ABIS="amd64 x86" but we want to
+	# add x32 to it, gcc/glibc don't yet support x32.
+	#
+	if [[ -n ${GCC_BOOTSTRAP_VER} ]] && use multilib-bootstrap ; then
+		echo 'int main(void){}' > "${T}"/test.c || die
+		if ! $(tc-getCC ${CTARGET}) ${CFLAGS} ${LDFLAGS} "${T}"/test.c -Wl,-emain -lgcc 2>/dev/null ; then
+			sed -i -e '/^CC = /s:$: -B$(objdir)/../'"gcc-multilib-bootstrap-${GCC_BOOTSTRAP_VER}/${ABI}:" config.make || die
+		fi
+	fi
+}
+
+glibc_headers_configure() {
+	export ABI=default
+
+	local builddir=$(builddir "headers")
+	mkdir -p "${builddir}"
+	cd "${builddir}"
+
+	# if we don't have a compiler yet, we can't really test it now ...
+	# hopefully they don't affect header generation, so let's hope for
+	# the best here ...
+	local v vars=(
+		ac_cv_header_cpuid_h=yes
+		libc_cv_{386,390,alpha,arm,hppa,mips,{powerpc,sparc}{,32,64},sh,x86_64}_tls=yes
+		libc_cv_asm_cfi_directives=yes
+		libc_cv_broken_visibility_attribute=no
+		libc_cv_c_cleanup=yes
+		libc_cv_compiler_powerpc64le_binary128_ok=yes
+		libc_cv_forced_unwind=yes
+		libc_cv_gcc___thread=yes
+		libc_cv_mlong_double_128=yes
+		libc_cv_mlong_double_128ibm=yes
+		libc_cv_ppc_machine=yes
+		libc_cv_ppc_rel16=yes
+		libc_cv_predef_fortify_source=no
+		libc_cv_target_power8_ok=yes
+		libc_cv_visibility_attribute=yes
+		libc_cv_z_combreloc=yes
+		libc_cv_z_execstack=yes
+		libc_cv_z_initfirst=yes
+		libc_cv_z_nodelete=yes
+		libc_cv_z_nodlopen=yes
+		libc_cv_z_relro=yes
+		libc_mips_abi=${ABI}
+		libc_mips_float=$([[ $(tc-is-softfloat) == "yes" ]] && echo soft || echo hard)
+		# These libs don't have configure flags.
+		ac_cv_lib_audit_audit_log_user_avc_message=no
+		ac_cv_lib_cap_cap_init=no
+	)
+
+	einfo "Forcing cached settings:"
+	for v in "${vars[@]}" ; do
+		einfo " ${v}"
+		export ${v}
+	done
+
+	local headers_only_arch_CPPFLAGS=()
+
+	# Blow away some random CC settings that screw things up. #550192
+	if [[ -d ${S}/sysdeps/mips ]]; then
+		pushd "${S}"/sysdeps/mips >/dev/null
+		sed -i -e '/^CC +=/s:=.*:= -D_MIPS_SZPTR=32:' mips32/Makefile mips64/n32/Makefile || die
+		sed -i -e '/^CC +=/s:=.*:= -D_MIPS_SZPTR=64:' mips64/n64/Makefile || die
+
+		# Force the mips ABI to the default.  This is OK because the set of
+		# installed headers in this phase is the same between the 3 ABIs.
+		# If this ever changes, this hack will break, but that's unlikely
+		# as glibc discourages that behavior.
+		# https://crbug.com/647033
+		sed -i -e 's:abiflag=.*:abiflag=_ABIO32:' preconfigure || die
+
+		popd >/dev/null
+	fi
+
+	local myconf=()
+
+	case ${CTARGET} in
+	aarch64*)
+		# The configure checks fail during cross-build, so disable here
+		# for headers-only
+		myconf+=(
+			--disable-mathvec
+		) ;;
+	riscv*)
+		# RISC-V interrogates the compiler to determine which target to
+		# build.  If building the headers then we don't strictly need a
+		# RISC-V compiler, so the built-in definitions that are provided
+		# along with all RISC-V compiler might not exist.  This causes
+		# glibc's RISC-V preconfigure script to blow up.  Since we're just
+		# building the headers any value will actually work here, so just
+		# pick the standard one (rv64g/lp64d) to make the build scripts
+		# happy for now -- the headers are all the same anyway so it
+		# doesn't matter.
+		headers_only_arch_CPPFLAGS+=(
+			-D__riscv_xlen=64
+			-D__riscv_flen=64
+			-D__riscv_float_abi_double=1
+			-D__riscv_atomic=1
+		) ;;
+	esac
+
+	myconf+=(
+		--disable-sanity-checks
+		--enable-hacker-mode
+		--disable-werror
+		--enable-bind-now
+		--build=${CBUILD_OPT:-${CBUILD}}
+		--host=${CTARGET_OPT:-${CTARGET}}
+		--with-headers="${ESYSROOT}$(alt_headers)"
+		--prefix="$(host_eprefix)/usr"
+		${EXTRA_ECONF}
+	)
+
+	# Nothing is compiled here which would affect the headers for the target.
+	# So forcing CC/CFLAGS is sane.
+	local headers_only_CC=$(tc-getBUILD_CC)
+	local headers_only_CFLAGS="-O1 -pipe"
+	local headers_only_CPPFLAGS="-U_FORTIFY_SOURCE ${headers_only_arch_CPPFLAGS[*]}"
+	local headers_only_LDFLAGS=""
+	set -- "${S}"/configure "${myconf[@]}"
+	echo \
+		"CC=${headers_only_CC}" \
+		"CFLAGS=${headers_only_CFLAGS}" \
+		"CPPFLAGS=${headers_only_CPPFLAGS}" \
+		"LDFLAGS=${headers_only_LDFLAGS}" \
+		"$@"
+	CC=${headers_only_CC} \
+	CFLAGS=${headers_only_CFLAGS} \
+	CPPFLAGS=${headers_only_CPPFLAGS} \
+	LDFLAGS="" \
+	"$@" || die "failed to configure glibc"
+}
+
+do_src_configure() {
+	if just_headers ; then
+		glibc_headers_configure
+	else
+		glibc_do_configure nptl
+	fi
+}
+
+src_configure() {
+	foreach_abi do_src_configure
+}
+
+# src_compile
+
+do_src_compile() {
+	emake -C "$(builddir nptl)"
+}
+
+src_compile() {
+	if just_headers ; then
+		return
+	fi
+
+	foreach_abi do_src_compile
+}
+
+# src_test
+
+glibc_src_test() {
+	cd "$(builddir nptl)"
+
+	local myxfailparams=""
+	if [[ "${GENTOO_GLIBC_XFAIL_TESTS}" == "yes" ]] ; then
+		local virt=$(systemd-detect-virt 2>/dev/null)
+		if [[ ${virt} == systemd-nspawn ]] ; then
+			ewarn "Skipping extra tests because in systemd-nspawn container"
+			XFAIL_TEST_LIST+=( "${XFAIL_NSPAWN_TEST_LIST[@]}" )
+		fi
+		if [[ "$(nice)" == "19" ]] ; then
+			# Expects to be able to increase niceness, which it can't do if
+			# already at the highest nice value
+			XFAIL_TEST_LIST+=( "tst-nice" )
+		fi
+
+		for myt in ${XFAIL_TEST_LIST[@]} ; do
+			myxfailparams+="test-xfail-${myt}=yes "
+		done
+	fi
+
+	# sandbox does not understand unshare() and prevents
+	# writes to /proc/, which makes many tests fail
+
+	# we give the tests a bit more time to avoid spurious
+	# bug reports on slow arches
+
+	SANDBOX_ON=0 LD_PRELOAD= TIMEOUTFACTOR=16 emake ${myxfailparams} check
+}
+
+src_test() {
+	if just_headers ; then
+		return
+	fi
+
+	foreach_abi glibc_src_test || die "tests failed"
+}
+
+# src_install
+
+run_locale_gen() {
+	# if the host locales.gen contains no entries, we'll install everything
+	local root="$1"
+	local inplace=""
+
+	if [[ "${root}" == "--inplace-glibc" ]] ; then
+		inplace="--inplace-glibc"
+		root="$2"
+	fi
+
+	local locale_list="${root%/}/etc/locale.gen"
+
+	pushd "${ED}"/$(get_libdir) >/dev/null
+
+	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
+		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
+		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	fi
+
+	# bug 736794: we need to be careful with the parallelization... the number of
+	# processors saved in the environment of a binary package may differ strongly
+	# from the number of processes available during postinst
+	local mygenjobs="$(makeopts_jobs)"
+	if [[ "${EMERGE_FROM}" == "binary" ]] ; then
+		mygenjobs="$(nproc)"
+	fi
+
+	set -- locale-gen ${inplace} --jobs "${mygenjobs}" --config "${locale_list}" \
+		--destdir "${root}"
+	echo "$@"
+	"$@"
+
+	popd >/dev/null
+}
+
+glibc_do_src_install() {
+	local builddir=$(builddir nptl)
+	cd "${builddir}"
+
+	emake install_root="${D}/$(build_eprefix)$(alt_prefix)" install
+
+	# This version (2.26) provides some compatibility libraries for the NIS/NIS+ support
+	# which come without headers etc. Only needed for binary packages since the
+	# external net-libs/libnsl has increased soversion. Keep only versioned libraries.
+	find "${D}" -name "libnsl.a" -delete
+	find "${D}" -name "libnsl.so" -delete
+
+	# Normally upstream_pv is ${PV}. Live ebuilds are exception, there we need
+	# to infer upstream version:
+	# '#define VERSION "2.26.90"' -> '2.26.90'
+	local upstream_pv=$(sed -n -r 's/#define VERSION "(.*)"/\1/p' "${S}"/version.h)
+
+	# Avoid stripping binaries not targeted by ${CHOST}. Or else
+	# ${CHOST}-strip would break binaries build for ${CTARGET}.
+	is_crosscompile && dostrip -x /
+
+	# gdb thread introspection relies on local libpthreads symbols. stripping breaks it
+	# See Note [Disable automatic stripping]
+	dostrip -x $(alt_libdir)/libpthread-${upstream_pv}.so
+	# valgrind requires knowledge about ld.so symbols.
+	dostrip -x $(alt_libdir)/ld-*.so*
+
+	if [[ -e ${ED}/$(alt_usrlibdir)/libm-${upstream_pv}.a ]] ; then
+		# Move versioned .a file out of libdir to evade portage QA checks
+		# instead of using gen_usr_ldscript(). We fix ldscript as:
+		# "GROUP ( /usr/lib64/libm-<pv>.a ..." -> "GROUP ( /usr/lib64/glibc-<pv>/libm-<pv>.a ..."
+		sed -i "s@\(libm-${upstream_pv}.a\)@${P}/\1@" \
+			"${ED}"/$(alt_usrlibdir)/libm.a || die
+		dodir $(alt_usrlibdir)/${P}
+		mv "${ED}"/$(alt_usrlibdir)/libm-${upstream_pv}.a \
+			"${ED}"/$(alt_usrlibdir)/${P}/libm-${upstream_pv}.a || die
+	fi
+
+	# We configure toolchains for standalone prefix systems with a sysroot,
+	# which is prepended to paths in ld scripts, so strip the prefix from these.
+	# Before: GROUP ( /foo/lib64/libc.so.6 /foo/usr/lib64/libc_nonshared.a  AS_NEEDED ( /foo/lib64/ld-linux-x86-64.so.2 ) )
+	# After: GROUP ( /lib64/libc.so.6 /usr/lib64/libc_nonshared.a  AS_NEEDED ( /lib64/ld-linux-x86-64.so.2 ) )
+	if [[ -n $(host_eprefix) ]] ; then
+		local file
+		grep -lZIF "ld script" "${ED}/$(alt_usrlibdir)"/lib*.{a,so} 2>/dev/null | while read -rd '' file ; do
+			sed -i "s|$(host_eprefix)/|/|g" "${file}" || die
+		done
+	fi
+
+	# We'll take care of the cache ourselves
+	rm -f "${ED}"/etc/ld.so.cache
+
+	# Everything past this point just needs to be done once ...
+	is_final_abi || return 0
+
+	# Make sure the non-native interp can be found on multilib systems even
+	# if the main library set isn't installed into the right place.  Maybe
+	# we should query the active gcc for info instead of hardcoding it ?
+	local i ldso_abi ldso_name
+	local ldso_abi_list=(
+		# x86
+		amd64   /lib64/ld-linux-x86-64.so.2
+		x32     /libx32/ld-linux-x32.so.2
+		x86     /lib/ld-linux.so.2
+		# mips
+		o32     /lib/ld.so.1
+		n32     /lib32/ld.so.1
+		n64     /lib64/ld.so.1
+		# powerpc
+		ppc     /lib/ld.so.1
+		# riscv
+		ilp32d  /lib/ld-linux-riscv32-ilp32d.so.1
+		ilp32   /lib/ld-linux-riscv32-ilp32.so.1
+		lp64d   /lib/ld-linux-riscv64-lp64d.so.1
+		lp64    /lib/ld-linux-riscv64-lp64.so.1
+		# s390
+		s390    /lib/ld.so.1
+		s390x   /lib/ld64.so.1
+		# sparc
+		sparc32 /lib/ld-linux.so.2
+		sparc64 /lib64/ld-linux.so.2
+	)
+	case $(tc-endian) in
+	little)
+		ldso_abi_list+=(
+			# arm
+			arm64   /lib/ld-linux-aarch64.so.1
+			# ELFv2 (glibc does not support ELFv1 on LE)
+			ppc64   /lib64/ld64.so.2
+		)
+		;;
+	big)
+		ldso_abi_list+=(
+			# arm
+			arm64   /lib/ld-linux-aarch64_be.so.1
+			# ELFv1 (glibc does not support ELFv2 on BE)
+			ppc64   /lib64/ld64.so.1
+		)
+		;;
+	esac
+	if [[ ${SYMLINK_LIB} == "yes" ]] && [[ ! -e ${ED}/$(alt_prefix)/lib ]] ; then
+		dosym $(get_abi_LIBDIR ${DEFAULT_ABI}) $(alt_prefix)/lib
+	fi
+	for (( i = 0; i < ${#ldso_abi_list[@]}; i += 2 )) ; do
+		ldso_abi=${ldso_abi_list[i]}
+		has ${ldso_abi} $(get_install_abis) || continue
+
+		ldso_name="$(alt_prefix)${ldso_abi_list[i+1]}"
+		if [[ ! -L ${ED}/${ldso_name} && ! -e ${ED}/${ldso_name} ]] ; then
+			dosym ../$(get_abi_LIBDIR ${ldso_abi})/${ldso_name##*/} ${ldso_name}
+		fi
+	done
+
+	# In the LSB 5.0 definition, someone had the excellent idea to "standardize"
+	# the runtime loader name, see also https://xkcd.com/927/
+	# Normally, in Gentoo one should never come across executables that require this.
+	# However, binary commercial packages are known to adhere to weird practices.
+	# https://refspecs.linuxfoundation.org/LSB_5.0.0/LSB-Core-AMD64/LSB-Core-AMD64.html#BASELIB
+	local lsb_ldso_name native_ldso_name lsb_ldso_abi
+	local lsb_ldso_abi_list=(
+		# x86
+		amd64	ld-linux-x86-64.so.2	ld-lsb-x86-64.so.3
+	)
+	for (( i = 0; i < ${#lsb_ldso_abi_list[@]}; i += 3 )) ; do
+		lsb_ldso_abi=${lsb_ldso_abi_list[i]}
+		native_ldso_name=${lsb_ldso_abi_list[i+1]}
+		lsb_ldso_name=${lsb_ldso_abi_list[i+2]}
+		has ${lsb_ldso_abi} $(get_install_abis) || continue
+
+		if [[ ! -L ${ED}/$(get_abi_LIBDIR ${lsb_ldso_abi})/${lsb_ldso_name} && ! -e ${ED}/$(get_abi_LIBDIR ${lsb_ldso_abi})/${lsb_ldso_name} ]] ; then
+			dosym ${native_ldso_name} "$(alt_prefix)/$(get_abi_LIBDIR ${lsb_ldso_abi})/${lsb_ldso_name}"
+		fi
+	done
+
+	# With devpts under Linux mounted properly, we do not need the pt_chown
+	# binary to be setuid.  This is because the default owners/perms will be
+	# exactly what we want.
+	if ! use suid ; then
+		find "${ED}" -name pt_chown -exec chmod -s {} +
+	fi
+
+	#################################################################
+	# EVERYTHING AFTER THIS POINT IS FOR NATIVE GLIBC INSTALLS ONLY #
+	#################################################################
+
+	# Make sure we install some symlink hacks so that when we build
+	# a 2nd stage cross-compiler, gcc finds the target system
+	# headers correctly.  See gcc/doc/gccinstall.info
+	if is_crosscompile ; then
+		# We need to make sure that /lib and /usr/lib always exists.
+		# gcc likes to use relative paths to get to its multilibs like
+		# /usr/lib/../lib64/.  So while we don't install any files into
+		# /usr/lib/, we do need it to exist.
+		keepdir $(alt_prefix)/lib
+		keepdir $(alt_prefix)/usr/lib
+
+		dosym usr/include $(alt_prefix)/sys-include
+		return 0
+	fi
+
+	# Files for Debian-style locale updating
+	dodir /usr/share/i18n
+	sed \
+		-e "/^#/d" \
+		-e "/SUPPORTED-LOCALES=/d" \
+		-e "s: \\\\::g" -e "s:/: :g" \
+		"${S}"/localedata/SUPPORTED > "${ED}"/usr/share/i18n/SUPPORTED \
+		|| die "generating /usr/share/i18n/SUPPORTED failed"
+
+	cd "${S}" || die
+
+	# Install misc network config files
+	insinto /etc
+	doins posix/gai.conf
+
+	if use systemd ; then
+		doins "${WORKDIR}/glibc-systemd-${GLIBC_SYSTEMD_VER}/gentoo-config/nsswitch.conf"
+	else
+		doins nss/nsswitch.conf
+	fi
+
+	# Gentoo-specific
+	newins "${FILESDIR}"/host.conf-1 host.conf
+
+	if use nscd ; then
+		doins nscd/nscd.conf
+
+		newinitd "$(prefixify_ro "${FILESDIR}"/nscd-1)" nscd
+
+		local nscd_args=(
+			-e "s:@PIDFILE@:$(strings "${ED}"/usr/sbin/nscd | grep nscd.pid):"
+		)
+
+		sed -i "${nscd_args[@]}" "${ED}"/etc/init.d/nscd
+
+		use systemd && systemd_dounit nscd/nscd.service
+		newtmpfiles nscd/nscd.tmpfiles nscd.conf
+	fi
+
+	echo 'LDPATH="include ld.so.conf.d/*.conf"' > "${T}"/00glibc
+	doenvd "${T}"/00glibc
+
+	for d in BUGS ChangeLog CONFORMANCE FAQ NEWS NOTES PROJECTS README* ; do
+		[[ -s ${d} ]] && dodoc ${d}
+	done
+	dodoc -r ChangeLog.old
+
+	# Prevent overwriting of the /etc/localtime symlink.  We'll handle the
+	# creation of the "factory" symlink in pkg_postinst().
+	rm -f "${ED}"/etc/localtime
+
+	# Generate all locales if this is a native build as locale generation
+	if use compile-locales && ! is_crosscompile ; then
+		run_locale_gen --inplace-glibc "${ED}/"
+	fi
+}
+
+glibc_headers_install() {
+	local builddir=$(builddir "headers")
+	cd "${builddir}"
+	emake install_root="${D}/$(build_eprefix)$(alt_prefix)" install-headers
+
+	insinto $(alt_headers)/gnu
+	doins "${S}"/include/gnu/stubs.h
+
+	# Make sure we install the sys-include symlink so that when
+	# we build a 2nd stage cross-compiler, gcc finds the target
+	# system headers correctly.  See gcc/doc/gccinstall.info
+	dosym usr/include $(alt_prefix)/sys-include
+}
+
+src_install() {
+	if just_headers ; then
+		export ABI=default
+		glibc_headers_install
+		return
+	fi
+
+	foreach_abi glibc_do_src_install
+
+	if ! use static-libs ; then
+		einfo "Not installing static glibc libraries"
+		find "${ED}" -name "*.a" -and -not -name "*_nonshared.a" -delete
+	fi
+}
+
+# Simple test to make sure our new glibc isn't completely broken.
+# Make sure we don't test with statically built binaries since
+# they will fail.  Also, skip if this glibc is a cross compiler.
+#
+# If coreutils is built with USE=multicall, some of these files
+# will just be wrapper scripts, not actual ELFs we can test.
+glibc_sanity_check() {
+	cd / #228809
+
+	# We enter ${ED} so to avoid trouble if the path contains
+	# special characters; for instance if the path contains the
+	# colon character (:), then the linker will try to split it
+	# and look for the libraries in an unexpected place. This can
+	# lead to unsafe code execution if the generated prefix is
+	# within a world-writable directory.
+	# (e.g. /var/tmp/portage:${HOSTNAME})
+	pushd "${ED}"/$(get_libdir) >/dev/null
+
+	# first let's find the actual dynamic linker here
+	# symlinks may point to the wrong abi
+	local newldso=$(find . -maxdepth 1 -name 'ld*so.?' -type f -print -quit)
+
+	einfo Last-minute run tests with ${newldso} in /$(get_libdir) ...
+
+	local x striptest
+	for x in cal date env free ls true uname uptime ; do
+		x=$(type -p ${x})
+		[[ -z ${x} || ${x} != ${EPREFIX}/* ]] && continue
+		striptest=$(LC_ALL="C" file -L ${x} 2>/dev/null) || continue
+		case ${striptest} in
+		*"statically linked"*) continue;;
+		*"ASCII text"*) continue;;
+		esac
+		# We need to clear the locale settings as the upgrade might want
+		# incompatible locale data.  This test is not for verifying that.
+		LC_ALL=C \
+		${newldso} --library-path . ${x} > /dev/null \
+			|| die "simple run test (${x}) failed"
+	done
+
+	popd >/dev/null
+}
+
+pkg_preinst() {
+	# nothing to do if just installing headers
+	just_headers && return
+
+	einfo "Checking general environment sanity."
+	sanity_prechecks
+
+	# prepare /etc/ld.so.conf.d/ for files
+	mkdir -p "${EROOT}"/etc/ld.so.conf.d
+
+	# Default /etc/hosts.conf:multi to on for systems with small dbs.
+	if [[ $(wc -l < "${EROOT}"/etc/hosts) -lt 1000 ]] ; then
+		sed -i '/^multi off/s:off:on:' "${ED}"/etc/host.conf
+		einfo "Defaulting /etc/host.conf:multi to on"
+	fi
+
+	[[ -n ${ROOT} ]] && return 0
+	[[ -d ${ED}/$(get_libdir) ]] || return 0
+	[[ -z ${BOOTSTRAP_RAP} ]] && glibc_sanity_check
+
+	if [[ -L ${EROOT}/usr/lib/locale ]]; then
+		# Help portage migrate this to a directory
+		# https://bugs.gentoo.org/753740
+		rm "${EROOT}"/usr/lib/locale || die
+	fi
+
+	# Keep around libcrypt so that Perl doesn't break when merging libxcrypt
+	# (libxcrypt is the new provider for now of libcrypt.so.{1,2}).
+	# bug #802207
+	if has_version "${CATEGORY}/${PN}[crypt]" && ! has preserve-libs ${FEATURES}; then
+		PRESERVED_OLD_LIBCRYPT=1
+		cp -p "${EROOT}/$(get_libdir)/libcrypt$(get_libname 1)" \
+			"${T}/libcrypt$(get_libname 1)" || die
+	else
+		PRESERVED_OLD_LIBCRYPT=0
+	fi
+}
+
+glibc_refresh_ldconfig() {
+	if [[ ${MERGE_TYPE} == buildonly ]]; then
+		return
+	fi
+
+	# Version check could be added to avoid unnecessary work, but ldconfig
+	# should finish quickly enough to not matter.
+	ebegin "Refreshing ld.so.cache"
+	ldconfig -i
+	if ! eend $?; then
+		ewarn "Failed to refresh the ld.so.cache for you. Some programs may be broken"
+		ewarn "before you manually do so (ldconfig -i)."
+	fi
+}
+
+pkg_postinst() {
+	# nothing to do if just installing headers
+	just_headers && return
+
+	if ! tc-is-cross-compiler && [[ -x ${EROOT}/usr/sbin/iconvconfig ]] ; then
+		# Generate fastloading iconv module configuration file.
+		"${EROOT}"/usr/sbin/iconvconfig --prefix="${ROOT}/"
+	fi
+
+	if ! is_crosscompile && [[ -z ${ROOT} ]] ; then
+		# glibc-2.38+ on loong has ldconfig support added, but the ELF e_flags
+		# handling has changed as well, which means stale ldconfig auxiliary
+		# cache entries and failure to lookup libgcc_s / libstdc++ (breaking
+		# every C++ application) / libgomp etc., among other breakages.
+		#
+		# To fix this, simply refresh the ld.so.cache without using the
+		# auxiliary cache if we're natively installing on loong. This should
+		# be done relatively soon because we want to minimize the breakage
+		# window for the affected programs.
+		use loong && glibc_refresh_ldconfig
+
+		use compile-locales || run_locale_gen "${EROOT}/"
+
+		# If fixincludes was/is active for a particular GCC slot, we
+		# must refresh it. See bug #933282 and GCC's documentation:
+		# https://gcc.gnu.org/onlinedocs/gcc/Fixed-Headers.html
+		#
+		# TODO: Could this be done for cross? Some care would be needed
+		# to pass the right arguments.
+		while IFS= read -r -d $'\0' slot ; do
+			local mkheaders_path="${BROOT}"/usr/libexec/gcc/${CBUILD}/${slot##*/}/install-tools/mkheaders
+			local pthread_h="${BROOT}"/usr/lib/gcc/${CBUILD}/${slot##*/}/include-fixed/pthread.h
+			if [[ -x ${mkheaders_path} ]] ; then
+				ebegin "Refreshing fixincludes for ${CBUILD} with gcc-${slot##*/}"
+				${mkheaders_path} -v
+				eend $?
+			elif [[ -f ${pthread_h} ]] ; then
+				# fixincludes might have been enabled in the past for this
+				# GCC slot but not since we fixed toolchain.eclass to install
+				# mkheaders, so we need to manually delete pthread.h at least.
+				ebegin "Deleting stale fixincludes'd pthread.h for ${CBUILD} with gcc-${slot##*/}"
+				mv -v "${pthread_h}" "${pthread_h}.bak"
+				eend $?
+			fi
+		done < <(find "${BROOT}"/usr/libexec/gcc/${CBUILD}/ -mindepth 1 -maxdepth 1 -type d -print0)
+	fi
+
+	upgrade_warning
+
+	# Check for sanity of /etc/nsswitch.conf, take 2
+	if [[ -e ${EROOT}/etc/nsswitch.conf ]] && ! has_version sys-auth/libnss-nis ; then
+		local entry
+		for entry in passwd group shadow; do
+			if grep -E -q "^[ \t]*${entry}:.*nis" "${EROOT}"/etc/nsswitch.conf; then
+				ewarn ""
+				ewarn "Your ${EROOT}/etc/nsswitch.conf uses NIS. Support for that has been"
+				ewarn "removed from glibc and is now provided by the package"
+				ewarn "  sys-auth/libnss-nis"
+				ewarn "Install it now to keep your NIS setup working."
+				ewarn ""
+			fi
+		done
+	fi
+
+	if [[ ${PRESERVED_OLD_LIBCRYPT} -eq 1 ]] ; then
+		cp -p "${T}/libcrypt$(get_libname 1)" "${EROOT}/$(get_libdir)/libcrypt$(get_libname 1)" || die
+		preserve_old_lib_notify /$(get_libdir)/libcrypt$(get_libname 1)
+
+		elog "Please ignore a possible later error message about a file collision involving"
+		elog "${EROOT}/$(get_libdir)/libcrypt$(get_libname 1). We need to preserve this file for the moment to keep"
+		elog "the upgrade working, but it also needs to be overwritten when"
+		elog "sys-libs/libxcrypt is installed. See bug 802210 for more details."
+	fi
+}

From 5401b6c3fb637c93f5da2ce8292448d65a6cd595 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:12:54 +0000
Subject: [PATCH 127/136] sys-libs/ldb: Sync with Gentoo

It's from Gentoo commit 2f88f6f6b4fa3b23ebcbd3b48c99bc22303aa261.
---
 .../third_party/portage-stable/sys-libs/ldb/ldb-2.9.2.ebuild    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.9.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.9.2.ebuild
index 6d3e584582b..a107cc54a12 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.9.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.9.2.ebuild
@@ -13,7 +13,7 @@ SRC_URI="https://download.samba.org/pub/${PN}/${P}.tar.gz"
 
 LICENSE="LGPL-3"
 SLOT="0/${PV}"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="doc ldap +lmdb python test"
 
 REQUIRED_USE="${PYTHON_REQUIRED_USE}

From 673b86997ed20cd8eea3b12a1251ba5ab341875b Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:12:56 +0000
Subject: [PATCH 128/136] sys-libs/libselinux: Sync with Gentoo

It's from Gentoo commit 106d929db5afc67becc4aa99f27d27e98b4b9e9a.
---
 .../portage-stable/sys-libs/libselinux/libselinux-3.8.1.ebuild  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.8.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.8.1.ebuild
index 2902fd245a1..1fce91e47d9 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.8.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.8.1.ebuild
@@ -20,7 +20,7 @@ if [[ ${PV} == 9999 ]]; then
 	S="${WORKDIR}/${P}/${PN}"
 else
 	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
-	KEYWORDS="~amd64 ~arm ~arm64 ~mips ~riscv ~x86"
+	KEYWORDS="amd64 arm arm64 ~mips ~riscv x86"
 	S="${WORKDIR}/${MY_P}"
 fi
 

From 00f2380bc6fa3b32a568d6aa6bfc93494aac17b0 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:12:57 +0000
Subject: [PATCH 129/136] sys-libs/libsepol: Sync with Gentoo

It's from Gentoo commit f24580fd925c0e8aa7e4d26c60e62755ba87fa0e.
---
 .../portage-stable/sys-libs/libsepol/libsepol-3.8.1.ebuild      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libsepol/libsepol-3.8.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libsepol/libsepol-3.8.1.ebuild
index 041e040a37d..37c01b9d4b7 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libsepol/libsepol-3.8.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libsepol/libsepol-3.8.1.ebuild
@@ -17,7 +17,7 @@ if [[ ${PV} == 9999 ]]; then
 	S="${WORKDIR}/${P}/${PN}"
 else
 	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
-	KEYWORDS="~amd64 ~arm ~arm64 ~mips ~riscv ~x86"
+	KEYWORDS="amd64 arm arm64 ~mips ~riscv x86"
 	S="${WORKDIR}/${MY_P}"
 fi
 

From 0c6f3d7a6ec0a47fa79ce5c43c14873743f436d1 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:12:59 +0000
Subject: [PATCH 130/136] sys-libs/libxcrypt: Sync with Gentoo

It's from Gentoo commit 26809fe4c3ebdad74e81e32e608c310325f76cc0.
---
 .../sys-libs/libxcrypt/Manifest               |   1 -
 .../libxcrypt/libxcrypt-4.4.36-r3.ebuild      | 258 -------------
 .../libxcrypt/libxcrypt-4.4.36.ebuild         | 340 ------------------
 .../libxcrypt/libxcrypt-4.4.38.ebuild         |   4 +-
 4 files changed, 2 insertions(+), 601 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36-r3.ebuild
 delete mode 100644 sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/Manifest
index 18c4945f0d7..259a3cce265 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/Manifest
@@ -1,2 +1 @@
-DIST libxcrypt-4.4.36-autotools.tar.xz 624660 BLAKE2B 8dc3d0f354baf8c64dc011e95e7df10d48b0dfe428503936ffd55edf2745de04003c7efe231ed5d9a14cea7f682ba377b7e00f0463b4060c50c9c29f555b790f SHA512 fb8391ecb89622eb0d74d13c5fc1369718e83c47671449044ca0c2f78a236d7b06177a60bf8cda47694caa840c68eaaf0b23690e8975fa5d64b734c8eb246d10
 DIST libxcrypt-4.4.38-autotools.tar.xz 630696 BLAKE2B 471066e83495fbaf3ef8dee066b4a7bff36dbc36d6ae1c09f2510d79b041b8517d6cc345e678d92508f5d044dc25fd7b1d36e0243aa46314bbbe7e3201838a5c SHA512 9b1d53119e0d808f6bc30e39cbe85710e3abb774109df28e05b90adebb828f47db3f7126de4ffdea2e63073905648ad941985d1a2167ba7282c01e132ef4e2b2
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36-r3.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36-r3.ebuild
deleted file mode 100644
index ee2c2f74d18..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36-r3.ebuild
+++ /dev/null
@@ -1,258 +0,0 @@
-# Copyright 2004-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..13} )
-# NEED_BOOTSTRAP is for developers to quickly generate a tarball
-# for publishing to the tree.
-NEED_BOOTSTRAP="no"
-inherit crossdev multibuild multilib python-any-r1 flag-o-matic toolchain-funcs multilib-minimal
-
-DESCRIPTION="Extended crypt library for descrypt, md5crypt, bcrypt, and others"
-HOMEPAGE="https://github.com/besser82/libxcrypt"
-if [[ ${NEED_BOOTSTRAP} == "yes" ]] ; then
-	inherit autotools
-	SRC_URI="https://github.com/besser82/libxcrypt/releases/download/v${PV}/${P}.tar.xz"
-else
-	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}-autotools.tar.xz"
-fi
-
-LICENSE="LGPL-2.1+ public-domain BSD BSD-2"
-SLOT="0/1"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="+compat static-libs +system test headers-only"
-RESTRICT="!test? ( test )"
-
-DEPEND="
-	system? (
-		elibc_glibc? (
-			${CATEGORY}/glibc[-crypt(-)]
-			!${CATEGORY}/glibc[crypt(-)]
-		)
-		elibc_musl? (
-			${CATEGORY}/musl[-crypt(+)]
-			!${CATEGORY}/musl[crypt(+)]
-		)
-	)
-"
-RDEPEND="${DEPEND}"
-BDEPEND="
-	dev-lang/perl
-	test? ( $(python_gen_any_dep 'dev-python/passlib[${PYTHON_USEDEP}]') )
-"
-
-python_check_deps() {
-	python_has_version "dev-python/passlib[${PYTHON_USEDEP}]"
-}
-
-pkg_pretend() {
-	if has "distcc" ${FEATURES} ; then
-		ewarn "Please verify all distcc nodes are using the same versions of GCC (>= 10) and Binutils!"
-		ewarn "Older/mismatched versions of GCC may lead to a misbehaving library: bug #823179."
-
-		if [[ ${BUILD_TYPE} != "binary" ]] && tc-is-gcc && [[ $(gcc-major-version) -lt 10 ]] ; then
-			die "libxcrypt is known to fail to build or be broken at runtime with < GCC 10 (bug #823179)!"
-		fi
-	fi
-}
-
-pkg_setup() {
-	:
-}
-
-src_prepare() {
-	default
-
-	# WARNING: Please read on bumping or applying patches!
-	#
-	# There are two circular dependencies to be aware of:
-	# 1)
-	#	if we're bootstrapping configure and makefiles:
-	#		libxcrypt -> automake -> perl -> libxcrypt
-	#
-	#   mitigation:
-	#		toolchain@ manually runs `make dist` after running autoconf + `./configure`
-	#		and the ebuild uses that.
-	#		(Don't include the pre-generated Perl artefacts.)
-	#
-	#	solution for future:
-	#		Upstream are working on producing `make dist` tarballs.
-	#		https://github.com/besser82/libxcrypt/issues/134#issuecomment-871833573
-	#
-	# 2)
-	#	configure *unconditionally* needs Perl at build time to generate
-	#	a list of enabled algorithms based on the set passed to `configure`:
-	#		libxcrypt -> perl -> libxcrypt
-	#
-	#	mitigation:
-	#		None at the moment.
-	#
-	#	solution for future:
-	#		Not possible right now. Upstream intend on depending on Perl for further
-	#		configuration options.
-	#		https://github.com/besser82/libxcrypt/issues/134#issuecomment-871833573
-	#
-	# Therefore, on changes (inc. bumps):
-	#	* You must check whether upstream have started providing tarballs with bootstrapped
-	#	  auto{conf,make};
-	#
-	#	* diff the build system changes!
-	#
-	if [[ ${NEED_BOOTSTRAP} == "yes" ]] ; then
-		# Facilitate our split variant build for compat + non-compat
-		eapply "${FILESDIR}"/${PN}-4.4.19-multibuild.patch
-		eautoreconf
-	fi
-}
-
-src_configure() {
-	MULTIBUILD_VARIANTS=(
-		$(usev compat 'xcrypt_compat')
-		xcrypt_nocompat
-	)
-
-	MYPREFIX=${EPREFIX}
-	MYSYSROOT=${ESYSROOT}
-
-	if target_is_not_host; then
-		# Hack to work around missing TARGET_CC support.
-		# See bug 949976.
-		if tc-is-clang; then
-			export CC="${CTARGET}-clang"
-		else
-			export CC="${CTARGET}-gcc"
-		fi
-
-		local CHOST=${CTARGET}
-
-		MYPREFIX=
-		MYSYSROOT=${ESYSROOT}/usr/${CTARGET}
-
-		# Ensure we get compatible libdir
-		unset DEFAULT_ABI MULTILIB_ABIS
-		multilib_env
-		ABI=${DEFAULT_ABI}
-
-		strip-unsupported-flags
-	fi
-
-	if use headers-only; then
-		# Nothing is compiled which would affect the headers, so we set
-		# CC and PKG_CONFIG to ensure configure passes without defaulting
-		# to the unprefixed host variants e.g. "pkg-config"
-		local -x CC="$(tc-getBUILD_CC)"
-		local -x PKG_CONFIG="false"
-	fi
-
-	# Avoid possible "illegal instruction" errors with gold
-	# bug #821496
-	tc-ld-disable-gold
-
-	# Doesn't work with LTO: bug #852917.
-	# https://github.com/besser82/libxcrypt/issues/24
-	filter-lto
-
-	append-ldflags $(test-flags-CCLD -Wl,--undefined-version)
-
-	if use test; then
-		python_setup
-	fi
-
-	multibuild_foreach_variant multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	local myconf=(
-		--disable-werror
-		--prefix="${MYPREFIX}/usr"
-		--libdir="${MYPREFIX}/usr/$(get_libdir)$(usev !system /xcrypt)"
-		--includedir="${MYPREFIX}/usr/include$(usev !system /xcrypt)"
-		--with-pkgconfigdir="${MYPREFIX}/usr/$(get_libdir)/pkgconfig"
-		--with-sysroot="${MYSYSROOT}"
-	)
-
-	tc-export PKG_CONFIG
-
-	case "${MULTIBUILD_ID}" in
-		xcrypt_compat-*)
-			myconf+=(
-				--disable-static
-				--disable-xcrypt-compat-files
-				--enable-obsolete-api=yes
-			)
-			;;
-		xcrypt_nocompat-*)
-			myconf+=(
-				--enable-obsolete-api=no
-				$(use_enable static-libs static)
-			)
-			;;
-		*) die "Unexpected MULTIBUILD_ID: ${MULTIBUILD_ID}";;
-	esac
-
-	ECONF_SOURCE="${S}" econf "${myconf[@]}"
-}
-
-src_compile() {
-	use headers-only && return
-
-	multibuild_foreach_variant multilib-minimal_src_compile
-}
-
-multilib_src_test() {
-	emake check
-}
-
-src_test() {
-	multibuild_foreach_variant multilib-minimal_src_test
-}
-
-src_install() {
-	local DESTDIR=${D}
-	if target_is_not_host; then
-		DESTDIR=${ED}/usr/${CTARGET}
-	fi
-
-	multibuild_foreach_variant multilib-minimal_src_install
-
-	find "${ED}" -name '*.la' -delete || die
-
-	if target_is_not_host; then
-		insinto /usr/${CTARGET}/usr/share
-		doins -r "${ED}/usr/share/doc"
-		rm -r "${ED}/usr/share/doc" || die
-		rmdir "${ED}/usr/share" || die
-	fi
-}
-
-multilib_src_install() {
-	if use headers-only; then
-		emake DESTDIR="${DESTDIR}" install-nodist_includeHEADERS
-	else
-		emake DESTDIR="${DESTDIR}" install
-		# Conflicts with sys-apps/man-pages
-		rm "${DESTDIR}${MYPREFIX}"/usr/share/man/man3/crypt{,_r}.3 || die
-	fi
-}
-
-pkg_preinst() {
-	# Verify we're not in a bad case like bug #843209 with broken symlinks.
-	# This can be dropped when, if ever, the split-usr && system && compat case
-	# is cleaned up in *_src_install.
-	local broken_symlinks=()
-	mapfile -d '' broken_symlinks < <(
-		find "${ED}" -xtype l -print0
-	)
-
-	if [[ ${#broken_symlinks[@]} -gt 0 ]]; then
-		eerror "Broken symlinks found before merging!"
-		local symlink target resolved
-		for symlink in "${broken_symlinks[@]}" ; do
-			target="$(readlink "${symlink}")"
-			resolved="$(readlink -f "${symlink}")"
-			eerror "  '${symlink}' -> '${target}' (${resolved})"
-		done
-		die "Broken symlinks found! Aborting to avoid damaging system. Please report a bug."
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36.ebuild
deleted file mode 100644
index 3380844c86d..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36.ebuild
+++ /dev/null
@@ -1,340 +0,0 @@
-# Copyright 2004-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..11} )
-# NEED_BOOTSTRAP is for developers to quickly generate a tarball
-# for publishing to the tree.
-NEED_BOOTSTRAP="no"
-inherit multibuild multilib python-any-r1 flag-o-matic toolchain-funcs multilib-minimal
-
-DESCRIPTION="Extended crypt library for descrypt, md5crypt, bcrypt, and others"
-HOMEPAGE="https://github.com/besser82/libxcrypt"
-if [[ ${NEED_BOOTSTRAP} == "yes" ]] ; then
-	inherit autotools
-	SRC_URI="https://github.com/besser82/libxcrypt/releases/download/v${PV}/${P}.tar.xz"
-else
-	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}-autotools.tar.xz"
-fi
-
-LICENSE="LGPL-2.1+ public-domain BSD BSD-2"
-SLOT="0/1"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="+compat split-usr static-libs +system test headers-only"
-REQUIRED_USE="split-usr? ( system )"
-RESTRICT="!test? ( test )"
-
-export CTARGET=${CTARGET:-${CHOST}}
-if [[ ${CTARGET} == ${CHOST} ]] ; then
-	if [[ ${CATEGORY/cross-} != ${CATEGORY} ]] ; then
-		export CTARGET=${CATEGORY/cross-}
-	fi
-fi
-
-is_cross() {
-	local enabled_abis=( $(multilib_get_enabled_abis) )
-	[[ "${#enabled_abis[@]}" -le 1 ]] && [[ ${CHOST} != ${CTARGET} ]]
-}
-
-DEPEND="
-	system? (
-		elibc_glibc? (
-			${CATEGORY}/glibc[-crypt(+)]
-			!${CATEGORY}/glibc[crypt(+)]
-		)
-		elibc_musl? (
-			${CATEGORY}/musl[-crypt(+)]
-			!${CATEGORY}/musl[crypt(+)]
-		)
-	)
-"
-RDEPEND="${DEPEND}"
-BDEPEND="
-	dev-lang/perl
-	test? ( $(python_gen_any_dep 'dev-python/passlib[${PYTHON_USEDEP}]') )
-"
-
-python_check_deps() {
-	python_has_version "dev-python/passlib[${PYTHON_USEDEP}]"
-}
-
-pkg_pretend() {
-	if has "distcc" ${FEATURES} ; then
-		ewarn "Please verify all distcc nodes are using the same versions of GCC (>= 10) and Binutils!"
-		ewarn "Older/mismatched versions of GCC may lead to a misbehaving library: bug #823179."
-
-		if [[ ${BUILD_TYPE} != "binary" ]] && tc-is-gcc && [[ $(gcc-major-version) -lt 10 ]] ; then
-			die "libxcrypt is known to fail to build or be broken at runtime with < GCC 10 (bug #823179)!"
-		fi
-	fi
-}
-
-pkg_setup() {
-	MULTIBUILD_VARIANTS=(
-		$(usev compat 'xcrypt_compat')
-		xcrypt_nocompat
-	)
-
-	use test && python-any-r1_pkg_setup
-}
-
-src_prepare() {
-	default
-
-	# WARNING: Please read on bumping or applying patches!
-	#
-	# There are two circular dependencies to be aware of:
-	# 1)
-	#	if we're bootstrapping configure and makefiles:
-	#		libxcrypt -> automake -> perl -> libxcrypt
-	#
-	#   mitigation:
-	#		toolchain@ manually runs `make dist` after running autoconf + `./configure`
-	#		and the ebuild uses that.
-	#		(Don't include the pre-generated Perl artefacts.)
-	#
-	#	solution for future:
-	#		Upstream are working on producing `make dist` tarballs.
-	#		https://github.com/besser82/libxcrypt/issues/134#issuecomment-871833573
-	#
-	# 2)
-	#	configure *unconditionally* needs Perl at build time to generate
-	#	a list of enabled algorithms based on the set passed to `configure`:
-	#		libxcrypt -> perl -> libxcrypt
-	#
-	#	mitigation:
-	#		None at the moment.
-	#
-	#	solution for future:
-	#		Not possible right now. Upstream intend on depending on Perl for further
-	#		configuration options.
-	#		https://github.com/besser82/libxcrypt/issues/134#issuecomment-871833573
-	#
-	# Therefore, on changes (inc. bumps):
-	#	* You must check whether upstream have started providing tarballs with bootstrapped
-	#	  auto{conf,make};
-	#
-	#	* diff the build system changes!
-	#
-	if [[ ${NEED_BOOTSTRAP} == "yes" ]] ; then
-		# Facilitate our split variant build for compat + non-compat
-		eapply "${FILESDIR}"/${PN}-4.4.19-multibuild.patch
-		eautoreconf
-	fi
-}
-
-src_configure() {
-	# Avoid possible "illegal instruction" errors with gold
-	# bug #821496
-	tc-ld-disable-gold
-
-	# Doesn't work with LTO: bug #852917.
-	# https://github.com/besser82/libxcrypt/issues/24
-	filter-lto
-
-	# ideally we want !tc-ld-is-bfd for best future-proofing, but it needs
-	# https://github.com/gentoo/gentoo/pull/28355
-	# mold needs this too but right now tc-ld-is-mold is also not available
-	if tc-ld-is-lld; then
-		append-ldflags -Wl,--undefined-version
-	fi
-
-	multibuild_foreach_variant multilib-minimal_src_configure
-}
-
-get_xcprefix() {
-	if is_cross; then
-		echo "${EPREFIX}/usr/${CTARGET}"
-	else
-		echo "${EPREFIX}"
-	fi
-}
-
-get_xclibdir() {
-	printf -- "%s/%s/%s/%s\n" \
-		"$(get_xcprefix)" \
-		"$(usev !split-usr '/usr')" \
-		"$(get_libdir)" \
-		"$(usev !system 'xcrypt')"
-}
-
-get_xcincludedir() {
-	printf -- "%s/usr/include/%s\n" \
-		"$(get_xcprefix)" \
-		"$(usev !system 'xcrypt')"
-}
-
-get_xcmandir() {
-	printf -- "%s/usr/share/man\n" \
-		"$(get_xcprefix)"
-}
-
-get_xcpkgconfigdir() {
-	printf -- "%s/usr/%s/pkgconfig\n" \
-		"$(get_xcprefix)" \
-		"$(get_libdir)"
-}
-
-multilib_src_configure() {
-	local -a myconf=(
-		--host=${CTARGET}
-		--disable-werror
-		--libdir=$(get_xclibdir)
-		--with-pkgconfigdir=$(get_xcpkgconfigdir)
-		--includedir=$(get_xcincludedir)
-		--mandir="$(get_xcmandir)"
-	)
-
-	tc-export PKG_CONFIG
-
-	if is_cross; then
-		if tc-is-clang; then
-			export CC="${CTARGET}-clang"
-		else
-			export CC="${CTARGET}-gcc"
-		fi
-	fi
-
-	case "${MULTIBUILD_ID}" in
-		xcrypt_compat-*)
-			myconf+=(
-				--disable-static
-				--disable-xcrypt-compat-files
-				--enable-obsolete-api=yes
-			)
-			;;
-		xcrypt_nocompat-*)
-			myconf+=(
-				--enable-obsolete-api=no
-				$(use_enable static-libs static)
-			)
-		;;
-		*) die "Unexpected MULTIBUILD_ID: ${MULTIBUILD_ID}";;
-	esac
-
-	if use headers-only; then
-		# Nothing is compiled here which would affect the headers for the target.
-		# So forcing CC is sane.
-		headers_only_flags="CC=$(tc-getBUILD_CC)"
-	fi
-
-	ECONF_SOURCE="${S}" econf "${myconf[@]}" "${headers_only_flags}"
-}
-
-src_compile() {
-	use headers-only && return
-
-	multibuild_foreach_variant multilib-minimal_src_compile
-}
-
-multilib_src_test() {
-	emake check
-}
-
-src_test() {
-	multibuild_foreach_variant multilib-minimal_src_test
-}
-
-src_install() {
-	multibuild_foreach_variant multilib-minimal_src_install
-
-	use headers-only || \
-	(
-		shopt -s failglob || die "failglob failed"
-
-		# Make sure our man pages do not collide with glibc or man-pages.
-		for manpage in "${D}$(get_xcmandir)"/man3/crypt{,_r}.?*; do
-			mv -n "${manpage}" "$(dirname "${manpage}")/xcrypt_$(basename "${manpage}")" \
-				|| die "mv failed"
-		done
-	) || die "failglob error"
-
-	# Remove useless stuff from installation
-	find "${ED}"/usr/share/doc/${PF} -type l -delete || die
-	find "${ED}" -name '*.la' -delete || die
-
-	# workaround broken upstream cross-* --docdir by installing files in proper locations
-	if is_cross; then
-		insinto "$(get_xcprefix)"/usr/share
-		doins -r "${ED}"/usr/share/doc
-		rm -r "${ED}"/usr/share/doc || die
-	fi
-}
-
-multilib_src_install() {
-	if use headers-only; then
-		emake DESTDIR="${D}" install-nodist_includeHEADERS
-		return
-	fi
-
-	emake DESTDIR="${D}" install
-
-	# Don't install the libcrypt.so symlink for the "compat" version
-	case "${MULTIBUILD_ID}" in
-		xcrypt_compat-*)
-			rm "${D}"$(get_xclibdir)/libcrypt$(get_libname) \
-				|| die "failed to remove extra compat libraries"
-		;;
-		xcrypt_nocompat-*)
-			if use split-usr; then
-				(
-					if use static-libs; then
-						# .a files are installed to /$(get_libdir) by default
-						# Move static libraries to /usr prefix or portage will abort
-						shopt -s nullglob || die "failglob failed"
-						static_libs=( "${D}"/$(get_xclibdir)/*.a )
-
-						if [[ -n ${static_libs[*]} ]]; then
-							dodir "/usr/$(get_xclibdir)"
-							mv "${static_libs[@]}" "${ED}/usr/$(get_xclibdir)" \
-								|| die "Moving static libs failed"
-						fi
-					fi
-
-					if use system; then
-						# Move versionless .so symlinks from /$(get_libdir) to /usr/$(get_libdir)
-						# to allow linker to correctly find shared libraries.
-						shopt -s failglob || die "failglob failed"
-
-						for lib_file in "${D}"$(get_xclibdir)/*$(get_libname); do
-							lib_file_basename="$(basename "${lib_file}")"
-							lib_file_target="$(basename "$(readlink -f "${lib_file}")")"
-
-							# We already know we're in split-usr (checked above)
-							# See bug #843209 (also worth keeping in mind bug #802222 too)
-							local libdir_no_prefix=$(get_xclibdir)
-							libdir_no_prefix=${libdir_no_prefix#${EPREFIX}}
-							libdir_no_prefix=${libdir_no_prefix%/usr}
-							dosym -r "/$(get_libdir)/${lib_file_target}" "/usr/${libdir_no_prefix}/${lib_file_basename}"
-						done
-
-						rm "${D}"$(get_xclibdir)/*$(get_libname) || die "Removing symlinks in incorrect location failed"
-					fi
-				)
-			fi
-		;;
-		*) die "Unexpected MULTIBUILD_ID: ${MULTIBUILD_ID}";;
-	esac
-}
-
-pkg_preinst() {
-	# Verify we're not in a bad case like bug #843209 with broken symlinks.
-	# This can be dropped when, if ever, the split-usr && system && compat case
-	# is cleaned up in *_src_install.
-	local broken_symlinks=()
-	mapfile -d '' broken_symlinks < <(
-		find "${ED}" -xtype l -print0
-	)
-
-	if [[ ${#broken_symlinks[@]} -gt 0 ]]; then
-		eerror "Broken symlinks found before merging!"
-		local symlink target resolved
-		for symlink in "${broken_symlinks[@]}" ; do
-			target="$(readlink "${symlink}")"
-			resolved="$(readlink -f "${symlink}")"
-			eerror "  '${symlink}' -> '${target}' (${resolved})"
-		done
-		die "Broken symlinks found! Aborting to avoid damaging system. Please report a bug."
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.38.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.38.ebuild
index 309bd48e295..69617761240 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.38.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.38.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..13} )
 # NEED_BOOTSTRAP is for developers to quickly generate a tarball
 # for publishing to the tree.
 NEED_BOOTSTRAP="no"
@@ -20,7 +20,7 @@ fi
 
 LICENSE="LGPL-2.1+ public-domain BSD BSD-2"
 SLOT="0/1"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="+compat static-libs +system test headers-only"
 RESTRICT="!test? ( test )"
 

From 14503ef0df9e5a05f645cda8c9976bd417ad9b8f Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:13:00 +0000
Subject: [PATCH 131/136] sys-libs/talloc: Sync with Gentoo

It's from Gentoo commit cb731bff8d88fb440423e04aa0fb93c261b586aa.
---
 .../portage-stable/sys-libs/talloc/talloc-2.4.2.ebuild        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.2.ebuild
index b32518a3794..a083802f828 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -13,7 +13,7 @@ SRC_URI="https://www.samba.org/ftp/${PN}/${P}.tar.gz"
 
 LICENSE="GPL-3 LGPL-3+ LGPL-2"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
 IUSE="compat +python test valgrind"
 
 REQUIRED_USE="${PYTHON_REQUIRED_USE}"

From 36288d5a26789715b50cb69658e7bb1785ef9fc3 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:13:00 +0000
Subject: [PATCH 132/136] sys-libs/tdb: Sync with Gentoo

It's from Gentoo commit b736fdcf6592489e0b6b2e288d67ede269aeafc0.
---
 .../third_party/portage-stable/sys-libs/tdb/tdb-1.4.12.ebuild   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.12.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.12.ebuild
index d179aa7975e..f8936c01030 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.12.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.12.ebuild
@@ -13,7 +13,7 @@ SRC_URI="https://samba.org/ftp/tdb/${P}.tar.gz"
 
 LICENSE="GPL-3"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 IUSE="python test"
 
 REQUIRED_USE="${PYTHON_REQUIRED_USE}"

From 2efb893c47e288408b639c3e5613bf01338e8f08 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:13:00 +0000
Subject: [PATCH 133/136] sys-libs/tevent: Sync with Gentoo

It's from Gentoo commit a504e6ff961514e57449d306826a3cee011e71da.
---
 .../portage-stable/sys-libs/tevent/tevent-0.16.1.ebuild       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/tevent/tevent-0.16.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/tevent/tevent-0.16.1.ebuild
index 037719db24f..4729fc57e83 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/tevent/tevent-0.16.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/tevent/tevent-0.16.1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -13,7 +13,7 @@ SRC_URI="https://samba.org/ftp/tevent/${P}.tar.gz"
 
 LICENSE="GPL-3"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x86-linux"
 IUSE="python test"
 REQUIRED_USE="${PYTHON_REQUIRED_USE}"
 RESTRICT="!test? ( test )"

From 58865502d4bbf67c70c8b45d1bd336e738c3e860 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:13:01 +0000
Subject: [PATCH 134/136] sys-libs/timezone-data: Sync with Gentoo

It's from Gentoo commit 38d6f41bc62e1575470b3cef7d308aa1731b1be4.
---
 .../sys-libs/timezone-data/timezone-data-2025b.ebuild           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/timezone-data/timezone-data-2025b.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/timezone-data/timezone-data-2025b.ebuild
index 539afc06569..790df813137 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/timezone-data/timezone-data-2025b.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/timezone-data/timezone-data-2025b.ebuild
@@ -14,7 +14,7 @@ S="${WORKDIR}"/tzdb-${PV}
 
 LICENSE="BSD public-domain"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="nls leaps-timezone zic-slim"
 
 DEPEND="nls? ( virtual/libintl )"

From 7721ce934a95e5fc8d0fa96576d2231111fa439d Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:13:01 +0000
Subject: [PATCH 135/136] sys-libs/zlib: Sync with Gentoo

It's from Gentoo commit 4d6f1784d518ffbb8d753f25ef1592eb11a4db57.
---
 .../portage-stable/sys-libs/zlib/zlib-1.3.1-r1.ebuild | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/zlib/zlib-1.3.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/zlib/zlib-1.3.1-r1.ebuild
index f81cf5fac8d..e7318f89fd2 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/zlib/zlib-1.3.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/zlib/zlib-1.3.1-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -6,7 +6,7 @@ EAPI=8
 # Worth keeping an eye on 'develop' branch upstream for possible backports.
 AUTOTOOLS_AUTO_DEPEND="no"
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/madler.asc
-inherit autotools edo multilib-minimal flag-o-matic verify-sig
+inherit autotools dot-a edo multilib-minimal flag-o-matic verify-sig
 
 DESCRIPTION="Standard (de)compression library"
 HOMEPAGE="https://zlib.net/"
@@ -68,6 +68,11 @@ src_prepare() {
 	esac
 }
 
+src_configure() {
+	use static-libs && lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	# We pass manually instead of relying on the configure script/makefile
 	# because it would pass it even for older binutils.
@@ -164,6 +169,8 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	strip-lto-bytecode
+
 	dodoc FAQ README ChangeLog doc/*.txt
 
 	if use minizip ; then

From 4a29ee1bc4908e8d7d97c1d7449328b92da2c1ba Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 12 May 2025 07:13:07 +0000
Subject: [PATCH 136/136] sys-process/tini: Sync with Gentoo

It's from Gentoo commit dee51f65cd50deb016bba2298f363f45d23a041f.
---
 .../portage-stable/sys-process/tini/tini-0.19.0-r2.ebuild       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-process/tini/tini-0.19.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-process/tini/tini-0.19.0-r2.ebuild
index ac403b354fc..7cda7f7e38d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-process/tini/tini-0.19.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-process/tini/tini-0.19.0-r2.ebuild
@@ -16,7 +16,7 @@ SRC_URI="https://github.com/krallin/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="amd64 arm arm64 ~hppa ppc64 ~riscv ~x86"
+KEYWORDS="amd64 arm arm64 hppa ppc64 ~riscv ~x86"
 IUSE="+args +static"
 
 PATCHES=(